@codacy/verity-cli 0.28.1-experimental.dbd87b1 → 0.28.1-experimental.dfb3ce6

package/README.md

@@ -63,6 +63,11 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | `verity token create --name <name>` | Mint a service token for CI (`--expires <days>` optional) |
 | `verity token list` | List this repository's tokens (ids and metadata only) |
 | `verity token revoke <id>` | Revoke a token by id |
+| `verity sessions list` | List your logins — device, last use, expiry (logins expire after 90 days) |
+| `verity sessions revoke <id>` | Revoke one login by session id |
+| `verity logout` | Sign out on this machine |
+| `verity logout --others` | Sign out every OTHER machine (e.g. a lost laptop) |
+| `verity logout --all` | Sign out everywhere, including here |
 | `verity hooks install` | Wire Claude Code hooks |
 | `verity standard push` | Upload project Standard |
 | **Knowledge** | |

package/bin/verity.js

@@ -10636,14 +10636,14 @@ async function readGlobalCredential(remote) {
       const parsed = parseCredentialLine(line);
       if (parsed && parsed.remote === key) last = parsed.rec;
     }
-    if (last) return last;
+    if (last) return { ...last, keyed: true };
   }
   let plain = null;
   for (const line of lines) {
     const parsed = parseCredentialLine(line);
     if (parsed && parsed.remote === "") plain = parsed.rec;
   }
-  return plain;
+  return plain ? { ...plain, keyed: false } : null;
 }
 async function upsertGlobalCredential(remote, rec) {
   const path = globalCredentialsPath();
@@ -10707,6 +10707,36 @@ async function removeSupersededUserCredentials(loginServiceUrl, loginUserId) {
   }
   return removed;
 }
+async function removeGlobalCredential(remote) {
+  const path = globalCredentialsPath();
+  let content;
+  try {
+    content = await (0, import_promises.readFile)(path, "utf-8");
+  } catch {
+    return false;
+  }
+  const key = encodeRemoteKey(remote);
+  const kept = [];
+  let removed = false;
+  for (const line of content.split("\n")) {
+    const parsed = parseCredentialLine(line);
+    if (parsed && parsed.remote === key) {
+      removed = true;
+      continue;
+    }
+    kept.push(line);
+  }
+  if (!removed) return false;
+  while (kept.length && kept[kept.length - 1].trim() === "") kept.pop();
+  try {
+    await (0, import_promises.writeFile)(path, kept.length ? kept.join("\n") + "\n" : "", { mode: 384 });
+    await (0, import_promises.chmod)(path, 384).catch(() => {
+    });
+  } catch {
+    return false;
+  }
+  return true;
+}
 function parseLocalCredentialFile(content) {
   const tokenMatch = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
   if (!tokenMatch) return null;
@@ -11188,7 +11218,13 @@ async function resolveToken(flagToken) {
   if (rec) {
     return {
       ok: true,
-      data: { token: rec.token, source: "global", userId: rec.userId, email: rec.email }
+      data: {
+        token: rec.token,
+        source: "global",
+        userId: rec.userId,
+        email: rec.email,
+        keyed: rec.keyed
+      }
     };
   }
   const local = await readLegacyLocalCredential();
@@ -11220,6 +11256,16 @@ function reverifyNudge(who) {
   }
   return null;
 }
+function isLegacyPerRepoCredential(auth2) {
+  return auth2.source === "local" || auth2.source === "global" && auth2.keyed === true;
+}
+async function shouldUpgradeOnLogin(auth2) {
+  if (!isLegacyPerRepoCredential(auth2)) return false;
+  if (auth2.userId == null) return true;
+  const bare = await readGlobalCredential("");
+  if (bare?.userId == null) return true;
+  return bare.userId === auth2.userId;
+}
 function authDenialRemedy(error) {
   if (error.startsWith("STALE_VERIFICATION")) {
     return {
@@ -11233,6 +11279,12 @@ function authDenialRemedy(error) {
       remedy: 'No access grant for this repository \u2014 run "verity login" to refresh your grants (a repo granted after your last login needs one), or get write access to it.'
     };
   }
+  if (error.startsWith("INVALID_TOKEN")) {
+    return {
+      code: "INVALID_TOKEN",
+      remedy: 'Your Verity login has expired or was revoked \u2014 run "verity login" to sign in again.'
+    };
+  }
   return null;
 }
 async function probeService(serviceUrl, verbose) {
@@ -11273,6 +11325,7 @@ async function maybeHealServiceUrl(resolution, verbose) {
 
 // src/lib/register.ts
 var readline = __toESM(require("node:readline/promises"));
+var import_node_os = require("node:os");
 
 // src/lib/provider-auth.ts
 var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
@@ -11460,6 +11513,15 @@ async function registerProject(opts) {
   }
   return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email, userId } };
 }
+function deviceLabel() {
+  const override = process.env.VERITY_DEVICE_LABEL?.trim();
+  if (override) return override;
+  try {
+    return (0, import_node_os.hostname)() || void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function loginOnce(opts) {
   const usingTokenOverride = Boolean(process.env.VERITY_PROVIDER_TOKEN);
   const providerAuth = await githubDeviceFlow();
@@ -11480,13 +11542,19 @@ async function loginOnce(opts) {
     path: "/auth/login",
     serviceUrl: opts.serviceUrl,
     extraHeaders: { "X-Provider-Token": providerToken },
+    // Label the session so its owner can tell their machines apart in
+    // `verity sessions list` — a list of identical "login" rows is unusable when
+    // the question is "which of these is the laptop I lost?". The hostname is the
+    // useful default; VERITY_DEVICE_LABEL overrides it for anyone who would
+    // rather not send it. Server-side it is sanitized and capped.
+    body: { device: deviceLabel() },
     verbose: opts.verbose,
     cmd: "login"
   });
   if (!result.ok) {
     return { ok: false, error: result.error };
   }
-  const { token, service_url, user_id, user, repo_count } = result.data;
+  const { token, service_url, user_id, user, repo_count, expires_at } = result.data;
   const loginUserId = user_id ?? user?.id ?? void 0;
   try {
     await upsertGlobalCredential("", {
@@ -11510,15 +11578,16 @@ async function loginOnce(opts) {
       email: user?.email,
       userId: loginUserId,
       repoCount: repo_count ?? 0,
-      prunedCredentials: pruned
+      prunedCredentials: pruned,
+      expiresAt: expires_at
     }
   };
 }
 
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
-  const auth = program2.command("auth").description("Manage project authentication");
-  auth.command("register").description("Register a project with Verity").requiredOption("--project <name>", "Project name").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
+  const auth2 = program2.command("auth").description("Manage project authentication");
+  auth2.command("register").description("Register a project with Verity").requiredOption("--project <name>", "Project name").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
     const globals = program2.opts();
     const serviceUrl = globals.serviceUrl ?? DEFAULT_SERVICE_URL;
     let remote = opts.remote;
@@ -11545,7 +11614,7 @@ function registerAuthCommands(program2) {
     if (email) printInfo(`Authenticated as: ${email}`);
     printJson({ project_id: projectId, service_url: resolvedUrl });
   });
-  auth.command("verify").description("Verify the current token is valid").action(async () => {
+  auth2.command("verify").description("Verify the current token is valid").action(async () => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -11571,7 +11640,7 @@ function registerAuthCommands(program2) {
     printInfo(`Token valid. Project: ${result.data.project_name}`);
     printJson(result.data);
   });
-  auth.command("discover").description("Check if a project is registered").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
+  auth2.command("discover").description("Check if a project is registered").option("--remote <url>", "Git remote URL (auto-detected if omitted)").action(async (opts) => {
     const globals = program2.opts();
     let remote = opts.remote;
     if (!remote) {
@@ -11627,13 +11696,19 @@ function registerLoginCommand(program2) {
       const who = await whoami(existing.data.token, serviceUrl, globals.verbose);
       if (who.ok && who.data.logged_in) {
         const nudge = reverifyNudge(who.data);
-        if (!nudge) {
+        const upgrade = await shouldUpgradeOnLogin(existing.data);
+        if (!nudge && !upgrade) {
           printInfo(`Already logged in as ${who.data.email ?? `user #${who.data.user_id}`}. \u2713`);
           printInfo("  Re-authenticate with: verity login --force");
           return;
         }
-        printWarn(nudge);
-        printInfo("Re-verifying your repository access\u2026");
+        if (nudge) {
+          printWarn(nudge);
+          printInfo("Re-verifying your repository access\u2026");
+        } else {
+          printInfo("You are signed in with a per-repository token (the old format).");
+          printInfo("  Upgrading to a single login that covers every repository you can write to\u2026");
+        }
       } else if (who.ok && who.data.anonymous) {
         printInfo("You have an anonymous token (the gate runs, but nothing is saved). Logging you in\u2026");
       } else if (!who.ok) {
@@ -11650,6 +11725,10 @@ function registerLoginCommand(program2) {
     const identity = out.email ?? (out.userId != null ? `user #${out.userId}` : "your account");
     printInfo(`Logged in as ${identity}. \u2713`);
     printInfo(`  Access granted to ${out.repoCount} ${out.repoCount === 1 ? "repository" : "repositories"}.`);
+    if (out.expiresAt) {
+      printInfo(`  This login expires on ${out.expiresAt.slice(0, 10)} \u2014 "verity login" again to renew.`);
+      printInfo('  See your machines with "verity sessions list"; sign out with "verity logout".');
+    }
     printInfo("  Runs, history, and cloud memory now sync to Verity everywhere you have write access.");
     if (out.prunedCredentials > 0) {
       printVerbose(`Pruned ${out.prunedCredentials} superseded per-repository credential line(s).`, globals.verbose);
@@ -11680,14 +11759,24 @@ function registerLoginCommand(program2) {
       const rec = await readGlobalCredential(remote);
       if (rec && rec.token !== out.token) {
         const otherBackend = rec.serviceUrl != null && rec.serviceUrl !== out.serviceUrl;
+        const otherIdentity = rec.userId != null && out.userId != null && rec.userId !== out.userId;
         if (otherBackend) {
           printWarn(`  Note: this repository is pinned to a different Verity service (${rec.serviceUrl})`);
           printWarn("  by its own credential line, which takes precedence here \u2014 this login does not");
           printWarn("  change that. To move the repository, remove its line from ~/.verity/credentials.");
+          printWarn('  Until that line is removed, "verity login" here cannot fast-path and will run');
+          printWarn("  the full GitHub flow every time.");
+        } else if (otherIdentity) {
+          printWarn("  Note: this repository uses a different account's credential, which takes");
+          printWarn('  precedence here \u2014 this login leaves it in place, and "verity login" in this');
+          printWarn("  repository will report that account. Remove its line from ~/.verity/credentials");
+          printWarn("  only if you want this repository on the login you just completed.");
         } else {
           const kind = rec.userId != null ? "superseded per-repository" : "anonymous project-specific";
           printWarn(`  Note: this repository has a ${kind} credential that takes`);
           printWarn("  precedence here. Remove its line from ~/.verity/credentials to use your login.");
+          printWarn('  Until then, "verity login" in this repository re-runs the full GitHub flow');
+          printWarn("  every time.");
         }
       }
     }
@@ -11809,6 +11898,177 @@ function registerTokenCommand(program2) {
   });
 }
 
+// src/commands/sessions.ts
+function shortDate(iso) {
+  return iso ? iso.slice(0, 10) : "\u2014";
+}
+function daysUntil(iso) {
+  if (!iso) return null;
+  const ms = Date.parse(iso);
+  if (Number.isNaN(ms)) return null;
+  return Math.round((ms - Date.now()) / 864e5);
+}
+async function auth(globals) {
+  const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    printError(tokenResult.error);
+    process.exit(1);
+  }
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!urlResult.ok) {
+    printError(urlResult.error);
+    process.exit(1);
+  }
+  return { token: tokenResult.data.token, serviceUrl: urlResult.data };
+}
+function explain(error) {
+  if (error.startsWith("FORBIDDEN")) {
+    printInfo('  Sessions belong to a logged-in account \u2014 run "verity login" first.');
+  } else if (error.startsWith("INVALID_TOKEN")) {
+    printInfo('  This login has expired or was revoked \u2014 run "verity login" to sign in again.');
+  }
+}
+function registerSessionsCommands(program2) {
+  const sessions = program2.command("sessions").description("List and revoke your Verity logins (one per machine)");
+  sessions.command("list").description("List your active logins \u2014 device, last use, and expiry").option("--json", "Output raw JSON").action(async (opts) => {
+    const globals = program2.opts();
+    const { token, serviceUrl } = await auth(globals);
+    const result = await apiRequest({
+      method: "GET",
+      path: "/auth/sessions",
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "sessions"
+    });
+    if (!result.ok) {
+      printError(result.error);
+      explain(result.error);
+      process.exit(1);
+    }
+    if (opts.json) {
+      printJson(result.data);
+      return;
+    }
+    const list = result.data.sessions;
+    if (list.length === 0) {
+      printInfo('No active logins. (Run "verity login".)');
+      return;
+    }
+    printInfo(`${list.length} active login${list.length === 1 ? "" : "s"}:`);
+    printInfo("");
+    printInfo(`${"SESSION ID".padEnd(38)}${"DEVICE".padEnd(24)}${"CREATED".padEnd(12)}${"LAST USED".padEnd(12)}EXPIRES`);
+    for (const s of list) {
+      const days = daysUntil(s.expires_at);
+      const expiry = s.expires_at ? `${shortDate(s.expires_at)}${days != null ? ` (${days}d)` : ""}` : "never";
+      const device = (s.device ?? "login").slice(0, 22);
+      printInfo(
+        `${s.id.padEnd(38)}${device.padEnd(24)}${shortDate(s.created_at).padEnd(12)}${shortDate(s.last_used_at).padEnd(12)}${expiry}${s.current ? "   \u2190 this machine" : ""}`
+      );
+    }
+    printInfo("");
+    printInfo("Revoke one:  verity sessions revoke <session-id>");
+    printInfo("Sign out everywhere else:  verity logout --others");
+  });
+  sessions.command("revoke <session-id>").description("Revoke one login. Revoking this machine's also clears the local credential").action(async (sessionId) => {
+    const globals = program2.opts();
+    const { token, serviceUrl } = await auth(globals);
+    const result = await apiRequest({
+      method: "DELETE",
+      path: `/auth/sessions/${encodeURIComponent(sessionId)}`,
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "sessions-revoke"
+    });
+    if (!result.ok) {
+      printError(result.error);
+      if (result.http_status === 404) {
+        printInfo('  No session with that id on your account \u2014 check "verity sessions list".');
+      }
+      explain(result.error);
+      process.exit(1);
+    }
+    printInfo(`Session ${sessionId} revoked. \u2713`);
+    if (result.data.was_current) {
+      const cleared = await removeGlobalCredential("");
+      printInfo(cleared ? '  That was this machine \u2014 local credential cleared. Run "verity login" to sign back in.' : '  That was this machine. Run "verity login" to sign back in.');
+    }
+  });
+}
+function registerLogoutCommand(program2) {
+  program2.command("logout").description("Sign out of Verity on this machine (--all / --others for every machine)").option("--all", "Revoke every login on every machine, including this one").option("--others", "Revoke every login EXCEPT this machine (e.g. a lost laptop)").action(async (opts) => {
+    const globals = program2.opts();
+    if (opts.all && opts.others) {
+      printError("Use either --all or --others, not both.");
+      process.exit(1);
+    }
+    const { token, serviceUrl } = await auth(globals);
+    if (opts.all || opts.others) {
+      const result = await apiRequest({
+        method: "DELETE",
+        path: opts.others ? "/auth/sessions?others=true" : "/auth/sessions",
+        serviceUrl,
+        token,
+        verbose: globals.verbose,
+        cmd: "logout"
+      });
+      if (!result.ok) {
+        printError(result.error);
+        explain(result.error);
+        process.exit(1);
+      }
+      const n = result.data.revoked;
+      printInfo(`Revoked ${n} login${n === 1 ? "" : "s"}. \u2713`);
+      if (opts.others) {
+        printInfo("  This machine is still signed in.");
+        return;
+      }
+      const cleared2 = await removeGlobalCredential("");
+      if (cleared2) printInfo("  Local credential cleared.");
+      printInfo('  Run "verity login" to sign back in.');
+      return;
+    }
+    const list = await apiRequest({
+      method: "GET",
+      path: "/auth/sessions",
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "logout"
+    });
+    if (!list.ok) {
+      printError(list.error);
+      explain(list.error);
+      process.exit(1);
+    }
+    const current = list.data.sessions.find((s) => s.current);
+    if (!current) {
+      printWarn("This machine is not signed in with a Verity login.");
+      const cleared2 = await removeGlobalCredential("");
+      if (cleared2) printInfo("  Cleared the local login credential anyway.");
+      return;
+    }
+    const revoked = await apiRequest({
+      method: "DELETE",
+      path: `/auth/sessions/${current.id}`,
+      serviceUrl,
+      token,
+      verbose: globals.verbose,
+      cmd: "logout"
+    });
+    if (!revoked.ok) {
+      printError(revoked.error);
+      explain(revoked.error);
+      process.exit(1);
+    }
+    const cleared = await removeGlobalCredential("");
+    printInfo("Signed out on this machine. \u2713");
+    if (cleared) printInfo("  Local credential cleared.");
+    printInfo('  Your other machines are unaffected \u2014 use "verity logout --all" for all of them.');
+  });
+}
+
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
 var import_node_path5 = require("node:path");
@@ -12430,7 +12690,7 @@ function getRecentCommitMessages() {
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
 var import_node_fs5 = require("node:fs");
-var import_node_os = require("node:os");
+var import_node_os2 = require("node:os");
 var import_node_path6 = require("node:path");
 var SHARED_SENTINELS = /* @__PURE__ */ new Set([
   "",
@@ -12485,7 +12745,7 @@ function contextIdentity(input) {
 }
 function verityHome() {
   const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path6.resolve)(override) : (0, import_node_path6.join)((0, import_node_os.homedir)(), ".verity");
+  return override && override.trim() ? (0, import_node_path6.resolve)(override) : (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".verity");
 }
 function dossierDir(identity) {
   return (0, import_node_path6.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
@@ -13579,6 +13839,13 @@ function reduce(state, events, now) {
         });
         break;
       }
+      case "goal_delivered": {
+        const g = state.goal.find((x) => x.status === "active");
+        if (!g) break;
+        if (g.delivered) break;
+        g.delivered = { at: ev.at, seq: ev.seq, summary: ev.summary };
+        break;
+      }
       case "authored": {
         authoredEvents++;
         const e = byPath.get(ev.path) ?? {
@@ -13693,6 +13960,18 @@ function reduce(state, events, now) {
       }
       case "verdict": {
         state.meta.last_verdict_seq = ev.seq;
+        state.meta.channel = {
+          emittedLast: ev.emitted === true,
+          // Reset by ANY movement, so the counter measures a standstill rather
+          // than session length.
+          consecutiveIdle: ev.idle === false ? 0 : (state.meta.channel?.consecutiveIdle ?? 0) + 1
+        };
+        state.meta.last_adjudication = ev.intent_verdict ? { verdict: ev.intent_verdict, score: ev.intent_score ?? null, at: ev.at, decision: ev.decision } : void 0;
+        if (ev.intent_sig) {
+          state.meta.intent_repeat = state.meta.intent_repeat && state.meta.intent_repeat.sig === ev.intent_sig ? { sig: ev.intent_sig, consecutive: state.meta.intent_repeat.consecutive + 1 } : { sig: ev.intent_sig, consecutive: 1 };
+        } else {
+          state.meta.intent_repeat = void 0;
+        }
         state.meta.watermark = {
           sha: ev.head_sha,
           reviewed_hash: ev.watermark_sha,
@@ -13778,7 +14057,12 @@ function compactState(s) {
   const ms = (iso) => Date.parse(iso) || 0;
   return {
     v: 1,
-    g: s.goal.map((g) => [g.seq, ms(g.at), g.hash, g.superseded_by, g.text ?? 0, g.text_len ?? 0, g.source ?? 0, g.status ?? 0, g.repeats ?? 0, g.truncated ? 1 : 0, g.collapsed ? 1 : 0]),
+    // ⚠ APPEND-ONLY POSITIONALLY. Indices 11-13 carry `delivered`; a cache row
+    // written before it existed has length 11 and expands with `delivered`
+    // absent, which is the correct reading of "nothing had been delivered yet".
+    // Inserting rather than appending would silently re-interpret every existing
+    // cached row.
+    g: s.goal.map((g) => [g.seq, ms(g.at), g.hash, g.superseded_by, g.text ?? 0, g.text_len ?? 0, g.source ?? 0, g.status ?? 0, g.repeats ?? 0, g.truncated ? 1 : 0, g.collapsed ? 1 : 0, g.delivered ? ms(g.delivered.at) : 0, g.delivered?.seq ?? 0, g.delivered?.summary ?? 0]),
     a: s.authored?.map((a) => [a.path, a.origin, a.edits, a.hunks, a.adds, a.dels, a.hash_now, a.hash_at_last_verdict, a.first_seq, a.last_seq]) ?? null,
     n: s.not_mine?.map((n) => [n.path, n.reason, ms(n.at), n.head_sha]) ?? null,
     t: s.statements.map((x) => [x.anchor_key, x.file, x.line, x.pattern_id, x.title_hash, x.register, x.line_sha, x.said_at_seq, ms(x.said_at), x.outcome, x.outcome_at ? ms(x.outcome_at) : 0, x.repeats, x.carried ? 1 : 0]),
@@ -13824,7 +14108,14 @@ function expandState(raw) {
         ...x[7] ? { status: x[7] } : {},
         ...x[8] ? { repeats: x[8] } : {},
         ...x[9] ? { truncated: true } : {},
-        ...x[10] ? { collapsed: true } : {}
+        ...x[10] ? { collapsed: true } : {},
+        ...x[11] ? {
+          delivered: {
+            at: iso(x[11]),
+            seq: x[12] ?? 0,
+            summary: x[13] || ""
+          }
+        } : {}
       })),
       authored: decodedAuthored,
       // The cache stores the BOUNDED list, so this is the bounded list too. That
@@ -14038,9 +14329,14 @@ function projectMemory(state, opts) {
       seq: active.seq,
       superseded,
       truncated: active.truncated === true,
-      collapsed: state.meta.collapsed.goal ?? 0
+      collapsed: state.meta.collapsed.goal ?? 0,
+      ...active.delivered && { delivered: active.delivered }
     };
   }
+  if (state.meta.last_adjudication) {
+    const a = state.meta.last_adjudication;
+    p.last_adjudication = { verdict: a.verdict, score: a.score, at: a.at };
+  }
   const ageOf = (seq, carried) => carried ? "carried" : seq > lastVerdictSeq ? "this_turn" : "this_session";
   if (opts.spoken.length > 0) {
     p.statements = opts.spoken.map((s) => ({
@@ -14466,6 +14762,10 @@ function toStatus(n) {
 }
 function recordVerdict(d, v) {
   const root = repoRoot();
+  if (v.intent?.verdict === "aligned") {
+    const summary = (v.intent.implemented ?? "").trim().slice(0, 400);
+    if (summary) appendEvent(d, { k: "goal_delivered", summary });
+  }
   const lines = /* @__PURE__ */ new Map();
   for (const f of v.findings) {
     if (!f.file || typeof f.line !== "number" || !f.pattern_id) continue;
@@ -14493,15 +14793,32 @@ function recordVerdict(d, v) {
       line_sha: at !== void 0 ? lineSha(at) : null
     });
   }
+  const foldedNow = foldDossier(d);
+  const sig = intentSignature(v.intent, {
+    goalSeq: foldedNow.goal.find((g) => g.status === "active")?.seq ?? 0,
+    idle: v.idle !== false
+  });
   appendEvent(d, {
     k: "verdict",
     run_id: v.runId,
     head_sha: getCurrentCommit(),
     watermark_sha: v.watermarkSha,
     branch: v.branch,
-    decision: v.decision
+    decision: v.decision,
+    ...sig && { intent_sig: sig },
+    emitted: v.emitted === true,
+    idle: v.idle !== false,
+    ...v.intent?.verdict && { intent_verdict: v.intent.verdict },
+    ...typeof v.intent?.score === "number" && { intent_score: v.intent.score }
   });
 }
+function intentSignature(intent, ctx) {
+  if (!intent?.verdict) return null;
+  if (intent.verdict !== "misaligned" && intent.verdict !== "partial") return null;
+  const goal = ctx ? `g${ctx.goalSeq}` : "g?";
+  const moved = ctx?.idle === false ? "active" : "idle";
+  return `${intent.verdict}:${goal}:${moved}`;
+}
 function toRegister(severity) {
   switch (severity) {
     case "critical":
@@ -16287,7 +16604,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.28.1-experimental.dbd87b1" : "dev";
+    return true ? "0.28.1-experimental.dfb3ce6" : "dev";
   } catch {
     return "dev";
   }
@@ -16512,6 +16829,7 @@ var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "subagent"
 ]);
 var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "NotebookEdit", "MultiEdit"]);
+var DISPATCH_TOOLS = /* @__PURE__ */ new Set(["Task", "Workflow"]);
 var COMMAND_CLASSES = [
   [/\b(npm|yarn|pnpm|bun)\s+(run\s+)?test\b|\bvitest\b|\bjest\b|\bpytest\b|\bgo test\b/, "test"],
   [/\b(npm|yarn|pnpm|bun)\s+(run\s+)?build\b|\btsc\b|\bwebpack\b|\bcargo build\b/, "build"],
@@ -16638,6 +16956,7 @@ function fold(transcriptPath, opts = {}) {
       totalRecords: 0,
       malformed: 0,
       subagentFiles: 0,
+      dispatched: 0,
       subagentSkipped: 0,
       compactions: 0,
       complete: false
@@ -16664,7 +16983,7 @@ function fold(transcriptPath, opts = {}) {
       if (type === "system" && record.subtype === "compact_boundary") {
         result.coverage.compactions++;
       }
-      collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, opts.repoRoot);
+      collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, opts.repoRoot, result.coverage);
     }
   };
   try {
@@ -16736,7 +17055,7 @@ function classifyUnobserved(path) {
   if (/\.(png|jpg|jpeg|gif|pdf|zip|woff2?|ico|mp4)$/i.test(path)) return "binary";
   return "no_edit_record";
 }
-function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, repoRoot2) {
+function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, repoRoot2, tally) {
   const message = record.message;
   const content = message?.content ?? record.content;
   const blocks = Array.isArray(content) ? content : content && typeof content === "object" ? [content] : [];
@@ -16758,6 +17077,9 @@ function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse
           byPath.set(path, entry);
         }
       }
+      if (DISPATCH_TOOLS.has(name) && tally) {
+        tally.dispatched += 1;
+      }
       if (name === "Bash") {
         const cmd = typeof input.command === "string" ? input.command : "";
         if (cmd) {
@@ -16838,9 +17160,16 @@ function buildAgentContext(input) {
   }
   if (input.intentVerdict === "misaligned" || input.intentVerdict === "partial") {
     const gap = input.intentGaps?.[0];
-    lines.push(
-      `- This does not look like the change that was asked for` + (gap ? `: ${gap}` : ".") + " Not blocking \u2014 but check it against what you were asked to do."
-    );
+    const repeat = input.intentRepeat ?? 0;
+    if (repeat > 0) {
+      lines.push(
+        `- Same intent flag as the last ${repeat === 1 ? "turn" : `${repeat} turns`}, on a goal that has not changed. Nothing new here \u2014 do not relay or re-explain it again; either act on it or carry on.`
+      );
+    } else {
+      lines.push(
+        `- This does not look like the change that was asked for` + (gap ? `: ${gap}` : ".") + " Not blocking \u2014 but check it against what you were asked to do."
+      );
+    }
   }
   const agentFindings = (input.findings ?? []).filter((f) => f.scope !== "pre-existing");
   for (const f of agentFindings) {
@@ -16887,6 +17216,14 @@ function buildHookOutput(gateDecision, systemMessage, agentContext) {
     } : {}
   };
 }
+var IDLE_EPISODE_CAP = 3;
+function channelSilence(input) {
+  const movedSomething = input.newUserPrompt || input.newAuthorship;
+  if (movedSomething) return null;
+  if (input.consecutiveIdle >= IDLE_EPISODE_CAP) return "idle-episode-cap";
+  if (input.emittedLast) return "caused-by-our-own-emission";
+  return null;
+}
 
 // src/lib/cache-cleanup.ts
 var import_node_fs21 = require("node:fs");
@@ -17714,10 +18051,11 @@ async function readStopHookStdin() {
     return empty;
   }
 }
-function agentContextFor(response) {
+function agentContextFor(response, intentRepeat = 0) {
   const metadata = response.metadata ?? {};
   const intent = response.intent_alignment ?? {};
   return buildAgentContext({
+    intentRepeat,
     gateDecision: String(response.gate_decision ?? ""),
     findings: response.findings ?? [],
     pendingItems: response.pending_items ?? [],
@@ -18201,6 +18539,25 @@ async function runAnalyze(opts, globals) {
       projection: {
         v: 1,
         authored: foldResult?.authored ?? [],
+        // ⚠ AUTHORED *SINCE THE LAST VERDICT* — a different question from `authored`.
+        //
+        // `authored` above is the fold of the session TRANSCRIPT, which is
+        // cumulative: on turn 3 it still lists the files turn 2 edited. The
+        // account's close-out reads it as "was this file edited since the
+        // statement was raised", and those are not the same set.
+        //
+        // Measured 2026-08-03 (shirt-seller): four real vulnerabilities were
+        // raised on the turn that wrote them, then marked `fixed` 36 seconds
+        // later by a SUMMARY turn that edited nothing — `authored` still said 2,
+        // the turn carried 0 findings, so "gone + file authored" resolved to
+        // fixed. The vulnerabilities were still on disk. A silent false `fixed`
+        // is worse than a false `open`: it retires the statement the Account
+        // exists to keep.
+        //
+        // `hash_at_last_verdict` is frozen at each verdict and `hash_now` tracks
+        // disk, so their inequality IS "changed since we last spoke" — already
+        // computed, already maintained by the divergence machinery.
+        authored_since_verdict: memorySession ? foldDossier(memorySession.d).authored_all.filter((a) => a.hash_now !== a.hash_at_last_verdict).map((a) => a.path) : [],
         unobserved: foldResult?.unobserved ?? [],
         commands: foldResult?.commands ?? [],
         unknown_types: foldResult?.unknownTypes ?? [],
@@ -18318,6 +18675,8 @@ async function runAnalyze(opts, globals) {
       message = "Verity: your GitHub verification expired \u2014 run `verity login` to re-verify (local analysis this run)";
     } else if (result.error.startsWith("FORBIDDEN")) {
       message = "Verity: no access grant for this repository \u2014 run `verity login` to refresh your grants (local analysis this run)";
+    } else if (result.error.startsWith("INVALID_TOKEN")) {
+      message = "Verity: your login expired or was revoked \u2014 run `verity login` to sign in again (local analysis this run)";
     } else if (result.http_status && result.http_status >= 400 && result.http_status < 500) {
       message = `Verity: request rejected (HTTP ${result.http_status}) \u2014 ${result.error}`;
     } else if (result.http_status && result.http_status >= 500) {
@@ -18334,6 +18693,34 @@ async function runAnalyze(opts, globals) {
   const sentPaths = codeDelta.files.map((f) => f.path);
   const watermarkHash = sentPaths.length > 0 ? computeContentHash(sentPaths) : contentHash;
   const watermarkIsPartial = !!codeDelta.truncated;
+  let silenced = null;
+  let turnIsIdleForChannel = true;
+  if (memorySession) {
+    try {
+      const st = foldDossier(memorySession.d);
+      turnIsIdleForChannel = st.authored_all.every((a) => a.hash_now === a.hash_at_last_verdict);
+      silenced = channelSilence({
+        // The BUFFER, not intentContext.user_prompt: the latter falls back to a
+        // linked issue (VRT-53 W4) when no human spoke, and a fallback goal is
+        // not a user utterance. Treating it as one would keep the loop alive on
+        // exactly the autonomous cohort.
+        newUserPrompt: (conversation?.prompts?.length ?? 0) > 0,
+        newAuthorship: !turnIsIdleForChannel,
+        emittedLast: st.meta.channel?.emittedLast === true,
+        consecutiveIdle: st.meta.channel?.consecutiveIdle ?? 0
+      });
+    } catch {
+      silenced = null;
+    }
+  }
+  if (silenced) {
+    logEvent("channel_silenced", {
+      reason: silenced,
+      run_id: response.run_id ?? turnId,
+      decision
+    });
+  }
+  let intentRepeatCount = 0;
   if (memorySession) {
     try {
       recordVerdict(memorySession.d, {
@@ -18347,8 +18734,18 @@ async function runAnalyze(opts, globals) {
           pattern_id: f.pattern_id ?? f.rule_id,
           title: f.title,
           severity: f.severity
-        })) ?? []
+        })) ?? [],
+        intent: response.intent_alignment ?? null,
+        // The same signal F1 introduced: bytes differing from the hash frozen at
+        // the last verdict. A turn that moved nothing is the only kind that can
+        // accumulate a repeat.
+        idle: turnIsIdleForChannel,
+        // What next turn reads as `emittedLast`. A suppressed turn did not
+        // speak, so it cannot be the cause of the turn after it — which is what
+        // keeps this from becoming a permanent gag.
+        emitted: !silenced
       });
+      intentRepeatCount = Math.max(0, (foldDossier(memorySession.d).meta.intent_repeat?.consecutive ?? 1) - 1);
     } catch {
     }
   }
@@ -18538,7 +18935,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
       userSummary += loginNudge + grantNudge;
       printJsonCompact(
-        buildHookOutput("PASS", userSummary, agentContextFor(response))
+        buildHookOutput("PASS", userSummary, silenced ? null : agentContextFor(response, intentRepeatCount))
       );
       process.exit(0);
       break;
@@ -18552,7 +18949,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
       userSummary += loginNudge + grantNudge;
       printJsonCompact(
-        buildHookOutput("WARN", userSummary, agentContextFor(response))
+        buildHookOutput("WARN", userSummary, silenced ? null : agentContextFor(response, intentRepeatCount))
       );
       process.exit(0);
       break;
@@ -18970,7 +19367,7 @@ async function runGuard(opts, globals) {
     cmd: "guard"
   });
   if (!result.ok) {
-    const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : "";
+    const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
     emitAllowNotice(
       `\u26A0 Verity ${moment}: ${authRemedy ? "not authorized" : "service offline"} \u2014 ${verb}ed WITHOUT review${authRemedy}`,
       `Verity ${moment}: ${authRemedy ? "not authorized" : "service unavailable"} (${result.error}); the ${verb} was allowed WITHOUT a Verity review.${authRemedy}`
@@ -20354,7 +20751,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.dbd87b1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.dfb3ce6").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   try {
     await foldLegacyLocalCredential();
   } catch {
@@ -20363,6 +20760,8 @@ program.name("verity").description("CLI for Verity quality gate service").versio
 registerAuthCommands(program);
 registerLoginCommand(program);
 registerTokenCommand(program);
+registerSessionsCommands(program);
+registerLogoutCommand(program);
 registerHooksCommands(program);
 registerIntentCommands(program);
 registerLifecycleCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.28.1-experimental.dbd87b1",
+  "version": "0.28.1-experimental.dfb3ce6",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "bugs": {