@codacy/verity-cli 0.28.1-experimental.8cc9c66 → 0.28.1-experimental.902dbd9

package/bin/verity.js

@@ -10386,10 +10386,9 @@ function projectPath(relativePath) {
   return (0, import_node_path.join)(repoRoot(), relativePath);
 }
 var MAX_DELTA_BYTES = 194560;
-var MAX_FILES = 20;
+var MAX_FILES = 40;
 var MAX_FILE_BYTES = 51200;
 var DEBOUNCE_SECONDS = 30;
-var MAX_ITERATIONS = 2;
 var MAX_SPEC_FILES = 10;
 var MAX_SPEC_FILE_BYTES = 10240;
 var MAX_TOTAL_SPEC_BYTES = 30720;
@@ -13591,6 +13590,143 @@ var import_node_fs10 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
 var import_node_path11 = require("node:path");
 
+// src/lib/skip-detection.ts
+function isBareAckPrompt(prompt) {
+  if (typeof prompt !== "string") return false;
+  const trimmed = prompt.trim();
+  if (trimmed.length === 0) return false;
+  if (trimmed.length > 20) return false;
+  const bareAckPattern = /^(\d{1,2}|y|n|yes|no|yep|nope|ok(ay)?|sure|skip|cancel|stop|done|noted|got\s+it|sounds\s+good|thanks|thank\s+you|thx)[.!?]*$/i;
+  return bareAckPattern.test(trimmed);
+}
+function isContinuationPrompt(prompt) {
+  if (typeof prompt !== "string") return false;
+  const trimmed = prompt.trim();
+  if (trimmed.length === 0) return false;
+  if (trimmed.length > 24) return false;
+  const continuation = /^(let['’]?s\s+(go|do\s+it|start|continue)|go|go\s+ahead|go\s+on|proceed|continue|carry\s+on|keep\s+going|do\s+it|make\s+it\s+so|next|start|begin|ship\s+it|yes\s+please|please\s+continue|perfect|great|nice|excellent|agreed)[.!]*$/i;
+  return continuation.test(trimmed) || isBareAckPrompt(trimmed);
+}
+function resolveGoalPrompt(prompts) {
+  if (prompts.length === 0) return null;
+  const latest = prompts[prompts.length - 1];
+  if (!isContinuationPrompt(latest.prompt)) return { entry: latest, turnsBack: 0 };
+  for (let i = prompts.length - 2; i >= 0; i--) {
+    if (!isContinuationPrompt(prompts[i].prompt)) {
+      return { entry: prompts[i], turnsBack: prompts.length - 1 - i };
+    }
+  }
+  return { entry: latest, turnsBack: 0 };
+}
+function isReflectionQuestion(response) {
+  if (!response || typeof response !== "string") return false;
+  const markers = [
+    /reflection\s+for\s+future\s+agents/i,
+    /what(?:'s|\s+is)\s+one\s+thing\s+you\s+learned/i,
+    /say\s+['"]?skip['"]?\s+to\s+skip/i,
+    /quick\s+reflection\s+question/i,
+    // Post-flip (VRT-21): the agent drafts the reflection itself and, when
+    // interactive, asks the user to confirm/correct before recording. That
+    // turn authors no code either, so it's still a reflection turn.
+    /reflection\s+draft/i,
+    /confirm,?\s+correct,?\s+or\s+add/i
+  ];
+  return markers.some((m) => m.test(response));
+}
+function isMetaTaskLabel(label2) {
+  if (label2 === null || label2 === void 0) return false;
+  if (typeof label2 !== "string") return false;
+  const trimmed = label2.trim();
+  if (trimmed.length === 0) return true;
+  const metaPatterns = [
+    /^verity\s+[\w-]+\s+response$/i,
+    // "Verity reflect response"
+    /^simple user response$/i,
+    /^verity\s+command$/i,
+    // "Verity command"
+    /^user\s+(question|reply|response|ack)$/i
+  ];
+  return metaPatterns.some((p) => p.test(trimmed));
+}
+function shouldSkipForBareAck(input) {
+  if (!isBareAckPrompt(input.prompt)) return false;
+  if (input.turnAuthoredCode) return false;
+  return input.canSeeTurnAuthorship;
+}
+
+// src/lib/pending-repeat.ts
+var STOP = /* @__PURE__ */ new Set([
+  "the",
+  "and",
+  "that",
+  "this",
+  "with",
+  "from",
+  "have",
+  "been",
+  "were",
+  "what",
+  "when",
+  "which",
+  "their",
+  "there",
+  "these",
+  "those",
+  "would",
+  "could",
+  "should",
+  "must",
+  "will",
+  "also",
+  "just",
+  "only",
+  "into",
+  "over",
+  "than",
+  "then",
+  "them",
+  "some",
+  "such",
+  "more",
+  "most",
+  "other",
+  "about",
+  "after",
+  "before",
+  "since",
+  "because",
+  "while",
+  "where",
+  "whether",
+  "ensure",
+  "confirm",
+  "verify",
+  "check"
+]);
+function pendingTokens(text) {
+  if (!text || typeof text !== "string") return [];
+  const out = /* @__PURE__ */ new Set();
+  for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (raw.length <= 3) continue;
+    if (STOP.has(raw)) continue;
+    out.add(raw);
+  }
+  return [...out].sort();
+}
+var REPEAT_THRESHOLD = 0.3;
+function overlapCoefficient(a, b) {
+  if (a.length === 0 || b.length === 0) return 0;
+  const setB = new Set(b);
+  let shared = 0;
+  for (const t of a) if (setB.has(t)) shared++;
+  return shared / Math.min(a.length, b.length);
+}
+function isRepeatOfAny(text, priorFingerprints, threshold = REPEAT_THRESHOLD) {
+  const tokens = pendingTokens(text);
+  if (tokens.length === 0) return false;
+  return priorFingerprints.some((prior) => overlapCoefficient(tokens, prior) >= threshold);
+}
+
 // src/lib/dossier.ts
 var import_node_fs9 = require("node:fs");
 var import_node_crypto4 = require("node:crypto");
@@ -13599,6 +13735,7 @@ var MAX_LINE_BYTES = 4096;
 var MAX_GOAL_CHARS = 2e3;
 var GOAL_KEEP = 8;
 var GOAL_TOTAL_CAP = 32;
+var RECENT_PENDING_CAP = 20;
 var HASH_WIDTH = 16;
 var AUTHORED_CAP = 300;
 var NOT_MINE_CAP = 300;
@@ -13967,6 +14104,10 @@ function reduce(state, events, now) {
           consecutiveIdle: ev.idle === false ? 0 : (state.meta.channel?.consecutiveIdle ?? 0) + 1
         };
         state.meta.last_adjudication = ev.intent_verdict ? { verdict: ev.intent_verdict, score: ev.intent_score ?? null, at: ev.at, decision: ev.decision } : void 0;
+        if (Array.isArray(ev.pending_sigs) && ev.pending_sigs.length > 0) {
+          const prior = state.meta.recent_pending_sigs ?? [];
+          state.meta.recent_pending_sigs = [...prior, ...ev.pending_sigs].slice(-RECENT_PENDING_CAP);
+        }
         if (ev.intent_sig) {
           state.meta.intent_repeat = state.meta.intent_repeat && state.meta.intent_repeat.sig === ev.intent_sig ? { sig: ev.intent_sig, consecutive: state.meta.intent_repeat.consecutive + 1 } : { sig: ev.intent_sig, consecutive: 1 };
         } else {
@@ -14695,7 +14836,19 @@ function sessionDossier(token, sessionId) {
   const d = openDossier(identity);
   return d ? { d, identity } : null;
 }
+function hasActiveGoal(d) {
+  try {
+    if (!(0, import_node_fs10.existsSync)(d.eventsPath)) return false;
+    return (0, import_node_fs10.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
+  } catch {
+    return false;
+  }
+}
 function recordGoal(d, prompt, source = "prompt") {
+  if (source === "prompt" && isContinuationPrompt(prompt) && hasActiveGoal(d)) {
+    appendEvent(d, { k: "goal_continue", text: prompt.slice(0, 64) });
+    return;
+  }
   const text = prompt.slice(0, MAX_GOAL_CHARS);
   appendEvent(d, {
     k: "goal",
@@ -14811,6 +14964,13 @@ function recordVerdict(d, v) {
     branch: v.branch,
     decision: v.decision,
     ...sig && { intent_sig: sig },
+    // Fingerprints of the pending items this verdict delivered, so the NEXT turn
+    // can tell a repeat from a new requirement. Only recorded when the channel
+    // actually spoke — a silenced turn delivered nothing, so nothing was "said
+    // before" and labelling the next turn's items as repeats would be a lie.
+    ...v.emitted === true && v.pendingTexts && v.pendingTexts.length > 0 && {
+      pending_sigs: v.pendingTexts.slice(0, 8).map((t) => pendingTokens(t).slice(0, 16))
+    },
     emitted: v.emitted === true,
     idle: v.idle !== false,
     ...v.intent?.verdict && { intent_verdict: v.intent.verdict },
@@ -15467,6 +15627,34 @@ ${addedLines}`,
   }
   return { diffs, has_baseline: true };
 }
+function absorbIntoBaseline(paths, sessionId) {
+  const baseline = readBaseline(sessionId);
+  if (!baseline || paths.length === 0) return 0;
+  const dir = sessionDir(sessionKey(baseline.session_id));
+  let adopted = 0;
+  const dirty = new Set(baseline.dirty_paths);
+  for (const p of paths) {
+    try {
+      const content = safeReadForMirror(projectPath(p));
+      if (content === null) continue;
+      const dest = mirrorPath(dir, p);
+      (0, import_node_fs13.mkdirSync)((0, import_node_path14.dirname)(dest), { recursive: true });
+      (0, import_node_fs13.writeFileSync)(dest, content);
+      dirty.add(p);
+      adopted++;
+    } catch {
+    }
+  }
+  if (adopted === 0) return 0;
+  try {
+    const updated = { ...baseline, dirty_paths: [...dirty] };
+    (0, import_node_fs13.writeFileSync)(manifestPath(dir), JSON.stringify(updated));
+    preImageCache.delete(baseline);
+  } catch {
+    return 0;
+  }
+  return adopted;
+}
 function changedSinceBaseline(repoRelPath, baseline) {
   const pre = preImage(repoRelPath, baseline);
   let current;
@@ -16343,40 +16531,40 @@ function narrowToRecent(files, sessionId) {
   });
   return recent.length > 0 ? recent : files;
 }
-function readIteration(currentCommit, _contentHash) {
-  if (!(0, import_node_fs15.existsSync)(ITERATION_FILE)) return 1;
+function readIterationState(currentCommit) {
+  if (!(0, import_node_fs15.existsSync)(ITERATION_FILE)) return { iteration: 1, fingerprint: null };
   try {
     const stored = (0, import_node_fs15.readFileSync)(ITERATION_FILE, "utf-8").trim();
     const parts = stored.split(":");
     const iter = parseInt(parts[0], 10);
     const storedCommit = parts[1] ?? "";
     const storedTimestamp = parseInt(parts[2] ?? "0", 10);
-    if (isNaN(iter)) return 1;
-    if (storedCommit !== currentCommit) return 1;
+    const fingerprint = parts.slice(3).join(":") || null;
+    if (isNaN(iter)) return { iteration: 1, fingerprint: null };
+    if (storedCommit !== currentCommit) return { iteration: 1, fingerprint: null };
     if (storedTimestamp > 0) {
       const elapsed = Math.floor(Date.now() / 1e3) - storedTimestamp;
-      if (elapsed > 600) return 1;
+      if (elapsed > 600) return { iteration: 1, fingerprint: null };
     }
-    return iter;
+    return { iteration: iter, fingerprint };
   } catch {
-    return 1;
+    return { iteration: 1, fingerprint: null };
   }
 }
-function checkMaxIterations(currentCommit, maxIterations = MAX_ITERATIONS, contentHash) {
-  const iteration = readIteration(currentCommit, contentHash);
-  if (iteration > maxIterations) {
-    writeIteration(1, currentCommit, contentHash);
-    return {
-      skip: `Max Verity iterations (${maxIterations}) reached \u2014 accepting to prevent infinite loop. Human review required before deploying.`,
-      iteration
-    };
-  }
-  return { skip: null, iteration };
+function findingsFingerprint(findings) {
+  const keys = findings.map((f) => `${String(f.pattern_id ?? "?")}|${String(f.file ?? "?")}`).filter((k) => k !== "?|?");
+  return [...new Set(keys)].sort().join(",");
+}
+function isSameProblem(previous, current) {
+  if (!previous || !current) return false;
+  const prev = new Set(previous.split(","));
+  return current.split(",").some((k) => prev.has(k));
 }
-function writeIteration(iteration, commit, _contentHash) {
+function writeIteration(iteration, commit, _contentHash, fingerprint) {
   (0, import_node_fs15.mkdirSync)(VERITY_DIR, { recursive: true });
   const ts = Math.floor(Date.now() / 1e3);
-  (0, import_node_fs15.writeFileSync)(ITERATION_FILE, `${iteration}:${commit}:${ts}`);
+  const fp = fingerprint ? `:${fingerprint}` : "";
+  (0, import_node_fs15.writeFileSync)(ITERATION_FILE, `${iteration}:${commit}:${ts}${fp}`);
 }
 
 // src/lib/static-analysis.ts
@@ -16625,7 +16813,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.28.1-experimental.8cc9c66" : "dev";
+    return true ? "0.28.1-experimental.902dbd9" : "dev";
   } catch {
     return "dev";
   }
@@ -17222,6 +17410,33 @@ function describeCoverage(coverage, maxPaths = 5) {
 ${lines.join("\n")}
 Treat those files as UNCHECKED, not as approved.`;
 }
+function openBlockingElsewhere(statements, reviewedNow, lineShaAt) {
+  const reviewed = new Set(reviewedNow);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const s of statements) {
+    if (s.outcome !== "open") continue;
+    if (s.register !== "BLOCK") continue;
+    if (s.carried) continue;
+    if (reviewed.has(s.file)) continue;
+    if (!s.line_sha) continue;
+    if (lineShaAt(s.file, s.line) !== s.line_sha) continue;
+    const key = `${s.file}::${s.pattern_id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ file: s.file, line: s.line, pattern_id: s.pattern_id });
+  }
+  return out;
+}
+function describeOpenElsewhere(open) {
+  if (open.length === 0) return null;
+  const lines = open.slice(0, 5).map((o) => `  ${o.file}:${o.line} [${o.pattern_id}]`);
+  const more = open.length > 5 ? `
+  (+${open.length - 5} more)` : "";
+  return `STILL OPEN ELSEWHERE. ${open.length} blocking finding(s) Verity raised earlier are still present in files this run did not review:
+${lines.join("\n")}${more}
+This verdict covers the current change only. The tree is not clean.`;
+}
 
 // src/lib/channel.ts
 var MAX_AGENT_CONTEXT_CHARS = 1500;
@@ -17272,9 +17487,13 @@ function buildAgentContext(input) {
   }
   for (const p of input.pendingItems ?? []) {
     if (lines.length >= MAX_AGENT_ITEMS) break;
+    if (p.pattern_id === "intent-misalignment") continue;
     const text = p.description ?? p.title ?? p.reason;
     if (!text) continue;
-    lines.push(renderItem("", text, p.pattern_id, p.file, p.line));
+    const seenBefore = isRepeatOfAny(text, input.priorPendingFingerprints ?? []);
+    lines.push(
+      renderItem("", text, p.pattern_id, p.file, p.line) + (seenBefore ? "\n    (raised earlier this session and still open \u2014 do not re-explain it; act on it or carry on)" : "")
+    );
   }
   if (lines.length === 0) return null;
   const body = `${REPORT_PREFIX}
@@ -17316,8 +17535,10 @@ var NC2 = "\x1B[0m";
 function emitVerdict(input) {
   const exit = input.exit ?? ((code) => process.exit(code));
   const { coverage, unaccounted } = reconcileCoverage(input.changed, input.coverage);
-  const verdict = resolveVerdict(input.proposed, coverage);
-  const note = describeCoverage(coverage);
+  let verdict = resolveVerdict(input.proposed, coverage);
+  const openElsewhere = input.openElsewhere ?? [];
+  if (verdict === "PASS" && openElsewhere.length > 0) verdict = "WARN";
+  const note = [describeCoverage(coverage), describeOpenElsewhere(openElsewhere)].filter(Boolean).join("\n\n") || null;
   if (unaccounted.length > 0) {
     process.stderr.write(
       `${YELLOW2}Verity: ${unaccounted.length} changed file(s) could not be attributed to any review stage \u2014 counted as unreviewed.${NC2}
@@ -17331,12 +17552,12 @@ function emitVerdict(input) {
 ${input.agentContext}
 `);
     }
-    if (note) process.stderr.write(`
+    if (note && !input.silenced) process.stderr.write(`
 ${YELLOW2}${note}${NC2}
 `);
     return exit(2);
   }
-  const agentBlock = [input.agentContext, note].filter(Boolean).join("\n\n") || null;
+  const agentBlock = input.silenced ? null : [input.agentContext, note].filter(Boolean).join("\n\n") || null;
   printJsonCompact(buildHookOutput(verdict, input.userSummary, agentBlock));
   return exit(0);
 }
@@ -17520,46 +17741,6 @@ function shouldWarmRetryAnalyze(result) {
   return false;
 }
 
-// src/lib/skip-detection.ts
-function isBareAckPrompt(prompt) {
-  if (typeof prompt !== "string") return false;
-  const trimmed = prompt.trim();
-  if (trimmed.length === 0) return false;
-  if (trimmed.length > 20) return false;
-  const bareAckPattern = /^(\d{1,2}|y|n|yes|no|yep|nope|ok(ay)?|sure|skip|cancel|stop|done|noted|got\s+it|sounds\s+good|thanks|thank\s+you|thx)[.!?]*$/i;
-  return bareAckPattern.test(trimmed);
-}
-function isReflectionQuestion(response) {
-  if (!response || typeof response !== "string") return false;
-  const markers = [
-    /reflection\s+for\s+future\s+agents/i,
-    /what(?:'s|\s+is)\s+one\s+thing\s+you\s+learned/i,
-    /say\s+['"]?skip['"]?\s+to\s+skip/i,
-    /quick\s+reflection\s+question/i,
-    // Post-flip (VRT-21): the agent drafts the reflection itself and, when
-    // interactive, asks the user to confirm/correct before recording. That
-    // turn authors no code either, so it's still a reflection turn.
-    /reflection\s+draft/i,
-    /confirm,?\s+correct,?\s+or\s+add/i
-  ];
-  return markers.some((m) => m.test(response));
-}
-function isMetaTaskLabel(label2) {
-  if (label2 === null || label2 === void 0) return false;
-  if (typeof label2 !== "string") return false;
-  const trimmed = label2.trim();
-  if (trimmed.length === 0) return true;
-  const metaPatterns = [
-    /^verity\s+[\w-]+\s+response$/i,
-    // "Verity reflect response"
-    /^simple user response$/i,
-    /^verity\s+command$/i,
-    // "Verity command"
-    /^user\s+(question|reply|response|ack)$/i
-  ];
-  return metaPatterns.some((p) => p.test(trimmed));
-}
-
 // src/lib/transcript.ts
 var import_node_fs22 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
@@ -17573,9 +17754,11 @@ var MAX_SUMMARY_BYTES = 4096;
 var HOME = process.env.HOME ?? "";
 async function extractActionSummary(transcriptPath) {
   try {
-    const lines = readTurnLines(transcriptPath);
-    if (!lines || lines.length === 0) return null;
-    return buildSummary(lines);
+    const read = readTurnLines(transcriptPath);
+    if (!read || read.lines.length === 0) return null;
+    const summary = buildSummary(read.lines);
+    if (summary) summary.transcript_windowed = read.window;
+    return summary;
   } catch {
     return null;
   }
@@ -17589,9 +17772,11 @@ function readTurnLines(transcriptPath) {
   }
   if (size === 0) return null;
   let raw;
+  let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
     raw = (0, import_node_fs22.readFileSync)(transcriptPath, "utf-8");
   } else {
+    windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
     const fd = require("node:fs").openSync(transcriptPath, "r");
     try {
@@ -17609,17 +17794,22 @@ function readTurnLines(transcriptPath) {
   const allLines = raw.split("\n").filter((l) => l.trim().length > 0);
   if (allLines.length === 0) return null;
   let turnStart = 0;
+  let boundaryFound = false;
   for (let i = allLines.length - 1; i >= 0; i--) {
     try {
       const parsed = JSON.parse(allLines[i]);
       if (parsed.type === "user" && isRealUserMessage(parsed)) {
         turnStart = i;
+        boundaryFound = true;
         break;
       }
     } catch {
     }
   }
-  return allLines.slice(turnStart);
+  return {
+    lines: allLines.slice(turnStart),
+    window: !windowed ? "whole" : boundaryFound ? "windowed" : "orphaned"
+  };
 }
 function isRealUserMessage(parsed) {
   const message = parsed.message;
@@ -18177,11 +18367,12 @@ async function readStopHookStdin() {
     return empty;
   }
 }
-function agentContextFor(response, intentRepeat = 0) {
+function agentContextFor(response, intentRepeat = 0, priorPendingFingerprints = []) {
   const metadata = response.metadata ?? {};
   const intent = response.intent_alignment ?? {};
   return buildAgentContext({
     intentRepeat,
+    priorPendingFingerprints,
     gateDecision: String(response.gate_decision ?? ""),
     findings: response.findings ?? [],
     pendingItems: response.pending_items ?? [],
@@ -18216,6 +18407,8 @@ async function passAndExit(reason, skip, kindOverride) {
   if (unaccounted.length > 0) {
     logEvent("coverage_unaccounted", { where: "passAndExit", skip, count: unaccounted.length });
   }
+  const AGENT_SILENT_SKIPS = /* @__PURE__ */ new Set([]);
+  const agentNote = AGENT_SILENT_SKIPS.has(skip) ? null : note;
   printJsonCompact(
     buildHookOutput(
       verdict,
@@ -18223,7 +18416,7 @@ async function passAndExit(reason, skip, kindOverride) {
       // The agent's ONLY input is additionalContext. Sixteen of the nineteen
       // terminating paths wrote `systemMessage` — the human's field — and told
       // the agent nothing at all.
-      note
+      agentNote
     )
   );
   process.exit(0);
@@ -18315,14 +18508,24 @@ async function runAnalyze(opts, globals) {
   const conversation = await readAndClearConversationBuffer(baselineSessionId);
   const specs = discoverSpecs();
   const plans = discoverPlans();
+  const agentAuthoredCodeThisTurn = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0));
+  const turnAuthoredCode = agentAuthoredCodeThisTurn || !!baseline && allForReview.some((f) => changedSinceBaseline(f, baseline));
+  const canSeeTurnAuthorship = !!actionSummary || !!baseline;
   const latestPrompt = conversation?.prompts?.[conversation.prompts.length - 1]?.prompt ?? "";
   if (/^\s*\/verity-/i.test(latestPrompt)) {
+    const setupAuthored = [
+      ...actionSummary?.files_edited ?? [],
+      ...actionSummary?.files_created ?? []
+    ];
+    if (setupAuthored.length > 0) {
+      const adopted = absorbIntoBaseline(setupAuthored, baselineSessionId);
+      logEvent("baseline_absorbed", { skip: "verity-command", offered: setupAuthored.length, adopted });
+    }
     await passAndExit("Verity command \u2014 skipping analysis", "verity-command");
   }
-  if (isBareAckPrompt(latestPrompt)) {
+  if (shouldSkipForBareAck({ prompt: latestPrompt, turnAuthoredCode, canSeeTurnAuthorship })) {
     await passAndExit("Bare acknowledgment \u2014 skipping analysis", "bare-acknowledgment");
   }
-  const agentAuthoredCodeThisTurn = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0));
   if (isReflectionQuestion(assistantResponse) && !agentAuthoredCodeThisTurn) {
     await passAndExit("Reflection-prompt turn \u2014 skipping analysis", "reflection-prompt");
   }
@@ -18369,7 +18572,11 @@ async function runAnalyze(opts, globals) {
     );
   }
   if (analysisMode === "skip") {
-    await passAndExit("Skip mode \u2014 no code work to analyze", "skip-mode");
+    await passAndExit(
+      "Skip mode \u2014 no code work to analyze",
+      "skip-mode",
+      turnAuthoredCode ? "capacity" : void 0
+    );
   }
   let staticResults = {
     tool: "@codacy/analysis-cli",
@@ -18462,19 +18669,13 @@ async function runAnalyze(opts, globals) {
         snapshotResult = generateSnapshotDiffs(codeDelta.files);
       }
       currentCommit = getCurrentCommit();
-      const maxIterations = parseInt(opts.maxIterations, 10);
-      const iterResult = checkMaxIterations(currentCommit, maxIterations, contentHash ?? void 0);
-      if (iterResult.skip) await passAndExit(iterResult.skip, "iteration-cap");
-      iteration = iterResult.iteration;
+      iteration = readIterationState(currentCommit).iteration;
     }
   }
   if (analysisMode === "plan") {
     recordAnalysisStart();
     currentCommit = getCurrentCommit();
-    const maxIterations = parseInt(opts.maxIterations, 10);
-    const iterResult = checkMaxIterations(currentCommit, maxIterations);
-    if (iterResult.skip) await passAndExit(iterResult.skip, "iteration-cap");
-    iteration = iterResult.iteration;
+    iteration = readIterationState(currentCommit).iteration;
   }
   const contextFiles = gatherContextFiles(contextFilePaths, codeDelta.files);
   for (const f of codeDelta.files) {
@@ -18647,7 +18848,30 @@ async function runAnalyze(opts, globals) {
     hasUserPrompt: (conversation?.prompts?.length ?? 0) > 0,
     isTTY: process.stdout.isTTY === true
   });
+  const excludedByReason = {};
+  for (const e of codeDelta.excluded ?? []) {
+    excludedByReason[e.reason] = (excludedByReason[e.reason] ?? 0) + 1;
+  }
+  const coverageTelemetry = {
+    // git's whole answer, before ANY narrowing. The number that has never been sent.
+    changed_all: allChanged.length,
+    analyzable: analyzable.length,
+    reviewable: reviewable.length,
+    security: securityFiles.length,
+    // after the allowlist, before authorship scoping and the caps
+    for_review: allForReview.length,
+    // what actually reaches the reviewer
+    sent: codeDelta.files.length,
+    // the two silent narrowings, counted separately so they can be told apart
+    capped_out: actionSummary?.capped_out?.length ?? 0,
+    excluded: (codeDelta.excluded ?? []).length,
+    excluded_by_reason: excludedByReason,
+    // was the transcript itself truncated? The 256 KB window means "this turn"
+    // can quietly mean "the last 256 KB of it".
+    transcript_windowed: actionSummary?.transcript_windowed ?? null
+  };
   const requestBody = {
+    coverage_telemetry: coverageTelemetry,
     static_results: staticResults,
     code_delta: codeDelta,
     changed_files: allForReview,
@@ -18733,6 +18957,54 @@ async function runAnalyze(opts, globals) {
         // replaced a population floor with ≈35% power that was sub-integer for
         // three-quarters of the fleet.
         conservation: foldConservation,
+        // ⚠ VRT-52 — RECORDED, NOT APPLIED. The number nobody has.
+        //
+        // The whole "task-scoped delta" design space rests on an assumption that
+        // has been observed exactly ONCE: that delta files routinely belong to
+        // earlier work. Three designs were built on it and all three were killed
+        // adversarially — two by measurement — so before another is attempted,
+        // measure the base rate.
+        //
+        // `authored_under_earlier_goal` counts delta paths whose LAST authorship
+        // event precedes the seq of the goal now in force. Both numbers come from
+        // the same append-only counter (`nextSeq`), so the comparison is exact.
+        //
+        // Keyed on the GOAL, deliberately, not on the task id. The task classifier
+        // reported `is_new_task` on two consecutive turns of one task 25 seconds
+        // apart, so a task-keyed number would measure its unreliability rather
+        // than the phenomenon. And this only became meaningful once `recordGoal`
+        // stopped letting a bare "ok" supersede the goal — before that the seq
+        // advanced every turn and this would have degenerated to "not edited this
+        // turn", which is the exact mistake that sank one of the three designs.
+        //
+        // Changes no payload the reviewer sees, no narrowing, no verdict.
+        vrt52: (() => {
+          const goalSeq = memory?.projection.goal?.seq;
+          if (goalSeq === void 0 || !memorySession) return { known: false };
+          const lastSeq2 = new Map(
+            foldDossier(memorySession.d).authored_all.map((a) => [a.path, a.last_seq])
+          );
+          let earlier = 0;
+          let unknown = 0;
+          for (const f of codeDelta.files) {
+            const seen = lastSeq2.get(f.path);
+            if (seen === void 0) unknown++;
+            else if (seen < goalSeq) earlier++;
+          }
+          return {
+            known: true,
+            goal_seq: goalSeq,
+            delta: codeDelta.files.length,
+            // Files this delta carries that were last written under an EARLIER
+            // instruction. If this stays near zero, VRT-52's code half is
+            // unnecessary and should be closed saying so.
+            authored_under_earlier_goal: earlier,
+            // Delta files the dossier has no authorship record for at all —
+            // pre-existing tree state, or an authorship channel the fold cannot
+            // see. Reported separately so a blind spot is never counted as a zero.
+            no_authorship_record: unknown
+          };
+        })(),
         // P2 — RECORDED, NOT APPLIED. What this run WOULD have reviewed if it
         // narrowed to the within-session increment: what changed since the last
         // VERDICT rather than since task start.
@@ -18765,7 +19037,20 @@ async function runAnalyze(opts, globals) {
     const intentContext = {};
     if (conversation && conversation.prompts.length > 0) {
       const latest = conversation.prompts[conversation.prompts.length - 1];
-      intentContext.user_prompt = latest.prompt;
+      const goalPrompt = resolveGoalPrompt(conversation.prompts) ?? { entry: latest, turnsBack: 0 };
+      intentContext.user_prompt = goalPrompt.entry.prompt;
+      if (isContinuationPrompt(intentContext.user_prompt)) {
+        const carried = memory?.projection.goal?.text;
+        if (carried && !isContinuationPrompt(carried)) {
+          intentContext.continuation_prompt = latest.prompt;
+          intentContext.user_prompt = carried;
+          logEvent("goal_from_dossier", { chars: carried.length });
+        }
+      }
+      if (goalPrompt.turnsBack > 0) {
+        intentContext.continuation_prompt = latest.prompt;
+        logEvent("goal_walked_back", { turns_back: goalPrompt.turnsBack });
+      }
       intentContext.session_id = latest.session_id || void 0;
       intentContext.prompt_captured_at = latest.captured_at || void 0;
       if (conversation.prompts.length > 1) {
@@ -18857,6 +19142,22 @@ async function runAnalyze(opts, globals) {
   const response = result.data;
   const decision = response.gate_decision ?? "(unrecognised)";
   const sentPaths = codeDelta.files.map((f) => f.path);
+  let openElsewhere = [];
+  if (memorySession) {
+    try {
+      const st = foldDossier(memorySession.d);
+      openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
+        try {
+          const src = (0, import_node_fs24.readFileSync)((0, import_node_path20.join)(repoRoot(), file), "utf8").split("\n");
+          const at = src[line - 1];
+          return at === void 0 ? null : lineSha(at);
+        } catch {
+          return null;
+        }
+      });
+    } catch {
+    }
+  }
   const reviewCoverage = {
     reviewed: sentPaths,
     // Declared drops from the stages that DO report themselves today. The other
@@ -18887,6 +19188,26 @@ async function runAnalyze(opts, globals) {
         stage: "extractActionSummary",
         kind: "capacity"
       })),
+      // ⚠ BASELINE SCOPING — the biggest source of false NOT A CLEAN REVIEW.
+      //
+      // The universe is `allChanged`, git's whole dirty tree. The reviewed set is
+      // scoped to what THIS SESSION authored (the VRT-26 contamination cure), so
+      // every pre-existing dirty file is in the universe, absent from `reviewed`,
+      // and — until now — declared by nobody. It fell through to `unaccounted`,
+      // became capacity, and produced "NOT A CLEAN REVIEW: admin.js" over a file
+      // that was never this session's to review.
+      //
+      // Measured 2026-08-04: three consecutive runs over an untouched tree gave
+      // three different answers — .claude/settings.json, then admin.js, then six
+      // files — because each run took a different path and each path had a
+      // different idea of the universe. POLICY: not this session's work is not a
+      // coverage gap, it is the cure working.
+      ...allChanged.filter((p) => !sentPaths.includes(p) && !codeDelta.excluded.some((e) => e.path === p)).filter((p) => analyzable.includes(p) || reviewable.includes(p) || securityFiles.includes(p)).map((path) => ({
+        path,
+        reason: "not-authored-this-session",
+        stage: "baseline-scoping",
+        kind: "policy"
+      })),
       // The extension allowlist, and it is POLICY rather than capacity: a changed
       // README was never going to be reviewed, and treating that as a coverage
       // gap would downgrade nearly every PASS to WARN until WARN meant nothing.
@@ -18930,6 +19251,13 @@ async function runAnalyze(opts, globals) {
     });
   }
   let intentRepeatCount = 0;
+  const priorPendingFingerprints = memorySession ? (() => {
+    try {
+      return foldDossier(memorySession.d).meta.recent_pending_sigs ?? [];
+    } catch {
+      return [];
+    }
+  })() : [];
   if (memorySession) {
     try {
       recordVerdict(memorySession.d, {
@@ -18952,7 +19280,10 @@ async function runAnalyze(opts, globals) {
         // What next turn reads as `emittedLast`. A suppressed turn did not
         // speak, so it cannot be the cause of the turn after it — which is what
         // keeps this from becoming a permanent gag.
-        emitted: !silenced
+        emitted: !silenced,
+        // Fingerprinted for the NEXT turn's repeat check. Reviewer pending items
+        // carry no `pattern_id`, so their content is the only available key.
+        pendingTexts: (response.pending_items ?? []).map((p) => String(p.description ?? p.title ?? p.reason ?? "")).filter(Boolean)
       });
       intentRepeatCount = Math.max(0, (foldDossier(memorySession.d).meta.intent_repeat?.consecutive ?? 1) - 1);
     } catch {
@@ -19052,9 +19383,41 @@ async function runAnalyze(opts, globals) {
     reverify_by: response.reverify_by
   });
   const grantNudge = grantWarning ? ` \u26A0\uFE0F ${grantWarning}` : "";
-  switch (decision) {
+  let capReleased = false;
+  let effectiveDecision = decision;
+  if (decision === "FAIL") {
+    const blocking = (response.findings ?? []).filter((f) => {
+      const sev = String(f.severity ?? "").toLowerCase();
+      return sev === "critical" || sev === "high";
+    });
+    const fingerprint = findingsFingerprint(blocking);
+    const prior = readIterationState(currentCommit);
+    const sameProblem = isSameProblem(prior.fingerprint, fingerprint);
+    const nextIteration = sameProblem ? prior.iteration + 1 : 1;
+    const maxIterations = parseInt(opts.maxIterations, 10);
+    writeIteration(nextIteration, currentCommit, contentHash ?? void 0, fingerprint);
+    iteration = nextIteration;
+    if (nextIteration > maxIterations) {
+      capReleased = true;
+      effectiveDecision = "WARN";
+      logEvent("iteration_cap_released", { iteration: nextIteration, fingerprint });
+    }
+  }
+  if (capReleased) {
+    const findings = response.findings ?? [];
+    const lines = findings.slice(0, 5).map((f) => `  [${String(f.severity ?? "?").toUpperCase()}] ${String(f.title ?? f.message ?? "")} (${String(f.file ?? "?")}:${String(f.line ?? "?")})`);
+    emitVerdict({
+      proposed: "WARN",
+      changed: skipCoverageChanged,
+      coverage: reviewCoverage,
+      userSummary: `Verity: WARN \u2014 self-healing limit (${opts.maxIterations}) reached on the same finding. NO LONGER BLOCKING, but ${findings.length} finding(s) remain OPEN and were NOT fixed. Human review required before deploying.
+${lines.join("\n")}`,
+      agentContext: null,
+      silenced: true
+    });
+  }
+  switch (effectiveDecision) {
     case "FAIL": {
-      writeIteration(iteration + 1, currentCommit, contentHash ?? void 0);
       const assessment = response.assessment;
       const narrative = assessment?.narrative ?? "";
       const findings = response.findings ?? [];
@@ -19139,7 +19502,10 @@ ${YELLOW}${grantNudge.trim()}${NC}
         // Subject to the SAME cycle cut as PASS/WARN. Suppressing here is safe:
         // the findings themselves are rendered above by the blocking renderer,
         // so what the cut removes is the repeated commentary, never the defect.
-        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount)
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount, priorPendingFingerprints),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced,
+        openElsewhere
       });
       break;
     }
@@ -19157,7 +19523,10 @@ ${YELLOW}${grantNudge.trim()}${NC}
         changed: skipCoverageChanged,
         coverage: reviewCoverage,
         userSummary,
-        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount)
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount, priorPendingFingerprints),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced,
+        openElsewhere
       });
       break;
     }
@@ -19174,7 +19543,10 @@ ${YELLOW}${grantNudge.trim()}${NC}
         changed: skipCoverageChanged,
         coverage: reviewCoverage,
         userSummary,
-        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount)
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount, priorPendingFingerprints),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced,
+        openElsewhere
       });
       break;
     }
@@ -19288,8 +19660,8 @@ async function runReview(opts, globals) {
     for (const p of specPaths) {
       if (!(0, import_node_fs26.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync15 } = await import("node:fs");
-        const content = readFileSync15(p, "utf-8");
+        const { readFileSync: readFileSync16 } = await import("node:fs");
+        const content = readFileSync16(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -20975,7 +21347,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.8cc9c66").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.902dbd9").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   try {
     await foldLegacyLocalCredential();
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.28.1-experimental.8cc9c66",
+  "version": "0.28.1-experimental.902dbd9",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "bugs": {