@codacy/verity-cli 0.29.3 → 0.29.4

package/bin/verity.js

@@ -10833,6 +10833,12 @@ function writeBaselineSha(sha) {
   } catch {
   }
 }
+var VERITY_OWNED_PREFIXES = [".verity/", ".gate/", ".codacy/"];
+var VERITY_OWNED_FILES = ["VERITY.md"];
+function isVerityOwnedPath(file) {
+  const p = file.replace(/\\/g, "/");
+  return VERITY_OWNED_PREFIXES.some((d) => p.startsWith(d)) || VERITY_OWNED_FILES.includes(p);
+}
 function getChangedFiles() {
   const sets = /* @__PURE__ */ new Set();
   let hasRecentCommitFiles = false;
@@ -10859,18 +10865,18 @@ function getChangedFiles() {
       }
     }
   }
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const filtered = Array.from(sets).filter((f) => !isVerityOwnedPath(f));
   return { files: filtered, hasRecentCommitFiles };
 }
 function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !isVerityOwnedPath(f));
 }
 function getDirtyFiles() {
   const set = /* @__PURE__ */ new Set();
   for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
   for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
   for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return Array.from(set).filter((f) => !isVerityOwnedPath(f));
 }
 function showContentAtRef(ref, repoRelPath) {
   if (!ref || ref === "no-git") return null;
@@ -16809,6 +16815,46 @@ function interpretAnalyzerRun(run) {
   };
 }
 
+// src/lib/remediation-guard.ts
+var TOOL_CONFIG_PATTERNS = [
+  /(^|\/)\.codacy\//,
+  /(^|\/)codacy\.(config\.)?(json|ya?ml)$/,
+  /(^|\/)eslint\.config\.(js|mjs|cjs|ts)$/,
+  /(^|\/)\.eslintrc(\.(json|ya?ml|js|cjs))?$/,
+  /(^|\/)\.?semgrep(\.(ya?ml))?$/,
+  /(^|\/)trivy\.ya?ml$/,
+  /(^|\/)\.trivyignore$/,
+  /(^|\/)sonar-project\.properties$/,
+  /(^|\/)\.?ruff\.toml$/,
+  /(^|\/)\.bandit$/,
+  /(^|\/)pmd\.xml$/,
+  /(^|\/)\.hadolint\.ya?ml$/
+];
+function isAnalysisToolConfig(file) {
+  if (!file) return false;
+  const p = file.replace(/\\/g, "/");
+  return TOOL_CONFIG_PATTERNS.some((re) => re.test(p));
+}
+var PROPOSES_PATTERN_ID = /["']patternId["']\s*:/;
+function screenRemediation(fix, findingFile) {
+  const suggestion = typeof fix?.suggestion === "string" ? fix.suggestion : "";
+  if (!suggestion) return { suggestion: null, withheldReason: null };
+  const target = typeof fix?.file === "string" && fix.file || (typeof findingFile === "string" ? findingFile : "");
+  if (isAnalysisToolConfig(target)) {
+    return {
+      suggestion: null,
+      withheldReason: "withheld \u2014 Verity does not hand-write edits to analysis-tool configuration. Run `node .claude/skills/verity-setup/validate-patterns.mjs` to check this file against the real adapter catalogue."
+    };
+  }
+  if (PROPOSES_PATTERN_ID.test(suggestion)) {
+    return {
+      suggestion: null,
+      withheldReason: "withheld \u2014 this suggestion proposes a tool `patternId`, which Verity cannot verify. Check it with `node .claude/skills/verity-setup/validate-patterns.mjs --list <toolId>` before applying."
+    };
+  }
+  return { suggestion, withheldReason: null };
+}
+
 // src/lib/specs.ts
 var import_node_fs17 = require("node:fs");
 var import_node_path16 = require("node:path");
@@ -16965,7 +17011,7 @@ function resolveTaskContext(opts) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.29.3" : "dev";
+    return true ? "0.29.4" : "dev";
   } catch {
     return "dev";
   }
@@ -19661,15 +19707,18 @@ ${lines.join("\n")}`,
           const line = f.line ?? "";
           const fix = f.fix;
           const fixDesc = fix?.description ?? "See description";
-          const suggestion = fix?.suggestion ?? "";
+          const screened = screenRemediation(fix, f.file);
           process.stderr.write(`[${severity}] ${title}
 `);
           process.stderr.write(`  File: ${file}:${line}
 `);
           process.stderr.write(`  Fix: ${fixDesc}
 `);
-          if (suggestion) {
-            process.stderr.write(`  Suggestion: ${suggestion}
+          if (screened.suggestion) {
+            process.stderr.write(`  Suggestion: ${screened.suggestion}
+`);
+          } else if (screened.withheldReason) {
+            process.stderr.write(`  Suggestion: ${screened.withheldReason}
 `);
           }
           process.stderr.write("\n");
@@ -21564,7 +21613,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.29.3").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.29.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.3",
+  "version": "0.29.4",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",