@codacy/verity-cli 0.31.1-experimental.79dc9c2 → 0.31.1

package/CHANGELOG.md

@@ -30,9 +30,10 @@ npm install -g @codacy/verity-cli
 
 ### 💬 The carried-findings notice tells the truth, and offers a way out
 
-- It **no longer calls those findings "blocking."** They are the ones that did
-  *not* gate your run — a passing run was printing "1 blocking finding(s)" every
-  turn, an alarm the gate itself had already decided not to act on.
+- It **no longer calls those findings "blocking."** They did not *fail* your
+  run — a run that was otherwise passing printed "1 blocking finding(s)" every
+  turn, which reads as a failure that never happened. (It does still turn a PASS
+  into a WARN, and the notice now says only what is true.)
 - It now **names the way to resolve them**, instead of repeating a problem with
   no stated exit.
 

package/bin/verity.js

@@ -10506,7 +10506,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -14136,6 +14136,11 @@ var REANCHOR_WINDOW = 20;
 var STATEMENT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
 var DEFAULT_MEMORY_BUDGET_BYTES = 4096;
 
+// src/lib/dossier/events.ts
+function statementAnchorKey(file, patternId) {
+  return `${file}::${patternId}`;
+}
+
 // src/lib/dossier/log.ts
 var import_node_crypto4 = require("node:crypto");
 var import_node_fs10 = require("node:fs");
@@ -15350,10 +15355,10 @@ function recordVerdict(d, v) {
     const at = src?.[f.line - 1];
     appendEvent(d, {
       k: "statement",
-      // Stable across title and line drift — 374 of 378 recurring sites (98.9%)
-      // carry title drift, so a title-inclusive key fragments the recurrence it
-      // exists to detect.
-      anchor_key: `${f.file}::${f.pattern_id}`,
+      // ⚠ ONE OWNER. The server's settled feed is resolved against this exact
+      // key in `13-reconcile.ts`; spelling the template literal twice is how the
+      // two sides drift apart. See `statementAnchorKey`.
+      anchor_key: statementAnchorKey(f.file, f.pattern_id),
       file: f.file,
       line: f.line,
       pattern_id: f.pattern_id,
@@ -18454,7 +18459,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.31.1-experimental.79dc9c2" : "dev";
+    return true ? "0.31.1" : "dev";
   } catch {
     return "dev";
   }
@@ -18706,7 +18711,7 @@ function describeOpenElsewhere(open) {
   (+${open.length - 5} more)` : "";
   return `STILL OPEN ELSEWHERE. ${open.length} finding(s) Verity raised earlier are still on disk in files this run did not review:
 ${lines.join("\n")}${more}
-They did not gate this run \u2014 this verdict covers the current change only. The tree is not clean.
+They did not fail this run \u2014 this verdict covers the current change only. The tree is not clean.
 Fix them, or record a disposition: verity waive <pattern-id> --file <path> --reason "\u2026"`;
 }
 
@@ -20885,6 +20890,25 @@ var import_node_path26 = require("node:path");
 async function reconcile(run) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run;
   const sentPaths = codeDelta.files.map((f) => f.path);
+  if (memorySession) {
+    try {
+      const settledSites = response.metadata?.settled_sites;
+      if (Array.isArray(settledSites)) {
+        for (const site of settledSites) {
+          const siteRecord = site;
+          const file = typeof siteRecord?.file === "string" ? siteRecord.file : null;
+          const patternId = typeof siteRecord?.pattern_id === "string" ? siteRecord.pattern_id : null;
+          if (!file || !patternId) continue;
+          appendEvent(memorySession.d, {
+            k: "outcome",
+            anchor_key: statementAnchorKey(file, patternId),
+            outcome: "answered"
+          });
+        }
+      }
+    } catch {
+    }
+  }
   let openElsewhere = [];
   if (memorySession) {
     try {
@@ -21045,14 +21069,6 @@ async function reconcile(run) {
   })() : [];
   if (memorySession) {
     try {
-      const settledAnchors = response.metadata?.settled_anchors;
-      if (Array.isArray(settledAnchors)) {
-        for (const anchorKey of settledAnchors) {
-          if (typeof anchorKey === "string" && anchorKey.length > 0) {
-            appendEvent(memorySession.d, { k: "outcome", anchor_key: anchorKey, outcome: "answered" });
-          }
-        }
-      }
       recordVerdict(memorySession.d, {
         runId: response.run_id ?? turnId,
         decision,
@@ -23591,8 +23607,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.31.1-experimental.79dc9c2").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.1-experimental.79dc9c2");
+program.name("verity").description("CLI for Verity quality gate service").version("0.31.1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.1");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.31.1-experimental.79dc9c2",
+  "version": "0.31.1",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",