@codacy/verity-cli 0.29.4-experimental.0d2e4a3 → 0.29.4-experimental.2ae1813

package/bin/verity.js

@@ -15060,8 +15060,10 @@ function recordVerdict(d, v) {
     if (summary) appendEvent(d, { k: "goal_delivered", summary });
   }
   const lines = /* @__PURE__ */ new Map();
+  const sent = new Set(v.sentPaths);
   for (const f of v.findings) {
     if (!f.file || typeof f.line !== "number" || !f.pattern_id) continue;
+    if (!sent.has(f.file)) continue;
     if (!lines.has(f.file)) {
       try {
         const abs = (0, import_node_path12.join)(root, f.file);
@@ -16717,7 +16719,7 @@ function formatRunEvidence(run, startedAt) {
   const md = run.modeDecision;
   if (md) {
     const how = md.forced ? "forced by --mode" : `predicted=${md.predicted ?? "none"} \u2192 ${md.resolved}`;
-    out += row("mode", `${md.resolved} \xB7 ${how} \xB7 authored=${md.authored ? "yes" : "no"} \xB7 investigated=${md.investigated ? "yes" : "no"}`);
+    out += row("mode", `${md.resolved} \xB7 ${how}` + (md.flip ? ` (flipped to plan: no delta at ${md.flip})` : "") + ` \xB7 authored=${md.authored ? "yes" : "no"} \xB7 investigated=${md.investigated ? "yes" : "no"}`);
   } else {
     out += row("mode", `? (this run stopped in ${run.phaseReached || "no phase"}, before the mode was decided)`);
   }
@@ -17240,7 +17242,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.29.4-experimental.0d2e4a3" : "dev";
+    return true ? "0.29.4-experimental.2ae1813" : "dev";
   } catch {
     return "dev";
   }
@@ -18057,26 +18059,50 @@ function narrowToRecent(files, sessionId) {
   });
   return recent.length > 0 ? recent : files;
 }
-function readIterationState(currentCommit) {
-  if (!(0, import_node_fs22.existsSync)(ITERATION_FILE)) return { iteration: 1, fingerprint: null };
+function readIteration(currentCommit, _contentHash) {
+  return Math.max(1, readBlockState(currentCommit).attempts);
+}
+var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
+function readBlockState(currentCommit, opts) {
+  if (opts?.newUserPrompt) return NO_BLOCKS;
+  if (!(0, import_node_fs22.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
   try {
     const stored = (0, import_node_fs22.readFileSync)(ITERATION_FILE, "utf-8").trim();
-    const parts = stored.split(":");
-    const iter = parseInt(parts[0], 10);
-    const storedCommit = parts[1] ?? "";
-    const storedTimestamp = parseInt(parts[2] ?? "0", 10);
-    const fingerprint = parts.slice(3).join(":") || null;
-    if (isNaN(iter)) return { iteration: 1, fingerprint: null };
-    if (storedCommit !== currentCommit) return { iteration: 1, fingerprint: null };
-    if (storedTimestamp > 0) {
-      const elapsed = Math.floor(Date.now() / 1e3) - storedTimestamp;
-      if (elapsed > 600) return { iteration: 1, fingerprint: null };
-    }
-    return { iteration: iter, fingerprint };
+    const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
+    if (!parsed) return NO_BLOCKS;
+    if (parsed.commit !== currentCommit) return NO_BLOCKS;
+    if (parsed.ts > 0 && Math.floor(Date.now() / 1e3) - parsed.ts > 600) return NO_BLOCKS;
+    return { attempts: parsed.attempts, blocks: parsed.blocks, fingerprint: parsed.fingerprint };
   } catch {
-    return { iteration: 1, fingerprint: null };
+    return NO_BLOCKS;
   }
 }
+function parseJsonState(raw) {
+  const o = JSON.parse(raw);
+  const attempts = typeof o.attempts === "number" ? o.attempts : NaN;
+  if (isNaN(attempts)) return null;
+  return {
+    attempts,
+    blocks: typeof o.blocks === "number" ? o.blocks : attempts,
+    fingerprint: typeof o.fingerprint === "string" && o.fingerprint ? o.fingerprint : null,
+    commit: typeof o.commit === "string" ? o.commit : "",
+    ts: typeof o.ts === "number" ? o.ts : 0
+  };
+}
+function parseLegacyState(raw) {
+  const parts = raw.split(":");
+  const n = parseInt(parts[0], 10);
+  if (isNaN(n)) return null;
+  return {
+    attempts: n,
+    // The old file has no separate block count; the old counter is the closest
+    // honest answer, and it errs toward releasing sooner rather than later.
+    blocks: n,
+    fingerprint: parts.slice(3).join(":") || null,
+    commit: parts[1] ?? "",
+    ts: parseInt(parts[2] ?? "0", 10)
+  };
+}
 function findingsFingerprint(findings) {
   const keys = findings.map((f) => `${String(f.pattern_id ?? "?")}|${String(f.file ?? "?")}`).filter((k) => k !== "?|?");
   return [...new Set(keys)].sort().join(",");
@@ -18086,11 +18112,22 @@ function isSameProblem(previous, current) {
   const prev = new Set(previous.split(","));
   return current.split(",").some((k) => prev.has(k));
 }
-function writeIteration(iteration, commit, _contentHash, fingerprint) {
+function writeBlockState(commit, state) {
   (0, import_node_fs22.mkdirSync)(VERITY_DIR, { recursive: true });
-  const ts = Math.floor(Date.now() / 1e3);
-  const fp = fingerprint ? `:${fingerprint}` : "";
-  (0, import_node_fs22.writeFileSync)(ITERATION_FILE, `${iteration}:${commit}:${ts}${fp}`);
+  (0, import_node_fs22.writeFileSync)(
+    ITERATION_FILE,
+    JSON.stringify({
+      v: 2,
+      attempts: state.attempts,
+      blocks: state.blocks,
+      commit,
+      ts: Math.floor(Date.now() / 1e3),
+      fingerprint: state.fingerprint ?? void 0
+    })
+  );
+}
+function resetBlockState(commit) {
+  writeBlockState(commit, { attempts: 0, blocks: 0, fingerprint: null });
 }
 
 // src/lib/fold.ts
@@ -18282,8 +18319,10 @@ function fold(transcriptPath, opts = {}) {
       subagentSkipped: 0,
       compactions: 0,
       complete: false
-    }
+    },
+    planApproval: { approvals: 0, activeSinceLastPrompt: false }
   };
+  const flow = { seq: 0, lastPrompt: -1, lastApproval: -1, approvals: 0 };
   const byPath = /* @__PURE__ */ new Map();
   const commandStats = /* @__PURE__ */ new Map();
   const pendingByToolUse = /* @__PURE__ */ new Map();
@@ -18309,8 +18348,12 @@ function fold(transcriptPath, opts = {}) {
       if (type === "system" && record.subtype === "compact_boundary") {
         result.coverage.compactions++;
       }
-      if (type === "user" && hasUserText(record)) result.coverage.userMessages++;
-      collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, toolStats, pendingToolName, taskById, pendingTaskName, opts.repoRoot, result.coverage);
+      if (type === "user" && hasUserText(record)) {
+        result.coverage.userMessages++;
+        if (owner === "agent") flow.lastPrompt = flow.seq;
+      }
+      if (owner === "agent") flow.seq++;
+      collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, toolStats, pendingToolName, taskById, pendingTaskName, opts.repoRoot, result.coverage, flow);
     }
   };
   try {
@@ -18382,6 +18425,10 @@ function fold(transcriptPath, opts = {}) {
     if (!p || authoredPaths.has(p)) continue;
     result.unobserved.push({ p, cause: classifyUnobserved(raw) });
   }
+  result.planApproval = {
+    approvals: flow.approvals,
+    activeSinceLastPrompt: flow.lastApproval >= 0 && flow.lastApproval > flow.lastPrompt
+  };
   return result;
 }
 function classifyUnobserved(path) {
@@ -18394,7 +18441,7 @@ function classifyUnobserved(path) {
   if (/\.(png|jpg|jpeg|gif|pdf|zip|woff2?|ico|mp4)$/i.test(path)) return "binary";
   return "no_edit_record";
 }
-function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, toolStats, pendingToolName, taskById, pendingTaskName, repoRoot2, tally) {
+function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse, toolStats, pendingToolName, taskById, pendingTaskName, repoRoot2, tally, flow) {
   const message = record.message;
   const content = message?.content ?? record.content;
   const blocks = Array.isArray(content) ? content : content && typeof content === "object" ? [content] : [];
@@ -18478,6 +18525,13 @@ function collectFromRecord(record, owner, byPath, commandStats, pendingByToolUse
         }
       }
       const toolName = id ? pendingToolName.get(id) : void 0;
+      if (toolName === "ExitPlanMode" && flow && block.is_error !== true) {
+        const body = typeof block.content === "string" ? block.content : Array.isArray(block.content) ? block.content.map((c) => typeof c.text === "string" ? c.text : "").join(" ") : "";
+        if (/approved your plan/i.test(body)) {
+          flow.lastApproval = flow.seq;
+          flow.approvals += 1;
+        }
+      }
       if (toolName) {
         pendingToolName.delete(id);
         const prevTool = toolStats.get(toolName);
@@ -18535,8 +18589,13 @@ function checkConservation(changedFiles, result, repoRoot2) {
 // src/commands/analyze/phases/06-evidence.ts
 async function evidence(run) {
   const { opts } = run;
-  const { actionSummary, allForReview, analyzable, assistantResponse, authorshipIsObservable, baseline, baselineSessionId, hasRecentCommitFiles, reviewable, securityFiles, sessionAuthoredCode, transcriptPath } = run;
+  const { actionSummary, allForReview, analyzable, assistantResponse, authorshipIsObservable, baseline, baselineSessionId, hasRecentCommitFiles, reviewable, securityFiles, sessionAuthoredCode, transcriptPath, turnAuthoredCode } = run;
   let { analysisMode, earlyFold } = run;
+  const recordFlip = (stage) => {
+    if (run.modeDecision) run.modeDecision = { ...run.modeDecision, resolved: "plan", flip: stage };
+    logEvent("mode_flipped", { stage, to: "plan" });
+  };
+  const planWorthy = !!assistantResponse && !turnAuthoredCode;
   let staticResults = {
     tool: "@codacy/analysis-cli",
     findings: [],
@@ -18556,8 +18615,9 @@ async function evidence(run) {
     const debounceSeconds = parseInt(opts.debounce, 10);
     const debounceSkip = checkDebounce(debounceSeconds, baselineSessionId);
     if (debounceSkip) {
-      if (assistantResponse) {
+      if (planWorthy) {
         analysisMode = "plan";
+        recordFlip("debounce");
       } else {
         await passAndExit(run, debounceSkip, "debounce");
       }
@@ -18566,8 +18626,9 @@ async function evidence(run) {
       const allCheckable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable, ...securityFiles]));
       const mtimeSkip = checkMtime(allCheckable, hasRecentCommitFiles, baselineSessionId);
       if (mtimeSkip) {
-        if (assistantResponse) {
+        if (planWorthy) {
           analysisMode = "plan";
+          recordFlip("mtime");
         } else {
           await passAndExit(run, mtimeSkip, "no-delta-since-last-review");
         }
@@ -18578,8 +18639,9 @@ async function evidence(run) {
       const allCheckable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable, ...securityFiles]));
       const hashResult = checkContentHash(allCheckable, baselineSessionId);
       if (hashResult.skip) {
-        if (assistantResponse) {
+        if (planWorthy) {
           analysisMode = "plan";
+          recordFlip("content-hash");
         } else {
           await passAndExit(run, hashResult.skip, "no-delta-since-last-review");
         }
@@ -18641,8 +18703,9 @@ async function evidence(run) {
           maxTotalBytes: parseInt(opts.maxTotalSize, 10)
         });
         if (codeDelta.files.length === 0 && staticResults.findings.length === 0) {
-          if (assistantResponse) {
+          if (planWorthy) {
             analysisMode = "plan";
+            recordFlip("empty-after-scoping");
           } else {
             await passAndExit(
               run,
@@ -18662,13 +18725,13 @@ async function evidence(run) {
         snapshotResult = generateSnapshotDiffs(codeDelta.files);
       }
       currentCommit = getCurrentCommit();
-      iteration = readIterationState(currentCommit).iteration;
+      iteration = readIteration(currentCommit);
     }
   }
   if (analysisMode === "plan") {
     recordAnalysisStart();
     currentCommit = getCurrentCommit();
-    iteration = readIterationState(currentCommit).iteration;
+    iteration = readIteration(currentCommit);
   }
   Object.assign(run, { analysisMode, codeDelta, contentHash, currentCommit, earlyFold, iteration, snapshotResult, staticResults });
 }
@@ -19566,7 +19629,8 @@ async function buildRequest(run) {
   }
   const noHumanPrompt = (conversation?.prompts?.length ?? 0) === 0;
   const w4Task = noHumanPrompt && isExplicitlyAutonomous() ? resolveTaskContext() : null;
-  const hasIntent = (conversation?.prompts?.length ?? 0) > 0 || specs.length > 0 || plans.length > 0 || !!assistantResponse || !!w4Task;
+  const planApprovalActive = foldResult?.planApproval?.activeSinceLastPrompt === true;
+  const hasIntent = (conversation?.prompts?.length ?? 0) > 0 || specs.length > 0 || plans.length > 0 || !!assistantResponse || !!w4Task || planApprovalActive;
   if (hasIntent) {
     const intentContext = {};
     if (conversation && conversation.prompts.length > 0) {
@@ -19598,6 +19662,10 @@ async function buildRequest(run) {
       intentContext.user_prompt = w4Task.goal;
       logEvent("w4_issue_anchor", { issue: w4Task.number, via: w4Task.via });
     }
+    if (planApprovalActive) {
+      intentContext.plan_approved = true;
+      logEvent("plan_approval_carried", { approvals: foldResult.planApproval.approvals });
+    }
     if (assistantResponse) {
       const cap = analysisMode === "plan" ? MAX_ASSISTANT_RESPONSE_CHARS_PLAN : MAX_ASSISTANT_RESPONSE_CHARS_DEFAULT;
       intentContext.assistant_response = assistantResponse.length > cap ? assistantResponse.slice(0, cap) : assistantResponse;
@@ -19861,6 +19929,11 @@ async function reconcile(run) {
         decision,
         branch: getCurrentBranch(),
         watermarkSha: watermarkIsPartial ? null : watermarkHash,
+        // The byte witness — the same "only honest definition of reviewed" the
+        // coverage column uses. A finding on a path outside this set records no
+        // statement (plan-mode prose anchored to unsent files must not become
+        // "STILL OPEN … the tree is not clean").
+        sentPaths,
         findings: response.findings?.map((f) => ({
           file: f.file,
           line: f.line,
@@ -19927,6 +20000,39 @@ ${YELLOW2}${note}${NC2}
   return exit(0);
 }
 
+// src/lib/may-block.ts
+var HARD_BLOCK_CEILING = 5;
+function mayBlock(input) {
+  const ceiling = input.ceiling ?? HARD_BLOCK_CEILING;
+  if (input.reviewedFileCount === 0 && input.staticFindingCount === 0) {
+    return { block: false, release: "no-code-reviewed" };
+  }
+  if (input.cycleCutFired) {
+    return { block: false, release: "nothing-moved" };
+  }
+  if (input.attempts > input.maxIterations) {
+    return { block: false, release: "same-problem-cap" };
+  }
+  if (input.blocks > ceiling) {
+    return { block: false, release: "block-ceiling" };
+  }
+  return { block: true, release: null };
+}
+function describeRelease(release, input) {
+  const ceiling = input.ceiling ?? HARD_BLOCK_CEILING;
+  const open = input.findingCount > 0 ? `${input.findingCount} finding(s) remain OPEN and were NOT fixed. Human review required before deploying.` : "Human review required before deploying.";
+  switch (release) {
+    case "no-code-reviewed":
+      return `Verity: WARN \u2014 NOT BLOCKING: no code was reviewed on this turn, so there is nothing here to fix. Reported as advice instead. ${open}`;
+    case "nothing-moved":
+      return `Verity: WARN \u2014 NOT BLOCKING: nothing has changed since the last verdict, so re-raising it cannot move anything forward. ${open}`;
+    case "same-problem-cap":
+      return `Verity: WARN \u2014 self-healing limit (${input.maxIterations}) reached on the same finding. NO LONGER BLOCKING, but ${open}`;
+    case "block-ceiling":
+      return `Verity: WARN \u2014 ${ceiling} consecutive blocking verdicts reached; releasing the block so this cannot loop. ${open}`;
+  }
+}
+
 // src/lib/remediation-guard.ts
 var TOOL_CONFIG_PATTERNS = [
   /(^|\/)\.codacy\//,
@@ -20075,38 +20181,63 @@ async function render(run) {
     reverify_by: response.reverify_by
   });
   const grantNudge = grantWarning ? ` \u26A0\uFE0F ${grantWarning}` : "";
-  let capReleased = false;
+  let release = null;
   let effectiveDecision = decision;
   if (decision === "FAIL") {
-    const blocking = (response.findings ?? []).filter((f) => {
+    const findings = response.findings ?? [];
+    const blocking = findings.filter((f) => {
       const sev = String(f.severity ?? "").toLowerCase();
       return sev === "critical" || sev === "high";
     });
     const fingerprint = findingsFingerprint(blocking);
-    const prior = readIterationState(currentCommit);
+    const prior = readBlockState(currentCommit, {
+      newUserPrompt: (conversation?.prompts?.length ?? 0) > 0
+    });
     const sameProblem = isSameProblem(prior.fingerprint, fingerprint);
-    const nextIteration = sameProblem ? prior.iteration + 1 : 1;
     const maxIterations = parseInt(opts.maxIterations, 10);
-    writeIteration(nextIteration, currentCommit, contentHash ?? void 0, fingerprint);
-    iteration = nextIteration;
-    if (nextIteration > maxIterations) {
-      capReleased = true;
+    const attempts = sameProblem ? prior.attempts + 1 : 1;
+    const blocks = prior.blocks + 1;
+    const decisionNow = mayBlock({
+      reviewedFileCount: codeDelta.files.length,
+      staticFindingCount: run.staticResults?.findings?.length ?? 0,
+      cycleCutFired: silenced !== null,
+      attempts,
+      blocks,
+      maxIterations
+    });
+    if (decisionNow.block) {
+      writeBlockState(currentCommit, { attempts, blocks, fingerprint });
+      iteration = attempts;
+    } else {
+      release = decisionNow.release;
       effectiveDecision = "WARN";
-      logEvent("iteration_cap_released", { iteration: nextIteration, fingerprint });
+      logEvent("block_released", {
+        reason: release,
+        attempts,
+        blocks,
+        reviewed_files: codeDelta.files.length,
+        cycle_cut: silenced,
+        fingerprint
+      });
     }
   }
-  if (capReleased) {
+  if (release) {
     const findings = response.findings ?? [];
     const lines = findings.slice(0, 5).map((f) => `  [${String(f.severity ?? "?").toUpperCase()}] ${String(f.title ?? f.message ?? "")} (${String(f.file ?? "?")}:${String(f.line ?? "?")})`);
+    const summary = describeRelease(release, {
+      findingCount: findings.length,
+      maxIterations: parseInt(opts.maxIterations, 10)
+    });
     emitVerdict({
       proposed: "WARN",
       changed: run.changedUniverse,
       coverage: reviewCoverage,
-      userSummary: `Verity: WARN \u2014 self-healing limit (${opts.maxIterations}) reached on the same finding. NO LONGER BLOCKING, but ${findings.length} finding(s) remain OPEN and were NOT fixed. Human review required before deploying.
-${lines.join("\n")}`,
+      userSummary: lines.length > 0 ? `${summary}
+${lines.join("\n")}` : summary,
       agentContext: null,
       silenced: true
     });
+    return;
   }
   switch (effectiveDecision) {
     case "FAIL": {
@@ -20205,7 +20336,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       break;
     }
     case "PASS": {
-      writeIteration(1, currentCommit, contentHash ?? void 0);
+      resetBlockState(currentCommit);
       if (watermarkHash) recordPassHash(watermarkHash, baselineSessionId);
       if (!watermarkIsPartial && currentCommit && currentCommit !== "no-git") writeBaselineSha(currentCommit);
       let userSummary = response.user_summary ?? "Verity: PASS";
@@ -20226,6 +20357,7 @@ ${YELLOW}${grantNudge.trim()}${NC}
       break;
     }
     case "WARN": {
+      if (decision !== "FAIL") resetBlockState(currentCommit);
       if (watermarkHash) recordPassHash(watermarkHash, baselineSessionId);
       if (!watermarkIsPartial && currentCommit && currentCommit !== "no-git") writeBaselineSha(currentCommit);
       let userSummary = response.user_summary ?? "Verity: WARN";
@@ -22114,8 +22246,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.29.4-experimental.0d2e4a3").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.29.4-experimental.0d2e4a3");
+program.name("verity").description("CLI for Verity quality gate service").version("0.29.4-experimental.2ae1813").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.29.4-experimental.2ae1813");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.4-experimental.0d2e4a3",
+  "version": "0.29.4-experimental.2ae1813",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",