@codacy/verity-cli 0.31.0-experimental.48d33ea → 0.31.0

package/bin/verity.js

@@ -10407,6 +10407,13 @@ var CONVERSATION_BUFFER_FILE = `${VERITY_DIR}/.conversation-buffer`;
 var CONVERSATION_MAX_ENTRIES = 10;
 var CONVERSATION_WINDOW_MINUTES = 15;
 var MAX_FINDINGS = 25;
+var GIT_MOMENT_BUDGET = {
+  maxFiles: 120,
+  maxFileBytes: 98304,
+  // 96KB, under the server's 100k chars
+  maxTotalBytes: 583680
+  // 570KB, under the server's 600k chars
+};
 var ANALYZABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   "ts",
   "tsx",
@@ -10499,7 +10506,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -13533,6 +13540,54 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "## Quality gate: accepted risks",
+  "",
+  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
+  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
+  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
+  "the user saying so in this conversation. The --reason must cite that source.",
+  "",
+  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
+  "binds to the file's current bytes and voids automatically when the file changes,",
+  "and every waive is recorded in the run ledger. For a pattern-level false positive",
+  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_WAIVE = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -13693,7 +13748,12 @@ function extractPreserveContent(interior) {
 }
 function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
-  for (const prose of [CLAUDE_MD_PROSE, CLAUDE_MD_PROSE_PRE_IGNORE, CLAUDE_MD_PROSE_LEGACY]) {
+  for (const prose of [
+    CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_WAIVE,
+    CLAUDE_MD_PROSE_PRE_IGNORE,
+    CLAUDE_MD_PROSE_LEGACY
+  ]) {
     if (trimmed.startsWith(prose)) return trimmed.slice(prose.length);
   }
   return trimmed;
@@ -16571,6 +16631,15 @@ function registerStandardCommands(program2) {
 var import_promises10 = require("node:fs/promises");
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage analysis configuration");
+  config.command("service-url").description("Print the resolved service URL (used by the shipped skills)").action(async () => {
+    const globals = program2.opts();
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    process.stdout.write(urlResult.data + "\n");
+  });
   config.command("push").description("Upload the analysis config to the service").option("--file <path>", "Path to config file", CODACY_CONFIG_FILE).action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -18383,7 +18452,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.31.0-experimental.48d33ea" : "dev";
+    return true ? "0.31.0" : "dev";
   } catch {
     return "dev";
   }
@@ -18858,6 +18927,28 @@ function discoverPlans() {
   }
   return result;
 }
+var GUARD_DOC_EXT = /\.(md|mdx|txt|rst|adoc)$/i;
+function discoverGuardDocs(rangeFiles2) {
+  const result = [];
+  let totalBytes = 0;
+  for (const path of rangeFiles2) {
+    if (result.length >= MAX_SPEC_FILES) break;
+    if (!GUARD_DOC_EXT.test(path)) continue;
+    if (path.startsWith("/") || path.includes("..")) continue;
+    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    try {
+      const stat3 = (0, import_node_fs27.statSync)(path);
+      if (stat3.size > MAX_PLAN_FILE_BYTES) continue;
+      if (totalBytes + stat3.size > MAX_TOTAL_SPEC_BYTES) continue;
+      const content = (0, import_node_fs27.readFileSync)(path, "utf-8");
+      if (!content) continue;
+      result.push({ name: path, content });
+      totalBytes += content.length;
+    } catch {
+    }
+  }
+  return result;
+}
 
 // src/commands/analyze/phases/03-intent-inputs.ts
 async function intentInputs(run) {
@@ -21573,8 +21664,8 @@ async function runReview(opts, globals) {
     for (const p of specPaths) {
       if (!(0, import_node_fs37.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync23 } = await import("node:fs");
-        const content = readFileSync23(p, "utf-8");
+        const { readFileSync: readFileSync24 } = await import("node:fs");
+        const content = readFileSync24(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -21808,13 +21899,11 @@ function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedInte
     }
   };
   if (coverageTelemetry) requestBody.coverage_telemetry = coverageTelemetry;
-  const specs = discoverSpecs();
-  const plans = discoverPlans();
-  if (specs.length > 0 || plans.length > 0 || statedIntent) {
+  const docs = discoverGuardDocs(files);
+  if (docs.length > 0 || statedIntent) {
     const intentContext = {};
     if (statedIntent) intentContext.user_prompt = statedIntent;
-    if (specs.length > 0) intentContext.specs = specs;
-    if (plans.length > 0) intentContext.plans = plans;
+    if (docs.length > 0) intentContext.plans = docs;
     requestBody.intent_context = intentContext;
   }
   return requestBody;
@@ -21895,7 +21984,7 @@ async function runGuard(opts, globals) {
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) process.exit(0);
   logEvent("guard_frame", { moment, ...frameTelemetry(frame, range) });
-  const codeDelta = collectCodeDelta(files);
+  const codeDelta = collectCodeDelta(files, GIT_MOMENT_BUDGET);
   if (codeDelta.total_files === 0) process.exit(0);
   const statedIntent = extractStatedIntent(
     moment,
@@ -21921,6 +22010,7 @@ async function runGuard(opts, globals) {
     excluded: codeDelta.excluded.map((e) => ({ path: e.path, reason: e.reason }))
   };
   logToFileOnly(coverageBlock(coverage));
+  const reviewStart = Date.now();
   const result = await analyzeRequest({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
@@ -21929,6 +22019,7 @@ async function runGuard(opts, globals) {
     timeout: 29e4,
     cmd: "guard"
   });
+  const reviewSecs = Math.max(1, Math.round((Date.now() - reviewStart) / 1e3));
   if (!result.ok) {
     const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
     emitAllowNotice(
@@ -21941,7 +22032,7 @@ async function runGuard(opts, globals) {
   const decision = response.gate_decision ?? "(unrecognised)";
   const viewUrl = response.view_url ?? "";
   const link = viewUrl ? ` \u2014 ${viewUrl}` : "";
-  const covLine = coverageSummary(coverage);
+  const covLine = `${coverageSummary(coverage)} in ${reviewSecs}s`;
   const covDetail = coverageBlock(coverage);
   if (decision === "FAIL" && hasBlockingFinding(response, codeDelta.files.map((f) => f.path))) {
     writeIter(moment, iter + 1);
@@ -22010,6 +22101,8 @@ function writeBlockMessage(moment, response, covDetail) {
 
 `);
   process.stderr.write(`${BOLD}Fix these, then re-run the ${verb}.${NC}
+`);
+  process.stderr.write(`${DIM}Accepted risk? Record it: verity waive <pattern-id> --file <path> --reason "\u2026" (voids automatically when the file changes).${NC}
 `);
 }
 
@@ -22105,15 +22198,70 @@ function registerIgnoreCommand(program2) {
   });
 }
 
+// src/commands/waive.ts
+var import_node_crypto12 = require("node:crypto");
+var import_node_fs39 = require("node:fs");
+function registerWaiveCommand(program2) {
+  program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
+    const globals = program2.opts();
+    try {
+      process.chdir(repoRoot());
+    } catch {
+    }
+    if (opts.reason.trim().length < 20) {
+      printError("A waive needs a real reason (>= 20 chars) \u2014 name the human disposition it records.");
+      process.exit(1);
+    }
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) {
+      printError(tokenResult.error);
+      process.exit(1);
+    }
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    const body = {
+      pattern_id: patternId,
+      reason: opts.reason.trim()
+    };
+    if (opts.file) {
+      body.file = opts.file;
+      try {
+        body.file_sha256 = (0, import_node_crypto12.createHash)("sha256").update((0, import_node_fs39.readFileSync)(opts.file)).digest("hex");
+      } catch {
+        printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
+        process.exit(1);
+      }
+    }
+    const result = await apiRequest({
+      method: "POST",
+      path: "/feedback/waive",
+      serviceUrl: urlResult.data,
+      token: tokenResult.data.token,
+      body,
+      verbose: globals.verbose
+    });
+    if (!result.ok) {
+      printError(`Couldn't record the waive: ${result.error}`);
+      process.exit(1);
+    }
+    logEvent("waive_recorded", { pattern: patternId, file: opts.file ?? null, waived: result.data.waived });
+    printInfo(`Waived ${result.data.waived} open statement(s) for '${patternId}'${opts.file ? ` on ${opts.file}` : ""}.`);
+    printInfo(result.data.note);
+  });
+}
+
 // src/commands/init.ts
-var import_node_fs40 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
 var import_node_path29 = require("node:path");
 var import_node_child_process11 = require("node:child_process");
 var readline2 = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_path28 = require("node:path");
 var import_node_child_process10 = require("node:child_process");
 
@@ -22245,10 +22393,10 @@ async function runMigration(opts = {}) {
 function migrateProjectDir(root, actions) {
   const gateDir = (0, import_node_path28.join)(root, ".gate");
   const verityDir = (0, import_node_path28.join)(root, ".verity");
-  if ((0, import_node_fs39.existsSync)(gateDir) && !(0, import_node_fs39.existsSync)(verityDir)) {
+  if ((0, import_node_fs40.existsSync)(gateDir) && !(0, import_node_fs40.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs39.existsSync)(gateDir) && (0, import_node_fs39.existsSync)(verityDir)) {
+  if ((0, import_node_fs40.existsSync)(gateDir) && (0, import_node_fs40.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -22269,13 +22417,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs39.existsSync)(gateDir)) {
+    if ((0, import_node_fs40.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs39.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs40.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -22291,7 +22439,7 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs39.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs40.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
@@ -22300,9 +22448,9 @@ function migrateGlobalCredentials(home, actions) {
   if (!home) return;
   const gateCreds = (0, import_node_path28.join)(home, ".gate", "credentials");
   const verityCreds = (0, import_node_path28.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs39.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs39.existsSync)(verityCreds)) {
-    (0, import_node_fs39.mkdirSync)((0, import_node_path28.join)(home, ".verity"), { recursive: true });
+  if (!(0, import_node_fs40.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs40.existsSync)(verityCreds)) {
+    (0, import_node_fs40.mkdirSync)((0, import_node_path28.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -22325,7 +22473,7 @@ async function migrateLegacyHooks(root, actions) {
 }
 async function migrateClaudeMd(root, actions) {
   const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs39.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const hadLegacyBlock = (0, import_node_fs40.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -22337,7 +22485,7 @@ async function migrateClaudeMd(root, actions) {
 function migrateStandardFile(root, actions) {
   const gateMd = (0, import_node_path28.join)(root, "GATE.md");
   const verityMd = (0, import_node_path28.join)(root, "VERITY.md");
-  if (!(0, import_node_fs39.existsSync)(gateMd) || (0, import_node_fs39.existsSync)(verityMd)) return;
+  if (!(0, import_node_fs40.existsSync)(gateMd) || (0, import_node_fs40.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -22349,12 +22497,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs39.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs40.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
   const file = (0, import_node_path28.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs39.existsSync)(file)) return;
+  if (!(0, import_node_fs40.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -22402,14 +22550,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep2 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs39.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
+    (0, import_node_fs40.writeFileSync)(verityCreds, verityContent + sep2 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs39.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs40.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs39.readFileSync)(path, "utf-8");
+    return (0, import_node_fs40.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -22424,35 +22572,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs39.renameSync)(from, to);
+    (0, import_node_fs40.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs39.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs39.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs40.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs40.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs39.renameSync)(from, to);
+    (0, import_node_fs40.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs39.cpSync)(from, to);
-    (0, import_node_fs39.rmSync)(from, { force: true });
+    (0, import_node_fs40.cpSync)(from, to);
+    (0, import_node_fs40.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
     const srcDir = (0, import_node_path28.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs39.readdirSync)(srcDir)) {
+    for (const entry of (0, import_node_fs40.readdirSync)(srcDir)) {
       const rel = relDir ? (0, import_node_path28.join)(relDir, entry) : entry;
       const src = (0, import_node_path28.join)(gateDir, rel);
       const dest = (0, import_node_path28.join)(verityDir, rel);
-      if ((0, import_node_fs39.statSync)(src).isDirectory()) {
+      if ((0, import_node_fs40.statSync)(src).isDirectory()) {
         walk(rel);
-      } else if (!(0, import_node_fs39.existsSync)(dest)) {
-        (0, import_node_fs39.mkdirSync)((0, import_node_path28.dirname)(dest), { recursive: true });
-        (0, import_node_fs39.cpSync)(src, dest);
+      } else if (!(0, import_node_fs40.existsSync)(dest)) {
+        (0, import_node_fs40.mkdirSync)((0, import_node_path28.dirname)(dest), { recursive: true });
+        (0, import_node_fs40.cpSync)(src, dest);
         copied++;
       }
     }
@@ -22463,20 +22611,20 @@ function carryLegacyContents(gateDir, verityDir) {
 async function needsMigration(root = repoRoot()) {
   const gateDir = (0, import_node_path28.join)(root, ".gate");
   const verityDir = (0, import_node_path28.join)(root, ".verity");
-  if ((0, import_node_fs39.existsSync)(gateDir) && !(0, import_node_fs39.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs39.existsSync)(gateDir) && (0, import_node_fs39.existsSync)(verityDir)) {
-    if ((0, import_node_fs39.existsSync)((0, import_node_path28.join)(gateDir, "credentials")) && !(0, import_node_fs39.existsSync)((0, import_node_path28.join)(verityDir, "credentials"))) {
+  if ((0, import_node_fs40.existsSync)(gateDir) && !(0, import_node_fs40.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs40.existsSync)(gateDir) && (0, import_node_fs40.existsSync)(verityDir)) {
+    if ((0, import_node_fs40.existsSync)((0, import_node_path28.join)(gateDir, "credentials")) && !(0, import_node_fs40.existsSync)((0, import_node_path28.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs39.existsSync)((0, import_node_path28.join)(gateDir, "memory")) && !(0, import_node_fs39.existsSync)((0, import_node_path28.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs40.existsSync)((0, import_node_path28.join)(gateDir, "memory")) && !(0, import_node_fs40.existsSync)((0, import_node_path28.join)(verityDir, "memory"))) {
       return true;
     }
   }
   const claudeMd = (0, import_node_path28.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs39.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  if ((0, import_node_fs40.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs39.existsSync)((0, import_node_path28.join)(root, "GATE.md")) && !(0, import_node_fs39.existsSync)((0, import_node_path28.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs40.existsSync)((0, import_node_path28.join)(root, "GATE.md")) && !(0, import_node_fs40.existsSync)((0, import_node_path28.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -22620,7 +22768,7 @@ function resolveDataDir() {
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs40.existsSync)((0, import_node_path29.join)(candidate, "skills"))) {
+    if ((0, import_node_fs41.existsSync)((0, import_node_path29.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -22636,7 +22784,7 @@ function registerInitCommand(program2) {
   program2.command("init").description("Initialize Verity in the current project").option("--force", "Overwrite existing skills and hooks").action(async (opts) => {
     const force = opts.force ?? false;
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs40.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs41.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -22706,14 +22854,14 @@ function registerInitCommand(program2) {
     for (const skill of skills) {
       const src = (0, import_node_path29.join)(skillsSource, skill);
       const dest = (0, import_node_path29.join)(skillsDest, skill);
-      if (!(0, import_node_fs40.existsSync)(src)) {
+      if (!(0, import_node_fs41.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
-      if ((0, import_node_fs40.existsSync)(dest) && !force) {
+      if ((0, import_node_fs41.existsSync)(dest) && !force) {
         const srcSkill = (0, import_node_path29.join)(src, "SKILL.md");
         const destSkill = (0, import_node_path29.join)(dest, "SKILL.md");
-        if ((0, import_node_fs40.existsSync)(destSkill)) {
+        if ((0, import_node_fs41.existsSync)(destSkill)) {
           try {
             const srcContent = await (0, import_promises13.readFile)(srcSkill, "utf-8");
             const destContent = await (0, import_promises13.readFile)(destSkill, "utf-8");
@@ -22791,7 +22939,7 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_path30 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
@@ -22812,10 +22960,10 @@ function registerUninstallCommand(program2) {
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
       const dir = (0, import_node_path30.join)(skillsRoot, name);
-      if ((0, import_node_fs41.existsSync)(dir)) {
+      if ((0, import_node_fs42.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs41.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs42.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -22829,24 +22977,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs41.existsSync)(verityDir)) {
+    if ((0, import_node_fs42.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs41.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs42.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs41.existsSync)(verityMd)) {
+      if ((0, import_node_fs42.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs41.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs42.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs41.existsSync)(path) && (0, import_node_fs41.statSync)(path).isDirectory() && (0, import_node_fs41.readdirSync)(path).length === 0) {
-        (0, import_node_fs41.rmdirSync)(path);
+      if ((0, import_node_fs42.existsSync)(path) && (0, import_node_fs42.statSync)(path).isDirectory() && (0, import_node_fs42.readdirSync)(path).length === 0) {
+        (0, import_node_fs42.rmdirSync)(path);
       }
     };
     actions.push({
@@ -22858,10 +23006,10 @@ function registerUninstallCommand(program2) {
     });
     const home = process.env.HOME ?? "";
     const globalVerityDir = (0, import_node_path30.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs41.existsSync)(globalVerityDir)) {
+    if (purgeGlobal && (0, import_node_fs42.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs41.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs42.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -23055,7 +23203,7 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs42 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_node_path31 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
@@ -23093,11 +23241,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs42.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs42.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs43.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs43.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs42.unlinkSync)((0, import_node_path31.join)(cacheDir, entry));
+            (0, import_node_fs43.unlinkSync)((0, import_node_path31.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -23112,19 +23260,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs42.existsSync)(file)) {
+      if ((0, import_node_fs43.existsSync)(file)) {
         try {
-          (0, import_node_fs42.writeFileSync)(file, "");
+          (0, import_node_fs43.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs42.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs42.readdirSync)(logsDir)) {
+      if ((0, import_node_fs43.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs43.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs42.unlinkSync)((0, import_node_path31.join)(logsDir, entry));
+            (0, import_node_fs43.unlinkSync)((0, import_node_path31.join)(logsDir, entry));
           } catch {
           }
         }
@@ -23432,8 +23580,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.31.0-experimental.48d33ea").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.0-experimental.48d33ea");
+program.name("verity").description("CLI for Verity quality gate service").version("0.31.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.0");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();
@@ -23457,6 +23605,7 @@ registerBaselineCommands(program);
 registerReviewCommand(program);
 registerGuardCommand(program);
 registerIgnoreCommand(program);
+registerWaiveCommand(program);
 registerInitCommand(program);
 registerUninstallCommand(program);
 registerTaskCommands(program);

package/data/skills/verity-insights/SKILL.md

@@ -85,3 +85,27 @@ curl -s -X POST -H "Authorization: Bearer $VERITY_TOKEN" \
 3. **Review**: User sees suggestions with evidence (run counts, FP rates, citation counts)
 4. **Apply**: Approved suggestions become a new Standard version (immutable, rollback-safe)
 5. **No autonomous changes** in v1 — every suggestion requires human approval
+
+## Recording an accepted-risk disposition (unblocking a guard deadlock)
+
+When the pre-commit/pre-push guard blocks on a finding that humans have already
+adjudicated the other way (a reviewer finding, an ADR, phase exit criteria),
+record the disposition with:
+
+```bash
+verity waive <pattern-id> --file <path> --reason "per reviewer finding 5 — no code change needed"
+```
+
+What this does — and deliberately does not do:
+
+- Marks the open statement `waived` with your reason; the next guard/analyze run
+  on the **same file bytes** no longer blocks on it, and the disposition is
+  visible in the run report.
+- **It voids automatically when the file changes** — a waive is an assertion
+  about specific bytes, never a standing mute. Edit the file and the finding is
+  reconsidered fresh.
+- The reason is mandatory (≥ 20 chars) and should name the human decision it
+  traces to. At most 3 statements are waived per invocation.
+- `verity feedback finding <run-id> <pattern-id> false_positive` remains the
+  right tool for *pattern-level* feedback (it feeds suppression/evolution);
+  `verity waive` is the *per-site, accepted-risk* path that unblocks a push.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.31.0-experimental.48d33ea",
+  "version": "0.31.0",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",