@codacy/verity-cli 0.29.2 → 0.29.4

package/bin/verity.js

@@ -10833,6 +10833,12 @@ function writeBaselineSha(sha) {
   } catch {
   }
 }
+var VERITY_OWNED_PREFIXES = [".verity/", ".gate/", ".codacy/"];
+var VERITY_OWNED_FILES = ["VERITY.md"];
+function isVerityOwnedPath(file) {
+  const p = file.replace(/\\/g, "/");
+  return VERITY_OWNED_PREFIXES.some((d) => p.startsWith(d)) || VERITY_OWNED_FILES.includes(p);
+}
 function getChangedFiles() {
   const sets = /* @__PURE__ */ new Set();
   let hasRecentCommitFiles = false;
@@ -10859,18 +10865,18 @@ function getChangedFiles() {
       }
     }
   }
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const filtered = Array.from(sets).filter((f) => !isVerityOwnedPath(f));
   return { files: filtered, hasRecentCommitFiles };
 }
 function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !isVerityOwnedPath(f));
 }
 function getDirtyFiles() {
   const set = /* @__PURE__ */ new Set();
   for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
   for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
   for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return Array.from(set).filter((f) => !isVerityOwnedPath(f));
 }
 function showContentAtRef(ref, repoRelPath) {
   if (!ref || ref === "no-git") return null;
@@ -16809,6 +16815,46 @@ function interpretAnalyzerRun(run) {
   };
 }
 
+// src/lib/remediation-guard.ts
+var TOOL_CONFIG_PATTERNS = [
+  /(^|\/)\.codacy\//,
+  /(^|\/)codacy\.(config\.)?(json|ya?ml)$/,
+  /(^|\/)eslint\.config\.(js|mjs|cjs|ts)$/,
+  /(^|\/)\.eslintrc(\.(json|ya?ml|js|cjs))?$/,
+  /(^|\/)\.?semgrep(\.(ya?ml))?$/,
+  /(^|\/)trivy\.ya?ml$/,
+  /(^|\/)\.trivyignore$/,
+  /(^|\/)sonar-project\.properties$/,
+  /(^|\/)\.?ruff\.toml$/,
+  /(^|\/)\.bandit$/,
+  /(^|\/)pmd\.xml$/,
+  /(^|\/)\.hadolint\.ya?ml$/
+];
+function isAnalysisToolConfig(file) {
+  if (!file) return false;
+  const p = file.replace(/\\/g, "/");
+  return TOOL_CONFIG_PATTERNS.some((re) => re.test(p));
+}
+var PROPOSES_PATTERN_ID = /["']patternId["']\s*:/;
+function screenRemediation(fix, findingFile) {
+  const suggestion = typeof fix?.suggestion === "string" ? fix.suggestion : "";
+  if (!suggestion) return { suggestion: null, withheldReason: null };
+  const target = typeof fix?.file === "string" && fix.file || (typeof findingFile === "string" ? findingFile : "");
+  if (isAnalysisToolConfig(target)) {
+    return {
+      suggestion: null,
+      withheldReason: "withheld \u2014 Verity does not hand-write edits to analysis-tool configuration. Run `node .claude/skills/verity-setup/validate-patterns.mjs` to check this file against the real adapter catalogue."
+    };
+  }
+  if (PROPOSES_PATTERN_ID.test(suggestion)) {
+    return {
+      suggestion: null,
+      withheldReason: "withheld \u2014 this suggestion proposes a tool `patternId`, which Verity cannot verify. Check it with `node .claude/skills/verity-setup/validate-patterns.mjs --list <toolId>` before applying."
+    };
+  }
+  return { suggestion, withheldReason: null };
+}
+
 // src/lib/specs.ts
 var import_node_fs17 = require("node:fs");
 var import_node_path16 = require("node:path");
@@ -16965,7 +17011,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.29.2" : "dev";
+    return true ? "0.29.4" : "dev";
   } catch {
     return "dev";
   }
@@ -19661,15 +19707,18 @@ ${lines.join("\n")}`,
           const line = f.line ?? "";
           const fix = f.fix;
           const fixDesc = fix?.description ?? "See description";
-          const suggestion = fix?.suggestion ?? "";
+          const screened = screenRemediation(fix, f.file);
           process.stderr.write(`[${severity}] ${title}
 `);
           process.stderr.write(`  File: ${file}:${line}
 `);
           process.stderr.write(`  Fix: ${fixDesc}
 `);
-          if (suggestion) {
-            process.stderr.write(`  Suggestion: ${suggestion}
+          if (screened.suggestion) {
+            process.stderr.write(`  Suggestion: ${screened.suggestion}
+`);
+          } else if (screened.withheldReason) {
+            process.stderr.write(`  Suggestion: ${screened.withheldReason}
 `);
           }
           process.stderr.write("\n");
@@ -21564,7 +21613,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.29.2").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.29.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/data/skills/verity-setup/SKILL.md

@@ -221,7 +221,43 @@ it from the installed adapter. Then **always validate** (next section).
    about signal rather than a complete enumeration. Copy the pattern list for each
    tool selected for this mode. `--list <toolId> <regex>` will confirm any single ID
    or let you derive additions.
-3. For tools with an **existing local config** (e.g., `eslint.config.js`): use `localConfigurationFile` to point to it. When `localConfigurationFile` is set, the tool uses its native config and the `patterns` array is ignored — but you still MUST include at least one pattern in the array (the CLI crashes without it). Use a single placeholder: `[{ "patternId": "ESLint9_no-eval" }]` for ESLint, etc.
+> ⚠ **Semgrep ids carry a doubled suffix.** The rule name appears twice — once as
+> the path segment and once as the rule id:
+> `Semgrep_javascript.browser.security.raw-html-concat.raw-html-concat`. Deriving
+> them with `--list Semgrep '<regex>'` gives the correct form; constructing them by
+> hand from the rule name does not.
+
+3. ⚠ **NEVER point `localConfigurationFile` at the project's own config** (VRT-108).
+   Doing so hands the tool the project's rule set, and Verity's `patterns` array
+   degrades to a **filter over rules someone else enabled** — it can no longer turn
+   a rule ON. A project that disables a rule makes it permanently unreachable by
+   the gate, silently. Measured: a repo whose `eslint.config.js` sets
+   `"@typescript-eslint/no-unused-vars": "off"` and omits `no-eval`/`eqeqeq`/`no-var`
+   had all four listed in its Verity config and **only** `no-explicit-any` could fire.
+
+   Setting the path is not even sufficient on its own. `useLocalConfigurationFile`
+   **defaults to true**, and the adapter auto-discovers `./eslint.config.js` and
+   overrides your value unless the flag is explicitly `false`:
+
+   ```js
+   // @codacy/analysis-cli — defaults to true unless EXPLICITLY false
+   if (!existing || existing.useLocalConfigurationFile !== false) {
+     config.useLocalConfigurationFile = true;
+   }
+   // patterns become the ENABLED set only when the flag is false
+   if (!codacyToolConfig.useLocalConfigurationFile && codacyToolConfig.patterns.length === …)
+   ```
+
+   So for ESLint9 always emit **both**:
+
+   - `"useLocalConfigurationFile": false` — makes `patterns` the enabled rule set
+   - `"localConfigurationFile": "./.codacy/tools-configs/eslint.config.mjs"` — a
+     **Verity-owned** config, written by this skill, so the gate does not inherit
+     the project's lint policy
+
+   The project's own `eslint.config.js` is left untouched and keeps serving
+   `npm run lint`. The two are deliberately independent: a team may reasonably turn
+   a rule off for their editor and still want the gate to enforce it.
 4. For tools **without** a local config: populate the full curated pattern list from `patterns-reference.yaml`
 5. **Validate** (next section). This is not optional — it is the only thing that
    catches a stale or mistyped ID, and the failure mode is silent.
@@ -245,7 +281,8 @@ Delete `.codacy/codacy.config.json` and write a new one. This example is for Typ
   "tools": [
     {
       "toolId": "ESLint9",
-      "localConfigurationFile": "./eslint.config.js",
+      "localConfigurationFile": "./.codacy/tools-configs/eslint.config.mjs",
+      "useLocalConfigurationFile": false,
       "patterns": [
         { "patternId": "ESLint9_no-eval" },
         { "patternId": "ESLint9_no-implied-eval" },
@@ -295,6 +332,58 @@ Delete `.codacy/codacy.config.json` and write a new one. This example is for Typ
 }
 ```
 
+### Also write the Verity-owned ESLint config
+
+Because `useLocalConfigurationFile` is `false`, the adapter builds ESLint's rule set
+from the `patterns` array — but ESLint still needs a config for parser, globals and
+ignores. Write `.codacy/tools-configs/eslint.config.mjs`, adapted to the project's
+frameworks and ignore paths:
+
+```js
+// Verity-owned ESLint config for the quality gate.
+//
+// Deliberately SEPARATE from the project's ./eslint.config.js. Pointing the gate at
+// the project config makes Verity's pattern list a FILTER over rules the project
+// enabled, so any rule the project disables becomes unreachable (VRT-108).
+//
+// Keep the rules here in sync with the ESLint9 patterns in codacy.config.json.
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: ["dist/**", "build/**", "node_modules/**", "coverage/**", ".codacy/**"] },
+  {
+    extends: [js.configs.recommended, ...tseslint.configs.recommended],
+    files: ["**/*.{ts,tsx,js,jsx}"],
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: "module",
+      globals: { ...globals.browser, ...globals.node },
+    },
+    rules: {
+      // Mirror the ESLint9 patterns in codacy.config.json.
+      "no-eval": "error",
+      "no-implied-eval": "error",
+      "no-new-func": "error",
+      "no-script-url": "error",
+      eqeqeq: ["error", "smart"],
+      "no-var": "error",
+      "@typescript-eslint/no-explicit-any": "warn",
+      "@typescript-eslint/no-unused-vars": ["warn", { argsIgnorePattern: "^_" }],
+    },
+  },
+);
+```
+
+⚠ **Do not enable type-checked rules** (`no-unsafe-assignment`, `no-unsafe-call`,
+`no-unsafe-return`). They require `parserOptions.projectService`, which makes a
+per-turn gate far too slow on a large repo. Cover those through AI review in the
+Standard instead.
+
+⚠ **Generated files belong in `ignores`** — `src/integrations/supabase/types.ts` and
+similar. They are not the agent's work and will otherwise dominate the findings.
+
 ### Validate the config — REQUIRED, do not skip
 
 Immediately after writing `.codacy/codacy.config.json`, run the validator that ships

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.2",
+  "version": "0.29.4",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",