@codacy/verity-cli 0.29.4-experimental.d8678a8 → 0.29.4-experimental.e818a8a

package/bin/verity.js

@@ -15516,6 +15516,33 @@ ${addedLines}`,
   }
   return { diffs, has_snapshots: true };
 }
+function ensureSnapshotGitignored() {
+  let content = "";
+  try {
+    content = (0, import_node_fs15.readFileSync)(".gitignore", "utf-8");
+  } catch {
+  }
+  let ignored = null;
+  try {
+    (0, import_node_child_process6.execSync)("git check-ignore -q -- .verity/.snapshot/__probe__", { stdio: "pipe" });
+    ignored = true;
+  } catch (err) {
+    ignored = err.status === 1 ? false : null;
+  }
+  if (ignored === true) return "covered";
+  if (ignored === null) {
+    const lines = content.split("\n").map((l) => l.trim());
+    const covering = [".verity/.snapshot/", ".verity/.snapshot", ".verity/", ".verity", ".verity/*"];
+    if (lines.some((l) => covering.includes(l))) return "covered";
+  }
+  try {
+    const block = "# Verity \u2014 snapshots of analyzed files (machine state, never commit)\n.verity/.snapshot/\n";
+    (0, import_node_fs15.writeFileSync)(".gitignore", content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block);
+    return "added";
+  } catch {
+    return "failed";
+  }
+}
 function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
@@ -15560,7 +15587,7 @@ function cleanStaleSnapshots(dir, keepSet) {
   try {
     const entries = (0, import_node_fs15.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      if (entry.name.startsWith(".")) continue;
+      if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
       const fullPath = (0, import_node_path14.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
@@ -17149,6 +17176,39 @@ async function bootstrap(run) {
   Object.assign(run, { actionSummary, assistantResponse, baseline, baselineSessionId, reachability, sessionId, stopReason, tokenResult, transcriptPath, turnId });
 }
 
+// src/lib/self-scope.ts
+var LEGACY_GATE_SKILLS = /* @__PURE__ */ new Set([
+  "gate-setup",
+  "gate-analyze",
+  "gate-review",
+  "gate-status",
+  "gate-feedback",
+  "gate-insights",
+  "gate-learn",
+  "gate-memory",
+  "gate-reflect"
+]);
+function isVerityOwned(path) {
+  const segments = path.replace(/\\/g, "/").split("/");
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    if (seg === ".verity" || seg === ".codacy") return true;
+    if (i === segments.length - 1 && (seg === "VERITY.md" || seg === "GATE.md")) return true;
+    if (seg === ".claude" && segments[i + 1] === "skills" && typeof segments[i + 2] === "string") {
+      const skill = segments[i + 2];
+      if (skill.startsWith("verity-") || LEGACY_GATE_SKILLS.has(skill)) return true;
+    }
+    if (seg === ".claude" && segments[i + 1] === "settings.json") return true;
+  }
+  return false;
+}
+function partitionVerityOwned(paths) {
+  const kept = [];
+  const owned = [];
+  for (const p of paths) (isVerityOwned(p) ? owned : kept).push(p);
+  return { kept, owned };
+}
+
 // src/lib/channel.ts
 var MAX_AGENT_CONTEXT_CHARS = 1500;
 var MAX_AGENT_ITEMS = 5;
@@ -17266,7 +17326,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.29.4-experimental.d8678a8" : "dev";
+    return true ? "0.29.4-experimental.e818a8a" : "dev";
   } catch {
     return "dev";
   }
@@ -17588,9 +17648,10 @@ async function scope(run) {
   const { assistantResponse } = run;
   const { files: allChanged, hasRecentCommitFiles } = getChangedFiles();
   run.changedUniverse = allChanged;
-  const analyzable = filterAnalyzable(allChanged);
-  const reviewable = filterReviewable(allChanged);
-  const securityFiles = filterSecurity(allChanged);
+  const { kept: external } = partitionVerityOwned(allChanged);
+  const analyzable = filterAnalyzable(external);
+  const reviewable = filterReviewable(external);
+  const securityFiles = filterSecurity(external);
   const noFilesChanged = analyzable.length === 0 && reviewable.length === 0 && securityFiles.length === 0;
   if (noFilesChanged && !assistantResponse) {
     await passAndExit(run, "No analyzable files changed", "no-analyzable-files");
@@ -18851,7 +18912,8 @@ function gatherContextFiles(contextPaths, deltaFiles) {
 // src/commands/analyze/phases/07-context-files.ts
 async function contextFiles(run) {
   const { codeDelta, contextFilePaths } = run;
-  const contextFiles2 = gatherContextFiles(contextFilePaths, codeDelta.files);
+  const { kept: externalContext } = partitionVerityOwned(contextFilePaths ?? []);
+  const contextFiles2 = gatherContextFiles(externalContext, codeDelta.files);
   for (const f of codeDelta.files) {
     f.role = "delta";
   }
@@ -19910,6 +19972,7 @@ async function reconcile(run) {
     } catch {
     }
   }
+  const { kept: externalChanged, owned: verityOwned } = partitionVerityOwned(allChanged);
   const reviewCoverage = {
     reviewed: sentPaths,
     // Declared drops from the stages that DO report themselves today. The other
@@ -19951,11 +20014,20 @@ async function reconcile(run) {
         stage: "baseline-scoping",
         kind: "policy"
       })),
+      // ⚠ VERITY'S OWN FILES, named as such — not laundered into the
+      // extension bucket below, where "we do not review our own installer's
+      // dirt" would read as "a changed README". See self-scope.ts.
+      ...verityOwned.map((path) => ({
+        path,
+        reason: "verity-owned",
+        stage: "self-scope",
+        kind: "policy"
+      })),
       // The extension allowlist. POLICY: a changed README was never going to be
       // reviewed, and calling that a coverage gap would downgrade nearly every
       // PASS to WARN until WARN meant nothing. Recorded so the ledger balances and
       // so "what did Verity ignore entirely" is answerable.
-      ...allChanged.filter((p) => !analyzable.includes(p) && !reviewable.includes(p) && !securityFiles.includes(p)).map((path) => ({
+      ...externalChanged.filter((p) => !analyzable.includes(p) && !reviewable.includes(p) && !securityFiles.includes(p)).map((path) => ({
         path,
         reason: "not-a-reviewed-file-type",
         stage: "extension-allowlist",
@@ -21653,6 +21725,12 @@ function registerInitCommand(program2) {
     }
     await (0, import_promises13.mkdir)(VERITY_DIR, { recursive: true });
     await ensureMemoryDir();
+    const ignoreResult = ensureSnapshotGitignored();
+    if (ignoreResult === "failed") {
+      printWarn("  .gitignore: could not add .verity/.snapshot/ \u2014 add it manually (it holds copies of analyzed files)");
+    } else {
+      printInfo(`  .gitignore: .verity/.snapshot/ ${ignoreResult === "added" ? "added" : "already covered"} \u2713`);
+    }
     try {
       await ensureClaudeMdPointer();
       printInfo("  CLAUDE.md memory pointer \u2713");
@@ -22335,8 +22413,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.29.4-experimental.d8678a8").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.29.4-experimental.d8678a8");
+program.name("verity").description("CLI for Verity quality gate service").version("0.29.4-experimental.e818a8a").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.29.4-experimental.e818a8a");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/data/skills/verity-setup/SKILL.md

@@ -711,18 +711,31 @@ to-be-pushed diff before it lands.
 Add these entries to `.gitignore` (create it if it doesn't exist, append if it does):
 
 ```
-# Verity
-.verity/.cache/
-.verity/.logs/
-.verity/.last-analysis
-.verity/.iteration-count
-.verity/.last-pass-hash
-.verity/.last-intent
-.verity/.memory-sync-state.json
+# Verity — machine-local state. Everything in .verity/ is ignored EXCEPT the
+# shared standard and the knowledge graph, which are meant to be committed.
+.verity/*
+!.verity/standard.yaml
+!.verity/memory/
 .verity/memory/log.md
 .claude/settings.local.json
 ```
 
+This is a whitelist on purpose: `.verity/` accumulates state files over time
+(`.snapshot/` holds byte-for-byte copies of analyzed files — including any
+secret the gate just flagged — plus `.cache/`, `.logs/`, `.baseline`,
+`.task-context`, session-suffixed `.last-analysis.*` files, and whatever comes
+next). Enumerating them one by one is how `.snapshot/` ended up committed in a
+real repo; ignoring everything and re-including the two shared artifacts means
+a future state file can never repeat that.
+
+**If the repo previously committed Verity state** (check with
+`git ls-files .verity`), untrack everything except the shared artifacts once:
+
+```bash
+git rm -r --cached .verity
+git add .verity/standard.yaml .verity/memory
+```
+
 `.claude/settings.local.json` is machine-local Claude Code config (telemetry endpoint + an
 `otelHeadersHelper` reference — no token). `verity telemetry install` adds this entry
 automatically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.4-experimental.d8678a8",
+  "version": "0.29.4-experimental.e818a8a",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",