@codacy/verity-cli 0.30.0-experimental.452ead4 → 0.30.0-experimental.5188287

package/bin/verity.js

@@ -10342,6 +10342,10 @@ function repoRoot() {
   }
   return _repoRoot;
 }
+function _resetRepoRoot() {
+  _repoRoot = null;
+  _mainRoot = void 0;
+}
 var _mainRoot;
 function mainWorktreeRoot() {
   if (_mainRoot !== void 0) return _mainRoot;
@@ -10804,13 +10808,6 @@ function execGit(cmd) {
     return "";
   }
 }
-function execGitArgs(args) {
-  try {
-    return (0, import_node_child_process3.execFileSync)("git", args, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
 function splitLines(s) {
   return s.split("\n").filter((l) => l.length > 0);
 }
@@ -10877,9 +10874,6 @@ function getChangedFiles() {
   const filtered = Array.from(sets).filter((f) => !isVerityOwnedPath(f));
   return { files: filtered, hasRecentCommitFiles };
 }
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !isVerityOwnedPath(f));
-}
 function getDirtyFiles() {
   const set = /* @__PURE__ */ new Set();
   for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
@@ -10900,33 +10894,6 @@ function showContentAtRef(ref, repoRelPath) {
     return null;
   }
 }
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGitArgs(["diff", "--name-only", range])).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGitArgs(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{push}"]) ? "@{push}..HEAD" : null,
-    () => execGitArgs(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"]) ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGitArgs(["rev-parse", "--abbrev-ref", "HEAD"]);
-      return branch && branch !== "HEAD" && execGitArgs(["rev-parse", "--verify", "-q", `origin/${branch}`]) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve4 of resolvers) {
-    const range = resolve4();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGitArgs(["log", range, "--format=%B%x00"]).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
 function filterAnalyzable(files) {
   return files.filter((f) => {
     const ext = (0, import_node_path3.extname)(f).slice(1);
@@ -13747,6 +13714,160 @@ var import_node_fs14 = require("node:fs");
 var import_node_crypto7 = require("node:crypto");
 var import_node_path13 = require("node:path");
 
+// src/lib/analysis-mode.ts
+var DEBUG_PHRASES = [
+  "not working",
+  "doesn't work",
+  "doesn't work",
+  "does not work",
+  "isn't working",
+  "is not working",
+  "can't figure out",
+  "stack trace"
+];
+var DEBUG_WORDS = [
+  "fix",
+  "bug",
+  "broken",
+  "crash",
+  "crashing",
+  "failing",
+  "debug",
+  "debugging",
+  "investigate",
+  "troubleshoot",
+  "regression",
+  "wrong"
+];
+var DEBUG_PATTERN = new RegExp(
+  [
+    ...DEBUG_PHRASES.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
+    ...DEBUG_WORDS.map((w) => `\\b${w}\\b`)
+  ].join("|"),
+  "i"
+);
+var FALSE_POSITIVE_PATTERNS = [
+  /\b(?:add|create|implement|write|build|design|set\s*up)\b.{0,20}\berror\b/i,
+  /\berror\s+handling\b/i,
+  /\berror\s+boundar(?:y|ies)\b/i,
+  /\berror\s+(?:type|class|page|component|message|code|enum)\b/i,
+  /\b(?:add|create|implement|write|build)\b.{0,20}\b(?:fix|debug|issue)\b/i
+];
+function hasDebugIntent(prompt) {
+  if (!DEBUG_PATTERN.test(prompt)) return false;
+  for (const fp of FALSE_POSITIVE_PATTERNS) {
+    if (fp.test(prompt)) return false;
+  }
+  return true;
+}
+var GIT_ONLY_PATTERN = /\b(commit|push|deploy|merge|rebase|tag|release|publish|ship)\b/i;
+var CODE_AUTHORING_PATTERN = /\b(add|create|implement|build|write|fix|update|change|refactor|modify|remove|delete|move|rename)\b.*\b(function|component|feature|endpoint|test|file|module|class|type|interface|hook|page|route|style|migration|code|bug|error|issue)\b/i;
+function isGitOnlyPrompt(prompt) {
+  if (!GIT_ONLY_PATTERN.test(prompt)) return false;
+  if (CODE_AUTHORING_PATTERN.test(prompt)) return false;
+  return true;
+}
+function reconcileAnalysisMode(predictedMode, signals) {
+  const mode2 = resolveAnalysisMode(predictedMode, signals);
+  if (mode2 !== "skip") return mode2;
+  const windowIsOrphaned = signals.actionSummary?.transcript_windowed === "orphaned";
+  if (windowIsOrphaned && !signals.sessionAuthoredCode) return "standard";
+  return mode2;
+}
+function resolveAnalysisMode(predictedMode, signals) {
+  if (!predictedMode || !isValidMode(predictedMode)) {
+    return detectAnalysisMode(
+      signals.noFilesChanged,
+      signals.assistantResponse,
+      signals.conversationPrompts,
+      signals.actionSummary,
+      signals.sessionAuthoredCode
+    );
+  }
+  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0)) || !!signals.sessionAuthoredCode;
+  const agentInvestigated = didAgentInvestigate(signals.actionSummary);
+  switch (predictedMode) {
+    case "skip":
+      if (agentAuthoredCode) return "standard";
+      return "skip";
+    case "plan":
+      if (agentAuthoredCode) return "standard";
+      return "plan";
+    case "debug":
+      return "debug";
+    case "standard":
+      if (!!signals.actionSummary && !agentAuthoredCode && !!signals.assistantResponse) {
+        return agentInvestigated ? "plan" : "skip";
+      }
+      return "standard";
+  }
+}
+function didAgentInvestigate(summary) {
+  if (!summary) return false;
+  return summary.files_read.length > 0 || summary.searches > 0 || summary.commands.length > 0 || summary.subagents > 0 || summary.web_fetches > 0;
+}
+function isValidMode(mode2) {
+  return mode2 === "standard" || mode2 === "plan" || mode2 === "debug" || mode2 === "skip";
+}
+function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary, sessionAuthoredCode) {
+  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0)) || !!sessionAuthoredCode;
+  if (conversationPrompts.length > 0 && conversationPrompts.every(isGitOnlyPrompt)) {
+    if (!agentAuthoredCode) return "skip";
+  }
+  if (noFilesChanged && !!assistantResponse && !agentAuthoredCode) {
+    return "plan";
+  }
+  if (!!actionSummary && !agentAuthoredCode && !!assistantResponse) {
+    return didAgentInvestigate(actionSummary) ? "plan" : "skip";
+  }
+  for (const prompt of conversationPrompts) {
+    if (hasDebugIntent(prompt)) {
+      return "debug";
+    }
+  }
+  return "standard";
+}
+var FILE_MUTATE_RE = /(?:^|[\s|&;(`])(?:sed\s+-i|perl\s+-i|awk\b|tee\b|dd\b|cp\b|mv\b|ln\b|install\b|touch\b|patch\b|git\s+(?:apply|am)\b|cargo\s+build|go\s+generate|make\b|--write\b|--fix\b|--in-place\b)|>>?(?![&>])/i;
+var GIT_PLUMBING_RE = /^\s*git\s+(?:merge|rebase|stash|cherry-pick|revert|pull|fetch|checkout|switch|reset|restore|clean)\b/i;
+var READ_ONLY_RE = /^\s*(?:git\s+(?:status|diff|log|show|branch|remote|config|rev-parse|ls-files|blame|describe)|ls|cat|head|tail|less|grep|rg|find|pwd|echo|printf|wc|which|type|tree|stat|file|env|printenv|date|whoami)\b/i;
+var CHAIN_RE = /&&|\||;|\$\(|\x60/;
+function isNonAuthoringCommand(cmd) {
+  if (typeof cmd !== "string" || cmd.trim().length === 0) return false;
+  if (FILE_MUTATE_RE.test(cmd)) return false;
+  if (CHAIN_RE.test(cmd)) return false;
+  return GIT_PLUMBING_RE.test(cmd) || READ_ONLY_RE.test(cmd);
+}
+function hasNonEditAuthorship(actionSummary, sessionAuthoredCode) {
+  if (!actionSummary) return sessionAuthoredCode;
+  if ((actionSummary.subagents ?? 0) > 0) return true;
+  if (Object.keys(actionSummary.tool_counts ?? {}).some((t) => t.startsWith("mcp__"))) return true;
+  const commands = actionSummary.commands ?? [];
+  if (commands.some((c) => FILE_MUTATE_RE.test(c))) return true;
+  if (sessionAuthoredCode) {
+    const allSafe = commands.length > 0 && commands.every(isNonAuthoringCommand);
+    if (!allSafe) return true;
+  }
+  return false;
+}
+function scopeToAuthored(files, actionSummary) {
+  if (!actionSummary) return { files, signal: "no-transcript" };
+  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
+  if (touched.length === 0) return { files: [], signal: "none-authored" };
+  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
+}
+function narrowToAgentAuthored(files, actionSummary) {
+  if (!actionSummary) return files;
+  const touched = [
+    ...actionSummary.files_edited,
+    ...actionSummary.files_created
+  ];
+  if (touched.length === 0) return files;
+  return files.filter((f) => {
+    const suffix = "/" + f;
+    return touched.some((t) => t === f || t.endsWith(suffix));
+  });
+}
+
 // src/lib/skip-detection.ts
 function isBareAckPrompt(prompt) {
   if (typeof prompt !== "string") return false;
@@ -13810,6 +13931,15 @@ function shouldSkipForBareAck(input) {
   if (input.turnAuthoredCode) return false;
   return input.canSeeTurnAuthorship;
 }
+function isCommandOnlyTurn(input) {
+  if (!input.authorshipIsObservable) return false;
+  if (input.userCommandsTruncated) return false;
+  const commands = input.userCommands ?? [];
+  if (commands.length === 0) return false;
+  if (input.agentAuthoredFiles > 0) return false;
+  if (input.agentToolCalls > 0) return false;
+  return commands.every(isNonAuthoringCommand);
+}
 
 // src/lib/pending-repeat.ts
 var STOP = /* @__PURE__ */ new Set([
@@ -16949,6 +17079,10 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     dir = (0, import_node_path18.isAbsolute)(expanded) ? expanded : (0, import_node_path18.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
+  const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
+  if (overrideMatch) {
+    return { dir: null, named: true, unresolvable: `git-dir/work-tree/index override in command: ${overrideMatch[0].trim()}` };
+  }
   const gitMatch = seg.match(new RegExp(`(?:^|[\\s;&|(])(?:[^\\s;&|()'"]*\\/)?git(${GIT_GLOBAL_OPTS})\\s`));
   if (gitMatch) {
     const optsRegion = gitMatch[1] ?? "";
@@ -17040,14 +17174,22 @@ function resolveFrame(input) {
   });
   let dir = baseDir;
   if (found) {
-    const target = extractCommandTarget(input.command, found.segmentIndex, baseDir);
-    if (target.named) anchor = "command-target";
-    if (target.unresolvable) return refuse(`target:${target.unresolvable}`);
-    if (target.dir !== null && target.dir !== baseDir) {
-      if (!(0, import_node_fs20.existsSync)(target.dir)) return refuse(`target:directory does not exist: ${target.dir}`);
-      dir = target.dir;
-    } else if (target.named) {
-      dir = target.dir ?? baseDir;
+    const segments = splitSegments(input.command);
+    const kindRes = found.moment === "pre-commit" ? [COMMIT_RE] : [PUSH_RE, GH_PR_RE];
+    const dirs = /* @__PURE__ */ new Set();
+    for (let i = 0; i < segments.length; i++) {
+      if (/--dry-run\b/.test(segments[i])) continue;
+      if (!kindRes.some((re) => re.test(segments[i]))) continue;
+      const target = extractCommandTarget(input.command, i, baseDir);
+      if (target.named) anchor = "command-target";
+      if (target.unresolvable) return refuse(`target:${target.unresolvable}`);
+      dirs.add(target.dir ?? baseDir);
+    }
+    if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
+    const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
+    if (targetDir !== baseDir) {
+      if (!(0, import_node_fs20.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      dir = targetDir;
     }
   }
   const toplevel = gitAt(dir, ["rev-parse", "--show-toplevel"]);
@@ -17148,6 +17290,10 @@ function rangeFiles(frame, range) {
   }
   return out.split("\n").filter((l) => l.length > 0).filter((f) => !isVerityOwnedPath(f));
 }
+function rangeMessages(frame, range) {
+  if (range.kind === "staged" || range.kind === "nothing" || !range.base) return "";
+  return frameGit(frame, ["log", `${range.base}..${range.head === "INDEX" ? "HEAD" : range.head}`, "--format=%B%x00"]).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
 function frameTelemetry(frame, range, divergence) {
   const t = {
     anchor: frame.anchor,
@@ -17204,6 +17350,8 @@ var MAX_COMMAND_CHARS = 80;
 var MAX_TOOL_BLOCKS = 200;
 var MAX_SUMMARY_BYTES = 4096;
 var HOME = process.env.HOME ?? "";
+var BASH_INPUT_RE = /^\s*<bash-input>([\s\S]*?)<\/bash-input>/;
+var BASH_ECHO_RE = /^\s*<bash-(?:stdout|stderr)>/;
 async function extractActionSummary(transcriptPath) {
   try {
     const read = readTurnLines(transcriptPath);
@@ -17267,7 +17415,7 @@ function isRealUserMessage(parsed) {
   const message = parsed.message;
   if (!message) return false;
   const content = message.content;
-  if (typeof content === "string") return true;
+  if (typeof content === "string") return !BASH_ECHO_RE.test(content);
   if (Array.isArray(content)) {
     return content.some((b) => {
       if (typeof b !== "object" || b === null) return false;
@@ -17282,6 +17430,8 @@ function buildSummary(lines) {
   const filesEdited = /* @__PURE__ */ new Set();
   const filesCreated = /* @__PURE__ */ new Set();
   const commands = [];
+  const userCommands = [];
+  let userCommandsTruncated = false;
   let searches = 0;
   let subagents = 0;
   let webFetches = 0;
@@ -17299,6 +17449,17 @@ function buildSummary(lines) {
     if (entry.type === "user" && !firstTimestamp) {
       firstTimestamp = entry.timestamp ?? null;
     }
+    if (entry.type === "user") {
+      const typed = userTypedCommands(entry);
+      if (typed.truncated) userCommandsTruncated = true;
+      for (const cmd of typed.commands) {
+        if (userCommands.length >= MAX_COMMANDS) {
+          userCommandsTruncated = true;
+          break;
+        }
+        userCommands.push(cmd);
+      }
+    }
     if (entry.type !== "assistant") continue;
     turnMessages++;
     lastTimestamp = entry.timestamp ?? lastTimestamp;
@@ -17376,6 +17537,8 @@ function buildSummary(lines) {
     ],
     searches,
     commands,
+    user_commands: userCommands,
+    ...userCommandsTruncated ? { user_commands_truncated: true } : {},
     subagents,
     web_fetches: webFetches,
     total_tool_calls: totalToolCalls,
@@ -17384,6 +17547,8 @@ function buildSummary(lines) {
   };
   if (JSON.stringify(summary).length > MAX_SUMMARY_BYTES) {
     summary.commands = [];
+    summary.user_commands = [];
+    summary.user_commands_truncated = true;
     if (JSON.stringify(summary).length > MAX_SUMMARY_BYTES) {
       summary.files_read = summary.files_read.slice(0, 10);
       summary.files_edited = summary.files_edited.slice(0, 10);
@@ -17401,6 +17566,22 @@ function addPath(set, rawPath) {
   if (p.length > 200) p = p.slice(0, 200);
   set.add(p);
 }
+function userTypedCommands(entry) {
+  const none = { commands: [], truncated: false };
+  const message = entry.message;
+  const content = message?.content;
+  if (typeof content !== "string") return none;
+  const m = BASH_INPUT_RE.exec(content);
+  if (!m) return none;
+  const commands = [];
+  let truncated = false;
+  for (const line of m[1].split("\n")) {
+    if (line.length > MAX_COMMAND_CHARS) truncated = true;
+    const cmd = sanitizeCommand(line);
+    if (cmd) commands.push(cmd);
+  }
+  return { commands, truncated };
+}
 function sanitizeCommand(rawCmd) {
   if (typeof rawCmd !== "string" || !rawCmd) return null;
   let cmd = rawCmd.split("\n")[0];
@@ -17635,7 +17816,7 @@ function truncateToCap(text) {
 function buildHookOutput(gateDecision, systemMessage, agentContext) {
   return {
     gate_decision: gateDecision,
-    systemMessage,
+    ...systemMessage === null ? {} : { systemMessage },
     ...agentContext ? {
       hookSpecificOutput: {
         hookEventName: "Stop",
@@ -17656,7 +17837,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.30.0-experimental.452ead4" : "dev";
+    return true ? "0.30.0-experimental.5188287" : "dev";
   } catch {
     return "dev";
   }
@@ -17942,6 +18123,7 @@ async function passAndExit(run, reason, skip, kindOverride) {
     "verity-command",
     "bare-acknowledgment",
     "reflection-prompt",
+    "command-only-turn",
     "skip-mode",
     "zero-increment",
     "debounce",
@@ -17960,10 +18142,12 @@ async function passAndExit(run, reason, skip, kindOverride) {
   }
   const AGENT_SILENT_SKIPS = /* @__PURE__ */ new Set([]);
   const agentNote = AGENT_SILENT_SKIPS.has(skip) ? null : note;
+  const HUMAN_SILENT_SKIPS = /* @__PURE__ */ new Set(["command-only-turn"]);
+  const humanNote = HUMAN_SILENT_SKIPS.has(skip) ? null : `Verity: ${reason}`;
   printJsonCompact(
     buildHookOutput(
       verdict,
-      `Verity: ${reason}`,
+      humanNote,
       // `additionalContext` is the agent's ONLY input. Writing only
       // `systemMessage` — the human's field — tells the agent nothing at all,
       // which is what sixteen of the nineteen terminating paths used to do.
@@ -18113,6 +18297,15 @@ function discoverPlans() {
 // src/commands/analyze/phases/03-intent-inputs.ts
 async function intentInputs(run) {
   const { actionSummary, allForReview, assistantResponse, baseline, baselineSessionId } = run;
+  if (isCommandOnlyTurn({
+    userCommands: actionSummary?.user_commands,
+    userCommandsTruncated: actionSummary?.user_commands_truncated,
+    agentAuthoredFiles: (actionSummary?.files_edited.length ?? 0) + (actionSummary?.files_created.length ?? 0),
+    agentToolCalls: actionSummary?.total_tool_calls ?? 0,
+    authorshipIsObservable: !!actionSummary && actionSummary.transcript_windowed !== "orphaned"
+  })) {
+    await passAndExit(run, "User command only \u2014 skipping analysis", "command-only-turn");
+  }
   const conversation = await readAndClearConversationBuffer(baselineSessionId);
   const specs = discoverSpecs(actionSummary?.files_read ?? []);
   const plans = discoverPlans();
@@ -18153,156 +18346,6 @@ async function connect(run) {
   Object.assign(run, { urlResult, serviceUrl: urlResult.data, token: tokenResult.data.token });
 }
 
-// src/lib/analysis-mode.ts
-var DEBUG_PHRASES = [
-  "not working",
-  "doesn't work",
-  "doesn't work",
-  "does not work",
-  "isn't working",
-  "is not working",
-  "can't figure out",
-  "stack trace"
-];
-var DEBUG_WORDS = [
-  "fix",
-  "bug",
-  "broken",
-  "crash",
-  "crashing",
-  "failing",
-  "debug",
-  "debugging",
-  "investigate",
-  "troubleshoot",
-  "regression",
-  "wrong"
-];
-var DEBUG_PATTERN = new RegExp(
-  [
-    ...DEBUG_PHRASES.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
-    ...DEBUG_WORDS.map((w) => `\\b${w}\\b`)
-  ].join("|"),
-  "i"
-);
-var FALSE_POSITIVE_PATTERNS = [
-  /\b(?:add|create|implement|write|build|design|set\s*up)\b.{0,20}\berror\b/i,
-  /\berror\s+handling\b/i,
-  /\berror\s+boundar(?:y|ies)\b/i,
-  /\berror\s+(?:type|class|page|component|message|code|enum)\b/i,
-  /\b(?:add|create|implement|write|build)\b.{0,20}\b(?:fix|debug|issue)\b/i
-];
-function hasDebugIntent(prompt) {
-  if (!DEBUG_PATTERN.test(prompt)) return false;
-  for (const fp of FALSE_POSITIVE_PATTERNS) {
-    if (fp.test(prompt)) return false;
-  }
-  return true;
-}
-var GIT_ONLY_PATTERN = /\b(commit|push|deploy|merge|rebase|tag|release|publish|ship)\b/i;
-var CODE_AUTHORING_PATTERN = /\b(add|create|implement|build|write|fix|update|change|refactor|modify|remove|delete|move|rename)\b.*\b(function|component|feature|endpoint|test|file|module|class|type|interface|hook|page|route|style|migration|code|bug|error|issue)\b/i;
-function isGitOnlyPrompt(prompt) {
-  if (!GIT_ONLY_PATTERN.test(prompt)) return false;
-  if (CODE_AUTHORING_PATTERN.test(prompt)) return false;
-  return true;
-}
-function reconcileAnalysisMode(predictedMode, signals) {
-  const mode2 = resolveAnalysisMode(predictedMode, signals);
-  if (mode2 !== "skip") return mode2;
-  const windowIsOrphaned = signals.actionSummary?.transcript_windowed === "orphaned";
-  if (windowIsOrphaned && !signals.sessionAuthoredCode) return "standard";
-  return mode2;
-}
-function resolveAnalysisMode(predictedMode, signals) {
-  if (!predictedMode || !isValidMode(predictedMode)) {
-    return detectAnalysisMode(
-      signals.noFilesChanged,
-      signals.assistantResponse,
-      signals.conversationPrompts,
-      signals.actionSummary,
-      signals.sessionAuthoredCode
-    );
-  }
-  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0)) || !!signals.sessionAuthoredCode;
-  const agentInvestigated = didAgentInvestigate(signals.actionSummary);
-  switch (predictedMode) {
-    case "skip":
-      if (agentAuthoredCode) return "standard";
-      return "skip";
-    case "plan":
-      if (agentAuthoredCode) return "standard";
-      return "plan";
-    case "debug":
-      return "debug";
-    case "standard":
-      if (!!signals.actionSummary && !agentAuthoredCode && !!signals.assistantResponse) {
-        return agentInvestigated ? "plan" : "skip";
-      }
-      return "standard";
-  }
-}
-function didAgentInvestigate(summary) {
-  if (!summary) return false;
-  return summary.files_read.length > 0 || summary.searches > 0 || summary.commands.length > 0 || summary.subagents > 0 || summary.web_fetches > 0;
-}
-function isValidMode(mode2) {
-  return mode2 === "standard" || mode2 === "plan" || mode2 === "debug" || mode2 === "skip";
-}
-function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary, sessionAuthoredCode) {
-  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0)) || !!sessionAuthoredCode;
-  if (conversationPrompts.length > 0 && conversationPrompts.every(isGitOnlyPrompt)) {
-    if (!agentAuthoredCode) return "skip";
-  }
-  if (noFilesChanged && !!assistantResponse && !agentAuthoredCode) {
-    return "plan";
-  }
-  if (!!actionSummary && !agentAuthoredCode && !!assistantResponse) {
-    return didAgentInvestigate(actionSummary) ? "plan" : "skip";
-  }
-  for (const prompt of conversationPrompts) {
-    if (hasDebugIntent(prompt)) {
-      return "debug";
-    }
-  }
-  return "standard";
-}
-var FILE_MUTATE_RE = /(?:^|[\s|&;(`])(?:sed\s+-i|perl\s+-i|awk\b|tee\b|dd\b|cp\b|mv\b|ln\b|install\b|touch\b|patch\b|git\s+(?:apply|am)\b|cargo\s+build|go\s+generate|make\b|--write\b|--fix\b|--in-place\b)|>>?(?![&>])/i;
-var GIT_PLUMBING_RE = /^\s*git\s+(?:merge|rebase|stash|cherry-pick|revert|pull|fetch|checkout|switch|reset|restore|clean)\b/i;
-var READ_ONLY_RE = /^\s*(?:git\s+(?:status|diff|log|show|branch|remote|config|rev-parse|ls-files|blame|describe)|ls|cat|head|tail|less|grep|rg|find|pwd|echo|printf|wc|which|type|tree|stat|file|env|printenv|date|whoami)\b/i;
-var CHAIN_RE = /&&|\||;|\$\(|\x60/;
-function hasNonEditAuthorship(actionSummary, sessionAuthoredCode) {
-  if (!actionSummary) return sessionAuthoredCode;
-  if ((actionSummary.subagents ?? 0) > 0) return true;
-  if (Object.keys(actionSummary.tool_counts ?? {}).some((t) => t.startsWith("mcp__"))) return true;
-  const commands = actionSummary.commands ?? [];
-  if (commands.some((c) => FILE_MUTATE_RE.test(c))) return true;
-  if (sessionAuthoredCode) {
-    const allSafe = commands.length > 0 && commands.every(
-      (c) => !CHAIN_RE.test(c) && (GIT_PLUMBING_RE.test(c) || READ_ONLY_RE.test(c))
-    );
-    if (!allSafe) return true;
-  }
-  return false;
-}
-function scopeToAuthored(files, actionSummary) {
-  if (!actionSummary) return { files, signal: "no-transcript" };
-  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
-  if (touched.length === 0) return { files: [], signal: "none-authored" };
-  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
-}
-function narrowToAgentAuthored(files, actionSummary) {
-  if (!actionSummary) return files;
-  const touched = [
-    ...actionSummary.files_edited,
-    ...actionSummary.files_created
-  ];
-  if (touched.length === 0) return files;
-  return files.filter((f) => {
-    const suffix = "/" + f;
-    return touched.some((t) => t === f || t.endsWith(suffix));
-  });
-}
-
 // src/commands/analyze/phases/05-mode.ts
 async function mode(run) {
   const { opts, globals } = run;
@@ -20155,7 +20198,10 @@ async function buildRequest(run) {
     }
     if (specs.length > 0) intentContext.specs = specs;
     if (plans.length > 0) intentContext.plans = plans;
-    if (actionSummary) intentContext.action_summary = actionSummary;
+    if (actionSummary) {
+      const { user_commands: _uc, user_commands_truncated: _uct, ...onTheWire } = actionSummary;
+      intentContext.action_summary = onTheWire;
+    }
     for (const key of Object.keys(intentContext)) {
       if (intentContext[key] == null) delete intentContext[key];
     }
@@ -21210,9 +21256,14 @@ function registerGuardCommand(program2) {
     }
   });
 }
-function getMomentScope(moment) {
-  if (moment === "pre-commit") return { files: getStagedFiles(), range: "staged" };
-  return getPushRangeFiles();
+function resolveMomentRange(moment, frame, command, on) {
+  return moment === "pre-commit" ? stagedRange() : resolvePushRange(frame, command, on);
+}
+function describeRange(range) {
+  if (range.kind === "staged") return "staged";
+  if (range.kind === "nothing" || !range.base) return null;
+  const base = /^[0-9a-f]{40}$/.test(range.base) ? range.base.slice(0, 7) : range.base;
+  return `${base}..${range.head} via ${range.via}`;
 }
 function matchFlagValue(command, flags) {
   const re = new RegExp(`(?<![\\w-])(?:${flags})(?:=|\\s+)('((?:[^'\\\\]|\\\\.)*)'|"((?:[^"\\\\]|\\\\.)*)"|([^\\s'"-][^\\s]*))`);
@@ -21247,15 +21298,15 @@ function isSubstantiveIntent(text) {
   if (SHELL_PLUMBING.test(t)) return false;
   return true;
 }
-function extractStatedIntent(moment, command) {
-  const text = moment === "pre-commit" ? parseCommitMessage(command) : parsePrIntent(command) ?? (getPushRangeMessages() || null);
+function extractStatedIntent(moment, command, pushedMessages = null) {
+  const text = moment === "pre-commit" ? parseCommitMessage(command) : parsePrIntent(command) ?? pushedMessages;
   return isSubstantiveIntent(text) ? text : null;
 }
 function hasBlockingFinding(response) {
   const findings = response.findings ?? [];
   return findings.some((f) => f.scope !== "pre-existing" && ["critical", "high"].includes((f.severity ?? "").toLowerCase()));
 }
-function buildGuardRequest(moment, files, codeDelta, iter, sessionId, command, coverageTelemetry) {
+function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
   let staticResults;
@@ -21284,7 +21335,6 @@ function buildGuardRequest(moment, files, codeDelta, iter, sessionId, command, c
   if (coverageTelemetry) requestBody.coverage_telemetry = coverageTelemetry;
   const specs = discoverSpecs();
   const plans = discoverPlans();
-  const statedIntent = extractStatedIntent(moment, command);
   if (specs.length > 0 || plans.length > 0 || statedIntent) {
     const intentContext = {};
     if (statedIntent) intentContext.user_prompt = statedIntent;
@@ -21294,7 +21344,7 @@ function buildGuardRequest(moment, files, codeDelta, iter, sessionId, command, c
   }
   return requestBody;
 }
-function buildGuardCoverage(files, codeDelta, frame, frameRange, frameFiles, actualRoot) {
+function buildGuardCoverage(files, codeDelta, frame, frameRange) {
   const byReason = {};
   for (const e of codeDelta.excluded) byReason[e.reason] = (byReason[e.reason] ?? 0) + 1;
   return {
@@ -21308,11 +21358,7 @@ function buildGuardCoverage(files, codeDelta, frame, frameRange, frameFiles, act
     excluded: codeDelta.excluded.length,
     excluded_by_reason: byReason,
     transcript_windowed: null,
-    guard_frame: frameTelemetry(frame, frameRange, {
-      actualRoot,
-      actualFiles: files,
-      frameFiles
-    })
+    guard_frame: frameTelemetry(frame, frameRange)
   };
 }
 function coverageSummary(c) {
@@ -21341,15 +21387,24 @@ function emitAllowNotice(userMsg, agentMsg) {
 async function runGuard(opts, globals) {
   const on = opts.on.split(",").map((s) => s.trim()).filter((s) => s === "commit" || s === "push");
   const { command, cwd, sessionId } = await readPreToolUseStdin();
-  if (cwd && (0, import_node_fs35.existsSync)(cwd)) {
-    try {
-      process.chdir(cwd);
-    } catch {
-    }
-  }
   const moment = classifyCommand(command, on);
   if (!moment) process.exit(0);
   const verb = moment === "pre-commit" ? "commit" : "push";
+  const { frame } = resolveFrame({ command, on, hookCwd: cwd });
+  if (frame.refusal || !frame.worktreeRoot) {
+    logEvent("guard_frame", { moment, ...frameTelemetry(frame, null) });
+    if ((frame.refusal ?? "").startsWith("anchor:")) process.exit(0);
+    emitAllowNotice(
+      `\u26A0 Verity ${moment}: could not resolve the tree this ${verb} targets \u2014 ${verb}ed WITHOUT review`,
+      `Verity ${moment}: the target tree could not be resolved (${frame.refusal}); the ${verb} was allowed WITHOUT a Verity review.`
+    );
+  }
+  try {
+    process.chdir(frame.worktreeRoot);
+  } catch {
+    process.exit(0);
+  }
+  _resetRepoRoot();
   const iter = readIter(moment);
   if (iter >= GUARD_BLOCK_CAP) {
     resetIter(moment);
@@ -21358,36 +21413,35 @@ async function runGuard(opts, globals) {
       `Verity ${moment}: review-cycle cap (${GUARD_BLOCK_CAP}) reached; the ${verb} was allowed without a further block.`
     );
   }
-  const { files, range: actualRange } = getMomentScope(moment);
+  const range = resolveMomentRange(moment, frame, command, on);
+  const files = rangeFiles(frame, range);
   if (files.length === 0) process.exit(0);
   const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) process.exit(0);
-  const { frame } = resolveFrame({ command, on, hookCwd: cwd });
-  const frameRange = moment === "pre-push" ? resolvePushRange(frame, command, on) : stagedRange();
-  const frameFiles = frame.refusal ? [] : rangeFiles(frame, frameRange);
-  const actualRoot = repoRoot();
-  logEvent("guard_frame", {
-    moment,
-    ...frameTelemetry(frame, frameRange, { actualRoot, actualFiles: files, frameFiles })
-  });
+  logEvent("guard_frame", { moment, ...frameTelemetry(frame, range) });
   const codeDelta = collectCodeDelta(files);
   if (codeDelta.total_files === 0) process.exit(0);
+  const statedIntent = extractStatedIntent(
+    moment,
+    command,
+    moment === "pre-push" ? rangeMessages(frame, range) || null : null
+  );
   const requestBody = buildGuardRequest(
     moment,
     files,
     codeDelta,
     iter,
     sessionId,
-    command,
-    buildGuardCoverage(files, codeDelta, frame, frameRange, frameFiles, actualRoot)
+    statedIntent,
+    buildGuardCoverage(files, codeDelta, frame, range)
   );
   const coverage = {
     moment,
-    root: actualRoot,
-    branch: frame.refusal ? null : frame.branch,
+    root: frame.worktreeRoot,
+    branch: frame.branch,
     linked: frame.isLinkedWorktree,
-    range: actualRange,
+    range: describeRange(range),
     sent: codeDelta.files.map((f) => f.path),
     excluded: codeDelta.excluded.map((e) => ({ path: e.path, reason: e.reason }))
   };
@@ -22811,8 +22865,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.30.0-experimental.452ead4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.30.0-experimental.452ead4");
+program.name("verity").description("CLI for Verity quality gate service").version("0.30.0-experimental.5188287").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.30.0-experimental.5188287");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.30.0-experimental.452ead4",
+  "version": "0.30.0-experimental.5188287",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",