@codacy/verity-cli 0.29.4-experimental.6f2ede0 → 0.29.4-experimental.7475da6

package/bin/verity.js

@@ -15516,6 +15516,33 @@ ${addedLines}`,
   }
   return { diffs, has_snapshots: true };
 }
+function ensureSnapshotGitignored() {
+  let content = "";
+  try {
+    content = (0, import_node_fs15.readFileSync)(".gitignore", "utf-8");
+  } catch {
+  }
+  let ignored = null;
+  try {
+    (0, import_node_child_process6.execSync)("git check-ignore -q -- .verity/.snapshot/__probe__", { stdio: "pipe" });
+    ignored = true;
+  } catch (err) {
+    ignored = err.status === 1 ? false : null;
+  }
+  if (ignored === true) return "covered";
+  if (ignored === null) {
+    const lines = content.split("\n").map((l) => l.trim());
+    const covering = [".verity/.snapshot/", ".verity/.snapshot", ".verity/", ".verity", ".verity/*"];
+    if (lines.some((l) => covering.includes(l))) return "covered";
+  }
+  try {
+    const block = "# Verity \u2014 snapshots of analyzed files (machine state, never commit)\n.verity/.snapshot/\n";
+    (0, import_node_fs15.writeFileSync)(".gitignore", content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block);
+    return "added";
+  } catch {
+    return "failed";
+  }
+}
 function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
@@ -15560,7 +15587,7 @@ function cleanStaleSnapshots(dir, keepSet) {
   try {
     const entries = (0, import_node_fs15.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      if (entry.name.startsWith(".")) continue;
+      if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
       const fullPath = (0, import_node_path14.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
@@ -17299,7 +17326,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.29.4-experimental.6f2ede0" : "dev";
+    return true ? "0.29.4-experimental.7475da6" : "dev";
   } catch {
     return "dev";
   }
@@ -21698,6 +21725,12 @@ function registerInitCommand(program2) {
     }
     await (0, import_promises13.mkdir)(VERITY_DIR, { recursive: true });
     await ensureMemoryDir();
+    const ignoreResult = ensureSnapshotGitignored();
+    if (ignoreResult === "failed") {
+      printWarn("  .gitignore: could not add .verity/.snapshot/ \u2014 add it manually (it holds copies of analyzed files)");
+    } else {
+      printInfo(`  .gitignore: .verity/.snapshot/ ${ignoreResult === "added" ? "added" : "already covered"} \u2713`);
+    }
     try {
       await ensureClaudeMdPointer();
       printInfo("  CLAUDE.md memory pointer \u2713");
@@ -22380,8 +22413,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.29.4-experimental.6f2ede0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.29.4-experimental.6f2ede0");
+program.name("verity").description("CLI for Verity quality gate service").version("0.29.4-experimental.7475da6").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.29.4-experimental.7475da6");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/data/skills/verity-setup/SKILL.md

@@ -711,18 +711,31 @@ to-be-pushed diff before it lands.
 Add these entries to `.gitignore` (create it if it doesn't exist, append if it does):
 
 ```
-# Verity
-.verity/.cache/
-.verity/.logs/
-.verity/.last-analysis
-.verity/.iteration-count
-.verity/.last-pass-hash
-.verity/.last-intent
-.verity/.memory-sync-state.json
+# Verity — machine-local state. Everything in .verity/ is ignored EXCEPT the
+# shared standard and the knowledge graph, which are meant to be committed.
+.verity/*
+!.verity/standard.yaml
+!.verity/memory/
 .verity/memory/log.md
 .claude/settings.local.json
 ```
 
+This is a whitelist on purpose: `.verity/` accumulates state files over time
+(`.snapshot/` holds byte-for-byte copies of analyzed files — including any
+secret the gate just flagged — plus `.cache/`, `.logs/`, `.baseline`,
+`.task-context`, session-suffixed `.last-analysis.*` files, and whatever comes
+next). Enumerating them one by one is how `.snapshot/` ended up committed in a
+real repo; ignoring everything and re-including the two shared artifacts means
+a future state file can never repeat that.
+
+**If the repo previously committed Verity state** (check with
+`git ls-files .verity`), untrack everything except the shared artifacts once:
+
+```bash
+git rm -r --cached .verity
+git add .verity/standard.yaml .verity/memory
+```
+
 `.claude/settings.local.json` is machine-local Claude Code config (telemetry endpoint + an
 `otelHeadersHelper` reference — no token). `verity telemetry install` adds this entry
 automatically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.4-experimental.6f2ede0",
+  "version": "0.29.4-experimental.7475da6",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",