@codacy/verity-cli 0.29.0-experimental.9760196 → 0.29.0

package/bin/verity.js

@@ -10492,7 +10492,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -16919,7 +16919,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.29.0-experimental.9760196" : "dev";
+    return true ? "0.29.0" : "dev";
   } catch {
     return "dev";
   }
@@ -21518,7 +21518,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.29.0-experimental.9760196").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.29.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.0-experimental.9760196",
+  "version": "0.29.0",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",
@@ -15,8 +15,7 @@
     "data/skills/",
     "package.json",
     "README.md",
-    "LICENSE",
-    "CHANGELOG.md"
+    "LICENSE"
   ],
   "engines": {
     "node": ">=20"

package/CHANGELOG.md

@@ -1,406 +0,0 @@
-# Changelog
-
-All notable changes to Verity are documented here. This project follows
-[Semantic Versioning](https://semver.org/).
-
-## [0.29.0] — 2026-08-07
-
-**Phase 1 of the Road to 1.0: identity and context.** One login now covers every
-repository you can write to, and the gate stops guessing about what it reviewed.
-
-```bash
-npm install -g @codacy/verity-cli
-verity login
-```
-
-Nothing is revoked, and for most people those two commands are the whole migration.
-Three cases need one more step — see **[Migrating](#migrating)** at the end.
-
-### 🔑 Log in once — for every repository, on every machine
-
-- **`verity login` is now repo-independent.** One GitHub device flow authenticates
-  *you*, and the service sweeps your Verity GitHub App installations to grant access
-  to every repository you can write to. A second repository needs no authentication
-  at all. Previously this was one device flow **per repository**.
-- **Re-running `verity login` refreshes every grant at once** — it is how newly
-  granted repositories appear, and how repositories you lost access to are revoked.
-- **`verity login` works on a machine with nothing configured.** Auth commands now
-  fall back to the default service URL, and `verity init` drives the login instead of
-  asking you to configure a URL first.
-- **Existing per-repository tokens are upgraded, not broken.** Logging in supersedes
-  and prunes them; anything it cannot prune is reported rather than silently left in
-  place.
-
-### 👤 A login is a session, not a permanent key
-
-- **90-day expiry**, reported at login (`This login expires on …`).
-- **`verity sessions list`** — every machine you are signed in on, by device name,
-  with `← this machine`.
-- **`verity sessions revoke <id>`**, **`verity logout`**, **`verity logout --others`**
-  (a lost laptop, from a machine you still control) and **`verity logout --all`**.
-- Before this release a login token was invisible and permanent: it could be neither
-  listed nor revoked, every re-login minted another, and the only recourse was
-  deleting the user row in the database.
-- `verity logout` works even when the service is unreachable: it clears the local
-  credential and says plainly that the server-side session may survive, rather than
-  refusing to sign you out.
-- A revoked or expired session now reports *"your login expired or was revoked — run
-  verity login"* and falls back to local analysis, instead of a bare HTTP 401.
-
-### 🤖 Service tokens for CI
-
-- **`verity token create --name ci [--expires <days>]`** mints a project-pinned
-  machine token for `VERITY_TOKEN`, printed once. **`verity token list`** shows ids and
-  metadata (never secrets); **`verity token revoke <id>`** removes one.
-- Service tokens are **exempt from grant freshness** — a pipeline does not break
-  because the person who created it went stale or left the company — and are
-  **revocable by any current writer** of the repository, so a CI credential neither
-  dies with its minter nor outlives their access.
-- `VERITY_TOKEN` from the environment is exempt from credential pinning: it is an
-  explicit act by whoever set it, and carries no stored record to check against.
-
-### 🔒 Security & privacy
-
-- **The login token is pinned to the backend that issued it.** A
-  repository's `VERITY.md` is committed, and both the CLI and the hooks resolve their
-  service URL from it. With a machine-global credential, cloning a hostile repository
-  and working in it would have POSTed your login token *and* your code delta to
-  whatever URL that file named, on the next Stop hook. The credential now records the
-  service that minted it and **refuses** to travel anywhere else — refused, not
-  downgraded, because stripping the auth header would still ship the request body.
-  The Stop hook degrades to local static analysis, so "unauthenticated still
-  analyzes" is preserved.
-- **No secret is written into your repository any more.** `.verity/credentials`
-  inside the repo is no longer written or read for auth — the first `verity` command
-  folds any leftover file into `~/.verity/credentials` and deletes it. That global
-  store is now the single secret store, and the installer re-applies `chmod 600` on
-  **every** run, correcting older installs that left it world-readable.
-- **Your token is out of `.claude/settings.local.json` too.** The OTLP telemetry block
-  used to contain it verbatim; it now references an `otelHeadersHelper` that resolves
-  the token at session start. Re-run `verity telemetry install` once to pick this up.
-- **Control characters in a git remote are rejected** before the remote becomes a
-  request header, and a `VERITY.md` label line yields only its **first** URL.
-- **The offline cache keeps metadata, never code.** Both offline writers persisted
-  the code-bearing request body "for later upload" — an upload that was never built,
-  and the only other reader deletes the files after 7 days. They now record what you
-  actually need to debug a failed run (when, why, how many files, how many bytes,
-  which paths) and none of the content.
-- **Grant freshness is surfaced, never enforced, in this release.** Access carries a
-  two-stage TTL from its last verification (14d soft / 30d hard); the CLI nudges you
-  to re-verify well before anything can break. `STALE_VERIFICATION` is deliberately
-  distinct from `FORBIDDEN`, because the remedy is `verity login`, not asking someone
-  for access.
-- Cross-tenant gaps closed on the token routes and `/review`; a transient grant-lookup
-  failure now returns `503` with `Retry-After` instead of reporting "you lack access".
-
-### ✅ The gate stops rendering unreviewed code as PASS
-
-- **An unreviewed run can no longer come back green.** Two new fields —
-  `review_status` (did a review happen) and `coverage` (how complete was the
-  evidence) — are computed server-side from request facts, and a run with no review
-  is clamped away from PASS. Previously, **251 of 251 fail-opens in this product's
-  lifetime rendered PASS**: there was no field anywhere that could say a review had
-  not happened, so an unreviewed run was indistinguishable from clean code.
-- **The reviewer call now retries and fails over.** One retry on 429/5xx within the
-  60-second budget, honouring `Retry-After`; **a quota error is never retried** (the
-  largest real fail-open was a 50-hour billing lapse, and a status-code-only retry
-  would have hammered it for the duration). A secondary provider can answer, but its
-  answer yields **WARN, not PASS** — a clean bill of health from a model your project
-  did not choose is not one.
-- **Cost per reviewed run is computable for the first time** — the provider usage
-  block is returned instead of only logged.
-
-### 💬 Verity now speaks on turns that go well
-
-- **A short report reaches the agent on every meaningful turn**, not only when the
-  gate blocks. 87.4% of runs used to end PASS or WARN and reach the agent with
-  nothing at all, while 1,384 pending items across 53% of runs were computed,
-  returned, and read by nobody.
-- Capped and framed so it cannot take over the conversation: **≤1,500 characters,
-  ≤5 items, one message per turn**, prefixed as a *report to relay* rather than an
-  instruction — and **a PASS with nothing to say says nothing.**
-- Each line now prints its `pattern_id`, so `verity feedback finding …` can finally
-  be used — it previously asked for an argument that had never been shown to anyone.
-
-### 🎯 The verdict is about your goal, and about your code
-
-- **Intent misalignment no longer blocks — it arrives.** This was the single largest
-  source of false blocks: **57.6% of identified FAILs**. It is now delivered as a
-  pending item with a stable `intent-misalignment` id instead of a refusal. It also
-  ends an inconsistency that was never decided, only implemented twice — the same
-  server verdict used to block at Stop and pass at pre-commit.
-- **A block now requires at least one agent-scope finding** (a further 47.8% of
-  FAILs), written as an explicit predicate rather than left emergent.
-- **A goal that has been delivered is recorded as delivered.** A goal met on turn 1
-  used to be re-asserted verbatim forever; one real session produced a four-turn loop
-  in which Verity graded turns that were relaying its own feedback.
-- **"Let's go", "yes" and "sounds good" are no longer treated as the goal**, and a
-  repeated advisory is **labelled as a repeat** rather than asked for again.
-- **An operation is work too.** "Pull all changes from main" → the agent ran
-  `git fetch`, found the branch current, correctly did nothing — and Verity answered
-  *"Intent misaligned (2/10): No Git pull was performed."* Actions can now satisfy a
-  goal, and Verity no longer asserts that something did not happen when it can see
-  that it did.
-- **Findings anchor to real line numbers on the diff path.** It previously pushed the
-  raw unified diff and left the model counting from a hunk header — a finding
-  reported at `admin.js:156` against code at `:163`, which also broke recurrence
-  detection.
-
-### 🧠 Verity remembers the session
-
-- **A working-memory dossier**, per session, on your machine (~12 KB, append-only,
-  CRC-checked, never a store): the goal you typed four turns ago and have not
-  restated, what has been authored since, what Verity already said, and what became
-  of it. **84.0% of runs were the second-or-later run of a session Verity had
-  entirely forgotten.**
-- **Stale memory is refused, not softened.** An orphaned dossier is never loaded as
-  working memory; every carried assertion re-anchors against the current bytes within
-  ±20 lines or is dropped. Decay is keyed on repository movement, not wall clock — the
-  same branch with nothing landed is still the same work at 400 hours; a branch switch
-  is new work at five minutes.
-- **A session digest** is written to the project knowledge base at session end — the
-  first thing that carries the shape of a whole session across. A session with nothing
-  to say writes nothing.
-
-### 🔍 Two skips that were letting real vulnerabilities through
-
-- **A bare "yes" no longer skips the review.** The bare-acknowledgment skip fired on
-  the prompt alone, ~100 lines before Verity computed what had changed. A controlled
-  probe planted an exploitable stored XSS; Verity answered *"Bare acknowledgment —
-  skipping analysis."* Both acknowledgment skips now consult the diff.
-- **The self-healing cap stops blocking, not looking.** "Max Verity iterations (2)
-  reached" was keyed on the commit, so unrelated vulnerabilities in unrelated tasks
-  counted toward the same limit — and by the time control reached the cap the content
-  had changed *by construction*, so every firing discarded genuinely new, unreviewed
-  code. It green-lit a stored XSS, an unbounded request body and a directory
-  traversal on separate days.
-- **An "orphaned window" is no longer read as an empty turn.** When a turn's edits
-  fell outside the last 256 KB of the transcript, four separate consumers read that
-  absence as proof that no code was written — one live security-fix run reviewed 4 of
-  56 changed files because of it.
-
-### 📉 A third of the review prompt was chosen alphabetically
-
-- **Project specs are no longer read from byte 0 in `ls` order.** They shipped on
-  99.8% of runs at 30 KB ≈ 7,680 tokens — 1.5% of a 2 MB corpus, selected by filename,
-  with the later files getting hundreds of bytes and one getting **two**. They are now
-  kept where they are genuinely the rubric (plan mode, or when your goal names a spec
-  path) and demoted otherwise. **Measured net: −7,321 tokens per review (≈ −32% of the
-  prompt)**, spent on this turn's goal instead.
-- Per-project override both ways: `process_constraints.specs = always | never`.
-
-### 📈 More of your change gets reviewed
-
-- **File cap raised 20 → 40**, on measured evidence rather than instinct: latency over
-  3,060 real reviewed runs fits ≈ 8.9s + 0.43s/file (40 files ≈ 26s against a 60s
-  budget), and findings per run *rise* with file count (0.19 at 1–5 files, 0.92 at 20).
-  The reviewer was not being diluted by volume; it was being starved by the cap.
-  77 of 1,611 runs sat exactly at the old 20-file wall and zero above it.
-- **Truncation declares itself.** Every subtraction stage — extension filter, file cap,
-  byte budget, the 300-line elision — now names what it dropped and why, instead of
-  silently reporting a partial review as a complete one.
-
-### 🔬 Instrumentation (invisible, and the reason the numbers above are trustworthy)
-
-- **Every turn is now countable.** Verity reviews roughly one turn in fourteen; the
-  other thirteen exited without writing anything anywhere, so every rate in the
-  product read 100% by construction. A skip beacon now records each one with a reason
-  and whether the skip was **chosen** (debounce, no delta) or **unavoidable** (no
-  token, service unreachable) — deliberately not averaged together.
-- **The full session transcript is read** — all 17 record types plus subagent
-  sidecars, instead of 2 of 17 types from the last 256 KB of a typical 2.75 MB file,
-  which recovered 37.1% of edits and never once opened a subagent sidecar (in one
-  measured session, a subagent edited 8 files that appear nowhere in the main
-  transcript). Shipped in **recording mode**: it measures what would have been
-  reviewed and changes nothing about what is.
-- Coverage telemetry, per-run identity/session/effort keys, provider health, and a
-  golden verdict corpus — so a regression in any of the above can turn something red
-  on its own.
-
-### Migrating
-
-The unit of authentication changed from **one token per repository** to **one token
-per person, per machine**.
-
-| | Before (v0.28.x) | After |
-|---|---|---|
-| Setup | `verity auth register` in every repo | `verity login` once, anywhere |
-| A new repo you can write to | Register it | Already covered |
-| A repo granted *after* you logged in | — | `verity login` again to refresh grants |
-| Token lifetime | Never expires | Logins expire after **90 days** |
-| Seeing / ending a login | Not possible | `verity sessions list`, `verity logout` |
-| CI | Reuse a project token | `verity token create --name <name>` |
-| Secret on disk | `.verity/credentials` **in the repo** + a global line | `~/.verity/credentials` **only** |
-| Where your token may be sent | Any URL the repo's `VERITY.md` named | Only the backend that **issued** it |
-
-The gate itself is unchanged (same PASS/WARN/FAIL, same findings), as is the privacy
-guarantee: code is analyzed in memory and never stored, and your GitHub token is used
-once server-side to sweep your repository access, then discarded.
-
-#### The two commands
-
-```bash
-npm install -g @codacy/verity-cli
-verity login          # approve a device code at github.com/login/device
-```
-
-Run it anywhere — login is repo-independent now, and falls back to the default service
-URL when the machine has nothing configured. Run it *inside* a repo and it also
-confirms that repo is covered. `verity init` offers the same step optionally, and
-auto-skips it without a TTY, so `/verity-setup` and CI both still work end to end.
-
-Confirm with `verity status` (should not say `Anonymous`) and `verity sessions list`
-(this machine appears, marked `← this machine`).
-
-If login reports `Access granted to 0 repositories`, the Verity GitHub App is not
-installed on any account you can reach — it prints an install link; install, then
-re-run.
-
-#### Three cases need one more step
-
-**1. CI.** Project tokens still authenticate, but service tokens are the supported
-shape. Inside the repo, as a logged-in writer:
-
-```bash
-verity token create --name github-actions   # optionally --expires <1-3650 days>
-```
-
-Printed once — store it as `VERITY_TOKEN` in your CI secret store. `VERITY_TOKEN` from
-the environment is exempt from credential pinning.
-
-**2. If you use `/usage`,** re-run `verity telemetry install` once. The OTLP block in
-`.claude/settings.local.json` no longer contains your token; it resolves one at session
-start. Takes effect on your next Claude Code session.
-
-**3. A repo whose `.verity/credentials` is gone** — typically a fresh clone, since that
-file is gitignored. The old CLI also appended a global `<remote> token: …` line
-*without* recording which backend issued it, and an unverifiable credential is now
-refused rather than sent:
-
-```
-Refusing to send your Verity login to https://…: this machine's credential does
-not record which service issued it, so it cannot be verified. Run "verity login"
-to re-issue it.
-```
-
-This is not a crash — the request never leaves your machine and the caller takes its
-normal offline path, so the Stop hook still gives you local static analysis. But
-nothing uploads until you run `verity login`. Most people never see it, because a
-surviving project-local file heals the line automatically.
-
-#### If you do nothing
-
-- **A project-local `.verity/credentials` with an `origin` remote** — auto-migrated.
-  The first `verity` command folds it into `~/.verity/credentials` and deletes the
-  in-repo file. Everything keeps working.
-- **`VERITY_TOKEN` or `--token`** — unaffected.
-- **A global keyed line with no `service_url`, and no local file to heal it** — the
-  refusal case above.
-- **No login at all** — the gate keeps running. What stops is everything needing a
-  verified identity: run history, shareable links, task tracking, cloud memory and the
-  cost views. Nothing already stored is deleted; it is paused until you log in.
-
-Per-remote lines still take precedence over your login **in their own repository**.
-After a successful login, lines it supersedes (same identity, same backend) are pruned;
-lines belonging to a **different GitHub account** or pointing at a **different backend**
-are deliberately kept, and `verity login` tells you when one shadows your login here.
-
-#### Command changes
-
-| Old | New |
-|---|---|
-| `verity auth register --project … --remote …` | `verity login` |
-| `verity login` (per-repo) | `verity login` (machine-wide, all writable repos) |
-| — | `verity logout` / `--others` / `--all` |
-| — | `verity sessions list` / `verity sessions revoke <session-id>` |
-| — | `verity token create --name <n>` / `token list` / `token revoke <id>` |
-
-`verity auth register`, `verity auth verify` and `verity auth discover` still exist and
-still work; `register` is superseded by `login` for normal use.
-
-#### Troubleshooting
-
-| You see | Means | Fix |
-|---|---|---|
-| `Refusing to send your Verity login to …` | Legacy credential with no recorded backend, or a repo naming a different one | `verity login`. If the other service is genuinely yours: `VERITY_SERVICE_URL=<url> verity login` |
-| `Your Verity login has expired or was revoked` | 90-day expiry, or revoked from another machine | `verity login` |
-| `No access grant for this repository` | Repo granted **after** your last login sweep | `verity login` to refresh grants |
-| `This repository is NOT covered by your grants` | The App is installed, but not on this repo | Grant it via the printed link, then `verity login` |
-| `origin remote is not a recognizable git URL` | An ssh alias (`gh:owner/repo`) or local path as `origin` | `git remote set-url origin <full url>` |
-| `verity status` says `Anonymous` | No user-bound credential resolved here | `verity login` |
-
-**Lost a laptop:** `verity logout --others` from a machine you still control revokes
-every other session.
-
-#### Also unchanged
-
-Anonymous usage (the gate runs, nothing is persisted), existing shareable run links,
-and GitHub as the only supported sign-in provider. Server changes reach every client on
-deploy day; the client changes need `npm install -g @codacy/verity-cli`.
-
-**Teams:** each person runs `verity login` once. Runs are attributed individually,
-while the standard, history and knowledge base stay shared across the repository.
-
-[0.29.0]: https://github.com/codacy/verity-core/releases/tag/v0.29.0
-
----
-
-## [0.26.0] — 2026-07-06
-
-### 🔒 Repo-scoped authentication (breaking)
-
-Verity now verifies that you have **write access to a repository** before it will
-store anything for that repository. Previously, any client that could reach the
-service could register a repo and read its run history — ownership was never
-proven. This release closes that gap.
-
-> **Action required for existing users:** re-run `/verity-setup` (or
-> `verity auth register`) once per repository to sign in. Until you do, Verity
-> keeps running the gate but stops recording history — see **Migration** below.
-
-#### Added
-
-- **Provider-gated registration (GitHub).** `verity auth register` now runs a
-  GitHub OAuth **device flow**: you approve the CLI in your browser, and the
-  service confirms you have push/maintain/admin access to the repo before
-  issuing a token. The provider token is used once to verify access and read
-  your verified email, then **discarded server-side** — never stored. The CLI
-  keeps a local copy in `.verity/credentials` (perms `600`) so you don't
-  re-auth on every register.
-- **User identity on tokens.** Tokens minted through registration are now bound
-  to a `user_id`. Uploaded `runs`, `tasks`, `task_classifications`, and
-  `feedback` are stamped with the author's identity.
-- **Repository access grants.** A `repository_users` grant (`write` / `admin`) is
-  recorded at registration. This is the foundation for **multiple developers on
-  one repository**: each member signs in, each gets their own token and
-  attribution, and history/knowledge stays shared across the team.
-- New tables: `verity_organizations`, `verity_users`, `organization_repositories`,
-  `repository_users` (migrations 029–032).
-
-#### Changed
-
-- **Access control on data endpoints.** `runs`, `usage`, `feedback`,
-  `classify-task`, and `otlp` ingest now require a verified repo grant and return
-  `403 FORBIDDEN` without one.
-- `POST /auth/register` now requires an `X-Provider-Token` header and returns the
-  authenticated `user.email`. New error codes: `PROVIDER_TOKEN_REQUIRED` (401),
-  `NO_WRITE_ACCESS` (403), `NO_VERIFIED_EMAIL` (422), `UNSUPPORTED_PROVIDER` (400),
-  `PROVIDER_ERROR` (502).
-- Only **GitHub** remotes are supported for registration in this release.
-
-#### Migration & compatibility
-
-- **The gate still works without signing in.** Clients holding a pre-0.26 token
-  continue to receive `POST /analyze` verdicts (PASS / WARN / FAIL, findings,
-  intent alignment) unchanged. Analysis fidelity is identical.
-- **But it goes stateless.** For an un-migrated (anonymous) token: nothing is
-  persisted — no run history, no shareable `view_url`, no task tracking, no
-  compounding memory/learning — and the `classify-task`, `runs`, `usage`,
-  `feedback`, and `otlp` endpoints return `403`.
-- **No automatic backfill.** Legacy tokens have no email on record, so they stay
-  anonymous until re-registration. Every teammate must run `/verity-setup`
-  individually to restore full functionality.
-- Existing shareable run links (view tokens) are unaffected and continue to work
-  until their 7-day TTL expires.
-
-[0.26.0]: https://github.com/codacy/verity-core/releases/tag/v0.26.0