@codacy/verity-cli 0.31.0 → 0.31.1-experimental.02b82ff

package/CHANGELOG.md

@@ -3,6 +3,172 @@
 All notable changes to Verity are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [0.31.1] — 2026-08-27
+
+**Verity stops repeating itself.** A finding it had already closed could keep
+appearing on every run, for the life of the project, with no way to end it — and
+the one command you'd run to understand why would crash halfway through. Both
+are fixed.
+
+```bash
+npm install -g @codacy/verity-cli
+```
+
+### 🔁 A finding Verity has answered stops coming back
+
+- **When a finding is settled — you rebutted it, you waived it, it was
+  dispositioned — Verity now knows.** It used to keep its own local copy of what
+  it had said and never update it, so a finding that was formally closed on the
+  service still reappeared on every run. One reported case repeated six times
+  across two branches, including runs that never even looked at the file.
+- **`verity waive` stopped looking broken.** A waive worked, but this same stale
+  copy meant the finding kept printing anyway — so the disposition looked like it
+  had been ignored.
+- **Saying it again re-opens it.** If Verity raises a settled finding a second
+  time, it counts as open again. Answering a finding is not a mute switch, and
+  a real recurrence always wins.
+
+### 💬 The carried-findings notice tells the truth, and offers a way out
+
+- It **no longer calls those findings "blocking."** They are the ones that did
+  *not* gate your run — a passing run was printing "1 blocking finding(s)" every
+  turn, an alarm the gate itself had already decided not to act on.
+- It now **names the way to resolve them**, instead of repeating a problem with
+  no stated exit.
+
+### 🐛 Fixes
+
+- **`verity status` no longer crashes partway through.** A pending item with no
+  priority threw an error mid-report, so everything below it — your active
+  tasks, your run history — silently never printed. It was also the one screen
+  that would have explained the repeating finding above.
+
+## [0.31.0] — 2026-08-25
+
+**The gate reviews exactly the change you're shipping — and people get the last
+word.** The theme of 0.31 is evidence and disposition. Every claim the gate
+makes is now bound to bytes it actually reviewed: a finding about a file that
+isn't in your change can no longer block it, leftovers from a previous run can
+no longer resurface as fresh criticals, and an old plan file that happens to be
+committed can no longer hijack what a push is judged against. Commits and
+pushes become a first-class review moment — the whole change ships for review,
+to a stronger model, on its own budget. And two new verbs, `verity waive` and
+`verity ignore`, let humans and agents put a disposition on the record that the
+gate *verifies* rather than obeys: every one is reasoned, audited, and voids
+itself the moment the evidence changes.
+
+```bash
+npm install -g @codacy/verity-cli
+verity init   # optional — refreshes the installed skill docs
+```
+
+### 🧾 No finding without the bytes
+
+- **A finding about a file that wasn't in the change can no longer block.**
+  Findings citing files whose bytes were not under review are downgraded to
+  pre-existing — downgraded, never dropped, and counted in the run's metadata.
+  This closes a real class of false blocks reproduced from production: stale
+  pending items from a previous run re-raised as blocking criticals against a
+  clean push — one of them literally labelled *"Not blocking"*.
+- **It reaches every installed CLI on deploy day** — the rule is enforced
+  server-side, with a client-side belt on top: the guard refuses to block on a
+  finding citing a file it never sent.
+- **What the gate said before is context, never a fresh finding.** Pending
+  items inform the review; they are no longer restatable as new findings.
+
+### 🚢 A commit or push is a first-class review moment
+
+- **The whole change ships for review.** Budgets at `pre-commit`/`pre-push`
+  are raised to **120 files / ~570 KB** (the interactive Stop turn is
+  unchanged at 40). A 45-file commit used to arrive as 40 files with 5
+  silently dropped — the gate was reviewing a different change than the one
+  landing.
+- **A stronger reviewer, when it matters most.** Git moments run on
+  **gpt-5.6-sol** at medium reasoning with a 3-minute budget; interactive
+  turns stay on the fast model. Overridable per project
+  (`process_constraints.git_moment_model` / `git_moment_reasoning_effort`).
+  Measured live: a 45-file, 318 KB push reviewed in ~52s.
+- **Intent is what the change contains.** Only documents that are *part of the
+  push* ride along as plans. A six-month-old committed plan can no longer gate
+  an unrelated push — and "the plan isn't fully implemented" is never a
+  finding; it informs intent alignment only.
+- The coverage line now carries the elapsed time — a longer review is fine
+  when it says so.
+
+### ✋ `verity waive` — accepted risk, on the record
+
+- **A human disposition now actually unblocks the gate.** A finding your
+  reviewers had explicitly accepted used to re-block every commit and push,
+  forever, with no documented way out.
+- `verity waive <pattern-id> --file <path> --reason "…"` — the reason is
+  mandatory (name the review, ADR, or ticket it records). The waive is bound
+  to the file's exact bytes: the same bytes pass for everyone, in any session
+  — **edit the file and the waive voids itself.** An assertion, not a mute
+  switch.
+- Every waive lands in the statements ledger, visible in run reports; at most
+  3 statements per call.
+- **A waive ends a security-pushback round.** The gate resists an *agent*
+  arguing a security finding away; a human-attributable disposition is exactly
+  the adjudication that round exists to wait for.
+
+### 🤫 `verity ignore` and `.verityignore`
+
+- **Declare a housekeeping window** — `verity ignore --turn --reason "…"` (or
+  `--for 30m`) for the agent-run `git pull` or dependency surgery that
+  shouldn't cost a review turn. **The declaration is checked, never
+  believed**: if a single file is authored during it, the whole window voids,
+  the review runs anyway, and the broken declaration is reported. Budgeted at
+  3 per session, spent on declaration — a void never refunds the attempt.
+- **`.verityignore`** — a committed, team-shared exclusion file at the repo
+  root, gitignore syntax: "is this file worth reviewing, ever?" Every
+  exclusion is named in the run's coverage ledger, never silent.
+- **You can't blind the gate in the same move.** If `.verityignore` is part of
+  a turn's change, *no* ignore rules apply to that turn at all — writing
+  `src/**` into it and the vulnerability into `src/` in one turn doesn't work.
+  Patterns that would exclude the whole repository are refused, and a pattern
+  that would have hidden a really-detected secret is warned about.
+
+### Migrating
+
+1. Server-side changes — the byte witness, the git-moment profile, waive
+   honouring — reach **every** installed client on deploy day with no action.
+2. `npm install -g @codacy/verity-cli` for the new commands (`verity waive`,
+   `verity ignore`, `verity config service-url`) and the raised git-moment
+   budget on the client side.
+3. Optionally re-run `verity init` once per repo to refresh the installed
+   skill docs; the CLAUDE.md guidance block updates automatically.
+4. To use `.verityignore`: create it at the repo root (gitignore syntax) and
+   commit it.
+
+[0.31.0]: https://github.com/codacy/verity-core/releases/tag/v0.31.0
+
+## [0.30.1] — 2026-08-24
+
+**The guard reviews the tree your command targets.** A focused release for
+everyone working with git worktrees — and the first piece of making routine
+turns free.
+
+- **Worktrees are reviewed correctly.** `cd ../wt && git push` used to review
+  the *main checkout's* push range; pushing from a worktree that had diverged
+  from its upstream reviewed drift that wasn't even on disk. The guard now
+  resolves *which repo, which tree, which range* from the command itself (cd
+  chains, `git -C`, remotes and refspecs), with ranges anchored at the
+  merge-base — worktrees can live anywhere.
+- **Named refusals over guesses.** When the command's target can't be resolved
+  (e.g. `--git-dir`, `GIT_WORK_TREE=`, or two pushes at two targets in one
+  command), the guard allows *without* review and says so loudly — it never
+  issues a verdict about a tree it guessed.
+- **Coverage is printed on every run**: the moment, tree, branch, range, the
+  files reviewed, and what was excluded and why.
+- **A user-typed `! command` turn no longer costs a Verity turn.** `! git
+  pull` used to run the full pipeline and then narrate, in Verity's voice, a
+  turn nobody took. It now exits fast and silent — keyed on evidence, never
+  the prompt: any authored file or agent tool call defeats the skip, and
+  commands that can write code (`! npm install`, redirects, pipes) are still
+  reviewed.
+
+[0.30.1]: https://github.com/codacy/verity-core/releases/tag/v0.30.1
+
 ## [0.30.0] — 2026-08-13
 
 **Verity feels smarter, and tuned to the session you're in.** The theme of 0.30

package/bin/verity.js

@@ -10506,7 +10506,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -14136,6 +14136,11 @@ var REANCHOR_WINDOW = 20;
 var STATEMENT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
 var DEFAULT_MEMORY_BUDGET_BYTES = 4096;
 
+// src/lib/dossier/events.ts
+function statementAnchorKey(file, patternId) {
+  return `${file}::${patternId}`;
+}
+
 // src/lib/dossier/log.ts
 var import_node_crypto4 = require("node:crypto");
 var import_node_fs10 = require("node:fs");
@@ -14419,6 +14424,7 @@ function reduce(state, events, now) {
           existing.line_sha = ev.line_sha ?? existing.line_sha;
           existing.register = ev.register;
           if (existing.outcome === "fixed") existing.outcome = "recurred";
+          else if (existing.outcome !== "open") existing.outcome = "open";
           break;
         }
         byAnchor.set(ev.anchor_key, {
@@ -15349,10 +15355,10 @@ function recordVerdict(d, v) {
     const at = src?.[f.line - 1];
     appendEvent(d, {
       k: "statement",
-      // Stable across title and line drift — 374 of 378 recurring sites (98.9%)
-      // carry title drift, so a title-inclusive key fragments the recurrence it
-      // exists to detect.
-      anchor_key: `${f.file}::${f.pattern_id}`,
+      // ⚠ ONE OWNER. The server's settled feed is resolved against this exact
+      // key in `13-reconcile.ts`; spelling the template literal twice is how the
+      // two sides drift apart. See `statementAnchorKey`.
+      anchor_key: statementAnchorKey(f.file, f.pattern_id),
       file: f.file,
       line: f.line,
       pattern_id: f.pattern_id,
@@ -17229,7 +17235,8 @@ function registerStatusCommand(program2) {
       printInfo("");
       printInfo("--- Pending Items ---");
       for (const item of mem.pending_items) {
-        printInfo(`  [${item.priority.toUpperCase()}] ${item.description}`);
+        const priority = typeof item.priority === "string" && item.priority.length > 0 ? item.priority.toUpperCase() : "UNSPECIFIED";
+        printInfo(`  [${priority}] ${item.description ?? "(no description)"}`);
       }
     }
     const recentTasks = mem.recent_tasks;
@@ -18452,7 +18459,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.31.0" : "dev";
+    return true ? "0.31.1-experimental.02b82ff" : "dev";
   } catch {
     return "dev";
   }
@@ -18702,9 +18709,10 @@ function describeOpenElsewhere(open) {
   const lines = open.slice(0, 5).map((o) => `  ${o.file}:${o.line} [${o.pattern_id}]`);
   const more = open.length > 5 ? `
   (+${open.length - 5} more)` : "";
-  return `STILL OPEN ELSEWHERE. ${open.length} blocking finding(s) Verity raised earlier are still present in files this run did not review:
+  return `STILL OPEN ELSEWHERE. ${open.length} finding(s) Verity raised earlier are still on disk in files this run did not review:
 ${lines.join("\n")}${more}
-This verdict covers the current change only. The tree is not clean.`;
+They did not gate this run \u2014 this verdict covers the current change only. The tree is not clean.
+Fix them, or record a disposition: verity waive <pattern-id> --file <path> --reason "\u2026"`;
 }
 
 // src/commands/analyze/exit.ts
@@ -21042,6 +21050,20 @@ async function reconcile(run) {
   })() : [];
   if (memorySession) {
     try {
+      const settledSites = response.metadata?.settled_sites;
+      if (Array.isArray(settledSites)) {
+        for (const site of settledSites) {
+          const s = site;
+          const file = typeof s?.file === "string" ? s.file : null;
+          const patternId = typeof s?.pattern_id === "string" ? s.pattern_id : null;
+          if (!file || !patternId) continue;
+          appendEvent(memorySession.d, {
+            k: "outcome",
+            anchor_key: statementAnchorKey(file, patternId),
+            outcome: "answered"
+          });
+        }
+      }
       recordVerdict(memorySession.d, {
         runId: response.run_id ?? turnId,
         decision,
@@ -23580,8 +23602,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.31.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.0");
+program.name("verity").description("CLI for Verity quality gate service").version("0.31.1-experimental.02b82ff").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.1-experimental.02b82ff");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.31.0",
+  "version": "0.31.1-experimental.02b82ff",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",