@codacy/verity-cli 0.29.1 → 0.29.2-experimental.88e4b5c

package/bin/verity.js

@@ -10492,7 +10492,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -16693,12 +16693,33 @@ function isCodacyAvailable() {
     return false;
   }
 }
-function runCodacyAnalysis(files) {
-  const empty = {
-    tool: "@codacy/analysis-cli",
-    findings: [],
-    summary: { total_findings: 0, by_severity: {}, tools_run: [] }
+function buildAnalyzerArgv(files) {
+  return [
+    "analyze",
+    "--install-dependencies",
+    "--files",
+    ...files,
+    "--output-format",
+    "json",
+    "--log-level",
+    "error",
+    "--parallel-tools",
+    "3"
+  ];
+}
+var EMPTY_RESULT = {
+  tool: "@codacy/analysis-cli",
+  findings: [],
+  summary: { total_findings: 0, by_severity: {}, tools_run: [] }
+};
+function withFailure(kind, detail) {
+  return {
+    ...EMPTY_RESULT,
+    summary: { ...EMPTY_RESULT.summary, failure: { kind, detail: detail.slice(0, 300) } }
   };
+}
+function runCodacyAnalysis(files) {
+  const empty = EMPTY_RESULT;
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
@@ -16708,22 +16729,30 @@ function runCodacyAnalysis(files) {
     }
   });
   if (existingFiles.length === 0) return empty;
-  const fileArgs = existingFiles.join(" ");
-  let output;
-  try {
-    output = (0, import_node_child_process7.execSync)(
-      `codacy-analysis analyze --install-dependencies --files ${fileArgs} --output-format json --log-level error --parallel-tools 3`,
-      { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], maxBuffer: 10 * 1024 * 1024 }
+  const proc = (0, import_node_child_process7.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
+    encoding: "utf-8",
+    maxBuffer: 10 * 1024 * 1024
+  });
+  return interpretAnalyzerRun({
+    stdout: proc.stdout ?? "",
+    status: proc.status,
+    stderr: proc.stderr ?? "",
+    spawnError: proc.error?.message
+  });
+}
+function interpretAnalyzerRun(run) {
+  const output = run.stdout ?? "";
+  if (!output.trim()) {
+    return withFailure(
+      run.spawnError ? "spawn_failed" : "no_output",
+      run.spawnError ?? run.stderr ?? `exit ${run.status}`
     );
-  } catch {
-    return empty;
   }
-  if (!output.trim()) return empty;
   let parsed;
   try {
     parsed = JSON.parse(output);
   } catch {
-    return empty;
+    return withFailure("unparseable_output", output);
   }
   const issues = parsed.issues ?? [];
   const findings = issues.map((issue) => ({
@@ -16746,6 +16775,22 @@ function runCodacyAnalysis(files) {
       (parsed.capability?.ready ?? []).map((r) => r.toolId).filter((id) => id != null)
     )
   );
+  const analyzerErrors = parsed.errors ?? [];
+  let failure;
+  if (findings.length === 0) {
+    if (analyzerErrors.length > 0) {
+      const first = analyzerErrors[0];
+      failure = {
+        kind: first.kind ?? "analyzer_error",
+        detail: (first.message ?? "").slice(0, 300)
+      };
+    } else if (toolsRun.length === 0) {
+      failure = {
+        kind: "no_tools_ran",
+        detail: "The analyzer reported no ready tools. Usually a missing or invalid .codacy/codacy.config.json \u2014 pattern ids that match no rule leave the tool configured out of existence (VRT-105)."
+      };
+    }
+  }
   const totalFindings = findings.length;
   findings.sort(
     (a, b) => (SEVERITY_ORDER[a.severity] ?? 3) - (SEVERITY_ORDER[b.severity] ?? 3)
@@ -16758,7 +16803,8 @@ function runCodacyAnalysis(files) {
       total_findings: totalFindings,
       by_severity: bySeverity,
       tools_run: toolsRun,
-      capped: totalFindings > MAX_FINDINGS
+      capped: totalFindings > MAX_FINDINGS,
+      ...failure && { failure }
     }
   };
 }
@@ -16919,7 +16965,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.29.1" : "dev";
+    return true ? "0.29.2-experimental.88e4b5c" : "dev";
   } catch {
     return "dev";
   }
@@ -21518,7 +21564,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.29.1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.29.2-experimental.88e4b5c").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/data/skills/verity-setup/SKILL.md

@@ -160,7 +160,7 @@ Write the file to `.verity/standard.yaml`. Show the user a summary:
 > - Security patterns: 7 (3 critical, 4 high)
 > - Custom patterns: 3 (auth-middleware, rls-policy, error-boundary)
 > - Analysis mode: balanced
-> - Tools: ESLint9, Semgrep, Trivy
+> - Tools: ESLint9, Trivy
 
 Ask for confirmation before proceeding.
 
@@ -179,17 +179,62 @@ Ask for confirmation before proceeding.
 
 **NEVER use `"patterns": []`.** Always populate patterns with specific patternId entries from `patterns-reference.yaml` section 8 (`curated_patterns`). This is the single most important step for keeping analysis fast and token-efficient.
 
+### Pattern ID format — a wrong ID disables the tool SILENTLY
+
+Every ID is `<toolId>_<ruleId>`, with `/` replaced by `_`:
+
+| Rule as documented upstream | patternId to write |
+|---|---|
+| `no-eval` | `ESLint9_no-eval` |
+| `@typescript-eslint/no-explicit-any` | `ESLint9_@typescript-eslint_no-explicit-any` |
+| `F401` | `Ruff_F401` |
+| `SC2086` | `shellcheck_SC2086` |
+
+An unrecognised ID produces **no error**. The adapter builds `enabledPatterns` from
+the config, matches nothing, and returns 0 issues — indistinguishable from clean
+code. Note the perverse asymmetry: `patterns: []` (size 0) means "run all defaults"
+and works, so a *wrong* list is strictly worse than *no* list.
+
+Never hand-author or guess an ID. Copy it from `patterns-reference.yaml`, or derive
+it from the installed adapter. Then **always validate** (next section).
+
 ### How to build the config
 
-1. Read `patterns-reference.yaml` → `curated_patterns` section
-2. For each tool selected for this mode, copy its pattern list into the config
-3. For tools with an **existing local config** (e.g., `eslint.config.js`): use `localConfigurationFile` to point to it. When `localConfigurationFile` is set, the tool uses its native config and the `patterns` array is ignored — but you still MUST include at least one pattern in the array (the CLI crashes without it). Use a single placeholder: `[{ "patternId": "no-eval" }]` for ESLint, etc.
+1. **Generate the umbrella-pattern tools mechanically.** Trivy's catalogue is small,
+   fixed, and severity-partitioned, so never copy it by hand — emit it from the
+   installed adapter metadata:
+
+   ```bash
+   # balanced/thorough: critical + high vulns, secrets, malicious packages
+   node <skill-dir>/validate-patterns.mjs --emit Trivy \
+     '^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$'
+
+   # lightweight: drop malicious_packages if you want the minimum
+   # thorough: add |medium to the regex to widen severity
+   ```
+
+   Paste the emitted array straight into the Trivy `patterns` field. `--list Trivy`
+   shows all six available patterns if you need to choose a different subset.
+
+2. Read `patterns-reference.yaml` → `curated_patterns` section for the rule-level
+   tools (ESLint9, Ruff, shellcheck, …), where the curation is an editorial choice
+   about signal rather than a complete enumeration. Copy the pattern list for each
+   tool selected for this mode. `--list <toolId> <regex>` will confirm any single ID
+   or let you derive additions.
+3. For tools with an **existing local config** (e.g., `eslint.config.js`): use `localConfigurationFile` to point to it. When `localConfigurationFile` is set, the tool uses its native config and the `patterns` array is ignored — but you still MUST include at least one pattern in the array (the CLI crashes without it). Use a single placeholder: `[{ "patternId": "ESLint9_no-eval" }]` for ESLint, etc.
 4. For tools **without** a local config: populate the full curated pattern list from `patterns-reference.yaml`
+5. **Validate** (next section). This is not optional — it is the only thing that
+   catches a stale or mistyped ID, and the failure mode is silent.
 
 ### Template — write this file exactly
 
 Delete `.codacy/codacy.config.json` and write a new one. This example is for TypeScript **balanced** mode. Adapt the tool list and patterns for the detected languages and mode.
 
+> The `Trivy` block below shows what `--emit Trivy` produces for balanced mode — it is
+> illustrative output, **not** a list to copy. Run the command (step 1) and paste its
+> actual result, so the config tracks the installed adapter rather than this document.
+> `patterns-reference.yaml` deliberately stores no Trivy list for the same reason.
+
 ```json
 {
   "version": 1,
@@ -202,53 +247,40 @@ Delete `.codacy/codacy.config.json` and write a new one. This example is for Typ
       "toolId": "ESLint9",
       "localConfigurationFile": "./eslint.config.js",
       "patterns": [
-        { "patternId": "no-eval" },
-        { "patternId": "no-implied-eval" },
-        { "patternId": "no-new-func" },
-        { "patternId": "no-script-url" },
-        { "patternId": "no-unused-vars" },
-        { "patternId": "no-undef" },
-        { "patternId": "no-unreachable" },
-        { "patternId": "no-constant-condition" },
-        { "patternId": "no-dupe-keys" },
-        { "patternId": "no-duplicate-case" },
-        { "patternId": "no-fallthrough" },
-        { "patternId": "no-self-assign" },
-        { "patternId": "no-self-compare" },
-        { "patternId": "use-isnan" },
-        { "patternId": "valid-typeof" },
-        { "patternId": "no-loss-of-precision" },
-        { "patternId": "no-unsafe-optional-chaining" },
-        { "patternId": "@typescript-eslint/no-explicit-any" },
-        { "patternId": "@typescript-eslint/no-unused-vars" },
-        { "patternId": "@typescript-eslint/no-unsafe-assignment" },
-        { "patternId": "@typescript-eslint/no-unsafe-call" },
-        { "patternId": "@typescript-eslint/no-unsafe-return" },
-        { "patternId": "eqeqeq" },
-        { "patternId": "no-var" },
-        { "patternId": "prefer-const" }
-      ]
-    },
-    {
-      "toolId": "Semgrep",
-      "patterns": [
-        { "patternId": "javascript.lang.security.audit.sqli.node-sequelize-sqli" },
-        { "patternId": "javascript.lang.security.audit.sqli.node-knex-sqli" },
-        { "patternId": "typescript.lang.security.audit.sqli.node-sequelize-sqli" },
-        { "patternId": "javascript.lang.security.audit.command-injection" },
-        { "patternId": "javascript.lang.security.audit.unsafe-html" },
-        { "patternId": "generic.secrets.security.detected-generic-api-key" },
-        { "patternId": "javascript.express.security.audit.express-jwt-not-revoked" },
-        { "patternId": "javascript.jsonwebtoken.security.jwt-hardcode" }
+        { "patternId": "ESLint9_no-eval" },
+        { "patternId": "ESLint9_no-implied-eval" },
+        { "patternId": "ESLint9_no-new-func" },
+        { "patternId": "ESLint9_no-script-url" },
+        { "patternId": "ESLint9_no-unused-vars" },
+        { "patternId": "ESLint9_no-undef" },
+        { "patternId": "ESLint9_no-unreachable" },
+        { "patternId": "ESLint9_no-constant-condition" },
+        { "patternId": "ESLint9_no-dupe-keys" },
+        { "patternId": "ESLint9_no-duplicate-case" },
+        { "patternId": "ESLint9_no-fallthrough" },
+        { "patternId": "ESLint9_no-self-assign" },
+        { "patternId": "ESLint9_no-self-compare" },
+        { "patternId": "ESLint9_use-isnan" },
+        { "patternId": "ESLint9_valid-typeof" },
+        { "patternId": "ESLint9_no-loss-of-precision" },
+        { "patternId": "ESLint9_no-unsafe-optional-chaining" },
+        { "patternId": "ESLint9_@typescript-eslint_no-explicit-any" },
+        { "patternId": "ESLint9_@typescript-eslint_no-unused-vars" },
+        { "patternId": "ESLint9_@typescript-eslint_no-unsafe-assignment" },
+        { "patternId": "ESLint9_@typescript-eslint_no-unsafe-call" },
+        { "patternId": "ESLint9_@typescript-eslint_no-unsafe-return" },
+        { "patternId": "ESLint9_eqeqeq" },
+        { "patternId": "ESLint9_no-var" },
+        { "patternId": "ESLint9_prefer-const" }
       ]
     },
     {
       "toolId": "Trivy",
       "patterns": [
-        { "patternId": "trivy_vuln" },
-        { "patternId": "trivy_secret" },
-        { "patternId": "trivy_config" },
-        { "patternId": "trivy_license" }
+        { "patternId": "Trivy_vulnerability_critical" },
+        { "patternId": "Trivy_vulnerability_high" },
+        { "patternId": "Trivy_secret" },
+        { "patternId": "Trivy_malicious_packages" }
       ]
     }
   ],
@@ -263,20 +295,51 @@ Delete `.codacy/codacy.config.json` and write a new one. This example is for Typ
 }
 ```
 
+### Validate the config — REQUIRED, do not skip
+
+Immediately after writing `.codacy/codacy.config.json`, run the validator that ships
+alongside this skill. It checks every `patternId` against the IDs the installed
+adapters actually define, and exits non-zero on any that does not exist:
+
+```bash
+node "$(dirname "$0")/validate-patterns.mjs"   # or: node <skill-dir>/validate-patterns.mjs
+```
+
+Expected output:
+
+```
+  ESLint9: 25/25 valid
+  Trivy: 4/4 valid
+  shellcheck: 14/14 valid
+
+PASS: every patternId resolves.
+```
+
+**If it reports FAIL, fix the IDs before continuing.** Do not report setup as
+complete with a failing validation — every listed pattern is silently disabled, so
+the project would appear to have static analysis while enforcing nothing. The
+validator prints the conventional `<toolId>_<rule>` form as a suggested fix.
+
 **Tool selection by language** — ONLY include tools that apply to the detected languages:
 
 | Language | Balanced mode tools |
 |----------|-------------------|
-| TypeScript/JavaScript | ESLint9 + Semgrep + Trivy |
-| Python | Ruff + Semgrep + Trivy |
-| Go | Semgrep + Trivy |
-| Java | PMD7 + Semgrep + Trivy |
-| Kotlin | detekt + Semgrep + Trivy |
+| TypeScript/JavaScript | ESLint9 + Trivy |
+| Python | Ruff + Trivy |
+| Go | Trivy |
+| Java | PMD7 + Trivy |
+| Kotlin | detekt + Trivy |
 | Shell | shellcheck + Trivy |
 | C/C++ | cppcheck + flawfinder + Trivy |
 | Dockerfile | Hadolint + Trivy |
 
-Use curated patterns from `patterns-reference.yaml` for each tool. For Python, use the Ruff and Semgrep Python patterns. For TypeScript, use ESLint9 and Semgrep JS/TS patterns.
+> **Semgrep is deliberately absent.** Its curated pattern IDs have not been derived
+> yet (see the note in `patterns-reference.yaml`), and it additionally requires the
+> Opengrep binary, which `--install-dependencies` does not fetch. Omit the Semgrep
+> tool block entirely rather than emitting `patterns: []`, which would enable all
+> 2523 default rules. Re-add it once IDs are derived and the validator passes.
+
+Use curated patterns from `patterns-reference.yaml` for each tool. For Python, use the Ruff patterns. For TypeScript, use the ESLint9 patterns.
 
 **Do NOT include tools for languages not in the project.** For example:
 - Do NOT add ESLint9 to a Python project
@@ -297,16 +360,34 @@ Use curated patterns from `patterns-reference.yaml` for each tool. For Python, u
 | Mode | Tools | Approximate pattern count |
 |------|-------|--------------------------|
 | lightweight | Trivy only | ~4 patterns |
-| balanced | Language linter + Semgrep + Trivy | ~25 + ~8-17 + 4 = ~40 patterns |
+| balanced | Language linter + Trivy | ~25 + 4 = ~29 patterns |
 | thorough | All applicable + Lizard | ~60-80 patterns |
 
 ### Verify
 
+First confirm every pattern ID resolves (see "Validate the config" above) — a silently
+disabled tool produces the same zero findings as clean code, so a quiet run proves
+nothing on its own:
+
+```bash
+node <skill-dir>/validate-patterns.mjs
+```
+
+Then confirm the volume is sane:
+
 ```bash
 codacy-analysis analyze --install-dependencies --files src/some-small-file.ts --log-level error --output-format json 2>/dev/null
 ```
 
-Expected: single-digit findings per file, not hundreds. If you see 50+ issues from one file, you likely have `"patterns": []` somewhere — fix it. The `--install-dependencies` flag ensures any missing tool binaries (ESLint9, Semgrep, Trivy, etc.) are auto-installed by the CLI — no need to install them manually.
+Expected: single-digit findings per file, not hundreds. If you see 50+ issues from one
+file, you likely have `"patterns": []` somewhere — fix it.
+
+Check the `capability.ready` array in the JSON to see which tools actually ran.
+`--install-dependencies` handles tools the CLI can install itself (ESLint9 is bundled,
+shellcheck it downloads, Trivy it finds on PATH) but it does **not** fetch every
+binary — Semgrep needs Opengrep installed separately, and at `--log-level error` the
+"Tool unavailable" warning is suppressed, so the omission is invisible. Use
+`--log-level warning` or `--inspect` when a tool seems to report nothing.
 
 ---
 

package/data/skills/verity-setup/patterns-reference.yaml

@@ -395,7 +395,20 @@ analysis_modes:
 # 8. Curated Patterns Per Tool
 #    IMPORTANT: patterns: [] means ALL defaults (thousands of rules, massive
 #    token consumption and slow runs). Always use these curated lists instead.
-#    Pattern IDs match @codacy/analysis-cli patternId format.
+#
+#    PATTERN ID FORMAT — get this wrong and the tool fails SILENTLY.
+#    Every ID is `<toolId>_<ruleId>`, with `/` replaced by `_`:
+#        no-eval                            → ESLint9_no-eval
+#        @typescript-eslint/no-explicit-any  → ESLint9_@typescript-eslint_no-explicit-any
+#        F401                               → Ruff_F401
+#        SC2086                             → shellcheck_SC2086
+#    An unrecognised ID is not an error. The adapter builds `enabledPatterns` from
+#    the config, matches nothing, and reports 0 issues — identical to clean code.
+#    Perversely, `patterns: []` (size 0) means "all defaults" and DOES work, so a
+#    wrong list is strictly worse than no list.
+#
+#    ALWAYS run `node validate-patterns.mjs` after writing codacy.config.json.
+#    Never hand-author an ID; derive it from the installed adapter metadata.
 # =============================================================================
 
 curated_patterns:
@@ -405,101 +418,116 @@ curated_patterns:
     description: "Security + error-prone + TypeScript strictness. Skips style/formatting."
     patterns:
       # Security (MUST have)
-      - patternId: "no-eval"
-      - patternId: "no-implied-eval"
-      - patternId: "no-new-func"
-      - patternId: "no-script-url"
+      - patternId: "ESLint9_no-eval"
+      - patternId: "ESLint9_no-implied-eval"
+      - patternId: "ESLint9_no-new-func"
+      - patternId: "ESLint9_no-script-url"
       # Error-prone (high value)
-      - patternId: "no-unused-vars"
-      - patternId: "no-undef"
-      - patternId: "no-unreachable"
-      - patternId: "no-constant-condition"
-      - patternId: "no-dupe-keys"
-      - patternId: "no-duplicate-case"
-      - patternId: "no-fallthrough"
-      - patternId: "no-self-assign"
-      - patternId: "no-self-compare"
-      - patternId: "use-isnan"
-      - patternId: "valid-typeof"
-      - patternId: "no-loss-of-precision"
-      - patternId: "no-unsafe-optional-chaining"
+      - patternId: "ESLint9_no-unused-vars"
+      - patternId: "ESLint9_no-undef"
+      - patternId: "ESLint9_no-unreachable"
+      - patternId: "ESLint9_no-constant-condition"
+      - patternId: "ESLint9_no-dupe-keys"
+      - patternId: "ESLint9_no-duplicate-case"
+      - patternId: "ESLint9_no-fallthrough"
+      - patternId: "ESLint9_no-self-assign"
+      - patternId: "ESLint9_no-self-compare"
+      - patternId: "ESLint9_use-isnan"
+      - patternId: "ESLint9_valid-typeof"
+      - patternId: "ESLint9_no-loss-of-precision"
+      - patternId: "ESLint9_no-unsafe-optional-chaining"
       # TypeScript (if applicable)
-      - patternId: "@typescript-eslint/no-explicit-any"
-      - patternId: "@typescript-eslint/no-unused-vars"
-      - patternId: "@typescript-eslint/no-unsafe-assignment"
-      - patternId: "@typescript-eslint/no-unsafe-call"
-      - patternId: "@typescript-eslint/no-unsafe-return"
+      - patternId: "ESLint9_@typescript-eslint_no-explicit-any"
+      - patternId: "ESLint9_@typescript-eslint_no-unused-vars"
+      - patternId: "ESLint9_@typescript-eslint_no-unsafe-assignment"
+      - patternId: "ESLint9_@typescript-eslint_no-unsafe-call"
+      - patternId: "ESLint9_@typescript-eslint_no-unsafe-return"
       # Best practice
-      - patternId: "eqeqeq"
-      - patternId: "no-var"
-      - patternId: "prefer-const"
-
-  # --- Semgrep / Opengrep (2517 available → security-focused subset) ---
-  # Semgrep patterns use registry rule IDs. These target OWASP Top 10.
+      - patternId: "ESLint9_eqeqeq"
+      - patternId: "ESLint9_no-var"
+      - patternId: "ESLint9_prefer-const"
+
+  # --- Semgrep / Opengrep (2523 available) — PATTERN LIST NOT YET DERIVED ---
+  #
+  # DO NOT emit a Semgrep block into codacy.config.json until the IDs below are
+  # derived and `validate-patterns.mjs` passes. The 17 IDs previously listed here
+  # were invented and matched nothing, so Semgrep silently reported zero findings.
+  #
+  # Real IDs repeat the trailing segment and carry the tool prefix, e.g.
+  #   Semgrep_javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
+  #   Semgrep_generic.secrets.security.detected-artifactory-token.detected-artifactory-token
+  # Derive them from the installed adapter, never by hand:
+  #   node -e "const fs=require('fs');const d=process.env.CODACY_TOOLS_DIR+'/tools-opengrep-1/dist';\
+  #     let b='';for(const f of fs.readdirSync(d))if(f.endsWith('.js'))b+=fs.readFileSync(d+'/'+f,'utf8');\
+  #     console.log([...new Set(b.match(/Semgrep_[A-Za-z0-9_.-]+/g))].sort().join('\n'))"
+  #
+  # Also note Semgrep needs the Opengrep binary, which `--install-dependencies`
+  # does NOT fetch:  curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash
+  #
+  # Categories to cover when curating (counts of real candidates in parentheses):
+  #   SQL injection, JS/TS (8) · XSS / unsafe HTML (15) · generic secrets (49)
+  #   hardcoded JWT secret (4) · Python deserialization / pickle (6)
+  #   NOTE: no rule matches "command-injection" for JavaScript — the old entry was fiction.
   Semgrep:
     description: "Security-only: injection, XSS, secrets, auth. No style rules."
-    patterns:
-      # Injection (SQL, NoSQL, command)
-      - patternId: "javascript.lang.security.audit.sqli.node-sequelize-sqli"
-      - patternId: "javascript.lang.security.audit.sqli.node-knex-sqli"
-      - patternId: "typescript.lang.security.audit.sqli.node-sequelize-sqli"
-      - patternId: "python.lang.security.audit.sqli.raw-query"
-      - patternId: "python.django.security.injection.sql.sql-injection"
-      - patternId: "go.lang.security.audit.sqli.gosql-sqli"
-      - patternId: "java.lang.security.audit.sqli.jdbc-sqli"
-      # Command injection
-      - patternId: "javascript.lang.security.audit.command-injection"
-      - patternId: "python.lang.security.audit.dangerous-subprocess-use"
-      # XSS
-      - patternId: "javascript.browser.security.insufficient-postmessage-origin-validation"
-      - patternId: "javascript.lang.security.audit.unsafe-html"
-      # Secrets
-      - patternId: "generic.secrets.security.detected-generic-api-key"
-      - patternId: "generic.secrets.security.detected-aws-account-id"
-      # Deserialization
-      - patternId: "python.lang.security.deserialization.avoid-pickle"
-      - patternId: "python.lang.security.deserialization.avoid-yaml-load"
-      # Auth
-      - patternId: "javascript.express.security.audit.express-jwt-not-revoked"
-      - patternId: "javascript.jsonwebtoken.security.jwt-hardcode"
-
-  # --- Trivy (6 umbrella patterns → use all, already minimal) ---
+    status: unverified   # omit from generated config until derived + validated
+    patterns: []         # intentionally empty — see note above, do NOT copy into config
+
+  # --- Trivy — DERIVED, NOT HAND-MAINTAINED ---
+  #
+  # Trivy's catalogue is a fixed set of 6 umbrella patterns, so the config block is
+  # GENERATED from adapter metadata rather than copied from here. The list below is
+  # a cached snapshot for reading convenience only; the generator must emit it:
+  #
+  #   node validate-patterns.mjs --emit Trivy \
+  #     '^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$'
+  #
+  # If this snapshot ever disagrees with `--list Trivy`, the adapter wins — the
+  # snapshot is stale and should be regenerated. Severity is fixed per pattern, so
+  # severity filtering IS pattern selection. There is NO misconfig/config or license
+  # pattern; the old `trivy_config`/`trivy_license` entries were fiction.
   Trivy:
-    description: "Vulnerability + secret scanning. Already minimal at 6 patterns."
-    patterns:
-      - patternId: "trivy_vuln"
-      - patternId: "trivy_secret"
-      - patternId: "trivy_config"
-      - patternId: "trivy_license"
+    description: "Dependency vulnerabilities, secrets, malicious packages. 6 patterns total."
+    source: derived
+    # NO pattern list is stored here ON PURPOSE. There is exactly one source of truth
+    # — the installed adapter — so there is nothing here to copy, mistype, or let go
+    # stale. Run `--list Trivy` to see all six, `--emit Trivy '<regex>'` to generate
+    # the config block.
+    #
+    # Selecting by severity IS selecting patterns (severity is fixed per pattern):
+    #   lightweight  '^Trivy_(secret|vulnerability_critical)$'
+    #   balanced     '^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$'
+    #   thorough     '^Trivy_(secret|malicious_packages|vulnerability_(critical|high|medium))$'
+    patterns: derive   # sentinel: not a list — see above. Never emit this value.
 
   # --- Ruff (773 available → ~20 high-signal) ---
   Ruff:
     description: "Python errors + security. Skips style/formatting (use formatter instead)."
     patterns:
       # Pyflakes — error-prone
-      - patternId: "F401"    # unused import
-      - patternId: "F811"    # redefined unused name
-      - patternId: "F841"    # unused variable
-      - patternId: "F821"    # undefined name
+      - patternId: "Ruff_F401"    # unused import
+      - patternId: "Ruff_F811"    # redefined unused name
+      - patternId: "Ruff_F841"    # unused variable
+      - patternId: "Ruff_F821"    # undefined name
       # Bugbear — likely bugs
-      - patternId: "B006"    # mutable default argument
-      - patternId: "B007"    # unused loop variable
-      - patternId: "B018"    # useless expression
+      - patternId: "Ruff_B006"    # mutable default argument
+      - patternId: "Ruff_B007"    # unused loop variable
+      - patternId: "Ruff_B018"    # useless expression
       # Security
-      - patternId: "S101"    # assert used (not for prod)
-      - patternId: "S102"    # exec used
-      - patternId: "S103"    # bad file permissions
-      - patternId: "S104"    # hardcoded bind all interfaces
-      - patternId: "S105"    # hardcoded password string
-      - patternId: "S106"    # hardcoded password argument
-      - patternId: "S107"    # hardcoded password default
-      - patternId: "S108"    # hardcoded temp file
-      - patternId: "S110"    # try-except-pass
-      - patternId: "S301"    # pickle usage
-      - patternId: "S608"    # SQL injection via string formatting
+      - patternId: "Ruff_S101"    # assert used (not for prod)
+      - patternId: "Ruff_S102"    # exec used
+      - patternId: "Ruff_S103"    # bad file permissions
+      - patternId: "Ruff_S104"    # hardcoded bind all interfaces
+      - patternId: "Ruff_S105"    # hardcoded password string
+      - patternId: "Ruff_S106"    # hardcoded password argument
+      - patternId: "Ruff_S107"    # hardcoded password default
+      - patternId: "Ruff_S108"    # hardcoded temp file
+      - patternId: "Ruff_S110"    # try-except-pass
+      - patternId: "Ruff_S301"    # pickle usage
+      - patternId: "Ruff_S608"    # SQL injection via string formatting
       # Type annotations (if desired)
-      - patternId: "ANN001"  # missing type annotation for function argument
-      - patternId: "ANN201"  # missing return type annotation
+      - patternId: "Ruff_ANN001"  # missing type annotation for function argument
+      - patternId: "Ruff_ANN201"  # missing return type annotation
 
   # --- ShellCheck (491 available → ~15 high-signal) ---
   shellcheck:

package/data/skills/verity-setup/validate-patterns.mjs

@@ -0,0 +1,345 @@
+#!/usr/bin/env node
+/**
+ * Derive and validate codacy-analysis patternIds against the pattern catalogue the
+ * installed @codacy/analysis-cli tool adapters actually define.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * A wrong patternId fails SILENTLY. Each adapter builds `enabledPatterns` from the
+ * config and then either skips work entirely or filters every result away:
+ *
+ *   runVulnScan = enabledPatterns.size === 0 || vulnPatternIds.some(id => enabledPatterns.has(id))
+ *
+ * So a tool with an unrecognised pattern list reports "ready", routes files, and
+ * returns 0 issues — indistinguishable from clean code. Worse, `size === 0` means
+ * "run ALL defaults", so an empty list works while a wrong list silently disables
+ * the tool. Verity shipped `trivy_vuln`, bare `no-eval`, and bare `F401` for months;
+ * ESLint, Semgrep, Trivy and Ruff were all dead and nothing surfaced it.
+ *
+ * The ID format is `<toolId>_<ruleId>`, with `/` replaced by `_` in namespaced
+ * rules (`@typescript-eslint/no-explicit-any` → `ESLint9_@typescript-eslint_no-explicit-any`).
+ *
+ * MODES
+ *   validate [config]              Check every patternId in the config resolves.
+ *                                  Exit 1 if any does not. Default: .codacy/codacy.config.json
+ *   --list <toolId> [regex]        Print the adapter's real pattern IDs, one per line.
+ *   --emit <toolId> [regex]        Print a ready-to-paste JSON "patterns" array.
+ *
+ * Use --emit to GENERATE config blocks so IDs are never hand-authored, e.g. Trivy:
+ *   node validate-patterns.mjs --emit Trivy '^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$'
+ */
+
+import { readFileSync, readdirSync, existsSync, realpathSync, statSync, writeSync } from 'node:fs'
+import { join, dirname, delimiter } from 'node:path'
+
+/**
+ * Locate the @codacy adapter packages shipped with the installed analysis CLI.
+ * Resolved without shelling out, so this works on Windows as well as POSIX.
+ */
+function findToolsDir() {
+  if (process.env.CODACY_TOOLS_DIR) return process.env.CODACY_TOOLS_DIR
+
+  // Walk PATH ourselves rather than calling `which`/`where`, which differ per platform.
+  const exts = process.platform === 'win32'
+    ? (process.env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';')
+    : ['']
+  const candidates = []
+  for (const dir of (process.env.PATH ?? '').split(delimiter)) {
+    if (!dir) continue
+    for (const ext of exts) {
+      candidates.push(join(dir, 'codacy-analysis' + ext.toLowerCase()))
+      if (ext) candidates.push(join(dir, 'codacy-analysis' + ext))
+    }
+  }
+
+  for (const candidate of candidates) {
+    let resolved
+    try {
+      if (!statSync(candidate).isFile()) continue
+      resolved = realpathSync(candidate)
+    } catch {
+      continue
+    }
+    // resolved is <pkg>/dist/index.js (POSIX symlink) or a shim dir (Windows).
+    // Walk up looking for node_modules/@codacy.
+    let dir = dirname(resolved)
+    for (let i = 0; i < 6; i++) {
+      const tools = join(dir, 'node_modules', '@codacy')
+      if (existsSync(tools)) return tools
+      const parent = dirname(dir)
+      if (parent === dir) break
+      dir = parent
+    }
+  }
+  return null
+}
+
+/**
+ * Harvest the pattern IDs an adapter defines. Adapters ship as bundled JS with the
+ * pattern catalogue inlined, so we scan for `<toolId>_<rule>` literals. This is a
+ * heuristic over a build artifact, not a public API — it can only ever produce false
+ * ALARMS (an ID we fail to find), never false confidence, which is the safe direction.
+ */
+/** The characters a pattern id may contain after its `<toolId>_` prefix. */
+const ID_CHAR = /[A-Za-z0-9_@./-]/
+
+/**
+ * Scan for `<toolId>_<rule>` literals WITHOUT building a regex from `toolId`.
+ *
+ * The previous form compiled `new RegExp(`${escaped}_[...]+`)` per call. Escaping
+ * made it correct, but a RegExp built from a runtime value is a ReDoS surface by
+ * construction and reads as one to any reviewer or scanner. An indexOf scan has
+ * neither problem, needs no escaping to be right, and is what the code was always
+ * expressing: find the prefix, then take the id characters that follow it.
+ */
+function harvestIds(toolsDir, toolId) {
+  const ids = new Set()
+  const prefix = toolId + '_'
+  const scan = (text) => {
+    let i = text.indexOf(prefix)
+    while (i !== -1) {
+      let end = i + prefix.length
+      while (end < text.length && ID_CHAR.test(text[end])) end++
+      // A bare prefix with nothing after it is not an id.
+      if (end > i + prefix.length) ids.add(text.slice(i, end))
+      i = text.indexOf(prefix, end > i ? end : i + 1)
+    }
+  }
+  for (const pkg of readdirSync(toolsDir)) {
+    if (!pkg.startsWith('tools-')) continue
+    const distDir = join(toolsDir, pkg, 'dist')
+    if (!existsSync(distDir)) continue
+    for (const file of readdirSync(distDir)) {
+      if (!file.endsWith('.js')) continue
+      scan(readFileSync(join(distDir, file), 'utf-8'))
+    }
+  }
+  return ids
+}
+
+const toolsDir = findToolsDir()
+if (!toolsDir) {
+  console.error('SKIP: could not locate @codacy tool adapters.')
+  console.error('      Install the CLI (npm i -g @codacy/analysis-cli) or set CODACY_TOOLS_DIR.')
+  process.exit(1)
+}
+
+/**
+ * Write to fd 1 synchronously, looping until every byte is gone.
+ *
+ * `console.log` / `process.stdout.write` are ASYNCHRONOUS when stdout is a pipe,
+ * and this script exits in the same tick — so the output was cut at whatever the
+ * pipe accepted. A write callback does not help either: this is a top-level
+ * block, so execution falls through to the validate path and exits 1 before the
+ * callback can run (observed: 65536 bytes, status 1).
+ *
+ * The loop matters. A single writeSync to a pipe may report a SHORT write, and
+ * dropping the remainder would reintroduce the same bug in a quieter form.
+ */
+function writeStdoutSync(text) {
+  const buf = Buffer.from(text, 'utf8')
+  let off = 0
+  while (off < buf.length) {
+    try {
+      off += writeSync(1, buf, off, buf.length - off)
+    } catch (err) {
+      if (err.code === 'EAGAIN') continue // non-blocking pipe not ready; retry
+      if (err.code === 'EPIPE') return // consumer went away (e.g. `| head`)
+      throw err
+    }
+  }
+}
+
+const argv = process.argv.slice(2)
+const mode = argv[0] === '--list' || argv[0] === '--emit' ? argv[0] : 'validate'
+
+// ---------------------------------------------------------------------------
+// --list / --emit : derive IDs straight from adapter metadata
+// ---------------------------------------------------------------------------
+if (mode !== 'validate') {
+  const toolId = argv[1]
+  if (!toolId) {
+    console.error(`Usage: validate-patterns.mjs ${mode} <toolId> [regex]`)
+    process.exit(1)
+  }
+  // An invalid pattern here is a typo in a hand-typed argument, not an error worth a
+  // stack trace — report it with the offending input so it can be fixed at a glance.
+  let filter = null
+  if (argv[2]) {
+    try {
+      // The filter IS a regex — that is the documented interface
+      // (`--list Trivy '^Trivy_secret$'`) and two tests pin the behaviour, so it
+      // cannot become a substring match. Unlike the harvest above, there is no
+      // way to express this without compiling a runtime value.
+      //
+      // It is also not a security boundary: this is a local developer CLI, the
+      // pattern comes from the operator's own shell, and the only thing a
+      // catastrophic regex can stall is the operator's own terminal. Nothing
+      // untrusted reaches this line — `argv[2]` is typed by the person running it.
+      // Suppressions for both engines Codacy may raise this under. The ESLint
+      // form alone did not clear it, so the finding comes from the Semgrep side;
+      // `nosemgrep` is rule-agnostic, which is deliberate here — pinning a rule id
+      // guessed from a message string is how the first attempt failed.
+      // eslint-disable-next-line security/detect-non-literal-regexp -- operator-supplied filter, local CLI, self-inflicted at worst
+      // nosemgrep: operator-supplied filter on a local CLI; see the reasoning above
+      filter = new RegExp(argv[2])
+    } catch (err) {
+      console.error(`Invalid regex: ${argv[2]}`)
+      console.error(`  ${err.message}`)
+      console.error(`  Note: quote the argument so the shell does not expand it, e.g. '^Trivy_secret$'`)
+      process.exit(1)
+    }
+  }
+  const ids = [...harvestIds(toolsDir, toolId)].sort().filter((id) => !filter || filter.test(id))
+  if (ids.length === 0) {
+    console.error(`No pattern IDs found for toolId "${toolId}"${filter ? ' matching ' + argv[2] : ''}.`)
+    console.error('Check the toolId spelling (case-sensitive: ESLint9, Semgrep, Trivy, Ruff, shellcheck).')
+    process.exit(1)
+  }
+  // ⚠ NEVER `process.exit()` IN THE SAME TICK AS A WRITE TO STDOUT.
+  //
+  // When stdout is a PIPE, Node's writes are asynchronous. `process.exit()`
+  // terminates before the buffer drains, truncating output at whatever the pipe
+  // accepted — about 64 KB. Redirecting to a FILE hides it completely, because
+  // file writes are synchronous. So it looks fine every time you check by hand,
+  // and is broken for every caller that reads the output programmatically.
+  //
+  // Measured on the ESLint9 catalogue (2936 ids), five runs each:
+  //   node ... > file   ->  2936, 2936, 2936, 2936, 2936   (whole)
+  //   node ... | cat    ->  1812, 1812, 1812, 1812, 1812   (cut at the buffer)
+  //
+  // The harvest is deterministic. Only the DELIVERY was not, and it cost a real
+  // misdiagnosis: `ESLint9_use-isnan` sorts at line 2608, past the cut, so every
+  // consumer reading through a pipe — including the review that flagged it —
+  // concluded a perfectly valid pattern id did not exist.
+  //
+  // `process.exitCode = 0` alone is NOT enough here: this is a top-level block,
+  // so execution would fall through into the validate path below and exit there,
+  // truncating exactly as before. The write callback fires once the data has been
+  // handed to the OS, which is the point at which exiting is safe.
+  const out =
+    mode === '--list'
+      ? ids.join('\n')
+      : JSON.stringify(ids.map((patternId) => ({ patternId })), null, 2)
+  writeStdoutSync(out + '\n')
+  process.exit(0)
+}
+
+// ---------------------------------------------------------------------------
+// validate : every patternId in the config must resolve
+// ---------------------------------------------------------------------------
+const configPath = argv[0] ?? '.codacy/codacy.config.json'
+
+if (!existsSync(configPath)) {
+  console.error(`SKIP: ${configPath} not found — write the config first.`)
+  process.exit(1)
+}
+
+let config
+try {
+  config = JSON.parse(readFileSync(configPath, 'utf-8'))
+} catch (err) {
+  console.error(`FAIL: could not parse ${configPath}`)
+  console.error(`  ${err.message}`)
+  process.exit(1)
+}
+
+const tools = config?.tools ?? []
+if (!Array.isArray(tools)) {
+  console.error(`FAIL: ${configPath} has a "tools" field that is not an array.`)
+  process.exit(1)
+}
+
+if (tools.length === 0) {
+  console.log('OK: "tools": [] — every tool runs its default pattern set. Nothing to validate.')
+  process.exit(0)
+}
+
+let invalidTotal = 0
+let emptyTotal = 0
+let unverifiableTotal = 0
+
+/**
+ * Reject a malformed tools[] entry with a located, actionable message. A generator
+ * bug or a half-written file must fail closed here rather than throw somewhere
+ * further down, where the stack trace would say nothing about which entry is bad.
+ */
+function readToolEntry(tool, index) {
+  const at = `tools[${index}]`
+  if (tool === null || typeof tool !== 'object' || Array.isArray(tool)) {
+    console.error(`FAIL: ${at} is not an object.`)
+    process.exit(1)
+  }
+  const { toolId, patterns } = tool
+  if (typeof toolId !== 'string' || toolId.trim() === '') {
+    console.error(`FAIL: ${at} has no valid "toolId" (expected a non-empty string).`)
+    process.exit(1)
+  }
+  if (patterns !== undefined && !Array.isArray(patterns)) {
+    console.error(`FAIL: ${toolId}: "patterns" must be an array, or omitted for tool defaults.`)
+    process.exit(1)
+  }
+  const patternIds = []
+  for (const [i, entry] of (patterns ?? []).entries()) {
+    if (entry === null || typeof entry !== 'object' || typeof entry.patternId !== 'string') {
+      console.error(
+        `FAIL: ${toolId}: patterns[${i}] must be an object with a string "patternId".`,
+      )
+      process.exit(1)
+    }
+    patternIds.push(entry.patternId)
+  }
+  return { toolId, patternIds }
+}
+
+for (const [index, rawTool] of tools.entries()) {
+  const { toolId, patternIds } = readToolEntry(rawTool, index)
+  if (patternIds.length === 0) {
+    console.log(`  ${toolId}: patterns: [] → all defaults enabled (valid, but noisy)`)
+    emptyTotal++
+    continue
+  }
+  const valid = harvestIds(toolsDir, toolId)
+  // FAIL CLOSED. "Cannot verify" is not "verified". This whole script exists because
+  // a silently-disabled tool looks identical to clean code, so reporting PASS on an
+  // unverifiable tool would reproduce the exact failure it is meant to catch.
+  if (valid.size === 0) {
+    unverifiableTotal++
+    console.log(
+      `  ${toolId}: UNVERIFIABLE — no pattern IDs harvested. Adapter missing, or the` +
+        ` toolId is misspelled (case-sensitive).`,
+    )
+    continue
+  }
+  const bad = patternIds.filter((id) => !valid.has(id))
+  if (bad.length === 0) {
+    console.log(`  ${toolId}: ${patternIds.length}/${patternIds.length} valid`)
+  } else {
+    invalidTotal += bad.length
+    console.log(
+      `  ${toolId}: ${patternIds.length - bad.length}/${patternIds.length} valid — ${bad.length} INVALID:`,
+    )
+    for (const id of bad) {
+      // Suggest the conventional form so the fix is obvious.
+      const guess = `${toolId}_${id.replace(/\//g, '_')}`
+      const hint = valid.has(guess)
+        ? `did you mean "${guess}"?`
+        : `no close match — regenerate with: --emit ${toolId}`
+      console.log(`      ✗ ${id} — ${hint}`)
+    }
+  }
+}
+
+console.log('')
+if (invalidTotal > 0) {
+  console.error(`FAIL: ${invalidTotal} patternId(s) do not exist. Those rules are SILENTLY DISABLED.`)
+  console.error('      Regenerate the list with --emit <toolId>, or use "patterns": [] for tool defaults.')
+  process.exit(1)
+}
+if (unverifiableTotal > 0) {
+  console.error(`FAIL: ${unverifiableTotal} tool(s) could not be verified — this is NOT a pass.`)
+  console.error('      Check the toolId spelling, reinstall @codacy/analysis-cli, or point')
+  console.error('      CODACY_TOOLS_DIR at the directory holding the tools-* adapter packages.')
+  process.exit(1)
+}
+console.log(`PASS: every patternId resolves${emptyTotal ? ` (${emptyTotal} tool(s) on defaults)` : ''}.`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.1",
+  "version": "0.29.2-experimental.88e4b5c",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",