@codacy/verity-cli 0.28.1-experimental.8cc9c66 → 0.28.1-experimental.99781f8

package/bin/verity.js

@@ -16625,7 +16625,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.28.1-experimental.8cc9c66" : "dev";
+    return true ? "0.28.1-experimental.99781f8" : "dev";
   } catch {
     return "dev";
   }
@@ -17331,12 +17331,12 @@ function emitVerdict(input) {
 ${input.agentContext}
 `);
     }
-    if (note) process.stderr.write(`
+    if (note && !input.silenced) process.stderr.write(`
 ${YELLOW2}${note}${NC2}
 `);
     return exit(2);
   }
-  const agentBlock = [input.agentContext, note].filter(Boolean).join("\n\n") || null;
+  const agentBlock = input.silenced ? null : [input.agentContext, note].filter(Boolean).join("\n\n") || null;
   printJsonCompact(buildHookOutput(verdict, input.userSummary, agentBlock));
   return exit(0);
 }
@@ -18216,6 +18216,8 @@ async function passAndExit(reason, skip, kindOverride) {
   if (unaccounted.length > 0) {
     logEvent("coverage_unaccounted", { where: "passAndExit", skip, count: unaccounted.length });
   }
+  const AGENT_SILENT_SKIPS = /* @__PURE__ */ new Set(["iteration-cap"]);
+  const agentNote = AGENT_SILENT_SKIPS.has(skip) ? null : note;
   printJsonCompact(
     buildHookOutput(
       verdict,
@@ -18223,7 +18225,7 @@ async function passAndExit(reason, skip, kindOverride) {
       // The agent's ONLY input is additionalContext. Sixteen of the nineteen
       // terminating paths wrote `systemMessage` — the human's field — and told
       // the agent nothing at all.
-      note
+      agentNote
     )
   );
   process.exit(0);
@@ -18887,6 +18889,26 @@ async function runAnalyze(opts, globals) {
         stage: "extractActionSummary",
         kind: "capacity"
       })),
+      // ⚠ BASELINE SCOPING — the biggest source of false NOT A CLEAN REVIEW.
+      //
+      // The universe is `allChanged`, git's whole dirty tree. The reviewed set is
+      // scoped to what THIS SESSION authored (the VRT-26 contamination cure), so
+      // every pre-existing dirty file is in the universe, absent from `reviewed`,
+      // and — until now — declared by nobody. It fell through to `unaccounted`,
+      // became capacity, and produced "NOT A CLEAN REVIEW: admin.js" over a file
+      // that was never this session's to review.
+      //
+      // Measured 2026-08-04: three consecutive runs over an untouched tree gave
+      // three different answers — .claude/settings.json, then admin.js, then six
+      // files — because each run took a different path and each path had a
+      // different idea of the universe. POLICY: not this session's work is not a
+      // coverage gap, it is the cure working.
+      ...allChanged.filter((p) => !sentPaths.includes(p) && !codeDelta.excluded.some((e) => e.path === p)).filter((p) => analyzable.includes(p) || reviewable.includes(p) || securityFiles.includes(p)).map((path) => ({
+        path,
+        reason: "not-authored-this-session",
+        stage: "baseline-scoping",
+        kind: "policy"
+      })),
       // The extension allowlist, and it is POLICY rather than capacity: a changed
       // README was never going to be reviewed, and treating that as a coverage
       // gap would downgrade nearly every PASS to WARN until WARN meant nothing.
@@ -19139,7 +19161,9 @@ ${YELLOW}${grantNudge.trim()}${NC}
         // Subject to the SAME cycle cut as PASS/WARN. Suppressing here is safe:
         // the findings themselves are rendered above by the blocking renderer,
         // so what the cut removes is the repeated commentary, never the defect.
-        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount)
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced
       });
       break;
     }
@@ -19157,7 +19181,9 @@ ${YELLOW}${grantNudge.trim()}${NC}
         changed: skipCoverageChanged,
         coverage: reviewCoverage,
         userSummary,
-        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount)
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced
       });
       break;
     }
@@ -19174,7 +19200,9 @@ ${YELLOW}${grantNudge.trim()}${NC}
         changed: skipCoverageChanged,
         coverage: reviewCoverage,
         userSummary,
-        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount)
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced
       });
       break;
     }
@@ -20975,7 +21003,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.8cc9c66").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.99781f8").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   try {
     await foldLegacyLocalCredential();
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.28.1-experimental.8cc9c66",
+  "version": "0.28.1-experimental.99781f8",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "bugs": {