@codacy/verity-cli 0.28.1-experimental.a57c8d9 → 0.28.1-experimental.a72d2d9

package/bin/verity.js

@@ -10570,135 +10570,6 @@ function rotateIfNeeded(file) {
   }
 }
 
-// src/lib/api-client.ts
-function describeFetchError(err, url) {
-  const message = err instanceof Error ? err.message : String(err);
-  const cause = err?.cause;
-  const causeBits = [cause?.code, cause?.hostname].filter(Boolean).join(" ");
-  const detail = causeBits || (cause?.message && cause.message !== message ? cause.message : "");
-  return `${message}${detail ? ` (${detail})` : ""} \u2014 could not reach ${url}`;
-}
-async function apiRequest(options) {
-  const {
-    method,
-    path,
-    serviceUrl,
-    token,
-    body,
-    verbose,
-    timeout = 9e4,
-    cmd = "unknown",
-    retry = false,
-    encodeBody = false,
-    extraHeaders
-  } = options;
-  const url = `${serviceUrl}${path}`;
-  const headers = {
-    "Content-Type": "application/json"
-  };
-  if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-  if (extraHeaders) {
-    Object.assign(headers, extraHeaders);
-  }
-  const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
-  if (testMockScenario) {
-    headers["X-Verity-Mock-Scenario"] = testMockScenario;
-  }
-  const testMockFailure = process.env.VERITY_TEST_MOCK_FAILURE;
-  if (testMockFailure) {
-    headers["X-Verity-Mock-Failure"] = testMockFailure;
-  }
-  printVerbose(`${method} ${url}`, verbose);
-  let serializedBody;
-  if (body !== void 0 && body !== null) {
-    const innerJson = JSON.stringify(body);
-    if (encodeBody) {
-      const payload = Buffer.from(innerJson, "utf8").toString("base64");
-      serializedBody = JSON.stringify({ encoding: "base64", payload });
-    } else {
-      serializedBody = innerJson;
-    }
-    printVerbose(`Body: ${serializedBody.slice(0, 500)}`, verbose);
-  }
-  const startedAt = Date.now();
-  const bodyBytes = serializedBody ? Buffer.byteLength(serializedBody) : 0;
-  const logBase = { cmd, method, url, body_bytes: bodyBytes, retry, encoded: encodeBody };
-  let response;
-  try {
-    response = await fetch(url, {
-      method,
-      headers,
-      body: serializedBody,
-      signal: AbortSignal.timeout(timeout)
-    });
-  } catch (err) {
-    const duration2 = Date.now() - startedAt;
-    const isTimeout = err instanceof DOMException && err.name === "TimeoutError";
-    const category = isTimeout ? "timeout" : "network";
-    const error = isTimeout ? `Request timed out after ${timeout}ms (${url})` : `Network error: ${describeFetchError(err, url)}`;
-    logHttpCall({ ...logBase, duration_ms: duration2, http_status: null, category, error });
-    return { ok: false, error, category, http_status: null };
-  }
-  let data;
-  try {
-    data = response.status === 204 || response.headers.get("content-length") === "0" ? {} : await response.json();
-  } catch {
-    const duration2 = Date.now() - startedAt;
-    const error = `Invalid JSON response (HTTP ${response.status})`;
-    logHttpCall({
-      ...logBase,
-      duration_ms: duration2,
-      http_status: response.status,
-      category: "invalid_json",
-      error
-    });
-    return { ok: false, error, category: "invalid_json", http_status: response.status };
-  }
-  printVerbose(`Response ${response.status}: ${JSON.stringify(data).slice(0, 500)}`, verbose);
-  const duration = Date.now() - startedAt;
-  if (!response.ok) {
-    const apiErr = data;
-    const code = apiErr?.error?.code ?? "UNKNOWN";
-    const message = apiErr?.error?.message ?? `HTTP ${response.status}`;
-    const category = response.status >= 500 ? "http_5xx" : "http_4xx";
-    const error = `${code}: ${message}`;
-    logHttpCall({
-      ...logBase,
-      duration_ms: duration,
-      http_status: response.status,
-      category,
-      error
-    });
-    return { ok: false, error, category, http_status: response.status };
-  }
-  logHttpCall({
-    ...logBase,
-    duration_ms: duration,
-    http_status: response.status,
-    category: "ok"
-  });
-  return { ok: true, data };
-}
-function analyzeRequest(options) {
-  return apiRequest({
-    method: "POST",
-    path: "/analyze",
-    serviceUrl: options.serviceUrl,
-    token: options.token,
-    body: options.body,
-    timeout: options.timeout,
-    cmd: options.cmd,
-    verbose: options.verbose,
-    retry: options.retry,
-    encodeBody: true
-  });
-}
-
-// src/lib/service-url.ts
-var import_promises2 = require("node:fs/promises");
-
 // src/lib/credentials.ts
 var import_promises = require("node:fs/promises");
 var import_node_path2 = require("node:path");
@@ -10765,14 +10636,14 @@ async function readGlobalCredential(remote) {
       const parsed = parseCredentialLine(line);
       if (parsed && parsed.remote === key) last = parsed.rec;
     }
-    if (last) return last;
+    if (last) return { ...last, keyed: true };
   }
   let plain = null;
   for (const line of lines) {
     const parsed = parseCredentialLine(line);
     if (parsed && parsed.remote === "") plain = parsed.rec;
   }
-  return plain;
+  return plain ? { ...plain, keyed: false } : null;
 }
 async function upsertGlobalCredential(remote, rec) {
   const path = globalCredentialsPath();
@@ -10805,6 +10676,67 @@ async function upsertGlobalCredential(remote, rec) {
   await (0, import_promises.chmod)(path, 384).catch(() => {
   });
 }
+async function removeSupersededUserCredentials(loginServiceUrl, loginUserId) {
+  if (loginUserId == null) return 0;
+  const path = globalCredentialsPath();
+  let content;
+  try {
+    content = await (0, import_promises.readFile)(path, "utf-8");
+  } catch {
+    return 0;
+  }
+  const kept = [];
+  let removed = 0;
+  for (const line of content.split("\n")) {
+    const parsed = parseCredentialLine(line);
+    const superseded = parsed !== null && parsed.remote !== "" && parsed.rec.userId === loginUserId && (!parsed.rec.serviceUrl || parsed.rec.serviceUrl === loginServiceUrl);
+    if (superseded) {
+      removed++;
+      continue;
+    }
+    kept.push(line);
+  }
+  if (removed === 0) return 0;
+  while (kept.length && kept[kept.length - 1].trim() === "") kept.pop();
+  try {
+    await (0, import_promises.writeFile)(path, kept.join("\n") + "\n", { mode: 384 });
+    await (0, import_promises.chmod)(path, 384).catch(() => {
+    });
+  } catch {
+    return -1;
+  }
+  return removed;
+}
+async function removeGlobalCredential(remote) {
+  const path = globalCredentialsPath();
+  let content;
+  try {
+    content = await (0, import_promises.readFile)(path, "utf-8");
+  } catch {
+    return false;
+  }
+  const key = encodeRemoteKey(remote);
+  const kept = [];
+  let removed = false;
+  for (const line of content.split("\n")) {
+    const parsed = parseCredentialLine(line);
+    if (parsed && parsed.remote === key) {
+      removed = true;
+      continue;
+    }
+    kept.push(line);
+  }
+  if (!removed) return false;
+  while (kept.length && kept[kept.length - 1].trim() === "") kept.pop();
+  try {
+    await (0, import_promises.writeFile)(path, kept.length ? kept.join("\n") + "\n" : "", { mode: 384 });
+    await (0, import_promises.chmod)(path, 384).catch(() => {
+    });
+  } catch {
+    return false;
+  }
+  return true;
+}
 function parseLocalCredentialFile(content) {
   const tokenMatch = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
   if (!tokenMatch) return null;
@@ -10854,10 +10786,378 @@ async function foldLegacyLocalCredential(remoteArg) {
   }
   await (0, import_promises.unlink)(projectPath(CREDENTIALS_FILE)).catch(() => {
   });
-  return true;
+  return true;
+}
+
+// src/lib/git.ts
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
+function resolveFile(relpath) {
+  return (0, import_node_fs3.existsSync)(relpath) ? relpath : null;
+}
+function execGit(cmd) {
+  try {
+    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function splitLines(s) {
+  return s.split("\n").filter((l) => l.length > 0);
+}
+var SHA_RE = /^[0-9a-f]{40}$/;
+function readBaselineSha() {
+  if (!(0, import_node_fs3.existsSync)(BASELINE_SHA_FILE)) return null;
+  let sha;
+  try {
+    sha = (0, import_node_fs3.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  if (!SHA_RE.test(sha)) return null;
+  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+  if (!reachable) {
+    try {
+      (0, import_node_fs3.unlinkSync)(BASELINE_SHA_FILE);
+    } catch {
+    }
+    return null;
+  }
+  return sha;
+}
+function writeBaselineSha(sha) {
+  if (!SHA_RE.test(sha)) return;
+  try {
+    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs3.writeFileSync)(BASELINE_SHA_FILE, sha);
+  } catch {
+  }
+}
+function getChangedFiles() {
+  const sets = /* @__PURE__ */ new Set();
+  let hasRecentCommitFiles = false;
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
+    if (committed.length > 0) {
+      hasRecentCommitFiles = true;
+      for (const f of committed) sets.add(f);
+    }
+  } else {
+    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
+    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
+    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
+    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
+    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
+      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
+      if (recentFiles.length > 0) {
+        hasRecentCommitFiles = true;
+        for (const f of recentFiles) sets.add(f);
+      }
+    }
+  }
+  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return { files: filtered, hasRecentCommitFiles };
+}
+function getStagedFiles() {
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function getDirtyFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function showContentAtRef(ref, repoRelPath) {
+  if (!ref || ref === "no-git") return null;
+  const normalizedPath = repoRelPath.replace(/\\/g, "/");
+  try {
+    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function getPushRangeFiles() {
+  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const resolvers = [
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
+    () => {
+      const branch = execGit("git rev-parse --abbrev-ref HEAD");
+      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
+    }
+  ];
+  for (const resolve2 of resolvers) {
+    const range = resolve2();
+    if (range) return { files: diff(range), range };
+  }
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const files = diff(`${baseline}..HEAD`);
+    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
+  }
+  const last = diff("HEAD~1..HEAD");
+  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
+}
+function getPushRangeMessages() {
+  const { range } = getPushRangeFiles();
+  if (!range) return "";
+  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
+function filterAnalyzable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path3.extname)(f).slice(1);
+    return ANALYZABLE_EXTENSIONS.has(ext);
+  });
+}
+function filterReviewable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path3.extname)(f).slice(1);
+    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
+    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
+    const basename4 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename4)) return true;
+    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
+    return false;
+  });
+}
+function filterSecurity(files) {
+  return files.filter(
+    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
+  );
+}
+function getCurrentCommit() {
+  return execGit("git rev-parse HEAD") || "no-git";
+}
+function getCurrentBranch() {
+  const b = execGit("git rev-parse --abbrev-ref HEAD");
+  return !b || b === "HEAD" ? null : b;
+}
+function commitResolves(sha) {
+  if (!sha) return false;
+  try {
+    (0, import_node_child_process3.execSync)(`git merge-base --is-ancestor ${JSON.stringify(sha)} HEAD`, {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function commitsSincePaths(sha, paths) {
+  if (!sha) return null;
+  try {
+    const scope = paths.length > 0 ? ` -- ${paths.slice(0, 50).map((p) => JSON.stringify(p)).join(" ")}` : "";
+    const out = (0, import_node_child_process3.execSync)(`git rev-list --count ${JSON.stringify(sha)}..HEAD${scope}`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    const n = Number.parseInt(out, 10);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
+function detectProvider(host) {
+  const h = host.toLowerCase();
+  if (h.includes("github")) return "github";
+  if (h.includes("gitlab")) return "gitlab";
+  if (h.includes("bitbucket")) return "bitbucket";
+  return "unknown";
+}
+function parseRemote(raw) {
+  if (!raw || typeof raw !== "string") return null;
+  let s = raw.trim();
+  if (!s) return null;
+  let host = "";
+  let path = "";
+  const scp = s.match(/^[^/@]+@([^:/]+):(.+)$/);
+  if (scp) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+    s = s.replace(/^[^/@]+@/, "");
+    const slash = s.indexOf("/");
+    if (slash === -1) return null;
+    host = s.slice(0, slash);
+    path = s.slice(slash + 1);
+  }
+  host = host.toLowerCase().trim();
+  path = path.replace(/\/+$/, "").replace(/\.git$/, "");
+  if (!host || !path) return null;
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length < 2) return null;
+  const owner = segments[0];
+  const repo = segments[segments.length - 1];
+  if (!owner || !repo) return null;
+  return {
+    host,
+    owner,
+    repo,
+    provider: detectProvider(host),
+    orgUrl: `https://${host}/${owner}`,
+    orgName: owner
+  };
+}
+function listTrackedFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set);
+}
+function sanitizeRemote(remote) {
+  return remote.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^/]*@/, "$1");
+}
+
+// src/lib/api-client.ts
+var cachedRemote = null;
+function requestRemote() {
+  const override = process.env.VERITY_REMOTE_OVERRIDE;
+  if (override) return sanitizeRemote(override.trim());
+  if (cachedRemote === null) cachedRemote = sanitizeRemote(currentRemote());
+  return cachedRemote;
+}
+function describeFetchError(err, url) {
+  const message = err instanceof Error ? err.message : String(err);
+  const cause = err?.cause;
+  const causeBits = [cause?.code, cause?.hostname].filter(Boolean).join(" ");
+  const detail = causeBits || (cause?.message && cause.message !== message ? cause.message : "");
+  return `${message}${detail ? ` (${detail})` : ""} \u2014 could not reach ${url}`;
+}
+async function apiRequest(options) {
+  const {
+    method,
+    path,
+    serviceUrl,
+    token,
+    body,
+    verbose,
+    timeout = 9e4,
+    cmd = "unknown",
+    retry = false,
+    encodeBody = false,
+    extraHeaders
+  } = options;
+  const url = `${serviceUrl}${path}`;
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (token) {
+    headers["Authorization"] = `Bearer ${token}`;
+  }
+  const remote = requestRemote();
+  if (remote) {
+    headers["X-Verity-Remote"] = remote;
+  }
+  if (extraHeaders) {
+    Object.assign(headers, extraHeaders);
+  }
+  const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
+  if (testMockScenario) {
+    headers["X-Verity-Mock-Scenario"] = testMockScenario;
+  }
+  const testMockFailure = process.env.VERITY_TEST_MOCK_FAILURE;
+  if (testMockFailure) {
+    headers["X-Verity-Mock-Failure"] = testMockFailure;
+  }
+  printVerbose(`${method} ${url}`, verbose);
+  let serializedBody;
+  if (body !== void 0 && body !== null) {
+    const innerJson = JSON.stringify(body);
+    if (encodeBody) {
+      const payload = Buffer.from(innerJson, "utf8").toString("base64");
+      serializedBody = JSON.stringify({ encoding: "base64", payload });
+    } else {
+      serializedBody = innerJson;
+    }
+    printVerbose(`Body: ${serializedBody.slice(0, 500)}`, verbose);
+  }
+  const startedAt = Date.now();
+  const bodyBytes = serializedBody ? Buffer.byteLength(serializedBody) : 0;
+  const logBase = { cmd, method, url, body_bytes: bodyBytes, retry, encoded: encodeBody };
+  let response;
+  try {
+    response = await fetch(url, {
+      method,
+      headers,
+      body: serializedBody,
+      signal: AbortSignal.timeout(timeout)
+    });
+  } catch (err) {
+    const duration2 = Date.now() - startedAt;
+    const isTimeout = err instanceof DOMException && err.name === "TimeoutError";
+    const category = isTimeout ? "timeout" : "network";
+    const error = isTimeout ? `Request timed out after ${timeout}ms (${url})` : `Network error: ${describeFetchError(err, url)}`;
+    logHttpCall({ ...logBase, duration_ms: duration2, http_status: null, category, error });
+    return { ok: false, error, category, http_status: null };
+  }
+  let data;
+  try {
+    data = response.status === 204 || response.headers.get("content-length") === "0" ? {} : await response.json();
+  } catch {
+    const duration2 = Date.now() - startedAt;
+    const error = `Invalid JSON response (HTTP ${response.status})`;
+    logHttpCall({
+      ...logBase,
+      duration_ms: duration2,
+      http_status: response.status,
+      category: "invalid_json",
+      error
+    });
+    return { ok: false, error, category: "invalid_json", http_status: response.status };
+  }
+  printVerbose(`Response ${response.status}: ${JSON.stringify(data).slice(0, 500)}`, verbose);
+  const duration = Date.now() - startedAt;
+  if (!response.ok) {
+    const apiErr = data;
+    const code = apiErr?.error?.code ?? "UNKNOWN";
+    const message = apiErr?.error?.message ?? `HTTP ${response.status}`;
+    const category = response.status >= 500 ? "http_5xx" : "http_4xx";
+    const error = `${code}: ${message}`;
+    logHttpCall({
+      ...logBase,
+      duration_ms: duration,
+      http_status: response.status,
+      category,
+      error
+    });
+    return { ok: false, error, category, http_status: response.status };
+  }
+  logHttpCall({
+    ...logBase,
+    duration_ms: duration,
+    http_status: response.status,
+    category: "ok"
+  });
+  return { ok: true, data };
+}
+function analyzeRequest(options) {
+  return apiRequest({
+    method: "POST",
+    path: "/analyze",
+    serviceUrl: options.serviceUrl,
+    token: options.token,
+    body: options.body,
+    timeout: options.timeout,
+    cmd: options.cmd,
+    verbose: options.verbose,
+    retry: options.retry,
+    encodeBody: true
+  });
 }
 
 // src/lib/service-url.ts
+var import_promises2 = require("node:fs/promises");
 async function serviceUrlFromCredentials() {
   const rec = await readGlobalCredential(currentRemote());
   return rec?.serviceUrl ?? null;
@@ -10918,7 +11218,13 @@ async function resolveToken(flagToken) {
   if (rec) {
     return {
       ok: true,
-      data: { token: rec.token, source: "global", userId: rec.userId, email: rec.email }
+      data: {
+        token: rec.token,
+        source: "global",
+        userId: rec.userId,
+        email: rec.email,
+        keyed: rec.keyed
+      }
     };
   }
   const local = await readLegacyLocalCredential();
@@ -10940,6 +11246,47 @@ async function whoami(token, serviceUrl, verbose) {
     cmd: "whoami"
   });
 }
+function reverifyNudge(who) {
+  if (who.grant_status === "hard_stale") {
+    return 'Your GitHub verification has expired \u2014 run "verity login" to restore saved runs and memory.';
+  }
+  if (who.grant_status === "soft_stale") {
+    const by = who.reverify_by ? ` by ${who.reverify_by.slice(0, 10)}` : " soon";
+    return `Your GitHub verification needs a refresh${by} \u2014 run "verity login" to re-verify.`;
+  }
+  return null;
+}
+function isLegacyPerRepoCredential(auth2) {
+  return auth2.source === "local" || auth2.source === "global" && auth2.keyed === true;
+}
+async function shouldUpgradeOnLogin(auth2) {
+  if (!isLegacyPerRepoCredential(auth2)) return false;
+  if (auth2.userId == null) return true;
+  const bare = await readGlobalCredential("");
+  if (bare?.userId == null) return true;
+  return bare.userId === auth2.userId;
+}
+function authDenialRemedy(error) {
+  if (error.startsWith("STALE_VERIFICATION")) {
+    return {
+      code: "STALE_VERIFICATION",
+      remedy: 'Your GitHub verification has expired \u2014 run "verity login" to re-verify your repository access.'
+    };
+  }
+  if (error.startsWith("FORBIDDEN")) {
+    return {
+      code: "FORBIDDEN",
+      remedy: 'No access grant for this repository \u2014 run "verity login" to refresh your grants (a repo granted after your last login needs one), or get write access to it.'
+    };
+  }
+  if (error.startsWith("INVALID_TOKEN")) {
+    return {
+      code: "INVALID_TOKEN",
+      remedy: 'Your Verity login has expired or was revoked \u2014 run "verity login" to sign in again.'
+    };
+  }
+  return null;
+}
 async function probeService(serviceUrl, verbose) {
   const res = await apiRequest({
     method: "GET",
@@ -10978,6 +11325,7 @@ async function maybeHealServiceUrl(resolution, verbose) {
 
 // src/lib/register.ts
 var readline = __toESM(require("node:readline/promises"));
+var import_node_os = require("node:os");
 
 // src/lib/provider-auth.ts
 var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
@@ -11064,250 +11412,23 @@ async function githubDeviceFlow() {
       data = await res.json().catch(() => ({}));
     } catch {
       continue;
-    }
-    if (data.access_token) return { ok: true, data: data.access_token };
-    switch (data.error) {
-      case "authorization_pending":
-        break;
-      case "slow_down":
-        interval += 5;
-        break;
-      case "access_denied":
-        return { ok: false, error: "Authorization was denied on GitHub." };
-      case "expired_token":
-        return { ok: false, error: "The authorization code expired. Re-run register." };
-      default:
-        if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
-    }
-  }
-  return { ok: false, error: "Timed out waiting for GitHub authorization." };
-}
-
-// src/lib/git.ts
-var import_node_child_process3 = require("node:child_process");
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
-function resolveFile(relpath) {
-  return (0, import_node_fs3.existsSync)(relpath) ? relpath : null;
-}
-function execGit(cmd) {
-  try {
-    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function splitLines(s) {
-  return s.split("\n").filter((l) => l.length > 0);
-}
-var SHA_RE = /^[0-9a-f]{40}$/;
-function readBaselineSha() {
-  if (!(0, import_node_fs3.existsSync)(BASELINE_SHA_FILE)) return null;
-  let sha;
-  try {
-    sha = (0, import_node_fs3.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
-  } catch {
-    return null;
-  }
-  if (!SHA_RE.test(sha)) return null;
-  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
-  if (!reachable) {
-    try {
-      (0, import_node_fs3.unlinkSync)(BASELINE_SHA_FILE);
-    } catch {
-    }
-    return null;
-  }
-  return sha;
-}
-function writeBaselineSha(sha) {
-  if (!SHA_RE.test(sha)) return;
-  try {
-    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs3.writeFileSync)(BASELINE_SHA_FILE, sha);
-  } catch {
-  }
-}
-function getChangedFiles() {
-  const sets = /* @__PURE__ */ new Set();
-  let hasRecentCommitFiles = false;
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
-    if (committed.length > 0) {
-      hasRecentCommitFiles = true;
-      for (const f of committed) sets.add(f);
-    }
-  } else {
-    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
-    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
-    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
-    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
-    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
-      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
-      if (recentFiles.length > 0) {
-        hasRecentCommitFiles = true;
-        for (const f of recentFiles) sets.add(f);
-      }
-    }
-  }
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  return { files: filtered, hasRecentCommitFiles };
-}
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function getDirtyFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function showContentAtRef(ref, repoRelPath) {
-  if (!ref || ref === "no-git") return null;
-  const normalizedPath = repoRelPath.replace(/\\/g, "/");
-  try {
-    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-  } catch {
-    return null;
-  }
-}
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGit("git rev-parse --abbrev-ref HEAD");
-      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve2 of resolvers) {
-    const range = resolve2();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
-function filterAnalyzable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path3.extname)(f).slice(1);
-    return ANALYZABLE_EXTENSIONS.has(ext);
-  });
-}
-function filterReviewable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path3.extname)(f).slice(1);
-    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
-    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename5 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename5)) return true;
-    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
-    return false;
-  });
-}
-function filterSecurity(files) {
-  return files.filter(
-    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
-  );
-}
-function getCurrentCommit() {
-  return execGit("git rev-parse HEAD") || "no-git";
-}
-function getCurrentBranch() {
-  const b = execGit("git rev-parse --abbrev-ref HEAD");
-  return !b || b === "HEAD" ? null : b;
-}
-function commitResolves(sha) {
-  if (!sha) return false;
-  try {
-    (0, import_node_child_process3.execSync)(`git merge-base --is-ancestor ${JSON.stringify(sha)} HEAD`, {
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function commitsSincePaths(sha, paths) {
-  if (!sha) return null;
-  try {
-    const scope = paths.length > 0 ? ` -- ${paths.slice(0, 50).map((p) => JSON.stringify(p)).join(" ")}` : "";
-    const out = (0, import_node_child_process3.execSync)(`git rev-list --count ${JSON.stringify(sha)}..HEAD${scope}`, {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    const n = Number.parseInt(out, 10);
-    return Number.isFinite(n) ? n : null;
-  } catch {
-    return null;
-  }
-}
-function detectProvider(host) {
-  const h = host.toLowerCase();
-  if (h.includes("github")) return "github";
-  if (h.includes("gitlab")) return "gitlab";
-  if (h.includes("bitbucket")) return "bitbucket";
-  return "unknown";
-}
-function parseRemote(raw) {
-  if (!raw || typeof raw !== "string") return null;
-  let s = raw.trim();
-  if (!s) return null;
-  let host = "";
-  let path = "";
-  const scp = s.match(/^[^/@]+@([^:/]+):(.+)$/);
-  if (scp) {
-    host = scp[1];
-    path = scp[2];
-  } else {
-    s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
-    s = s.replace(/^[^/@]+@/, "");
-    const slash = s.indexOf("/");
-    if (slash === -1) return null;
-    host = s.slice(0, slash);
-    path = s.slice(slash + 1);
+    }
+    if (data.access_token) return { ok: true, data: data.access_token };
+    switch (data.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "access_denied":
+        return { ok: false, error: "Authorization was denied on GitHub." };
+      case "expired_token":
+        return { ok: false, error: "The authorization code expired. Re-run register." };
+      default:
+        if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
+    }
   }
-  host = host.toLowerCase().trim();
-  path = path.replace(/\/+$/, "").replace(/\.git$/, "");
-  if (!host || !path) return null;
-  const segments = path.split("/").filter(Boolean);
-  if (segments.length < 2) return null;
-  const owner = segments[0];
-  const repo = segments[segments.length - 1];
-  if (!owner || !repo) return null;
-  return {
-    host,
-    owner,
-    repo,
-    provider: detectProvider(host),
-    orgUrl: `https://${host}/${owner}`,
-    orgName: owner
-  };
-}
-function listTrackedFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set);
+  return { ok: false, error: "Timed out waiting for GitHub authorization." };
 }
 
 // src/lib/register.ts
@@ -11392,11 +11513,81 @@ async function registerProject(opts) {
   }
   return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email, userId } };
 }
+function deviceLabel() {
+  const override = process.env.VERITY_DEVICE_LABEL?.trim();
+  if (override) return override;
+  try {
+    return (0, import_node_os.hostname)() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function loginOnce(opts) {
+  const usingTokenOverride = Boolean(process.env.VERITY_PROVIDER_TOKEN);
+  const providerAuth = await githubDeviceFlow();
+  if (!providerAuth.ok) {
+    return { ok: false, error: providerAuth.error };
+  }
+  const providerToken = providerAuth.data;
+  const parsed = opts.remote ? parseRemote(opts.remote) : null;
+  if (!usingTokenOverride && parsed && parsed.provider === "github") {
+    const installed = await ensureAppInstalled(parsed.owner, parsed.repo, providerToken);
+    if (!installed.ok) {
+      printWarn(installed.error);
+      printInfo("Continuing login \u2014 repositories on other accounts are still granted.");
+    }
+  }
+  const result = await apiRequest({
+    method: "POST",
+    path: "/auth/login",
+    serviceUrl: opts.serviceUrl,
+    extraHeaders: { "X-Provider-Token": providerToken },
+    // Label the session so its owner can tell their machines apart in
+    // `verity sessions list` — a list of identical "login" rows is unusable when
+    // the question is "which of these is the laptop I lost?". The hostname is the
+    // useful default; VERITY_DEVICE_LABEL overrides it for anyone who would
+    // rather not send it. Server-side it is sanitized and capped.
+    body: { device: deviceLabel() },
+    verbose: opts.verbose,
+    cmd: "login"
+  });
+  if (!result.ok) {
+    return { ok: false, error: result.error };
+  }
+  const { token, service_url, user_id, user, repo_count, expires_at } = result.data;
+  const loginUserId = user_id ?? user?.id ?? void 0;
+  try {
+    await upsertGlobalCredential("", {
+      token,
+      serviceUrl: service_url,
+      userId: loginUserId,
+      email: user?.email
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Logged in with the Verity service, but could not save credentials to ~/.verity/credentials: ${err.message}. Check filesystem permissions and re-run "verity login".`
+    };
+  }
+  const pruned = await removeSupersededUserCredentials(service_url, loginUserId);
+  return {
+    ok: true,
+    data: {
+      token,
+      serviceUrl: service_url,
+      email: user?.email,
+      userId: loginUserId,
+      repoCount: repo_count ?? 0,
+      prunedCredentials: pruned,
+      expiresAt: expires_at
+    }
+  };
+}
 
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
-  const auth = program2.command("auth").description("Manage project authentication");
-  auth.command("register").description("Register a project with Verity").requiredOption("--project <name>", "Project name").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
+  const auth2 = program2.command("auth").description("Manage project authentication");
+  auth2.command("register").description("Register a project with Verity").requiredOption("--project <name>", "Project name").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
     const globals = program2.opts();
     const serviceUrl = globals.serviceUrl ?? DEFAULT_SERVICE_URL;
     let remote = opts.remote;
@@ -11423,7 +11614,7 @@ function registerAuthCommands(program2) {
     if (email) printInfo(`Authenticated as: ${email}`);
     printJson({ project_id: projectId, service_url: resolvedUrl });
   });
-  auth.command("verify").description("Verify the current token is valid").action(async () => {
+  auth2.command("verify").description("Verify the current token is valid").action(async () => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -11449,7 +11640,7 @@ function registerAuthCommands(program2) {
     printInfo(`Token valid. Project: ${result.data.project_name}`);
     printJson(result.data);
   });
-  auth.command("discover").description("Check if a project is registered").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
+  auth2.command("discover").description("Check if a project is registered").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
     const globals = program2.opts();
     let remote = opts.remote;
     if (!remote) {
@@ -11481,10 +11672,8 @@ function registerAuthCommands(program2) {
 }
 
 // src/commands/login.ts
-var import_node_child_process5 = require("node:child_process");
-var import_node_path4 = require("node:path");
 function registerLoginCommand(program2) {
-  program2.command("login").description("Log in to Verity (link your GitHub identity so runs and memory are saved)").option("--force", "Re-authenticate even if already logged in").action(async (opts) => {
+  program2.command("login").description("Log in to Verity (one GitHub login grants access to all your repositories)").option("--force", "Re-authenticate even if already logged in").action(async (opts) => {
     const globals = program2.opts();
     const urlResult = await resolveServiceUrlDetailed(globals.serviceUrl);
     if (!urlResult.ok) {
@@ -11494,60 +11683,399 @@ function registerLoginCommand(program2) {
     const heal = await maybeHealServiceUrl(urlResult.data, globals.verbose);
     const serviceUrl = heal.serviceUrl;
     if (heal.healed) {
-      printInfo("  Completing login re-registers this project and updates ~/.verity/credentials.");
+      printInfo("  Completing login updates ~/.verity/credentials against the live service.");
+    }
+    const remote = currentRemote();
+    if (remote && !parseRemote(remote)) {
+      printWarn(`This repository's origin remote is not a recognizable git URL: ${remote}`);
+      printInfo("  Verity cannot identify the repository from it, so runs here will not be saved.");
+      printInfo("  Point origin at the full URL (e.g. git@github.com:owner/repo.git) to fix it.");
     }
     const existing = await resolveToken(globals.token);
     if (existing.ok && !opts.force && !heal.healed) {
-      if (existing.data.userId != null) {
-        printInfo(`Already logged in as ${existing.data.email ?? `user #${existing.data.userId}`}. \u2713`);
-        printInfo("  Re-authenticate with: verity login --force");
-        return;
-      }
-      const who2 = await whoami(existing.data.token, serviceUrl, globals.verbose);
-      if (who2.ok && who2.data.logged_in) {
-        printInfo(`Already logged in as ${who2.data.email ?? `user #${who2.data.user_id}`}. \u2713`);
-        printInfo("  Re-authenticate with: verity login --force");
-        return;
-      }
-      if (who2.ok && who2.data.anonymous) {
+      const who = await whoami(existing.data.token, serviceUrl, globals.verbose);
+      if (who.ok && who.data.logged_in) {
+        const nudge = reverifyNudge(who.data);
+        const upgrade = await shouldUpgradeOnLogin(existing.data);
+        if (!nudge && !upgrade) {
+          printInfo(`Already logged in as ${who.data.email ?? `user #${who.data.user_id}`}. \u2713`);
+          printInfo("  Re-authenticate with: verity login --force");
+          return;
+        }
+        if (nudge) {
+          printWarn(nudge);
+          printInfo("Re-verifying your repository access\u2026");
+        } else {
+          printInfo("You are signed in with a per-repository token (the old format).");
+          printInfo("  Upgrading to a single login that covers every repository you can write to\u2026");
+        }
+      } else if (who.ok && who.data.anonymous) {
         printInfo("You have an anonymous token (the gate runs, but nothing is saved). Logging you in\u2026");
-      } else if (!who2.ok) {
+      } else if (!who.ok) {
         printWarn("Could not confirm your current login state with the service \u2014 proceeding to log in.");
       }
     }
-    let remote = "";
-    try {
-      remote = (0, import_node_child_process5.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-    } catch {
+    printInfo("Authenticating with GitHub\u2026");
+    const result = await loginOnce({ serviceUrl, remote: remote || void 0, verbose: globals.verbose });
+    if (!result.ok) {
+      printError(`Login failed: ${result.error}`);
+      process.exit(1);
     }
-    if (!remote) {
-      printError("verity login needs a git remote (origin) to link this repository.");
-      printInfo("  Add one with: git remote add origin <url>, then re-run verity login.");
+    const out = result.data;
+    const identity = out.email ?? (out.userId != null ? `user #${out.userId}` : "your account");
+    printInfo(`Logged in as ${identity}. \u2713`);
+    printInfo(`  Access granted to ${out.repoCount} ${out.repoCount === 1 ? "repository" : "repositories"}.`);
+    if (out.expiresAt) {
+      printInfo(`  This login expires on ${out.expiresAt.slice(0, 10)} \u2014 "verity login" again to renew.`);
+      printInfo('  See your machines with "verity sessions list"; sign out with "verity logout".');
+    }
+    printInfo("  Runs, history, and cloud memory now sync to Verity everywhere you have write access.");
+    if (out.prunedCredentials > 0) {
+      printVerbose(`Pruned ${out.prunedCredentials} superseded per-repository credential line(s).`, globals.verbose);
+    } else if (out.prunedCredentials < 0) {
+      printWarn("  Could not rewrite ~/.verity/credentials: superseded per-repository tokens remain and");
+      printWarn("  will keep taking precedence over this login in their own repositories.");
+      printInfo(`  Check the file's permissions; the next successful "verity login" retries the cleanup.`);
+    }
+    if (out.repoCount === 0) {
+      printWarn("The Verity GitHub App is not installed on any account you can access.");
+      printInfo(`  Install it (and grant your repositories), then re-run verity login:`);
+      printInfo(`  ${githubAppInstallUrl(null)}`);
+      return;
+    }
+    if (remote) {
+      const who = await whoami(out.token, out.serviceUrl, globals.verbose);
+      if (who.ok && who.data.grant_status != null) {
+        printInfo("  \u2713 This repository is covered.");
+      } else if (!who.ok) {
+        printWarn(`  Could not confirm this repository's coverage (${who.error}) \u2014 verity status will show it.`);
+      } else {
+        const parsed = parseRemote(remote);
+        const installUrl = githubAppInstallUrl(parsed ? await githubAccountId(parsed.owner) : null);
+        printWarn(`  This repository (${parsed ? `${parsed.owner}/${parsed.repo}` : remote}) is NOT covered by your grants.`);
+        printInfo("  Grant the Verity GitHub App access to it, then re-run verity login:");
+        printInfo(`  ${installUrl}`);
+      }
+      const rec = await readGlobalCredential(remote);
+      if (rec && rec.token !== out.token) {
+        const otherBackend = rec.serviceUrl != null && rec.serviceUrl !== out.serviceUrl;
+        const otherIdentity = rec.userId != null && out.userId != null && rec.userId !== out.userId;
+        if (otherBackend) {
+          printWarn(`  Note: this repository is pinned to a different Verity service (${rec.serviceUrl})`);
+          printWarn("  by its own credential line, which takes precedence here \u2014 this login does not");
+          printWarn("  change that. To move the repository, remove its line from ~/.verity/credentials.");
+          printWarn('  Until that line is removed, "verity login" here cannot fast-path and will run');
+          printWarn("  the full GitHub flow every time.");
+        } else if (otherIdentity) {
+          printWarn("  Note: this repository uses a different account's credential, which takes");
+          printWarn('  precedence here \u2014 this login leaves it in place, and "verity login" in this');
+          printWarn("  repository will report that account. Remove its line from ~/.verity/credentials");
+          printWarn("  only if you want this repository on the login you just completed.");
+        } else {
+          const kind = rec.userId != null ? "superseded per-repository" : "anonymous project-specific";
+          printWarn(`  Note: this repository has a ${kind} credential that takes`);
+          printWarn("  precedence here. Remove its line from ~/.verity/credentials to use your login.");
+          printWarn('  Until then, "verity login" in this repository re-runs the full GitHub flow');
+          printWarn("  every time.");
+        }
+      }
+    }
+  });
+}
+
+// src/commands/token.ts
+function registerTokenCommand(program2) {
+  const token = program2.command("token").description("Manage service (CI/machine) tokens for this repository");
+  async function requireAuth(globals) {
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) {
+      printError(tokenResult.error);
       process.exit(1);
     }
-    const projectName = parseRemote(remote)?.repo ?? (0, import_node_path4.basename)(process.cwd());
-    printInfo("Authenticating with GitHub\u2026");
-    const result = await registerProject({ projectName, remote, serviceUrl, verbose: globals.verbose });
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    return { bearer: tokenResult.data.token, serviceUrl: urlResult.data };
+  }
+  function explainDenial(error) {
+    if (error.startsWith("STALE_VERIFICATION")) {
+      printInfo('  Your GitHub verification has expired \u2014 run "verity login", then retry.');
+    } else if (error.startsWith("FORBIDDEN")) {
+      printInfo("  You need write access to this repository. If it was added recently,");
+      printInfo('  run "verity login" to refresh your grants.');
+    } else if (error.startsWith("INVALID_REQUEST")) {
+      printInfo("  Tokens are managed per repository \u2014 run this inside a repository with a");
+      printInfo("  git remote (origin), so Verity knows which project the token belongs to.");
+    }
+  }
+  token.command("create").description("Mint a service token for CI (store it in your CI secret store as VERITY_TOKEN)").requiredOption("--name <name>", "Label for the token (e.g. github-actions)").option("--expires <days>", "Optional expiry in days (default: never)").action(async (opts) => {
+    const globals = program2.opts();
+    const { bearer, serviceUrl } = await requireAuth(globals);
+    let expiresInDays;
+    if (opts.expires != null) {
+      expiresInDays = Number(opts.expires);
+      if (!Number.isInteger(expiresInDays) || expiresInDays <= 0 || expiresInDays > 3650) {
+        printError("--expires must be a whole number of days between 1 and 3650");
+        process.exit(1);
+      }
+    }
+    const result = await apiRequest({
+      method: "POST",
+      path: "/auth/tokens",
+      serviceUrl,
+      token: bearer,
+      body: {
+        agent_name: String(opts.name).trim(),
+        token_type: "service",
+        ...expiresInDays != null ? { expires_in_days: expiresInDays } : {}
+      },
+      verbose: globals.verbose,
+      cmd: "token-create"
+    });
     if (!result.ok) {
-      printError(`Login failed: ${result.error}`);
+      printError(`Could not create the service token: ${result.error}`);
+      explainDenial(result.error);
+      process.exit(1);
+    }
+    printInfo(`Service token "${result.data.agent_name}" created. \u2713`);
+    printInfo("");
+    printInfo(`  ${result.data.token}`);
+    printInfo("");
+    printWarn("This token is shown ONCE \u2014 store it now (e.g. as a VERITY_TOKEN CI secret).");
+    if (result.data.expires_at) {
+      printInfo(`  Expires: ${result.data.expires_at.slice(0, 10)}`);
+    }
+    printInfo("  Any current writer of this repository can revoke it: verity token revoke <id>");
+    printInfo(`  Token id: ${result.data.token_id}`);
+  });
+  token.command("list").description("List this repository's tokens (ids and metadata only \u2014 never secrets)").action(async () => {
+    const globals = program2.opts();
+    const { bearer, serviceUrl } = await requireAuth(globals);
+    const result = await apiRequest({
+      method: "GET",
+      path: "/auth/tokens",
+      serviceUrl,
+      token: bearer,
+      verbose: globals.verbose,
+      cmd: "token-list"
+    });
+    if (!result.ok) {
+      printError(`Could not list tokens: ${result.error}`);
+      explainDenial(result.error);
+      process.exit(1);
+    }
+    const tokens = result.data.tokens ?? [];
+    if (tokens.length === 0) {
+      printInfo("No tokens found for this repository.");
+      return;
+    }
+    for (const t of tokens) {
+      const type = t.token_type ?? "user";
+      const expires = t.expires_at ? `expires ${t.expires_at.slice(0, 10)}` : "no expiry";
+      const lastUsed = t.last_used_at ? `last used ${t.last_used_at.slice(0, 10)}` : "never used";
+      printInfo(`${t.id}  [${type}]  ${t.agent_name ?? "unnamed"}  (${expires}, ${lastUsed})`);
+    }
+  });
+  token.command("revoke <id>").description("Revoke a token by id (service tokens: any current writer may revoke)").action(async (id) => {
+    const globals = program2.opts();
+    const { bearer, serviceUrl } = await requireAuth(globals);
+    const result = await apiRequest({
+      method: "DELETE",
+      path: `/auth/tokens/${encodeURIComponent(id)}`,
+      serviceUrl,
+      token: bearer,
+      verbose: globals.verbose,
+      cmd: "token-revoke"
+    });
+    if (!result.ok) {
+      printError(`Could not revoke the token: ${result.error}`);
+      explainDenial(result.error);
+      process.exit(1);
+    }
+    printInfo(`Token ${result.data.token_id} revoked. \u2713`);
+  });
+}
+
+// src/commands/sessions.ts
+function shortDate(iso) {
+  return iso ? iso.slice(0, 10) : "\u2014";
+}
+function daysUntil(iso) {
+  if (!iso) return null;
+  const ms = Date.parse(iso);
+  if (Number.isNaN(ms)) return null;
+  return Math.round((ms - Date.now()) / 864e5);
+}
+async function auth(globals) {
+  const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    printError(tokenResult.error);
+    process.exit(1);
+  }
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!urlResult.ok) {
+    printError(urlResult.error);
+    process.exit(1);
+  }
+  return { token: tokenResult.data.token, serviceUrl: urlResult.data };
+}
+function explain(error) {
+  if (error.startsWith("FORBIDDEN")) {
+    printInfo('  Sessions belong to a logged-in account \u2014 run "verity login" first.');
+  } else if (error.startsWith("INVALID_TOKEN")) {
+    printInfo('  This login has expired or was revoked \u2014 run "verity login" to sign in again.');
+  }
+}
+function registerSessionsCommands(program2) {
+  const sessions = program2.command("sessions").description("List and revoke your Verity logins (one per machine)");
+  sessions.command("list").description("List your active logins \u2014 device, last use, and expiry").option("--json", "Output raw JSON").action(async (opts) => {
+    const globals = program2.opts();
+    const { token, serviceUrl } = await auth(globals);
+    const result = await apiRequest({
+      method: "GET",
+      path: "/auth/sessions",
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "sessions"
+    });
+    if (!result.ok) {
+      printError(result.error);
+      explain(result.error);
+      process.exit(1);
+    }
+    if (opts.json) {
+      printJson(result.data);
+      return;
+    }
+    const list = result.data.sessions;
+    if (list.length === 0) {
+      printInfo('No active logins. (Run "verity login".)');
+      return;
+    }
+    printInfo(`${list.length} active login${list.length === 1 ? "" : "s"}:`);
+    printInfo("");
+    printInfo(`${"SESSION ID".padEnd(38)}${"DEVICE".padEnd(24)}${"CREATED".padEnd(12)}${"LAST USED".padEnd(12)}EXPIRES`);
+    for (const s of list) {
+      const days = daysUntil(s.expires_at);
+      const expiry = s.expires_at ? `${shortDate(s.expires_at)}${days != null ? ` (${days}d)` : ""}` : "never";
+      const device = (s.device ?? "login").slice(0, 22);
+      printInfo(
+        `${s.id.padEnd(38)}${device.padEnd(24)}${shortDate(s.created_at).padEnd(12)}${shortDate(s.last_used_at).padEnd(12)}${expiry}${s.current ? "   \u2190 this machine" : ""}`
+      );
+    }
+    printInfo("");
+    printInfo("Revoke one:  verity sessions revoke <session-id>");
+    printInfo("Sign out everywhere else:  verity logout --others");
+  });
+  sessions.command("revoke <session-id>").description("Revoke one login. Revoking this machine's also clears the local credential").action(async (sessionId) => {
+    const globals = program2.opts();
+    const { token, serviceUrl } = await auth(globals);
+    const result = await apiRequest({
+      method: "DELETE",
+      path: `/auth/sessions/${encodeURIComponent(sessionId)}`,
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "sessions-revoke"
+    });
+    if (!result.ok) {
+      printError(result.error);
+      if (result.http_status === 404) {
+        printInfo('  No session with that id on your account \u2014 check "verity sessions list".');
+      }
+      explain(result.error);
+      process.exit(1);
+    }
+    printInfo(`Session ${sessionId} revoked. \u2713`);
+    if (result.data.was_current) {
+      const cleared = await removeGlobalCredential("");
+      printInfo(cleared ? '  That was this machine \u2014 local credential cleared. Run "verity login" to sign back in.' : '  That was this machine. Run "verity login" to sign back in.');
+    }
+  });
+}
+function registerLogoutCommand(program2) {
+  program2.command("logout").description("Sign out of Verity on this machine (--all / --others for every machine)").option("--all", "Revoke every login on every machine, including this one").option("--others", "Revoke every login EXCEPT this machine (e.g. a lost laptop)").action(async (opts) => {
+    const globals = program2.opts();
+    if (opts.all && opts.others) {
+      printError("Use either --all or --others, not both.");
+      process.exit(1);
+    }
+    const { token, serviceUrl } = await auth(globals);
+    if (opts.all || opts.others) {
+      const result = await apiRequest({
+        method: "DELETE",
+        path: opts.others ? "/auth/sessions?others=true" : "/auth/sessions",
+        serviceUrl,
+        token,
+        verbose: globals.verbose,
+        cmd: "logout"
+      });
+      if (!result.ok) {
+        printError(result.error);
+        explain(result.error);
+        process.exit(1);
+      }
+      const n = result.data.revoked;
+      printInfo(`Revoked ${n} login${n === 1 ? "" : "s"}. \u2713`);
+      if (opts.others) {
+        printInfo("  This machine is still signed in.");
+        return;
+      }
+      const cleared2 = await removeGlobalCredential("");
+      if (cleared2) printInfo("  Local credential cleared.");
+      printInfo('  Run "verity login" to sign back in.');
+      return;
+    }
+    const list = await apiRequest({
+      method: "GET",
+      path: "/auth/sessions",
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "logout"
+    });
+    if (!list.ok) {
+      printError(list.error);
+      explain(list.error);
       process.exit(1);
     }
-    const who = result.data.email ?? (result.data.userId != null ? `user #${result.data.userId}` : "your account");
-    printInfo(`Logged in as ${who}. \u2713`);
-    printInfo("  Runs, history, and cloud memory now sync to Verity for this project.");
-    if (result.data.userId == null) {
-      printWarn("  (Server did not return a user id \u2014 update the CLI if this persists.)");
+    const current = list.data.sessions.find((s) => s.current);
+    if (!current) {
+      printWarn("This machine is not signed in with a Verity login.");
+      const cleared2 = await removeGlobalCredential("");
+      if (cleared2) printInfo("  Cleared the local login credential anyway.");
+      return;
+    }
+    const revoked = await apiRequest({
+      method: "DELETE",
+      path: `/auth/sessions/${current.id}`,
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "logout"
+    });
+    if (!revoked.ok) {
+      printError(revoked.error);
+      explain(revoked.error);
+      process.exit(1);
     }
+    const cleared = await removeGlobalCredential("");
+    printInfo("Signed out on this machine. \u2713");
+    if (cleared) printInfo("  Local credential cleared.");
+    printInfo('  Your other machines are unaffected \u2014 use "verity logout --all" for all of them.');
   });
 }
 
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path6 = require("node:path");
+var import_node_path5 = require("node:path");
 
 // src/lib/json-file.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_node_path4 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
@@ -11593,7 +12121,7 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises3.mkdir)((0, import_node_path5.dirname)(file), { recursive: true });
+  await (0, import_promises3.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
   await (0, import_promises3.writeFile)(file, next);
   return true;
 }
@@ -11766,13 +12294,13 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  await writeJsonFilePreservingStyle((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), settings);
+  await writeJsonFilePreservingStyle((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -12045,7 +12573,7 @@ var import_node_crypto6 = require("node:crypto");
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
 var import_node_fs4 = require("node:fs");
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
@@ -12148,7 +12676,7 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process6.execSync)(
+    const output = (0, import_node_child_process5.execSync)(
       'git log --since="30 minutes ago" --format="%s" -5',
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -12162,8 +12690,8 @@ function getRecentCommitMessages() {
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
 var import_node_fs5 = require("node:fs");
-var import_node_os = require("node:os");
-var import_node_path7 = require("node:path");
+var import_node_os2 = require("node:os");
+var import_node_path6 = require("node:path");
 var SHARED_SENTINELS = /* @__PURE__ */ new Set([
   "",
   "-",
@@ -12217,13 +12745,13 @@ function contextIdentity(input) {
 }
 function verityHome() {
   const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path7.resolve)(override) : (0, import_node_path7.join)((0, import_node_os.homedir)(), ".verity");
+  return override && override.trim() ? (0, import_node_path6.resolve)(override) : (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".verity");
 }
 function dossierDir(identity) {
-  return (0, import_node_path7.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+  return (0, import_node_path6.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
 }
 function treeDir(identity) {
-  return (0, import_node_path7.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+  return (0, import_node_path6.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
 }
 function scopeIdentity(token, sessionId) {
   const t = (token ?? "").trim();
@@ -12239,7 +12767,7 @@ function sessionScopeKey(token, sessionId) {
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
 var import_node_fs6 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_path7 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -12317,7 +12845,7 @@ async function cleanupTaskContextBuffers() {
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path8.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path7.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -12331,7 +12859,7 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path8.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path7.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
@@ -12357,7 +12885,7 @@ async function appendEntry(taskId, entry) {
 // src/lib/memory-retrieval.ts
 var import_promises7 = require("node:fs/promises");
 var import_node_fs7 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_path8 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -12455,14 +12983,14 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path9.join)(memoryDir(), domain);
+    const domainDir = (0, import_node_path8.join)(memoryDir(), domain);
     if (!(0, import_node_fs7.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises7.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises7.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises7.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -12522,7 +13050,7 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 // src/lib/memory-sync.ts
 var import_promises8 = require("node:fs/promises");
 var import_node_fs8 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_path9 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
 
 // src/lib/glob-match.ts
@@ -12593,16 +13121,16 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises8.mkdir)((0, import_node_path10.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises8.mkdir)((0, import_node_path9.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs8.existsSync)((0, import_node_path10.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs8.existsSync)((0, import_node_path9.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs8.existsSync)((0, import_node_path10.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs8.existsSync)((0, import_node_path9.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs8.existsSync)((0, import_node_path10.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs8.existsSync)((0, import_node_path9.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
@@ -12611,14 +13139,14 @@ async function buildManifest() {
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path10.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs8.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path10.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path9.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
@@ -12631,13 +13159,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises8.readFile)((0, import_node_path10.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises8.readFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises8.readFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises8.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -12650,13 +13178,13 @@ async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
   if (!(0, import_node_fs8.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path10.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs8.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises8.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path10.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -12702,7 +13230,7 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path10.join)(memoryDir2(), path);
+    const full = (0, import_node_path9.join)(memoryDir2(), path);
     if (!(0, import_node_fs8.existsSync)(full)) continue;
     let content;
     try {
@@ -12739,15 +13267,15 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs8.existsSync)((0, import_node_path10.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises8.writeFile)((0, import_node_path10.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs8.existsSync)((0, import_node_path9.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
   return count;
 }
 async function applyOneWrite(write, treePaths) {
-  const fullPath = (0, import_node_path10.join)(memoryDir2(), write.path);
+  const fullPath = (0, import_node_path9.join)(memoryDir2(), write.path);
   const notes = [];
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -12769,7 +13297,7 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises8.mkdir)((0, import_node_path10.dirname)(fullPath), { recursive: true });
+  await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(fullPath), { recursive: true });
   await (0, import_promises8.writeFile)(fullPath, content);
   return { written: true, notes };
 }
@@ -12810,7 +13338,7 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path10.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs8.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
@@ -12821,7 +13349,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path10.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -12845,7 +13373,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path10.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path9.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
@@ -12927,7 +13455,7 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path10.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path9.join)(cwd, "CLAUDE.md");
   let existing = "";
   if ((0, import_node_fs8.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
@@ -13061,12 +13589,76 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 // src/lib/dossier-session.ts
 var import_node_fs10 = require("node:fs");
 var import_node_crypto5 = require("node:crypto");
-var import_node_path12 = require("node:path");
+var import_node_path11 = require("node:path");
+
+// src/lib/skip-detection.ts
+function isBareAckPrompt(prompt) {
+  if (typeof prompt !== "string") return false;
+  const trimmed = prompt.trim();
+  if (trimmed.length === 0) return false;
+  if (trimmed.length > 20) return false;
+  const bareAckPattern = /^(\d{1,2}|y|n|yes|no|yep|nope|ok(ay)?|sure|skip|cancel|stop|done|noted|got\s+it|sounds\s+good|thanks|thank\s+you|thx)[.!?]*$/i;
+  return bareAckPattern.test(trimmed);
+}
+function isContinuationPrompt(prompt) {
+  if (typeof prompt !== "string") return false;
+  const trimmed = prompt.trim();
+  if (trimmed.length === 0) return false;
+  if (trimmed.length > 24) return false;
+  const continuation = /^(let['’]?s\s+(go|do\s+it|start|continue)|go|go\s+ahead|go\s+on|proceed|continue|carry\s+on|keep\s+going|do\s+it|make\s+it\s+so|next|start|begin|ship\s+it|yes\s+please|please\s+continue|perfect|great|nice|excellent|agreed)[.!]*$/i;
+  return continuation.test(trimmed) || isBareAckPrompt(trimmed);
+}
+function resolveGoalPrompt(prompts) {
+  if (prompts.length === 0) return null;
+  const latest = prompts[prompts.length - 1];
+  if (!isContinuationPrompt(latest.prompt)) return { entry: latest, turnsBack: 0 };
+  for (let i = prompts.length - 2; i >= 0; i--) {
+    if (!isContinuationPrompt(prompts[i].prompt)) {
+      return { entry: prompts[i], turnsBack: prompts.length - 1 - i };
+    }
+  }
+  return { entry: latest, turnsBack: 0 };
+}
+function isReflectionQuestion(response) {
+  if (!response || typeof response !== "string") return false;
+  const markers = [
+    /reflection\s+for\s+future\s+agents/i,
+    /what(?:'s|\s+is)\s+one\s+thing\s+you\s+learned/i,
+    /say\s+['"]?skip['"]?\s+to\s+skip/i,
+    /quick\s+reflection\s+question/i,
+    // Post-flip (VRT-21): the agent drafts the reflection itself and, when
+    // interactive, asks the user to confirm/correct before recording. That
+    // turn authors no code either, so it's still a reflection turn.
+    /reflection\s+draft/i,
+    /confirm,?\s+correct,?\s+or\s+add/i
+  ];
+  return markers.some((m) => m.test(response));
+}
+function isMetaTaskLabel(label2) {
+  if (label2 === null || label2 === void 0) return false;
+  if (typeof label2 !== "string") return false;
+  const trimmed = label2.trim();
+  if (trimmed.length === 0) return true;
+  const metaPatterns = [
+    /^verity\s+[\w-]+\s+response$/i,
+    // "Verity reflect response"
+    /^simple user response$/i,
+    /^verity\s+command$/i,
+    // "Verity command"
+    /^user\s+(question|reply|response|ack)$/i
+  ];
+  return metaPatterns.some((p) => p.test(trimmed));
+}
+function shouldSkipForBareAck(input) {
+  if (!isBareAckPrompt(input.prompt)) return false;
+  if (input.turnAuthoredCode) return false;
+  return input.canSeeTurnAuthorship;
+}
 
 // src/lib/dossier.ts
 var import_node_fs9 = require("node:fs");
 var import_node_crypto4 = require("node:crypto");
-var import_node_path11 = require("node:path");
+var import_node_path10 = require("node:path");
 var MAX_LINE_BYTES = 4096;
 var MAX_GOAL_CHARS = 2e3;
 var GOAL_KEEP = 8;
@@ -13109,9 +13701,9 @@ function openDossier(identity) {
     return {
       dir,
       identity,
-      eventsPath: (0, import_node_path11.join)(dir, "events.jsonl"),
-      foldPath: (0, import_node_path11.join)(dir, "fold.json"),
-      rotatedDir: (0, import_node_path11.join)(dir, "rotated")
+      eventsPath: (0, import_node_path10.join)(dir, "events.jsonl"),
+      foldPath: (0, import_node_path10.join)(dir, "fold.json"),
+      rotatedDir: (0, import_node_path10.join)(dir, "rotated")
     };
   } catch {
     return null;
@@ -13184,11 +13776,11 @@ function rotateIfNeeded2(d) {
     if (!(0, import_node_fs9.existsSync)(d.eventsPath)) return;
     if ((0, import_node_fs9.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
     (0, import_node_fs9.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
-    (0, import_node_fs9.renameSync)(d.eventsPath, (0, import_node_path11.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
+    (0, import_node_fs9.renameSync)(d.eventsPath, (0, import_node_path10.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
     const kept = (0, import_node_fs9.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
     for (const stale of kept.slice(0, Math.max(0, kept.length - ROTATE_KEEP))) {
       try {
-        (0, import_node_fs9.renameSync)((0, import_node_path11.join)(d.rotatedDir, stale), (0, import_node_path11.join)(d.rotatedDir, `${stale}.pruned`));
+        (0, import_node_fs9.renameSync)((0, import_node_path10.join)(d.rotatedDir, stale), (0, import_node_path10.join)(d.rotatedDir, `${stale}.pruned`));
       } catch {
       }
     }
@@ -13250,7 +13842,7 @@ function foldDossier(d, opts = {}) {
       state.meta.rotations = files.length;
       for (const f of files) {
         try {
-          ingest((0, import_node_fs9.readFileSync)((0, import_node_path11.join)(d.rotatedDir, f), "utf8"));
+          ingest((0, import_node_fs9.readFileSync)((0, import_node_path10.join)(d.rotatedDir, f), "utf8"));
         } catch {
           state.meta.dropped_lines++;
         }
@@ -13311,6 +13903,13 @@ function reduce(state, events, now) {
         });
         break;
       }
+      case "goal_delivered": {
+        const g = state.goal.find((x) => x.status === "active");
+        if (!g) break;
+        if (g.delivered) break;
+        g.delivered = { at: ev.at, seq: ev.seq, summary: ev.summary };
+        break;
+      }
       case "authored": {
         authoredEvents++;
         const e = byPath.get(ev.path) ?? {
@@ -13425,6 +14024,18 @@ function reduce(state, events, now) {
       }
       case "verdict": {
         state.meta.last_verdict_seq = ev.seq;
+        state.meta.channel = {
+          emittedLast: ev.emitted === true,
+          // Reset by ANY movement, so the counter measures a standstill rather
+          // than session length.
+          consecutiveIdle: ev.idle === false ? 0 : (state.meta.channel?.consecutiveIdle ?? 0) + 1
+        };
+        state.meta.last_adjudication = ev.intent_verdict ? { verdict: ev.intent_verdict, score: ev.intent_score ?? null, at: ev.at, decision: ev.decision } : void 0;
+        if (ev.intent_sig) {
+          state.meta.intent_repeat = state.meta.intent_repeat && state.meta.intent_repeat.sig === ev.intent_sig ? { sig: ev.intent_sig, consecutive: state.meta.intent_repeat.consecutive + 1 } : { sig: ev.intent_sig, consecutive: 1 };
+        } else {
+          state.meta.intent_repeat = void 0;
+        }
         state.meta.watermark = {
           sha: ev.head_sha,
           reviewed_hash: ev.watermark_sha,
@@ -13510,7 +14121,12 @@ function compactState(s) {
   const ms = (iso) => Date.parse(iso) || 0;
   return {
     v: 1,
-    g: s.goal.map((g) => [g.seq, ms(g.at), g.hash, g.superseded_by, g.text ?? 0, g.text_len ?? 0, g.source ?? 0, g.status ?? 0, g.repeats ?? 0, g.truncated ? 1 : 0, g.collapsed ? 1 : 0]),
+    // ⚠ APPEND-ONLY POSITIONALLY. Indices 11-13 carry `delivered`; a cache row
+    // written before it existed has length 11 and expands with `delivered`
+    // absent, which is the correct reading of "nothing had been delivered yet".
+    // Inserting rather than appending would silently re-interpret every existing
+    // cached row.
+    g: s.goal.map((g) => [g.seq, ms(g.at), g.hash, g.superseded_by, g.text ?? 0, g.text_len ?? 0, g.source ?? 0, g.status ?? 0, g.repeats ?? 0, g.truncated ? 1 : 0, g.collapsed ? 1 : 0, g.delivered ? ms(g.delivered.at) : 0, g.delivered?.seq ?? 0, g.delivered?.summary ?? 0]),
     a: s.authored?.map((a) => [a.path, a.origin, a.edits, a.hunks, a.adds, a.dels, a.hash_now, a.hash_at_last_verdict, a.first_seq, a.last_seq]) ?? null,
     n: s.not_mine?.map((n) => [n.path, n.reason, ms(n.at), n.head_sha]) ?? null,
     t: s.statements.map((x) => [x.anchor_key, x.file, x.line, x.pattern_id, x.title_hash, x.register, x.line_sha, x.said_at_seq, ms(x.said_at), x.outcome, x.outcome_at ? ms(x.outcome_at) : 0, x.repeats, x.carried ? 1 : 0]),
@@ -13556,7 +14172,14 @@ function expandState(raw) {
         ...x[7] ? { status: x[7] } : {},
         ...x[8] ? { repeats: x[8] } : {},
         ...x[9] ? { truncated: true } : {},
-        ...x[10] ? { collapsed: true } : {}
+        ...x[10] ? { collapsed: true } : {},
+        ...x[11] ? {
+          delivered: {
+            at: iso(x[11]),
+            seq: x[12] ?? 0,
+            summary: x[13] || ""
+          }
+        } : {}
       })),
       authored: decodedAuthored,
       // The cache stores the BOUNDED list, so this is the bounded list too. That
@@ -13770,9 +14393,18 @@ function projectMemory(state, opts) {
       seq: active.seq,
       superseded,
       truncated: active.truncated === true,
-      collapsed: state.meta.collapsed.goal ?? 0
+      collapsed: state.meta.collapsed.goal ?? 0,
+      ...active.delivered && { delivered: active.delivered }
     };
   }
+  if (opts.capture) {
+    const missed = Math.max(0, opts.capture.seen - opts.capture.captured);
+    p.capture = { seen: opts.capture.seen, captured: opts.capture.captured, missed };
+  }
+  if (state.meta.last_adjudication) {
+    const a = state.meta.last_adjudication;
+    p.last_adjudication = { verdict: a.verdict, score: a.score, at: a.at };
+  }
   const ageOf = (seq, carried) => carried ? "carried" : seq > lastVerdictSeq ? "this_turn" : "this_session";
   if (opts.spoken.length > 0) {
     p.statements = opts.spoken.map((s) => ({
@@ -14015,7 +14647,8 @@ function recall(d, input) {
     continuity,
     spoken: reanchored.spoken,
     refused: reanchored.dropped.length,
-    lastVerdictSeq
+    lastVerdictSeq,
+    ...input.capture && { capture: input.capture }
   });
   return {
     state: effective,
@@ -14046,16 +14679,16 @@ function foreignAuthoredPaths(identity, opts = {}) {
     for (const entry of (0, import_node_fs10.readdirSync)(dir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       if (entry.name === identity.sessionKey) continue;
-      const log = (0, import_node_path12.join)(dir, entry.name, "events.jsonl");
+      const log = (0, import_node_path11.join)(dir, entry.name, "events.jsonl");
       try {
         if (!(0, import_node_fs10.existsSync)(log)) continue;
         if (now - (0, import_node_fs10.statSync)(log).mtimeMs > windowMs) continue;
         const sib = {
-          dir: (0, import_node_path12.join)(dir, entry.name),
+          dir: (0, import_node_path11.join)(dir, entry.name),
           identity,
           eventsPath: log,
-          foldPath: (0, import_node_path12.join)(dir, entry.name, "fold.json"),
-          rotatedDir: (0, import_node_path12.join)(dir, entry.name, "rotated")
+          foldPath: (0, import_node_path11.join)(dir, entry.name, "fold.json"),
+          rotatedDir: (0, import_node_path11.join)(dir, entry.name, "rotated")
         };
         const state = readFoldCache(sib) ?? foldDossier(sib);
         sessions++;
@@ -14083,22 +14716,22 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
   let removed = 0;
   try {
     const mine = dossierDir(identity);
-    const userDir = (0, import_node_path12.dirname)((0, import_node_path12.dirname)(mine));
+    const userDir = (0, import_node_path11.dirname)((0, import_node_path11.dirname)(mine));
     if (!(0, import_node_fs10.existsSync)(userDir)) return 0;
     const cutoff = Date.now() - maxAgeMs;
     for (const tree of (0, import_node_fs10.readdirSync)(userDir, { withFileTypes: true })) {
       if (!tree.isDirectory()) continue;
-      const treePath = (0, import_node_path12.join)(userDir, tree.name);
+      const treePath = (0, import_node_path11.join)(userDir, tree.name);
       let live = 0;
       for (const entry of (0, import_node_fs10.readdirSync)(treePath, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const dir = (0, import_node_path12.join)(treePath, entry.name);
+        const dir = (0, import_node_path11.join)(treePath, entry.name);
         if (dir === mine) {
           live++;
           continue;
         }
         try {
-          const log = (0, import_node_path12.join)(dir, "events.jsonl");
+          const log = (0, import_node_path11.join)(dir, "events.jsonl");
           const at = (0, import_node_fs10.existsSync)(log) ? (0, import_node_fs10.statSync)(log).mtimeMs : (0, import_node_fs10.statSync)(dir).mtimeMs;
           if (at < cutoff) {
             (0, import_node_fs10.rmSync)(dir, { recursive: true, force: true });
@@ -14126,7 +14759,19 @@ function sessionDossier(token, sessionId) {
   const d = openDossier(identity);
   return d ? { d, identity } : null;
 }
+function hasActiveGoal(d) {
+  try {
+    if (!(0, import_node_fs10.existsSync)(d.eventsPath)) return false;
+    return (0, import_node_fs10.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
+  } catch {
+    return false;
+  }
+}
 function recordGoal(d, prompt, source = "prompt") {
+  if (source === "prompt" && isContinuationPrompt(prompt) && hasActiveGoal(d)) {
+    appendEvent(d, { k: "goal_continue", text: prompt.slice(0, 64) });
+    return;
+  }
   const text = prompt.slice(0, MAX_GOAL_CHARS);
   appendEvent(d, {
     k: "goal",
@@ -14141,7 +14786,7 @@ function recordTurn(d, t) {
   for (const a of t.authored) {
     const origin = a.owner === "subagent" ? "subagent" : "edit_tool";
     const prior = t.known?.authored?.get(a.p);
-    const hash = fileHash((0, import_node_path12.join)(root, a.p));
+    const hash = fileHash((0, import_node_path11.join)(root, a.p));
     const hunks = Math.max(0, a.h - (prior?.hunks ?? 0));
     const adds = Math.max(0, a.a - (prior?.adds ?? 0));
     const dels = Math.max(0, a.d - (prior?.dels ?? 0));
@@ -14174,7 +14819,7 @@ function recordTurn(d, t) {
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
   for (const u of t.unobserved) {
-    const hash = fileHash((0, import_node_path12.join)(root, u.p));
+    const hash = fileHash((0, import_node_path11.join)(root, u.p));
     if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
     appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
   }
@@ -14198,12 +14843,16 @@ function toStatus(n) {
 }
 function recordVerdict(d, v) {
   const root = repoRoot();
+  if (v.intent?.verdict === "aligned") {
+    const summary = (v.intent.implemented ?? "").trim().slice(0, 400);
+    if (summary) appendEvent(d, { k: "goal_delivered", summary });
+  }
   const lines = /* @__PURE__ */ new Map();
   for (const f of v.findings) {
     if (!f.file || typeof f.line !== "number" || !f.pattern_id) continue;
     if (!lines.has(f.file)) {
       try {
-        const abs = (0, import_node_path12.join)(root, f.file);
+        const abs = (0, import_node_path11.join)(root, f.file);
         lines.set(f.file, (0, import_node_fs10.existsSync)(abs) ? (0, import_node_fs10.readFileSync)(abs, "utf8").split("\n") : null);
       } catch {
         lines.set(f.file, null);
@@ -14225,15 +14874,32 @@ function recordVerdict(d, v) {
       line_sha: at !== void 0 ? lineSha(at) : null
     });
   }
+  const foldedNow = foldDossier(d);
+  const sig = intentSignature(v.intent, {
+    goalSeq: foldedNow.goal.find((g) => g.status === "active")?.seq ?? 0,
+    idle: v.idle !== false
+  });
   appendEvent(d, {
     k: "verdict",
     run_id: v.runId,
     head_sha: getCurrentCommit(),
     watermark_sha: v.watermarkSha,
     branch: v.branch,
-    decision: v.decision
+    decision: v.decision,
+    ...sig && { intent_sig: sig },
+    emitted: v.emitted === true,
+    idle: v.idle !== false,
+    ...v.intent?.verdict && { intent_verdict: v.intent.verdict },
+    ...typeof v.intent?.score === "number" && { intent_score: v.intent.score }
   });
 }
+function intentSignature(intent, ctx) {
+  if (!intent?.verdict) return null;
+  if (intent.verdict !== "misaligned" && intent.verdict !== "partial") return null;
+  const goal = ctx ? `g${ctx.goalSeq}` : "g?";
+  const moved = ctx?.idle === false ? "active" : "idle";
+  return `${intent.verdict}:${goal}:${moved}`;
+}
 function toRegister(severity) {
   switch (severity) {
     case "critical":
@@ -14269,7 +14935,9 @@ function recallMemory(d, identity, opts) {
     const state = foldDossier(d);
     const watermark = state.meta.watermark?.sha ?? null;
     const watermarkPaths = (state.authored ?? []).map((a) => a.path);
+    const captureCmp = typeof opts.userMessagesSeen === "number" ? { seen: opts.userMessagesSeen, captured: state.meta.goal_chain } : void 0;
     const r = recall(d, {
+      ...captureCmp && { capture: captureCmp },
       identity,
       currentSessionKey: opts.currentSessionKey,
       branchNow: getCurrentBranch(),
@@ -14278,7 +14946,7 @@ function recallMemory(d, identity, opts) {
       budgetBytes: opts.budgetBytes,
       readFileLines: (file) => {
         try {
-          const abs = (0, import_node_path12.join)(root, file);
+          const abs = (0, import_node_path11.join)(root, file);
           return (0, import_node_fs10.existsSync)(abs) ? (0, import_node_fs10.readFileSync)(abs, "utf8").split("\n") : null;
         } catch {
           return null;
@@ -14418,21 +15086,21 @@ async function fireClassify(prompt, sessionId, globals) {
 
 // src/commands/lifecycle.ts
 var import_node_fs14 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_path15 = require("node:path");
 
 // src/lib/baseline.ts
 var import_node_fs13 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_path14 = require("node:path");
 var import_node_crypto7 = require("node:crypto");
 
 // src/lib/snapshot.ts
 var import_node_fs12 = require("node:fs");
-var import_node_path14 = require("node:path");
-var import_node_child_process7 = require("node:child_process");
+var import_node_path13 = require("node:path");
+var import_node_child_process6 = require("node:child_process");
 
 // src/lib/files.ts
 var import_node_fs11 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_path12 = require("node:path");
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -14500,7 +15168,7 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path13.extname)(filepath).slice(1);
+  const ext = (0, import_node_path12.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
@@ -14526,6 +15194,8 @@ function collectCodeDelta(files, opts) {
   let totalSize = 0;
   let truncationReason = null;
   const droppedPaths = [];
+  const excluded = [];
+  const exclude = (path, reason) => excluded.push({ path, reason, stage: "collectCodeDelta", kind: "capacity" });
   for (const filepath of sorted) {
     if (result.length >= maxFiles) {
       truncationReason ??= "max_files";
@@ -14533,14 +15203,21 @@ function collectCodeDelta(files, opts) {
       continue;
     }
     const resolved = resolveFile(filepath);
-    if (!resolved) continue;
+    if (!resolved) {
+      exclude(filepath, "path-not-resolvable");
+      continue;
+    }
     let size;
     try {
       size = (0, import_node_fs11.statSync)(resolved).size;
     } catch {
+      exclude(filepath, "not-stattable");
+      continue;
+    }
+    if (size > maxFileBytes) {
+      exclude(filepath, `over-file-size-limit-${maxFileBytes}b`);
       continue;
     }
-    if (size > maxFileBytes) continue;
     if (totalSize + size > maxTotalBytes) {
       truncationReason ??= "max_total_bytes";
       const idx = sorted.indexOf(filepath);
@@ -14551,6 +15228,7 @@ function collectCodeDelta(files, opts) {
     try {
       content = (0, import_node_fs11.readFileSync)(resolved, "utf-8");
     } catch {
+      exclude(filepath, "not-readable");
       continue;
     }
     totalSize += size;
@@ -14564,10 +15242,14 @@ function collectCodeDelta(files, opts) {
     (sum, f) => sum + f.content.split("\n").length,
     0
   );
+  for (const path of droppedPaths) {
+    exclude(path, truncationReason === "max_files" ? "max-files-cap" : "max-total-bytes-cap");
+  }
   return {
     files: result,
     total_lines: totalLines,
     total_files: result.length,
+    excluded,
     ...truncationReason && {
       truncated: {
         reason: truncationReason,
@@ -14588,7 +15270,7 @@ function generateSnapshotDiffs(files) {
   }
   const diffs = [];
   for (const file of files) {
-    const snapshotPath = (0, import_node_path14.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path13.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
     if ((0, import_node_fs12.existsSync)(snapshotPath)) {
       const oldContent = (0, import_node_fs12.readFileSync)(snapshotPath, "utf-8");
@@ -14615,21 +15297,21 @@ ${addedLines}`,
 function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const snapshotPath = (0, import_node_path14.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path13.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs12.mkdirSync)((0, import_node_path14.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs12.mkdirSync)((0, import_node_path13.dirname)(snapshotPath), { recursive: true });
     (0, import_node_fs12.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path14.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path14.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path13.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path13.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
     (0, import_node_fs12.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
     (0, import_node_fs12.writeFileSync)(tmpOld, oldContent);
     (0, import_node_fs12.writeFileSync)(tmpNew, newContent);
-    const result = (0, import_node_child_process7.execSync)(
+    const result = (0, import_node_child_process6.execSync)(
       `git diff --no-index --unified=10 -- "${tmpOld}" "${tmpNew}"`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     );
@@ -14657,7 +15339,7 @@ function cleanStaleSnapshots(dir, keepSet) {
     const entries = (0, import_node_fs12.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
-      const fullPath = (0, import_node_path14.join)(dir, entry.name);
+      const fullPath = (0, import_node_path13.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
@@ -14686,13 +15368,13 @@ function sessionKey(sessionId) {
   return (0, import_node_crypto7.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path15.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path14.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path15.join)(dir, "manifest.json");
+  return (0, import_node_path14.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path15.join)(dir, "files", repoRelPath);
+  return (0, import_node_path14.join)(dir, "files", repoRelPath);
 }
 var CARRY_FILE = `${BASELINE_DIR}/.carry`;
 var CARRY_WINDOW_MS = 12e4;
@@ -14754,7 +15436,7 @@ function captureBaseline(opts = {}) {
     (0, import_node_fs13.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path15.join)(dir, "files");
+  const filesDir = (0, import_node_path14.join)(dir, "files");
   const mirrored = [];
   try {
     (0, import_node_fs13.mkdirSync)(filesDir, { recursive: true });
@@ -14764,7 +15446,7 @@ function captureBaseline(opts = {}) {
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs13.mkdirSync)((0, import_node_path15.dirname)(dest), { recursive: true });
+        (0, import_node_fs13.mkdirSync)((0, import_node_path14.dirname)(dest), { recursive: true });
         (0, import_node_fs13.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
@@ -14892,7 +15574,7 @@ function pruneOldBaselines() {
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path15.join)(root, name);
+    const dir = (0, import_node_path14.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
@@ -15078,7 +15760,7 @@ function buildCompactionContext(session) {
     commitsSince: commitsSincePaths(watermark, (state.authored ?? []).map((a) => a.path)),
     readFileLines: (file) => {
       try {
-        const abs = (0, import_node_path16.join)(root, file);
+        const abs = (0, import_node_path15.join)(root, file);
         return (0, import_node_fs14.existsSync)(abs) ? (0, import_node_fs14.readFileSync)(abs, "utf8").split("\n") : null;
       } catch {
         return null;
@@ -15414,6 +16096,7 @@ function registerStatusCommand(program2) {
     }
     const token = tokenResult.data.token;
     const serviceUrl = urlResult.data;
+    const who = await whoami(token, serviceUrl, globals.verbose);
     const memResult = await apiRequest({
       method: "GET",
       path: "/memory",
@@ -15421,14 +16104,21 @@ function registerStatusCommand(program2) {
       token,
       verbose: globals.verbose
     });
-    if (!memResult.ok) {
+    const denial = memResult.ok ? null : authDenialRemedy(memResult.error);
+    if (!memResult.ok && !denial) {
       printError(memResult.error);
       process.exit(1);
     }
-    const mem = memResult.data;
+    const mem = memResult.ok ? memResult.data : null;
     if (opts.json) {
-      const output = { memory: mem };
-      if (opts.history) {
+      const output = {
+        auth: who.ok ? who.data : { error: who.error },
+        memory: mem
+      };
+      if (denial && !memResult.ok) {
+        output.error = { code: denial.code, message: memResult.error, remedy: denial.remedy };
+      }
+      if (opts.history && !denial) {
         const runsResult = await apiRequest({
           method: "GET",
           path: `/runs?limit=${opts.limit}`,
@@ -15443,23 +16133,30 @@ function registerStatusCommand(program2) {
       printJson(output);
       return;
     }
-    if (mem.configured === false) {
+    if (mem?.configured === false) {
       printInfo("Verity is not configured for this project. Run /verity-setup.");
       return;
     }
     printInfo("=== Verity Status ===");
-    if (tokenResult.data.userId != null) {
-      printInfo(`Account:     Logged in as ${tokenResult.data.email ?? `user #${tokenResult.data.userId}`} \u2713`);
-    } else {
-      const who = await whoami(token, serviceUrl, globals.verbose);
-      if (who.ok && who.data.logged_in) {
-        printInfo(`Account:     Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713`);
-      } else if (who.ok && who.data.anonymous) {
-        printInfo('Account:     Anonymous \u2014 runs not saved, no cloud memory. Run "verity login".');
-      }
-    }
-    if (mem.project_name) printInfo(`Project:     ${mem.project_name}`);
-    if (mem.standard) {
+    if (who.ok && who.data.logged_in) {
+      printInfo(`Account:     Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713`);
+    } else if (who.ok && who.data.anonymous) {
+      printInfo('Account:     Anonymous \u2014 runs not saved, no cloud memory. Run "verity login".');
+    } else if (tokenResult.data.userId != null) {
+      printInfo(`Account:     Logged in as ${tokenResult.data.email ?? `user #${tokenResult.data.userId}`} (cached \u2014 could not reach the Verity service) \u2713`);
+    } else if (!who.ok) {
+      printInfo(`Account:     Unknown \u2014 could not reach the Verity service (${who.error})`);
+    }
+    if (who.ok) {
+      const nudge = reverifyNudge(who.data);
+      if (nudge) printWarn(`             ${nudge}`);
+    }
+    if (denial) {
+      printWarn(`Access:      ${denial.remedy}`);
+      printInfo("             Project status, history, and cloud memory stay unavailable until then.");
+    }
+    if (mem?.project_name) printInfo(`Project:     ${mem.project_name}`);
+    if (mem?.standard) {
       const s = mem.standard;
       printInfo(`Standard:    v${s.version} (${s.quality_dimensions} quality, ${s.security_patterns} security, ${s.custom_patterns} custom)`);
       printInfo(`Languages:   ${s.languages.join(", ")}`);
@@ -15470,6 +16167,7 @@ function registerStatusCommand(program2) {
     if (hookStatus.guardOn.includes("commit")) moments.push("pre-commit");
     if (hookStatus.guardOn.includes("push")) moments.push("pre-push/PR");
     printInfo(`Moments:     ${moments.length > 0 ? moments.join(", ") : "none (run /verity-setup)"}`);
+    if (!mem) return;
     if (mem.recent_runs) {
       const r = mem.recent_runs;
       printInfo("");
@@ -15621,7 +16319,7 @@ async function sendGeneralFeedback(message, opts, globals) {
 
 // src/commands/analyze.ts
 var import_node_fs24 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_path20 = require("node:path");
 
 // src/lib/debounce.ts
 var import_node_fs15 = require("node:fs");
@@ -15758,7 +16456,7 @@ function writeIteration(iteration, commit, _contentHash) {
 }
 
 // src/lib/static-analysis.ts
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process7 = require("node:child_process");
 var import_node_fs16 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
@@ -15771,7 +16469,7 @@ var SEVERITY_ORDER = {
 };
 function isCodacyAvailable() {
   try {
-    (0, import_node_child_process8.execSync)("which codacy-analysis", { stdio: "pipe" });
+    (0, import_node_child_process7.execSync)("which codacy-analysis", { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -15795,7 +16493,7 @@ function runCodacyAnalysis(files) {
   const fileArgs = existingFiles.join(" ");
   let output;
   try {
-    output = (0, import_node_child_process8.execSync)(
+    output = (0, import_node_child_process7.execSync)(
       `codacy-analysis analyze --install-dependencies --files ${fileArgs} --output-format json --log-level error --parallel-tools 3`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], maxBuffer: 10 * 1024 * 1024 }
     );
@@ -15849,7 +16547,7 @@ function runCodacyAnalysis(files) {
 
 // src/lib/specs.ts
 var import_node_fs17 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_path16 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -15911,7 +16609,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   try {
     const entries = (0, import_node_fs17.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path17.join)(dir, entry.name);
+      const fullPath = (0, import_node_path16.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -15923,7 +16621,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const homePlansDir = (0, import_node_path17.join)(process.env.HOME ?? "", ".claude", "plans");
+  const homePlansDir = (0, import_node_path16.join)(process.env.HOME ?? "", ".claude", "plans");
   const localPlansDir = ".claude/plans";
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -15933,7 +16631,7 @@ function discoverPlans() {
       for (const f of (0, import_node_fs17.readdirSync)(plansDir)) {
         if (!f.endsWith(".md") || seen.has(f)) continue;
         seen.add(f);
-        const fullPath = (0, import_node_path17.join)(plansDir, f);
+        const fullPath = (0, import_node_path16.join)(plansDir, f);
         try {
           const stat3 = (0, import_node_fs17.statSync)(fullPath);
           candidates.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
@@ -15957,7 +16655,7 @@ function discoverPlans() {
 }
 
 // src/lib/task-context.ts
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var CLOSING_RE = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?)\b[\s:]*#(\d+)/i;
 var BRANCH_RE = /(?:^|[/_-])(?:issue|gh|fix)[-_/]?(\d+)\b/i;
 function parseLinkedIssue(sources) {
@@ -15973,7 +16671,7 @@ function parseLinkedIssue(sources) {
 }
 function safeExec(cmd, timeout) {
   try {
-    return (0, import_node_child_process9.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
+    return (0, import_node_child_process8.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
   } catch {
     return "";
   }
@@ -16003,7 +16701,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.28.1-experimental.a57c8d9" : "dev";
+    return true ? "0.28.1-experimental.a72d2d9" : "dev";
   } catch {
     return "dev";
   }
@@ -16207,7 +16905,7 @@ function truthy(v) {
 
 // src/lib/fold.ts
 var import_node_fs20 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_path17 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -16228,6 +16926,16 @@ var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "subagent"
 ]);
 var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "NotebookEdit", "MultiEdit"]);
+var DISPATCH_TOOLS = /* @__PURE__ */ new Set(["Task", "Workflow"]);
+function hasUserText(record) {
+  const message = record.message;
+  const content = message?.content ?? record.content;
+  if (typeof content === "string") return content.trim().length > 0;
+  if (!Array.isArray(content)) return false;
+  return content.some(
+    (b) => b?.type === "text" && typeof b.text === "string" && b.text.trim().length > 0
+  );
+}
 var COMMAND_CLASSES = [
   [/\b(npm|yarn|pnpm|bun)\s+(run\s+)?test\b|\bvitest\b|\bjest\b|\bpytest\b|\bgo test\b/, "test"],
   [/\b(npm|yarn|pnpm|bun)\s+(run\s+)?build\b|\btsc\b|\bwebpack\b|\bcargo build\b/, "build"],
@@ -16354,6 +17062,8 @@ function fold(transcriptPath, opts = {}) {
       totalRecords: 0,
       malformed: 0,
       subagentFiles: 0,
+      dispatched: 0,
+      userMessages: 0,
       subagentSkipped: 0,
       compactions: 0,
       complete: false
@@ -16380,7 +17090,8 @@ function fold(transcriptPath, opts = {}) {
       if (type === "system" && record.subtype === "compact_boundary") {
         result.coverage.compactions++;
       }
-      collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, opts.repoRoot);
+      if (type === "user" && hasUserText(record)) result.coverage.userMessages++;
+      collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, opts.repoRoot, result.coverage);
     }
   };
   try {
@@ -16391,7 +17102,7 @@ function fold(transcriptPath, opts = {}) {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path18.join)((0, import_node_path18.dirname)(transcriptPath), "subagents");
+    const sidecarDir = (0, import_node_path17.join)((0, import_node_path17.dirname)(transcriptPath), "subagents");
     if ((0, import_node_fs20.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
@@ -16399,7 +17110,7 @@ function fold(transcriptPath, opts = {}) {
       const walk = (d, depth) => {
         if (depth > 4) return;
         for (const e of (0, import_node_fs20.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path18.join)(d, e.name);
+          const p = (0, import_node_path17.join)(d, e.name);
           if (e.isDirectory()) {
             walk(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
@@ -16452,7 +17163,7 @@ function classifyUnobserved(path) {
   if (/\.(png|jpg|jpeg|gif|pdf|zip|woff2?|ico|mp4)$/i.test(path)) return "binary";
   return "no_edit_record";
 }
-function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, repoRoot2) {
+function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, repoRoot2, tally) {
   const message = record.message;
   const content = message?.content ?? record.content;
   const blocks = Array.isArray(content) ? content : content && typeof content === "object" ? [content] : [];
@@ -16474,6 +17185,9 @@ function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse
           byPath.set(path, entry);
         }
       }
+      if (DISPATCH_TOOLS.has(name) && tally) {
+        tally.dispatched += 1;
+      }
       if (name === "Bash") {
         const cmd = typeof input.command === "string" ? input.command : "";
         if (cmd) {
@@ -16532,6 +17246,86 @@ function checkConservation(changedFiles, result, repoRoot2) {
   };
 }
 
+// src/lib/verdict.ts
+function reconcileCoverage(changed, coverage) {
+  const changedSet = new Set(changed);
+  const reviewed = coverage.reviewed.filter((p) => changedSet.has(p));
+  const claimed = /* @__PURE__ */ new Set([...reviewed, ...coverage.notReviewed.map((n) => n.path)]);
+  const unaccounted = [...changedSet].filter((p) => !claimed.has(p)).sort();
+  const notReviewed = [
+    ...coverage.notReviewed.filter((n) => changedSet.has(n.path)),
+    ...unaccounted.map((path) => ({
+      path,
+      reason: "unaccounted",
+      // Named so the eventual bug report writes itself: some stage removed this
+      // path and did not say so.
+      stage: "unknown-stage",
+      // An undeclared drop is CAPACITY by default. A stage that cannot be
+      // bothered to say why it dropped a file does not get the benefit of the
+      // doubt — that default is what makes forgetting expensive.
+      kind: "capacity"
+    }))
+  ];
+  return {
+    coverage: { reviewed: [...new Set(reviewed)].sort(), notReviewed },
+    unaccounted,
+    balances: unaccounted.length === 0
+  };
+}
+function resolveVerdict(proposed, coverage) {
+  if (proposed === "FAIL") return "FAIL";
+  const blocking = coverage.notReviewed.filter((n) => (n.kind ?? "capacity") !== "policy");
+  if (blocking.length === 0) return proposed;
+  return "WARN";
+}
+function describeCoverage(coverage, maxPaths = 5) {
+  const relevant = coverage.notReviewed.filter((n) => (n.kind ?? "capacity") !== "policy");
+  if (relevant.length === 0) return null;
+  const byReason = /* @__PURE__ */ new Map();
+  for (const n of relevant) {
+    const key = `${n.reason}`;
+    const list = byReason.get(key) ?? [];
+    list.push(n.path);
+    byReason.set(key, list);
+  }
+  const lines = [];
+  for (const [reason, paths] of [...byReason.entries()].sort()) {
+    const shown = paths.slice(0, maxPaths).join(", ");
+    const more = paths.length > maxPaths ? ` (+${paths.length - maxPaths} more)` : "";
+    lines.push(`  ${paths.length} not reviewed \u2014 ${reason}: ${shown}${more}`);
+  }
+  return `NOT A CLEAN REVIEW. ${relevant.length} changed file(s) never reached the reviewer, so this verdict does not cover them:
+${lines.join("\n")}
+Treat those files as UNCHECKED, not as approved.`;
+}
+function openBlockingElsewhere(statements, reviewedNow, lineShaAt) {
+  const reviewed = new Set(reviewedNow);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const s of statements) {
+    if (s.outcome !== "open") continue;
+    if (s.register !== "BLOCK") continue;
+    if (s.carried) continue;
+    if (reviewed.has(s.file)) continue;
+    if (!s.line_sha) continue;
+    if (lineShaAt(s.file, s.line) !== s.line_sha) continue;
+    const key = `${s.file}::${s.pattern_id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ file: s.file, line: s.line, pattern_id: s.pattern_id });
+  }
+  return out;
+}
+function describeOpenElsewhere(open) {
+  if (open.length === 0) return null;
+  const lines = open.slice(0, 5).map((o) => `  ${o.file}:${o.line} [${o.pattern_id}]`);
+  const more = open.length > 5 ? `
+  (+${open.length - 5} more)` : "";
+  return `STILL OPEN ELSEWHERE. ${open.length} blocking finding(s) Verity raised earlier are still present in files this run did not review:
+${lines.join("\n")}${more}
+This verdict covers the current change only. The tree is not clean.`;
+}
+
 // src/lib/channel.ts
 var MAX_AGENT_CONTEXT_CHARS = 1500;
 var MAX_AGENT_ITEMS = 5;
@@ -16554,9 +17348,16 @@ function buildAgentContext(input) {
   }
   if (input.intentVerdict === "misaligned" || input.intentVerdict === "partial") {
     const gap = input.intentGaps?.[0];
-    lines.push(
-      `- This does not look like the change that was asked for` + (gap ? `: ${gap}` : ".") + " Not blocking \u2014 but check it against what you were asked to do."
-    );
+    const repeat = input.intentRepeat ?? 0;
+    if (repeat > 0) {
+      lines.push(
+        `- Same intent flag as the last ${repeat === 1 ? "turn" : `${repeat} turns`}, on a goal that has not changed. Nothing new here \u2014 do not relay or re-explain it again; either act on it or carry on.`
+      );
+    } else {
+      lines.push(
+        `- This does not look like the change that was asked for` + (gap ? `: ${gap}` : ".") + " Not blocking \u2014 but check it against what you were asked to do."
+      );
+    }
   }
   const agentFindings = (input.findings ?? []).filter((f) => f.scope !== "pre-existing");
   for (const f of agentFindings) {
@@ -16603,10 +17404,51 @@ function buildHookOutput(gateDecision, systemMessage, agentContext) {
     } : {}
   };
 }
+var IDLE_EPISODE_CAP = 3;
+function channelSilence(input) {
+  const movedSomething = input.newUserPrompt || input.newAuthorship;
+  if (movedSomething) return null;
+  if (input.consecutiveIdle >= IDLE_EPISODE_CAP) return "idle-episode-cap";
+  if (input.emittedLast) return "caused-by-our-own-emission";
+  return null;
+}
+
+// src/lib/emit.ts
+var YELLOW2 = "\x1B[33m";
+var NC2 = "\x1B[0m";
+function emitVerdict(input) {
+  const exit = input.exit ?? ((code) => process.exit(code));
+  const { coverage, unaccounted } = reconcileCoverage(input.changed, input.coverage);
+  let verdict = resolveVerdict(input.proposed, coverage);
+  const openElsewhere = input.openElsewhere ?? [];
+  if (verdict === "PASS" && openElsewhere.length > 0) verdict = "WARN";
+  const note = [describeCoverage(coverage), describeOpenElsewhere(openElsewhere)].filter(Boolean).join("\n\n") || null;
+  if (unaccounted.length > 0) {
+    process.stderr.write(
+      `${YELLOW2}Verity: ${unaccounted.length} changed file(s) could not be attributed to any review stage \u2014 counted as unreviewed.${NC2}
+`
+    );
+  }
+  if (verdict === "FAIL") {
+    input.renderBlocking?.();
+    if (input.agentContext) {
+      process.stderr.write(`
+${input.agentContext}
+`);
+    }
+    if (note && !input.silenced) process.stderr.write(`
+${YELLOW2}${note}${NC2}
+`);
+    return exit(2);
+  }
+  const agentBlock = input.silenced ? null : [input.agentContext, note].filter(Boolean).join("\n\n") || null;
+  printJsonCompact(buildHookOutput(verdict, input.userSummary, agentBlock));
+  return exit(0);
+}
 
 // src/lib/cache-cleanup.ts
 var import_node_fs21 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_path18 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
@@ -16614,7 +17456,7 @@ function pruneStaleCache() {
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
     for (const entry of (0, import_node_fs21.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path19.join)(dir, entry);
+      const path = (0, import_node_path18.join)(dir, entry);
       try {
         const stat3 = (0, import_node_fs21.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
@@ -16783,46 +17625,6 @@ function shouldWarmRetryAnalyze(result) {
   return false;
 }
 
-// src/lib/skip-detection.ts
-function isBareAckPrompt(prompt) {
-  if (typeof prompt !== "string") return false;
-  const trimmed = prompt.trim();
-  if (trimmed.length === 0) return false;
-  if (trimmed.length > 20) return false;
-  const bareAckPattern = /^(\d{1,2}|y|n|yes|no|yep|nope|ok(ay)?|sure|skip|cancel|stop|done|noted|got\s+it|sounds\s+good|thanks|thank\s+you|thx)[.!?]*$/i;
-  return bareAckPattern.test(trimmed);
-}
-function isReflectionQuestion(response) {
-  if (!response || typeof response !== "string") return false;
-  const markers = [
-    /reflection\s+for\s+future\s+agents/i,
-    /what(?:'s|\s+is)\s+one\s+thing\s+you\s+learned/i,
-    /say\s+['"]?skip['"]?\s+to\s+skip/i,
-    /quick\s+reflection\s+question/i,
-    // Post-flip (VRT-21): the agent drafts the reflection itself and, when
-    // interactive, asks the user to confirm/correct before recording. That
-    // turn authors no code either, so it's still a reflection turn.
-    /reflection\s+draft/i,
-    /confirm,?\s+correct,?\s+or\s+add/i
-  ];
-  return markers.some((m) => m.test(response));
-}
-function isMetaTaskLabel(label2) {
-  if (label2 === null || label2 === void 0) return false;
-  if (typeof label2 !== "string") return false;
-  const trimmed = label2.trim();
-  if (trimmed.length === 0) return true;
-  const metaPatterns = [
-    /^verity\s+[\w-]+\s+response$/i,
-    // "Verity reflect response"
-    /^simple user response$/i,
-    /^verity\s+command$/i,
-    // "Verity command"
-    /^user\s+(question|reply|response|ack)$/i
-  ];
-  return metaPatterns.some((p) => p.test(trimmed));
-}
-
 // src/lib/transcript.ts
 var import_node_fs22 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
@@ -16986,6 +17788,13 @@ function buildSummary(lines) {
     files_read: capArray(filesRead, MAX_FILES_LIST),
     files_edited: capArray(filesEdited, MAX_FILES_LIST),
     files_created: capArray(filesCreated, MAX_CREATED_LIST),
+    // The complement of the two caps that affect SCOPE. `files_read` is excluded
+    // deliberately: reading a file is not authoring it, so a capped read list
+    // narrows nothing.
+    capped_out: [
+      ...cappedOut(filesEdited, MAX_FILES_LIST),
+      ...cappedOut(filesCreated, MAX_CREATED_LIST)
+    ],
     searches,
     commands,
     subagents,
@@ -17036,6 +17845,9 @@ function sanitizeCommand(rawCmd) {
 function capArray(set, max) {
   return Array.from(set).slice(0, max);
 }
+function cappedOut(set, max) {
+  return Array.from(set).slice(max);
+}
 
 // src/lib/run-mode.ts
 function parseAutonomousEnv(raw) {
@@ -17061,7 +17873,7 @@ function isExplicitlyAutonomous(env = process.env) {
 // src/lib/seed-runner.ts
 var import_promises11 = require("node:fs/promises");
 var import_node_fs23 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_path19 = require("node:path");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -17343,7 +18155,7 @@ async function runSeed(opts) {
   if (candidates.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path20.join)(MEMORY_DIR, "domain", "project-overview.md");
+  const overviewPath = (0, import_node_path19.join)(MEMORY_DIR, "domain", "project-overview.md");
   if ((0, import_node_fs23.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates };
   }
@@ -17379,9 +18191,9 @@ async function runSeed(opts) {
     }
     const nodeId = res.data.node_id;
     const filePathRel = res.data.file_path;
-    const targetPath = (0, import_node_path20.join)(MEMORY_DIR, filePathRel);
+    const targetPath = (0, import_node_path19.join)(MEMORY_DIR, filePathRel);
     try {
-      await (0, import_promises11.mkdir)((0, import_node_path20.dirname)(targetPath), { recursive: true });
+      await (0, import_promises11.mkdir)((0, import_node_path19.dirname)(targetPath), { recursive: true });
       await (0, import_promises11.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
@@ -17430,10 +18242,11 @@ async function readStopHookStdin() {
     return empty;
   }
 }
-function agentContextFor(response) {
+function agentContextFor(response, intentRepeat = 0) {
   const metadata = response.metadata ?? {};
   const intent = response.intent_alignment ?? {};
   return buildAgentContext({
+    intentRepeat,
     gateDecision: String(response.gate_decision ?? ""),
     findings: response.findings ?? [],
     pendingItems: response.pending_items ?? [],
@@ -17444,12 +18257,45 @@ function agentContextFor(response) {
   });
 }
 var beaconCtx = null;
-async function passAndExit(reason, skip) {
+async function passAndExit(reason, skip, kindOverride) {
   const sent = await sendSkipBeacon(beaconCtx, skip);
   logEvent("skip", { reason: skip, beacon: sent });
-  printJsonCompact({ gate_decision: "PASS", systemMessage: `Verity: ${reason}` });
+  const POLICY_SKIPS = /* @__PURE__ */ new Set([
+    "no-analyzable-files",
+    "verity-command",
+    "bare-acknowledgment",
+    "reflection-prompt",
+    "skip-mode",
+    "zero-increment",
+    "debounce",
+    "no-delta-since-last-review"
+  ]);
+  const skipKind = kindOverride ?? (POLICY_SKIPS.has(skip) ? "policy" : "capacity");
+  const changed = skipCoverageChanged;
+  const { coverage, unaccounted } = reconcileCoverage(changed, {
+    reviewed: [],
+    notReviewed: changed.map((path) => ({ path, reason: skip, stage: "pre-flight", kind: skipKind }))
+  });
+  const verdict = resolveVerdict("PASS", coverage);
+  const note = describeCoverage(coverage);
+  if (unaccounted.length > 0) {
+    logEvent("coverage_unaccounted", { where: "passAndExit", skip, count: unaccounted.length });
+  }
+  const AGENT_SILENT_SKIPS = /* @__PURE__ */ new Set(["iteration-cap"]);
+  const agentNote = AGENT_SILENT_SKIPS.has(skip) ? null : note;
+  printJsonCompact(
+    buildHookOutput(
+      verdict,
+      `Verity: ${reason}`,
+      // The agent's ONLY input is additionalContext. Sixteen of the nineteen
+      // terminating paths wrote `systemMessage` — the human's field — and told
+      // the agent nothing at all.
+      agentNote
+    )
+  );
   process.exit(0);
 }
+var skipCoverageChanged = [];
 var EMPTY_STATIC = {
   tool: "@codacy/analysis-cli",
   findings: [],
@@ -17464,7 +18310,7 @@ function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
 }
 function localOnlyAndExit(staticResults) {
   printJsonCompact({
-    gate_decision: "PASS",
+    gate_decision: "WARN",
     systemMessage: "Verity: not authenticated \u2014 ran a local static-only check (no deep review, no upload). Run `verity init` to authenticate and enable the full quality gate.",
     unauthenticated: true,
     static_results: staticResults
@@ -17524,6 +18370,7 @@ async function runAnalyze(opts, globals) {
     });
   }
   const { files: allChanged, hasRecentCommitFiles } = getChangedFiles();
+  skipCoverageChanged = allChanged;
   const analyzable = filterAnalyzable(allChanged);
   const reviewable = filterReviewable(allChanged);
   const securityFiles = filterSecurity(allChanged);
@@ -17539,10 +18386,12 @@ async function runAnalyze(opts, globals) {
   if (/^\s*\/verity-/i.test(latestPrompt)) {
     await passAndExit("Verity command \u2014 skipping analysis", "verity-command");
   }
-  if (isBareAckPrompt(latestPrompt)) {
+  const agentAuthoredCodeThisTurn = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0));
+  const turnAuthoredCode = agentAuthoredCodeThisTurn || !!baseline && allForReview.some((f) => changedSinceBaseline(f, baseline));
+  const canSeeTurnAuthorship = !!actionSummary || !!baseline;
+  if (shouldSkipForBareAck({ prompt: latestPrompt, turnAuthoredCode, canSeeTurnAuthorship })) {
     await passAndExit("Bare acknowledgment \u2014 skipping analysis", "bare-acknowledgment");
   }
-  const agentAuthoredCodeThisTurn = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0));
   if (isReflectionQuestion(assistantResponse) && !agentAuthoredCodeThisTurn) {
     await passAndExit("Reflection-prompt turn \u2014 skipping analysis", "reflection-prompt");
   }
@@ -17599,7 +18448,8 @@ async function runAnalyze(opts, globals) {
   let codeDelta = {
     files: [],
     total_lines: 0,
-    total_files: 0
+    total_files: 0,
+    excluded: []
   };
   let snapshotResult = { has_snapshots: false, diffs: [] };
   let contentHash = null;
@@ -17664,7 +18514,11 @@ async function runAnalyze(opts, globals) {
           if (assistantResponse) {
             analysisMode = "plan";
           } else {
-            await passAndExit("No files within size limits to analyze", "size-limit");
+            await passAndExit(
+              "No files within size limits to analyze",
+              "size-limit",
+              codeDelta.excluded.length > 0 ? "capacity" : "policy"
+            );
           }
         }
       }
@@ -17707,7 +18561,7 @@ async function runAnalyze(opts, globals) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path21.join)(VERITY_DIR, ".seeded");
+    const seedMarker = (0, import_node_path20.join)(VERITY_DIR, ".seeded");
     const hasStandard = (0, import_node_fs24.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs24.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
@@ -17775,7 +18629,7 @@ async function runAnalyze(opts, globals) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path21.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path20.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -17838,7 +18692,10 @@ async function runAnalyze(opts, globals) {
       priorState.capabilities
     );
     memory = recallMemory(memorySession.d, memorySession.identity, {
-      currentSessionKey: memorySession.identity.sessionKey
+      currentSessionKey: memorySession.identity.sessionKey,
+      // The independent witness. Only meaningful when a transcript was folded —
+      // otherwise it stays undefined and capture coverage reads as UNKNOWN.
+      ...foldResult && { userMessagesSeen: foldResult.coverage.userMessages }
     });
     if (memory && !memory.provenanceHolds) {
       process.stderr.write("Verity: working-memory provenance check failed \u2014 recall suppressed.\n");
@@ -17917,6 +18774,25 @@ async function runAnalyze(opts, globals) {
       projection: {
         v: 1,
         authored: foldResult?.authored ?? [],
+        // ⚠ AUTHORED *SINCE THE LAST VERDICT* — a different question from `authored`.
+        //
+        // `authored` above is the fold of the session TRANSCRIPT, which is
+        // cumulative: on turn 3 it still lists the files turn 2 edited. The
+        // account's close-out reads it as "was this file edited since the
+        // statement was raised", and those are not the same set.
+        //
+        // Measured 2026-08-03 (shirt-seller): four real vulnerabilities were
+        // raised on the turn that wrote them, then marked `fixed` 36 seconds
+        // later by a SUMMARY turn that edited nothing — `authored` still said 2,
+        // the turn carried 0 findings, so "gone + file authored" resolved to
+        // fixed. The vulnerabilities were still on disk. A silent false `fixed`
+        // is worse than a false `open`: it retires the statement the Account
+        // exists to keep.
+        //
+        // `hash_at_last_verdict` is frozen at each verdict and `hash_now` tracks
+        // disk, so their inequality IS "changed since we last spoke" — already
+        // computed, already maintained by the divergence machinery.
+        authored_since_verdict: memorySession ? foldDossier(memorySession.d).authored_all.filter((a) => a.hash_now !== a.hash_at_last_verdict).map((a) => a.path) : [],
         unobserved: foldResult?.unobserved ?? [],
         commands: foldResult?.commands ?? [],
         unknown_types: foldResult?.unknownTypes ?? [],
@@ -17958,7 +18834,20 @@ async function runAnalyze(opts, globals) {
     const intentContext = {};
     if (conversation && conversation.prompts.length > 0) {
       const latest = conversation.prompts[conversation.prompts.length - 1];
-      intentContext.user_prompt = latest.prompt;
+      const goalPrompt = resolveGoalPrompt(conversation.prompts) ?? { entry: latest, turnsBack: 0 };
+      intentContext.user_prompt = goalPrompt.entry.prompt;
+      if (isContinuationPrompt(intentContext.user_prompt)) {
+        const carried = memory?.projection.goal?.text;
+        if (carried && !isContinuationPrompt(carried)) {
+          intentContext.continuation_prompt = latest.prompt;
+          intentContext.user_prompt = carried;
+          logEvent("goal_from_dossier", { chars: carried.length });
+        }
+      }
+      if (goalPrompt.turnsBack > 0) {
+        intentContext.continuation_prompt = latest.prompt;
+        logEvent("goal_walked_back", { turns_back: goalPrompt.turnsBack });
+      }
       intentContext.session_id = latest.session_id || void 0;
       intentContext.prompt_captured_at = latest.captured_at || void 0;
       if (conversation.prompts.length > 1) {
@@ -18030,6 +18919,12 @@ async function runAnalyze(opts, globals) {
       message = `Verity: request rejected \u2014 payload too large (${kb}KB over the 190KB cap). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
     } else if (result.category === "network" || result.category === "timeout") {
       message = `Verity offline \u2014 ${result.error}`;
+    } else if (result.error.startsWith("STALE_VERIFICATION")) {
+      message = "Verity: your GitHub verification expired \u2014 run `verity login` to re-verify (local analysis this run)";
+    } else if (result.error.startsWith("FORBIDDEN")) {
+      message = "Verity: no access grant for this repository \u2014 run `verity login` to refresh your grants (local analysis this run)";
+    } else if (result.error.startsWith("INVALID_TOKEN")) {
+      message = "Verity: your login expired or was revoked \u2014 run `verity login` to sign in again (local analysis this run)";
     } else if (result.http_status && result.http_status >= 400 && result.http_status < 500) {
       message = `Verity: request rejected (HTTP ${result.http_status}) \u2014 ${result.error}`;
     } else if (result.http_status && result.http_status >= 500) {
@@ -18044,8 +18939,115 @@ async function runAnalyze(opts, globals) {
   const response = result.data;
   const decision = response.gate_decision ?? "(unrecognised)";
   const sentPaths = codeDelta.files.map((f) => f.path);
+  let openElsewhere = [];
+  if (memorySession) {
+    try {
+      const st = foldDossier(memorySession.d);
+      openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
+        try {
+          const src = (0, import_node_fs24.readFileSync)((0, import_node_path20.join)(repoRoot(), file), "utf8").split("\n");
+          const at = src[line - 1];
+          return at === void 0 ? null : lineSha(at);
+        } catch {
+          return null;
+        }
+      });
+    } catch {
+    }
+  }
+  const reviewCoverage = {
+    reviewed: sentPaths,
+    // Declared drops from the stages that DO report themselves today. The other
+    // stages surface via `unaccounted`, which is the tripwire, not the design.
+    notReviewed: [
+      // Every exit from the collection loop, each named. Six reasons where there
+      // used to be two recorded and four silent — the silent ones including the
+      // per-file size cap, which could drop a whole source file without leaving a
+      // trace anywhere in the payload or the run row.
+      ...codeDelta.excluded,
+      // The server-side 300-line middle-out truncation. It only bites on the
+      // full-file branch (a first analysis, before snapshots exist) because
+      // analyze normally sends diffs — but on that branch the reviewer sees the
+      // first and last 100 lines and nothing between, and until now said so to
+      // nobody. CAPACITY: a partial look is not a look.
+      ...(response.metadata?.truncated_files ?? []).map((path) => ({
+        path,
+        reason: "file-middle-truncated-300-lines",
+        stage: "prompt-builder",
+        kind: "capacity"
+      })),
+      // The 20-entry edit cap. CAPACITY, and the sharpest of the lot: it narrows
+      // what is REVIEWED, not merely what is summarised — a session editing 25
+      // files had five silently excluded from the reviewed set.
+      ...(actionSummary?.capped_out ?? []).map((path) => ({
+        path,
+        reason: "edit-list-cap-20",
+        stage: "extractActionSummary",
+        kind: "capacity"
+      })),
+      // ⚠ BASELINE SCOPING — the biggest source of false NOT A CLEAN REVIEW.
+      //
+      // The universe is `allChanged`, git's whole dirty tree. The reviewed set is
+      // scoped to what THIS SESSION authored (the VRT-26 contamination cure), so
+      // every pre-existing dirty file is in the universe, absent from `reviewed`,
+      // and — until now — declared by nobody. It fell through to `unaccounted`,
+      // became capacity, and produced "NOT A CLEAN REVIEW: admin.js" over a file
+      // that was never this session's to review.
+      //
+      // Measured 2026-08-04: three consecutive runs over an untouched tree gave
+      // three different answers — .claude/settings.json, then admin.js, then six
+      // files — because each run took a different path and each path had a
+      // different idea of the universe. POLICY: not this session's work is not a
+      // coverage gap, it is the cure working.
+      ...allChanged.filter((p) => !sentPaths.includes(p) && !codeDelta.excluded.some((e) => e.path === p)).filter((p) => analyzable.includes(p) || reviewable.includes(p) || securityFiles.includes(p)).map((path) => ({
+        path,
+        reason: "not-authored-this-session",
+        stage: "baseline-scoping",
+        kind: "policy"
+      })),
+      // The extension allowlist, and it is POLICY rather than capacity: a changed
+      // README was never going to be reviewed, and treating that as a coverage
+      // gap would downgrade nearly every PASS to WARN until WARN meant nothing.
+      // Recorded so the ledger balances and so "what did Verity ignore entirely"
+      // is answerable — but it never touches the verdict.
+      ...allChanged.filter((p) => !analyzable.includes(p) && !reviewable.includes(p) && !securityFiles.includes(p)).map((path) => ({
+        path,
+        reason: "not-a-reviewed-file-type",
+        stage: "extension-allowlist",
+        kind: "policy"
+      }))
+    ]
+  };
   const watermarkHash = sentPaths.length > 0 ? computeContentHash(sentPaths) : contentHash;
   const watermarkIsPartial = !!codeDelta.truncated;
+  let silenced = null;
+  let turnIsIdleForChannel = true;
+  if (memorySession) {
+    try {
+      const st = foldDossier(memorySession.d);
+      turnIsIdleForChannel = st.authored_all.every((a) => a.hash_now === a.hash_at_last_verdict);
+      silenced = channelSilence({
+        // The BUFFER, not intentContext.user_prompt: the latter falls back to a
+        // linked issue (VRT-53 W4) when no human spoke, and a fallback goal is
+        // not a user utterance. Treating it as one would keep the loop alive on
+        // exactly the autonomous cohort.
+        newUserPrompt: (conversation?.prompts?.length ?? 0) > 0,
+        newAuthorship: !turnIsIdleForChannel,
+        emittedLast: st.meta.channel?.emittedLast === true,
+        consecutiveIdle: st.meta.channel?.consecutiveIdle ?? 0
+      });
+    } catch {
+      silenced = null;
+    }
+  }
+  if (silenced) {
+    logEvent("channel_silenced", {
+      reason: silenced,
+      run_id: response.run_id ?? turnId,
+      decision
+    });
+  }
+  let intentRepeatCount = 0;
   if (memorySession) {
     try {
       recordVerdict(memorySession.d, {
@@ -18059,8 +19061,18 @@ async function runAnalyze(opts, globals) {
           pattern_id: f.pattern_id ?? f.rule_id,
           title: f.title,
           severity: f.severity
-        })) ?? []
+        })) ?? [],
+        intent: response.intent_alignment ?? null,
+        // The same signal F1 introduced: bytes differing from the hash frozen at
+        // the last verdict. A turn that moved nothing is the only kind that can
+        // accumulate a repeat.
+        idle: turnIsIdleForChannel,
+        // What next turn reads as `emittedLast`. A suppressed turn did not
+        // speak, so it cannot be the cause of the turn after it — which is what
+        // keeps this from becoming a permanent gag.
+        emitted: !silenced
       });
+      intentRepeatCount = Math.max(0, (foldDossier(memorySession.d).meta.intent_repeat?.consecutive ?? 1) - 1);
     } catch {
     }
   }
@@ -18153,6 +19165,11 @@ async function runAnalyze(opts, globals) {
   }
   saveSnapshots(codeDelta.files.map((f) => ({ path: f.path, content: f.content })));
   const loginNudge = response.persisted === false ? " \u26A0\uFE0F Not logged in \u2014 this run was NOT saved and Verity has no memory of your project. Run `verity login` to unlock run history, trends, and cloud memory." : "";
+  const grantWarning = reverifyNudge({
+    grant_status: response.grant_status,
+    reverify_by: response.reverify_by
+  });
+  const grantNudge = grantWarning ? ` \u26A0\uFE0F ${grantWarning}` : "";
   switch (decision) {
     case "FAIL": {
       writeIteration(iteration + 1, currentCommit, contentHash ?? void 0);
@@ -18229,7 +19246,22 @@ async function runAnalyze(opts, globals) {
       if (loginNudge) process.stderr.write(`
 ${YELLOW}${loginNudge.trim()}${NC}
 `);
-      process.exit(2);
+      if (grantNudge) process.stderr.write(`
+${YELLOW}${grantNudge.trim()}${NC}
+`);
+      emitVerdict({
+        proposed: "FAIL",
+        changed: skipCoverageChanged,
+        coverage: reviewCoverage,
+        userSummary: "",
+        // Subject to the SAME cycle cut as PASS/WARN. Suppressing here is safe:
+        // the findings themselves are rendered above by the blocking renderer,
+        // so what the cut removes is the repeated commentary, never the defect.
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced,
+        openElsewhere
+      });
       break;
     }
     case "PASS": {
@@ -18240,11 +19272,17 @@ ${YELLOW}${loginNudge.trim()}${NC}
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
-      userSummary += loginNudge;
-      printJsonCompact(
-        buildHookOutput("PASS", userSummary, agentContextFor(response))
-      );
-      process.exit(0);
+      userSummary += loginNudge + grantNudge;
+      emitVerdict({
+        proposed: "PASS",
+        changed: skipCoverageChanged,
+        coverage: reviewCoverage,
+        userSummary,
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced,
+        openElsewhere
+      });
       break;
     }
     case "WARN": {
@@ -18254,16 +19292,22 @@ ${YELLOW}${loginNudge.trim()}${NC}
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
-      userSummary += loginNudge;
-      printJsonCompact(
-        buildHookOutput("WARN", userSummary, agentContextFor(response))
-      );
-      process.exit(0);
+      userSummary += loginNudge + grantNudge;
+      emitVerdict({
+        proposed: "WARN",
+        changed: skipCoverageChanged,
+        coverage: reviewCoverage,
+        userSummary,
+        agentContext: silenced ? null : agentContextFor(response, intentRepeatCount),
+        // The coverage note is silenced with it — half a channel is still a channel.
+        silenced: !!silenced,
+        openElsewhere
+      });
       break;
     }
     default: {
       const raw = String(decision ?? "(missing)");
-      const msg = (autoSeedNotice ? `${autoSeedNotice} Verity: unrecognised verdict \u2014 treating as WARN` : "Verity: unrecognised verdict \u2014 treating as WARN") + loginNudge;
+      const msg = (autoSeedNotice ? `${autoSeedNotice} Verity: unrecognised verdict \u2014 treating as WARN` : "Verity: unrecognised verdict \u2014 treating as WARN") + loginNudge + grantNudge;
       process.stderr.write(
         `Verity: server returned an unrecognised gate_decision (${raw}). Rendering WARN rather than PASS. Update the CLI: npm i -g @codacy/verity-cli
 `
@@ -18371,8 +19415,8 @@ async function runReview(opts, globals) {
     for (const p of specPaths) {
       if (!(0, import_node_fs26.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync15 } = await import("node:fs");
-        const content = readFileSync15(p, "utf-8");
+        const { readFileSync: readFileSync16 } = await import("node:fs");
+        const content = readFileSync16(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -18430,9 +19474,9 @@ async function runReview(opts, globals) {
 
 // src/commands/guard.ts
 var import_node_fs27 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_path21 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path22.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path21.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve2) => {
@@ -18674,9 +19718,10 @@ async function runGuard(opts, globals) {
     cmd: "guard"
   });
   if (!result.ok) {
+    const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
     emitAllowNotice(
-      `\u26A0 Verity ${moment}: service offline \u2014 ${verb}ed WITHOUT review`,
-      `Verity ${moment}: service unavailable (${result.error}); the ${verb} was allowed WITHOUT a Verity review.`
+      `\u26A0 Verity ${moment}: ${authRemedy ? "not authorized" : "service offline"} \u2014 ${verb}ed WITHOUT review${authRemedy}`,
+      `Verity ${moment}: ${authRemedy ? "not authorized" : "service unavailable"} (${result.error}); the ${verb} was allowed WITHOUT a Verity review.${authRemedy}`
     );
   }
   if (opts.json) process.stderr.write(JSON.stringify(result.data) + "\n");
@@ -18748,14 +19793,14 @@ function writeBlockMessage(moment, response) {
 // src/commands/init.ts
 var import_node_fs29 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
-var import_node_path24 = require("node:path");
-var import_node_child_process11 = require("node:child_process");
+var import_node_path23 = require("node:path");
+var import_node_child_process10 = require("node:child_process");
 var readline2 = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
 var import_node_fs28 = require("node:fs");
-var import_node_path23 = require("node:path");
-var import_node_child_process10 = require("node:child_process");
+var import_node_path22 = require("node:path");
+var import_node_child_process9 = require("node:child_process");
 
 // src/lib/telemetry.ts
 var import_promises12 = require("node:fs/promises");
@@ -18850,11 +19895,11 @@ async function uninstallTelemetry() {
 // src/commands/migrate.ts
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
-  (0, import_node_child_process10.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  (0, import_node_child_process9.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
 function isGitTracked(cwd, relPath) {
   try {
-    (0, import_node_child_process10.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
+    (0, import_node_child_process9.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -18862,7 +19907,7 @@ function isGitTracked(cwd, relPath) {
 }
 function isGitRepo(cwd) {
   try {
-    (0, import_node_child_process10.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
+    (0, import_node_child_process9.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -18883,8 +19928,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path23.join)(root, ".gate");
-  const verityDir = (0, import_node_path23.join)(root, ".verity");
+  const gateDir = (0, import_node_path22.join)(root, ".gate");
+  const verityDir = (0, import_node_path22.join)(root, ".verity");
   if ((0, import_node_fs28.existsSync)(gateDir) && !(0, import_node_fs28.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -18902,7 +19947,7 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
       );
     }
     try {
-      (0, import_node_child_process10.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process9.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
       actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
       moved = true;
     } catch {
@@ -18938,11 +19983,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path23.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path23.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path22.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path22.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs28.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs28.existsSync)(verityCreds)) {
-    (0, import_node_fs28.mkdirSync)((0, import_node_path23.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs28.mkdirSync)((0, import_node_path22.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -18964,7 +20009,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path23.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path22.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs28.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -18975,13 +20020,13 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path23.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path23.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path22.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path22.join)(root, "VERITY.md");
   if (!(0, import_node_fs28.existsSync)(gateMd) || (0, import_node_fs28.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
-      (0, import_node_child_process10.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process9.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
       moved = true;
     } catch {
     }
@@ -18993,7 +20038,7 @@ function migrateStandardFile(root, actions) {
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path23.join)(root, ".claude", "settings.local.json");
+  const file = (0, import_node_path22.join)(root, ".claude", "settings.local.json");
   if (!(0, import_node_fs28.existsSync)(file)) return;
   let settings;
   try {
@@ -19056,7 +20101,7 @@ function readFileSyncSafe(path) {
 }
 function hasStagedChanges(root) {
   try {
-    (0, import_node_child_process10.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
+    (0, import_node_child_process9.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
     return false;
   } catch {
     return true;
@@ -19083,15 +20128,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
-    const srcDir = (0, import_node_path23.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path22.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs28.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path23.join)(relDir, entry) : entry;
-      const src = (0, import_node_path23.join)(gateDir, rel);
-      const dest = (0, import_node_path23.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path22.join)(relDir, entry) : entry;
+      const src = (0, import_node_path22.join)(gateDir, rel);
+      const dest = (0, import_node_path22.join)(verityDir, rel);
       if ((0, import_node_fs28.statSync)(src).isDirectory()) {
         walk(rel);
       } else if (!(0, import_node_fs28.existsSync)(dest)) {
-        (0, import_node_fs28.mkdirSync)((0, import_node_path23.dirname)(dest), { recursive: true });
+        (0, import_node_fs28.mkdirSync)((0, import_node_path22.dirname)(dest), { recursive: true });
         (0, import_node_fs28.cpSync)(src, dest);
         copied++;
       }
@@ -19101,22 +20146,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path23.join)(root, ".gate");
-  const verityDir = (0, import_node_path23.join)(root, ".verity");
+  const gateDir = (0, import_node_path22.join)(root, ".gate");
+  const verityDir = (0, import_node_path22.join)(root, ".verity");
   if ((0, import_node_fs28.existsSync)(gateDir) && !(0, import_node_fs28.existsSync)(verityDir)) return true;
   if ((0, import_node_fs28.existsSync)(gateDir) && (0, import_node_fs28.existsSync)(verityDir)) {
-    if ((0, import_node_fs28.existsSync)((0, import_node_path23.join)(gateDir, "credentials")) && !(0, import_node_fs28.existsSync)((0, import_node_path23.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs28.existsSync)((0, import_node_path22.join)(gateDir, "credentials")) && !(0, import_node_fs28.existsSync)((0, import_node_path22.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs28.existsSync)((0, import_node_path23.join)(gateDir, "memory")) && !(0, import_node_fs28.existsSync)((0, import_node_path23.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs28.existsSync)((0, import_node_path22.join)(gateDir, "memory")) && !(0, import_node_fs28.existsSync)((0, import_node_path22.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path23.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path22.join)(root, "CLAUDE.md");
   if ((0, import_node_fs28.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs28.existsSync)((0, import_node_path23.join)(root, "GATE.md")) && !(0, import_node_fs28.existsSync)((0, import_node_path23.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs28.existsSync)((0, import_node_path22.join)(root, "GATE.md")) && !(0, import_node_fs28.existsSync)((0, import_node_path22.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -19152,12 +20197,25 @@ async function promptYes(question) {
     rl.close();
   }
 }
-async function confirmExistingLogin(serviceUrl, opts) {
+async function confirmExistingLogin(serviceUrl, remote, opts) {
   const existing = await resolveToken(opts.token);
   if (!existing.ok) return "drive-login";
   const who = await whoami(existing.data.token, serviceUrl, opts.verbose);
   if (who.ok && who.data.logged_in) {
-    printInfo(`Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713 \u2014 runs & memory sync to Verity.`);
+    const identity = who.data.email ?? `user #${who.data.user_id}`;
+    const covered = who.data.grant_status != null;
+    if (!remote) {
+      printInfo(`Logged in as ${identity} \u2713`);
+      printInfo("  This directory has no git remote, so there is no project here to sync to.");
+    } else if (covered) {
+      printInfo(`Logged in as ${identity} \u2713 \u2014 runs & memory sync to Verity.`);
+    } else {
+      printInfo(`Logged in as ${identity} \u2713`);
+      printWarn("  This repository is NOT covered by your Verity access grants \u2014 nothing will sync.");
+      printInfo('  Grant the Verity GitHub App access to it, then run "verity login" to refresh your grants.');
+    }
+    const nudge = reverifyNudge(who.data);
+    if (nudge) printWarn(`  ${nudge}`);
     return "handled";
   }
   if (!who.ok) {
@@ -19186,18 +20244,18 @@ async function runOptionalAuth(resolution, opts = {}) {
       printInfo("  Log in below to re-register this project and repair ~/.verity/credentials.");
     }
   }
-  if (!healed) {
-    const state = await confirmExistingLogin(serviceUrl, opts);
-    if (state === "handled") return;
-  }
   let remote = "";
   try {
-    remote = (0, import_node_child_process11.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    remote = (0, import_node_child_process10.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
   }
+  if (!healed) {
+    const state = await confirmExistingLogin(serviceUrl, remote, opts);
+    if (state === "handled") return;
+  }
   const localOnlyNote = () => {
     printInfo("Verity runs in local-only mode: the gate still runs and shows static findings, but nothing uploads.");
-    printInfo('  Authenticate anytime: run "verity init" again, or "verity auth register".');
+    printInfo('  Authenticate anytime: run "verity login" (one login covers every repo you can write to).');
   };
   if (process.stdin.isTTY && process.stdout.isTTY) {
     console.log("");
@@ -19223,7 +20281,7 @@ async function runOptionalAuth(resolution, opts = {}) {
     localOnlyNote();
     return;
   }
-  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path24.basename)(process.cwd());
+  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path23.basename)(process.cwd());
   printInfo("Authenticating with GitHub\u2026");
   const result = await registerProject({ projectName, remote, serviceUrl, verbose: opts.verbose });
   if (result.ok) {
@@ -19236,15 +20294,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir() {
   const candidates = [
-    (0, import_node_path24.join)(__dirname, "..", "data"),
+    (0, import_node_path23.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path24.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path23.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path24.join)(process.cwd(), "cli", "data")
+    (0, import_node_path23.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs29.existsSync)((0, import_node_path24.join)(candidate, "skills"))) {
+    if ((0, import_node_fs29.existsSync)((0, import_node_path23.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -19288,30 +20346,30 @@ function registerInitCommand(program2) {
     }
     printInfo(`  Node.js ${nodeVersion} \u2713`);
     try {
-      const gitVersion = (0, import_node_child_process11.execSync)("git --version", { encoding: "utf-8" }).trim();
+      const gitVersion = (0, import_node_child_process10.execSync)("git --version", { encoding: "utf-8" }).trim();
       printInfo(`  ${gitVersion} \u2713`);
     } catch {
       printError("git is required but not installed. Install from https://git-scm.com");
       process.exit(1);
     }
     try {
-      (0, import_node_child_process11.execSync)("which claude", { encoding: "utf-8" });
+      (0, import_node_child_process10.execSync)("which claude", { encoding: "utf-8" });
       printInfo("  Claude Code \u2713");
     } catch {
       printWarn("  Claude Code not found \u2014 hooks will be configured but need Claude Code to run.");
     }
     try {
-      (0, import_node_child_process11.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
+      (0, import_node_child_process10.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
       printInfo("  @codacy/analysis-cli \u2713");
     } catch {
       printInfo("  Installing @codacy/analysis-cli...");
       try {
-        (0, import_node_child_process11.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
+        (0, import_node_child_process10.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
         printInfo("  @codacy/analysis-cli installed \u2713");
       } catch {
         try {
           printWarn("  Retrying with sudo...");
-          (0, import_node_child_process11.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+          (0, import_node_child_process10.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
           printInfo("  @codacy/analysis-cli installed \u2713");
         } catch {
           printWarn("  Could not install @codacy/analysis-cli automatically.");
@@ -19323,20 +20381,20 @@ function registerInitCommand(program2) {
     console.log("");
     printInfo("Installing skills...");
     const dataDir = resolveDataDir();
-    const skillsSource = (0, import_node_path24.join)(dataDir, "skills");
+    const skillsSource = (0, import_node_path23.join)(dataDir, "skills");
     const skillsDest = ".claude/skills";
     const skills = ["verity-setup", "verity-analyze", "verity-status", "verity-feedback", "verity-learn", "verity-memory", "verity-insights", "verity-reflect"];
     let skillsInstalled = 0;
     for (const skill of skills) {
-      const src = (0, import_node_path24.join)(skillsSource, skill);
-      const dest = (0, import_node_path24.join)(skillsDest, skill);
+      const src = (0, import_node_path23.join)(skillsSource, skill);
+      const dest = (0, import_node_path23.join)(skillsDest, skill);
       if (!(0, import_node_fs29.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
       if ((0, import_node_fs29.existsSync)(dest) && !force) {
-        const srcSkill = (0, import_node_path24.join)(src, "SKILL.md");
-        const destSkill = (0, import_node_path24.join)(dest, "SKILL.md");
+        const srcSkill = (0, import_node_path23.join)(src, "SKILL.md");
+        const destSkill = (0, import_node_path23.join)(dest, "SKILL.md");
         if ((0, import_node_fs29.existsSync)(destSkill)) {
           try {
             const srcContent = await (0, import_promises13.readFile)(srcSkill, "utf-8");
@@ -19374,7 +20432,7 @@ function registerInitCommand(program2) {
     } catch (err) {
       printWarn(`  Could not update CLAUDE.md: ${err.message}`);
     }
-    const globalVerityDir = (0, import_node_path24.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path23.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises13.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     try {
@@ -19403,14 +20461,14 @@ function registerInitCommand(program2) {
     console.log("    .verity/memory/                  \u2014 knowledge base (8 domains, commit to git)");
     console.log("");
     console.log("  Next step: open this project in Claude Code and run /verity-setup");
-    console.log('  (Not authenticated? Verity runs in local-only mode until you run "verity auth register".)');
+    console.log('  (Not authenticated? Verity runs in local-only mode until you run "verity login".)');
     console.log("");
   });
 }
 
 // src/commands/uninstall.ts
 var import_node_fs30 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_path24 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -19429,7 +20487,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path25.join)(skillsRoot, name);
+      const dir = (0, import_node_path24.join)(skillsRoot, name);
       if ((0, import_node_fs30.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
@@ -19475,7 +20533,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path25.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path24.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs30.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -19674,7 +20732,7 @@ function registerTaskCommands(program2) {
 
 // src/commands/reset.ts
 var import_node_fs31 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_path25 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -19715,7 +20773,7 @@ function registerResetCommand(program2) {
       for (const entry of (0, import_node_fs31.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs31.unlinkSync)((0, import_node_path26.join)(cacheDir, entry));
+            (0, import_node_fs31.unlinkSync)((0, import_node_path25.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -19742,7 +20800,7 @@ function registerResetCommand(program2) {
       if ((0, import_node_fs31.existsSync)(logsDir)) {
         for (const entry of (0, import_node_fs31.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs31.unlinkSync)((0, import_node_path26.join)(logsDir, entry));
+            (0, import_node_fs31.unlinkSync)((0, import_node_path25.join)(logsDir, entry));
           } catch {
           }
         }
@@ -20010,7 +21068,11 @@ function registerTelemetryCommands(program2) {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
     if (tokenResult.ok) {
-      printJsonCompact({ Authorization: `Bearer ${tokenResult.data.token}` });
+      const remote = requestRemote();
+      printJsonCompact({
+        Authorization: `Bearer ${tokenResult.data.token}`,
+        ...remote ? { "X-Verity-Remote": remote } : {}
+      });
     } else {
       printJsonCompact({});
     }
@@ -20040,7 +21102,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.a57c8d9").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.a72d2d9").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   try {
     await foldLegacyLocalCredential();
   } catch {
@@ -20048,6 +21110,9 @@ program.name("verity").description("CLI for Verity quality gate service").versio
 });
 registerAuthCommands(program);
 registerLoginCommand(program);
+registerTokenCommand(program);
+registerSessionsCommands(program);
+registerLogoutCommand(program);
 registerHooksCommands(program);
 registerIntentCommands(program);
 registerLifecycleCommands(program);