@codacy/verity-cli 0.31.2 → 0.31.4

package/CHANGELOG.md

@@ -24,6 +24,16 @@ installs and updates it for you.
   plugin is present it owns the hooks, and the settings.json copy stands down.
   `verity init` detects the plugin and removes the duplicate wiring.
 
+### 🚪 A project that was never set up is left alone
+
+Every hook now asks the same question the same way. `verity analyze` used to run
+in a project that had never seen `verity init`, create `.verity/` there, and then —
+with no baseline to compare against — review nothing. It now stands down like the
+other hooks always have, so installing Verity no longer scatters state through
+directories you merely opened. On the first session in such a project, Claude is
+told once that the gate is off here and can offer `/verity:setup` (or `verity init`
+on an npm install). Works correctly from linked git worktrees.
+
 ### ⚙️ Git-moment gating moved into the project
 
 `verity guard` now reads `.verity/config.json` instead of taking its moments from
@@ -107,6 +117,26 @@ with one entry point.
   terminal (Ctrl+D, a pty that ends) falls back to the default instead of
   crashing init between copying the skills and wiring the hooks.
 
+## [0.31.3] — 2026-09-03
+
+**After a rebase, Verity reviewed the wrong code.** When a branch was rebased
+onto an updated main, the gate could treat all of the upstream changes as the
+session's own work and block the push on findings in code the session never
+touched. The cause was that the review baseline was trusted by whether its commit
+still existed rather than whether it was still part of the current history, so a
+rewritten baseline kept anchoring every diff.
+
+- **The push gate reviews exactly what the push publishes** — the commits the
+  remote does not yet have — so a rebase, a force-push, a first push, or
+  re-pushing an already-published commit each review only their real new work.
+- **The stop-hook baseline is trusted only while it is an ancestor of HEAD.** A
+  rewritten baseline is discarded and re-derived from the commits actually made
+  since, so upstream changes are never attributed to the session.
+- **A commit made during a merge reviews only the files you resolved**, not the
+  whole incoming branch.
+- **A slash command such as `/login` is no longer treated as a task or a goal**,
+  so the review is graded against what you were actually working on.
+
 ## [0.31.1] — 2026-08-27
 
 **Verity stops repeating itself.** A finding it had already closed could keep

package/bin/verity.js

@@ -10833,16 +10833,9 @@ function splitLines(s) {
 }
 var SHA_RE = /^[0-9a-f]{40}$/;
 function readBaselineSha() {
-  if (!(0, import_node_fs3.existsSync)(BASELINE_SHA_FILE)) return null;
-  let sha;
-  try {
-    sha = (0, import_node_fs3.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
-  } catch {
-    return null;
-  }
-  if (!SHA_RE.test(sha)) return null;
-  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
-  if (!reachable) {
+  const sha = readRawBaselineSha();
+  if (sha === null) return null;
+  if (!commitResolves(sha)) {
     try {
       (0, import_node_fs3.unlinkSync)(BASELINE_SHA_FILE);
     } catch {
@@ -10851,6 +10844,16 @@ function readBaselineSha() {
   }
   return sha;
 }
+function readRawBaselineSha() {
+  if (!(0, import_node_fs3.existsSync)(BASELINE_SHA_FILE)) return null;
+  let sha;
+  try {
+    sha = (0, import_node_fs3.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  return SHA_RE.test(sha) ? sha : null;
+}
 function writeBaselineSha(sha) {
   if (!SHA_RE.test(sha)) return;
   try {
@@ -10859,6 +10862,25 @@ function writeBaselineSha(sha) {
   } catch {
   }
 }
+function commitObjectExists(sha) {
+  if (!SHA_RE.test(sha)) return false;
+  return execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+}
+function committedSinceRewrite(oldSha) {
+  if (!SHA_RE.test(oldSha)) return [];
+  const newLocal = new Set(splitLines(execGit(`git rev-list HEAD --not ${oldSha} --remotes`)));
+  if (newLocal.size === 0) return [];
+  const files = /* @__PURE__ */ new Set();
+  for (const line of splitLines(execGit(`git cherry ${oldSha} HEAD`))) {
+    const sp = line.indexOf(" ");
+    if (sp < 0) continue;
+    const mark = line.slice(0, sp);
+    const sha = line.slice(sp + 1).trim();
+    if (mark !== "+" || !newLocal.has(sha)) continue;
+    for (const f of splitLines(execGit(`git diff-tree --no-commit-id --name-only -r ${sha}`))) files.add(f);
+  }
+  return [...files].filter((f) => !isVerityOwnedPath(f));
+}
 var VERITY_OWNED_PREFIXES = [".verity/", ".gate/", ".codacy/"];
 var VERITY_OWNED_FILES = ["VERITY.md"];
 function isVerityOwnedPath(file) {
@@ -10871,6 +10893,7 @@ function getChangedFiles() {
   for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
   for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
   for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  const rawBaseline = readRawBaselineSha();
   const baseline = readBaselineSha();
   if (baseline) {
     const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
@@ -10878,6 +10901,13 @@ function getChangedFiles() {
       hasRecentCommitFiles = true;
       for (const f of committed) sets.add(f);
     }
+  } else if (rawBaseline && commitObjectExists(rawBaseline)) {
+    const committed = committedSinceRewrite(rawBaseline);
+    logEvent("baseline_rewritten", { recovered: committed.length });
+    if (committed.length > 0) {
+      hasRecentCommitFiles = true;
+      for (const f of committed) sets.add(f);
+    }
   } else {
     const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
     const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
@@ -13083,6 +13113,242 @@ function getRecentCommitMessages() {
   }
 }
 
+// src/lib/analysis-mode.ts
+var DEBUG_PHRASES = [
+  "not working",
+  "doesn't work",
+  "doesn't work",
+  "does not work",
+  "isn't working",
+  "is not working",
+  "can't figure out",
+  "stack trace"
+];
+var DEBUG_WORDS = [
+  "fix",
+  "bug",
+  "broken",
+  "crash",
+  "crashing",
+  "failing",
+  "debug",
+  "debugging",
+  "investigate",
+  "troubleshoot",
+  "regression",
+  "wrong"
+];
+var DEBUG_PATTERN = new RegExp(
+  [
+    ...DEBUG_PHRASES.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
+    ...DEBUG_WORDS.map((w) => `\\b${w}\\b`)
+  ].join("|"),
+  "i"
+);
+var FALSE_POSITIVE_PATTERNS = [
+  /\b(?:add|create|implement|write|build|design|set\s*up)\b.{0,20}\berror\b/i,
+  /\berror\s+handling\b/i,
+  /\berror\s+boundar(?:y|ies)\b/i,
+  /\berror\s+(?:type|class|page|component|message|code|enum)\b/i,
+  /\b(?:add|create|implement|write|build)\b.{0,20}\b(?:fix|debug|issue)\b/i
+];
+function hasDebugIntent(prompt) {
+  if (!DEBUG_PATTERN.test(prompt)) return false;
+  for (const fp of FALSE_POSITIVE_PATTERNS) {
+    if (fp.test(prompt)) return false;
+  }
+  return true;
+}
+var GIT_ONLY_PATTERN = /\b(commit|push|deploy|merge|rebase|tag|release|publish|ship)\b/i;
+var CODE_AUTHORING_PATTERN = /\b(add|create|implement|build|write|fix|update|change|refactor|modify|remove|delete|move|rename)\b.*\b(function|component|feature|endpoint|test|file|module|class|type|interface|hook|page|route|style|migration|code|bug|error|issue)\b/i;
+function isGitOnlyPrompt(prompt) {
+  if (!GIT_ONLY_PATTERN.test(prompt)) return false;
+  if (CODE_AUTHORING_PATTERN.test(prompt)) return false;
+  return true;
+}
+function reconcileAnalysisMode(predictedMode, signals) {
+  const mode2 = resolveAnalysisMode(predictedMode, signals);
+  if (mode2 !== "skip") return mode2;
+  const windowIsOrphaned = signals.actionSummary?.transcript_windowed === "orphaned";
+  if (windowIsOrphaned && !signals.sessionAuthoredCode) return "standard";
+  return mode2;
+}
+function resolveAnalysisMode(predictedMode, signals) {
+  if (!predictedMode || !isValidMode(predictedMode)) {
+    return detectAnalysisMode(
+      signals.noFilesChanged,
+      signals.assistantResponse,
+      signals.conversationPrompts,
+      signals.actionSummary,
+      signals.sessionAuthoredCode
+    );
+  }
+  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0)) || !!signals.sessionAuthoredCode;
+  const agentInvestigated = didAgentInvestigate(signals.actionSummary);
+  switch (predictedMode) {
+    case "skip":
+      if (agentAuthoredCode) return "standard";
+      return "skip";
+    case "plan":
+      if (agentAuthoredCode) return "standard";
+      return "plan";
+    case "debug":
+      return "debug";
+    case "standard":
+      if (!!signals.actionSummary && !agentAuthoredCode && !!signals.assistantResponse) {
+        return agentInvestigated ? "plan" : "skip";
+      }
+      return "standard";
+  }
+}
+function didAgentInvestigate(summary) {
+  if (!summary) return false;
+  return summary.files_read.length > 0 || summary.searches > 0 || summary.commands.length > 0 || summary.subagents > 0 || summary.web_fetches > 0;
+}
+function isValidMode(mode2) {
+  return mode2 === "standard" || mode2 === "plan" || mode2 === "debug" || mode2 === "skip";
+}
+function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary, sessionAuthoredCode) {
+  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0)) || !!sessionAuthoredCode;
+  if (conversationPrompts.length > 0 && conversationPrompts.every(isGitOnlyPrompt)) {
+    if (!agentAuthoredCode) return "skip";
+  }
+  if (noFilesChanged && !!assistantResponse && !agentAuthoredCode) {
+    return "plan";
+  }
+  if (!!actionSummary && !agentAuthoredCode && !!assistantResponse) {
+    return didAgentInvestigate(actionSummary) ? "plan" : "skip";
+  }
+  for (const prompt of conversationPrompts) {
+    if (hasDebugIntent(prompt)) {
+      return "debug";
+    }
+  }
+  return "standard";
+}
+var FILE_MUTATE_RE = /(?:^|[\s|&;(`])(?:sed\s+-i|perl\s+-i|awk\b|tee\b|dd\b|cp\b|mv\b|ln\b|install\b|touch\b|patch\b|git\s+(?:apply|am)\b|cargo\s+build|go\s+generate|make\b|--write\b|--fix\b|--in-place\b)|>>?(?![&>])/i;
+var GIT_PLUMBING_RE = /^\s*git\s+(?:merge|rebase|stash|cherry-pick|revert|pull|fetch|checkout|switch|reset|restore|clean)\b/i;
+var READ_ONLY_RE = /^\s*(?:git\s+(?:status|diff|log|show|branch|remote|config|rev-parse|ls-files|blame|describe)|ls|cat|head|tail|less|grep|rg|find|pwd|echo|printf|wc|which|type|tree|stat|file|env|printenv|date|whoami)\b/i;
+var CHAIN_RE = /&&|\||;|\$\(|\x60/;
+function isNonAuthoringCommand(cmd) {
+  if (typeof cmd !== "string" || cmd.trim().length === 0) return false;
+  if (FILE_MUTATE_RE.test(cmd)) return false;
+  if (CHAIN_RE.test(cmd)) return false;
+  return GIT_PLUMBING_RE.test(cmd) || READ_ONLY_RE.test(cmd);
+}
+function hasNonEditAuthorship(actionSummary, sessionAuthoredCode) {
+  if (!actionSummary) return sessionAuthoredCode;
+  if ((actionSummary.subagents ?? 0) > 0) return true;
+  if (Object.keys(actionSummary.tool_counts ?? {}).some((t) => t.startsWith("mcp__"))) return true;
+  const commands = actionSummary.commands ?? [];
+  if (commands.some((c) => FILE_MUTATE_RE.test(c))) return true;
+  if (sessionAuthoredCode) {
+    const allSafe = commands.length > 0 && commands.every(isNonAuthoringCommand);
+    if (!allSafe) return true;
+  }
+  return false;
+}
+function scopeToAuthored(files, actionSummary) {
+  if (!actionSummary) return { files, signal: "no-transcript" };
+  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
+  if (touched.length === 0) return { files: [], signal: "none-authored" };
+  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
+}
+function chooseReviewScope(input) {
+  if (input.narrowingIsTrustworthy) return input.scopedFiles;
+  if (input.recoveredScope.length > 0) return input.recoveredScope;
+  return input.authorshipWasObservable ? [] : input.allForReview;
+}
+function narrowToAgentAuthored(files, actionSummary) {
+  if (!actionSummary) return files;
+  const touched = [
+    ...actionSummary.files_edited,
+    ...actionSummary.files_created
+  ];
+  if (touched.length === 0) return files;
+  return files.filter((f) => {
+    const suffix = "/" + f;
+    return touched.some((t) => t === f || t.endsWith(suffix));
+  });
+}
+
+// src/lib/skip-detection.ts
+function isBareAckPrompt(prompt) {
+  if (typeof prompt !== "string") return false;
+  const trimmed = prompt.trim();
+  if (trimmed.length === 0) return false;
+  if (trimmed.length > 20) return false;
+  const bareAckPattern = /^(\d{1,2}|y|n|yes|no|yep|nope|ok(ay)?|sure|skip|cancel|stop|done|noted|got\s+it|sounds\s+good|thanks|thank\s+you|thx)[.!?]*$/i;
+  return bareAckPattern.test(trimmed);
+}
+function isContinuationPrompt(prompt) {
+  if (typeof prompt !== "string") return false;
+  const trimmed = prompt.trim();
+  if (trimmed.length === 0) return false;
+  if (trimmed.length > 24) return false;
+  const continuation = /^(let['’]?s\s+(go|do\s+it|start|continue)|go|go\s+ahead|go\s+on|proceed|continue|carry\s+on|keep\s+going|do\s+it|make\s+it\s+so|next|start|begin|ship\s+it|yes\s+please|please\s+continue|perfect|great|nice|excellent|agreed)[.!]*$/i;
+  return continuation.test(trimmed) || isBareAckPrompt(trimmed);
+}
+function isSlashCommand(prompt) {
+  if (typeof prompt !== "string") return false;
+  return /^\s*\/[A-Za-z][\w-]*(\s|$)/.test(prompt);
+}
+function resolveGoalPrompt(prompts) {
+  if (prompts.length === 0) return null;
+  const latest = prompts[prompts.length - 1];
+  if (!isContinuationPrompt(latest.prompt)) return { entry: latest, turnsBack: 0 };
+  for (let i = prompts.length - 2; i >= 0; i--) {
+    if (!isContinuationPrompt(prompts[i].prompt)) {
+      return { entry: prompts[i], turnsBack: prompts.length - 1 - i };
+    }
+  }
+  return { entry: latest, turnsBack: 0 };
+}
+function isReflectionQuestion(response) {
+  if (!response || typeof response !== "string") return false;
+  const markers = [
+    /reflection\s+for\s+future\s+agents/i,
+    /what(?:'s|\s+is)\s+one\s+thing\s+you\s+learned/i,
+    /say\s+['"]?skip['"]?\s+to\s+skip/i,
+    /quick\s+reflection\s+question/i,
+    // Post-flip (VRT-21): the agent drafts the reflection itself and, when
+    // interactive, asks the user to confirm/correct before recording. That
+    // turn authors no code either, so it's still a reflection turn.
+    /reflection\s+draft/i,
+    /confirm,?\s+correct,?\s+or\s+add/i
+  ];
+  return markers.some((m) => m.test(response));
+}
+function isMetaTaskLabel(label2) {
+  if (label2 === null || label2 === void 0) return false;
+  if (typeof label2 !== "string") return false;
+  const trimmed = label2.trim();
+  if (trimmed.length === 0) return true;
+  const metaPatterns = [
+    /^verity\s+[\w-]+\s+response$/i,
+    // "Verity reflect response"
+    /^simple user response$/i,
+    /^verity\s+command$/i,
+    // "Verity command"
+    /^user\s+(question|reply|response|ack)$/i
+  ];
+  return metaPatterns.some((p) => p.test(trimmed));
+}
+function shouldSkipForBareAck(input) {
+  if (!isBareAckPrompt(input.prompt)) return false;
+  if (input.turnAuthoredCode) return false;
+  return input.canSeeTurnAuthorship;
+}
+function isCommandOnlyTurn(input) {
+  if (!input.authorshipIsObservable) return false;
+  if (input.userCommandsTruncated) return false;
+  const commands = input.userCommands ?? [];
+  if (commands.length === 0) return false;
+  if (input.agentAuthoredFiles > 0) return false;
+  if (input.agentToolCalls > 0) return false;
+  return commands.every(isNonAuthoringCommand);
+}
+
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
 var import_node_fs8 = require("node:fs");
@@ -14023,386 +14289,159 @@ function* scanLines(text) {
     offset += line.length + 1;
   }
 }
-function findMarker(text, marker, from = 0) {
-  for (const { line, start, inFence } of scanLines(text)) {
-    if (!inFence && start >= from && line.startsWith(marker)) {
-      return start;
-    }
-  }
-  return -1;
-}
-function hasLegacyMemoryBlock(text) {
-  return findMarker(text, LEGACY_MD_START) !== -1;
-}
-async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path10.join)(cwd, "CLAUDE.md");
-  let existing = "";
-  if ((0, import_node_fs12.existsSync)(claudeMdPath)) {
-    existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
-  }
-  let startTag = CLAUDE_MD_START;
-  let endTag = CLAUDE_MD_END;
-  let startIdx = findMarker(existing, CLAUDE_MD_START);
-  let endIdx = startIdx === -1 ? -1 : findMarker(existing, CLAUDE_MD_END, startIdx + CLAUDE_MD_START.length);
-  if (startIdx === -1 || endIdx === -1) {
-    const legacyStart = findMarker(existing, LEGACY_MD_START);
-    const legacyEnd = legacyStart === -1 ? -1 : findMarker(existing, LEGACY_MD_END, legacyStart + LEGACY_MD_START.length);
-    if (legacyStart !== -1 && legacyEnd !== -1) {
-      startTag = LEGACY_MD_START;
-      endTag = LEGACY_MD_END;
-      startIdx = legacyStart;
-      endIdx = legacyEnd;
-    } else if (startIdx !== -1 && endIdx === -1 || legacyStart !== -1 && legacyEnd === -1) {
-      printWarn(
-        "CLAUDE.md: found an unterminated memory marker (a start marker with no matching end marker). Leaving the file untouched to avoid erasing your text \u2014 please close or remove the stray marker so Verity can manage the block."
-      );
-      return;
-    }
-  }
-  const hasBlock = startIdx !== -1 && endIdx !== -1 && endIdx > startIdx;
-  let preserved = PRESERVE_PLACEHOLDER;
-  if (hasBlock) {
-    const interior = existing.slice(startIdx + startTag.length, endIdx);
-    const captured = extractPreserveContent(interior);
-    if (captured !== null) {
-      preserved = captured;
-    } else {
-      const rescued = stripKnownProse(interior).trim();
-      if (rescued) {
-        preserved = rescued;
-        printWarn(
-          `CLAUDE.md: moved ${rescued.split("\n").length} line(s) of hand-edited text from inside the verity-memory markers into a preserve region (it now survives regeneration). Put durable guidance OUTSIDE the markers to keep it fully under your control.`
-        );
-      }
-    }
-  }
-  const block = [
-    CLAUDE_MD_START,
-    CLAUDE_MD_PROSE,
-    "",
-    PRESERVE_START,
-    preserved,
-    PRESERVE_END,
-    CLAUDE_MD_END
-  ].join("\n");
-  let next;
-  if (hasBlock) {
-    next = existing.slice(0, startIdx) + block + existing.slice(endIdx + endTag.length);
-  } else if (existing.trim() === "") {
-    next = block + "\n";
-  } else {
-    next = existing.replace(/\n*$/, "") + "\n\n" + block + "\n";
-  }
-  if (next === existing) return;
-  await (0, import_promises8.writeFile)(claudeMdPath, next);
-}
-function extractPreserveContent(interior) {
-  for (const [start, end] of [
-    [PRESERVE_START, PRESERVE_END],
-    [LEGACY_PRESERVE_START, LEGACY_PRESERVE_END]
-  ]) {
-    const s = interior.indexOf(start);
-    const e = interior.indexOf(end);
-    if (s !== -1 && e !== -1 && e >= s) {
-      return interior.slice(s + start.length, e).replace(/^\n+|\n+$/g, "");
-    }
-  }
-  return null;
-}
-function stripKnownProse(interior) {
-  const trimmed = interior.replace(/^\n+/, "");
-  for (const prose of [
-    CLAUDE_MD_PROSE,
-    CLAUDE_MD_PROSE_PRE_REFLECT,
-    CLAUDE_MD_PROSE_PRE_WAIVE,
-    CLAUDE_MD_PROSE_PRE_IGNORE,
-    CLAUDE_MD_PROSE_LEGACY
-  ]) {
-    if (trimmed.startsWith(prose)) return trimmed.slice(prose.length);
-  }
-  return trimmed;
-}
-var SCHEMA_TEMPLATE = `# Memory Graph Schema (v1)
-
-## Node format
-
-Each node is a markdown file with YAML frontmatter:
-
-\`\`\`yaml
----
-schema: 1
-id: n001-slug
-kind: decision | quality | security | intent | gotcha | pattern | domain | integration
-title: "Short title (\u2264200 chars)"
-domains: [tag1, tag2]
-file_globs: ["src/auth/**"]
-confidence: 0.5-1.0
-status: active | archived | superseded | orphan_flagged
-source: extractor | user | imported
-# ... (see full schema in MEMORY-GRAPH-PRD \xA76.3)
----
-
-# Title
-
-Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
-\`\`\`
-
-## Edge types
-
-| Edge | Meaning |
-|------|---------|
-| related | Loose association |
-| supersedes | A replaces B |
-| contradicts | A and B disagree |
-| caused_by | Something in B led to A |
-| example_of | A is an instance of B |
-
-## Domains
-
-| Directory | Purpose |
-|-----------|---------|
-| decisions/ | Architectural choices (ADR-style) |
-| quality/ | Quality patterns |
-| security/ | Security constraints |
-| intent/ | Intent templates |
-| gotchas/ | Footguns and surprises |
-| patterns/ | Code conventions |
-| domain/ | Business logic concepts |
-| integrations/ | External system knowledge |
-| _archive/ | Superseded nodes |
-`;
-
-// src/lib/dossier-session.ts
-var import_node_fs17 = require("node:fs");
-var import_node_crypto7 = require("node:crypto");
-var import_node_path13 = require("node:path");
-
-// src/lib/analysis-mode.ts
-var DEBUG_PHRASES = [
-  "not working",
-  "doesn't work",
-  "doesn't work",
-  "does not work",
-  "isn't working",
-  "is not working",
-  "can't figure out",
-  "stack trace"
-];
-var DEBUG_WORDS = [
-  "fix",
-  "bug",
-  "broken",
-  "crash",
-  "crashing",
-  "failing",
-  "debug",
-  "debugging",
-  "investigate",
-  "troubleshoot",
-  "regression",
-  "wrong"
-];
-var DEBUG_PATTERN = new RegExp(
-  [
-    ...DEBUG_PHRASES.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")),
-    ...DEBUG_WORDS.map((w) => `\\b${w}\\b`)
-  ].join("|"),
-  "i"
-);
-var FALSE_POSITIVE_PATTERNS = [
-  /\b(?:add|create|implement|write|build|design|set\s*up)\b.{0,20}\berror\b/i,
-  /\berror\s+handling\b/i,
-  /\berror\s+boundar(?:y|ies)\b/i,
-  /\berror\s+(?:type|class|page|component|message|code|enum)\b/i,
-  /\b(?:add|create|implement|write|build)\b.{0,20}\b(?:fix|debug|issue)\b/i
-];
-function hasDebugIntent(prompt) {
-  if (!DEBUG_PATTERN.test(prompt)) return false;
-  for (const fp of FALSE_POSITIVE_PATTERNS) {
-    if (fp.test(prompt)) return false;
-  }
-  return true;
-}
-var GIT_ONLY_PATTERN = /\b(commit|push|deploy|merge|rebase|tag|release|publish|ship)\b/i;
-var CODE_AUTHORING_PATTERN = /\b(add|create|implement|build|write|fix|update|change|refactor|modify|remove|delete|move|rename)\b.*\b(function|component|feature|endpoint|test|file|module|class|type|interface|hook|page|route|style|migration|code|bug|error|issue)\b/i;
-function isGitOnlyPrompt(prompt) {
-  if (!GIT_ONLY_PATTERN.test(prompt)) return false;
-  if (CODE_AUTHORING_PATTERN.test(prompt)) return false;
-  return true;
-}
-function reconcileAnalysisMode(predictedMode, signals) {
-  const mode2 = resolveAnalysisMode(predictedMode, signals);
-  if (mode2 !== "skip") return mode2;
-  const windowIsOrphaned = signals.actionSummary?.transcript_windowed === "orphaned";
-  if (windowIsOrphaned && !signals.sessionAuthoredCode) return "standard";
-  return mode2;
-}
-function resolveAnalysisMode(predictedMode, signals) {
-  if (!predictedMode || !isValidMode(predictedMode)) {
-    return detectAnalysisMode(
-      signals.noFilesChanged,
-      signals.assistantResponse,
-      signals.conversationPrompts,
-      signals.actionSummary,
-      signals.sessionAuthoredCode
-    );
-  }
-  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0)) || !!signals.sessionAuthoredCode;
-  const agentInvestigated = didAgentInvestigate(signals.actionSummary);
-  switch (predictedMode) {
-    case "skip":
-      if (agentAuthoredCode) return "standard";
-      return "skip";
-    case "plan":
-      if (agentAuthoredCode) return "standard";
-      return "plan";
-    case "debug":
-      return "debug";
-    case "standard":
-      if (!!signals.actionSummary && !agentAuthoredCode && !!signals.assistantResponse) {
-        return agentInvestigated ? "plan" : "skip";
-      }
-      return "standard";
-  }
-}
-function didAgentInvestigate(summary) {
-  if (!summary) return false;
-  return summary.files_read.length > 0 || summary.searches > 0 || summary.commands.length > 0 || summary.subagents > 0 || summary.web_fetches > 0;
-}
-function isValidMode(mode2) {
-  return mode2 === "standard" || mode2 === "plan" || mode2 === "debug" || mode2 === "skip";
-}
-function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary, sessionAuthoredCode) {
-  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0)) || !!sessionAuthoredCode;
-  if (conversationPrompts.length > 0 && conversationPrompts.every(isGitOnlyPrompt)) {
-    if (!agentAuthoredCode) return "skip";
-  }
-  if (noFilesChanged && !!assistantResponse && !agentAuthoredCode) {
-    return "plan";
-  }
-  if (!!actionSummary && !agentAuthoredCode && !!assistantResponse) {
-    return didAgentInvestigate(actionSummary) ? "plan" : "skip";
-  }
-  for (const prompt of conversationPrompts) {
-    if (hasDebugIntent(prompt)) {
-      return "debug";
-    }
-  }
-  return "standard";
-}
-var FILE_MUTATE_RE = /(?:^|[\s|&;(`])(?:sed\s+-i|perl\s+-i|awk\b|tee\b|dd\b|cp\b|mv\b|ln\b|install\b|touch\b|patch\b|git\s+(?:apply|am)\b|cargo\s+build|go\s+generate|make\b|--write\b|--fix\b|--in-place\b)|>>?(?![&>])/i;
-var GIT_PLUMBING_RE = /^\s*git\s+(?:merge|rebase|stash|cherry-pick|revert|pull|fetch|checkout|switch|reset|restore|clean)\b/i;
-var READ_ONLY_RE = /^\s*(?:git\s+(?:status|diff|log|show|branch|remote|config|rev-parse|ls-files|blame|describe)|ls|cat|head|tail|less|grep|rg|find|pwd|echo|printf|wc|which|type|tree|stat|file|env|printenv|date|whoami)\b/i;
-var CHAIN_RE = /&&|\||;|\$\(|\x60/;
-function isNonAuthoringCommand(cmd) {
-  if (typeof cmd !== "string" || cmd.trim().length === 0) return false;
-  if (FILE_MUTATE_RE.test(cmd)) return false;
-  if (CHAIN_RE.test(cmd)) return false;
-  return GIT_PLUMBING_RE.test(cmd) || READ_ONLY_RE.test(cmd);
-}
-function hasNonEditAuthorship(actionSummary, sessionAuthoredCode) {
-  if (!actionSummary) return sessionAuthoredCode;
-  if ((actionSummary.subagents ?? 0) > 0) return true;
-  if (Object.keys(actionSummary.tool_counts ?? {}).some((t) => t.startsWith("mcp__"))) return true;
-  const commands = actionSummary.commands ?? [];
-  if (commands.some((c) => FILE_MUTATE_RE.test(c))) return true;
-  if (sessionAuthoredCode) {
-    const allSafe = commands.length > 0 && commands.every(isNonAuthoringCommand);
-    if (!allSafe) return true;
-  }
-  return false;
-}
-function scopeToAuthored(files, actionSummary) {
-  if (!actionSummary) return { files, signal: "no-transcript" };
-  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
-  if (touched.length === 0) return { files: [], signal: "none-authored" };
-  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
-}
-function narrowToAgentAuthored(files, actionSummary) {
-  if (!actionSummary) return files;
-  const touched = [
-    ...actionSummary.files_edited,
-    ...actionSummary.files_created
-  ];
-  if (touched.length === 0) return files;
-  return files.filter((f) => {
-    const suffix = "/" + f;
-    return touched.some((t) => t === f || t.endsWith(suffix));
-  });
-}
-
-// src/lib/skip-detection.ts
-function isBareAckPrompt(prompt) {
-  if (typeof prompt !== "string") return false;
-  const trimmed = prompt.trim();
-  if (trimmed.length === 0) return false;
-  if (trimmed.length > 20) return false;
-  const bareAckPattern = /^(\d{1,2}|y|n|yes|no|yep|nope|ok(ay)?|sure|skip|cancel|stop|done|noted|got\s+it|sounds\s+good|thanks|thank\s+you|thx)[.!?]*$/i;
-  return bareAckPattern.test(trimmed);
-}
-function isContinuationPrompt(prompt) {
-  if (typeof prompt !== "string") return false;
-  const trimmed = prompt.trim();
-  if (trimmed.length === 0) return false;
-  if (trimmed.length > 24) return false;
-  const continuation = /^(let['’]?s\s+(go|do\s+it|start|continue)|go|go\s+ahead|go\s+on|proceed|continue|carry\s+on|keep\s+going|do\s+it|make\s+it\s+so|next|start|begin|ship\s+it|yes\s+please|please\s+continue|perfect|great|nice|excellent|agreed)[.!]*$/i;
-  return continuation.test(trimmed) || isBareAckPrompt(trimmed);
-}
-function resolveGoalPrompt(prompts) {
-  if (prompts.length === 0) return null;
-  const latest = prompts[prompts.length - 1];
-  if (!isContinuationPrompt(latest.prompt)) return { entry: latest, turnsBack: 0 };
-  for (let i = prompts.length - 2; i >= 0; i--) {
-    if (!isContinuationPrompt(prompts[i].prompt)) {
-      return { entry: prompts[i], turnsBack: prompts.length - 1 - i };
+function findMarker(text, marker, from = 0) {
+  for (const { line, start, inFence } of scanLines(text)) {
+    if (!inFence && start >= from && line.startsWith(marker)) {
+      return start;
     }
   }
-  return { entry: latest, turnsBack: 0 };
+  return -1;
 }
-function isReflectionQuestion(response) {
-  if (!response || typeof response !== "string") return false;
-  const markers = [
-    /reflection\s+for\s+future\s+agents/i,
-    /what(?:'s|\s+is)\s+one\s+thing\s+you\s+learned/i,
-    /say\s+['"]?skip['"]?\s+to\s+skip/i,
-    /quick\s+reflection\s+question/i,
-    // Post-flip (VRT-21): the agent drafts the reflection itself and, when
-    // interactive, asks the user to confirm/correct before recording. That
-    // turn authors no code either, so it's still a reflection turn.
-    /reflection\s+draft/i,
-    /confirm,?\s+correct,?\s+or\s+add/i
-  ];
-  return markers.some((m) => m.test(response));
+function hasLegacyMemoryBlock(text) {
+  return findMarker(text, LEGACY_MD_START) !== -1;
 }
-function isMetaTaskLabel(label2) {
-  if (label2 === null || label2 === void 0) return false;
-  if (typeof label2 !== "string") return false;
-  const trimmed = label2.trim();
-  if (trimmed.length === 0) return true;
-  const metaPatterns = [
-    /^verity\s+[\w-]+\s+response$/i,
-    // "Verity reflect response"
-    /^simple user response$/i,
-    /^verity\s+command$/i,
-    // "Verity command"
-    /^user\s+(question|reply|response|ack)$/i
-  ];
-  return metaPatterns.some((p) => p.test(trimmed));
+async function ensureClaudeMdPointer(cwd = repoRoot()) {
+  const claudeMdPath = (0, import_node_path10.join)(cwd, "CLAUDE.md");
+  let existing = "";
+  if ((0, import_node_fs12.existsSync)(claudeMdPath)) {
+    existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
+  }
+  let startTag = CLAUDE_MD_START;
+  let endTag = CLAUDE_MD_END;
+  let startIdx = findMarker(existing, CLAUDE_MD_START);
+  let endIdx = startIdx === -1 ? -1 : findMarker(existing, CLAUDE_MD_END, startIdx + CLAUDE_MD_START.length);
+  if (startIdx === -1 || endIdx === -1) {
+    const legacyStart = findMarker(existing, LEGACY_MD_START);
+    const legacyEnd = legacyStart === -1 ? -1 : findMarker(existing, LEGACY_MD_END, legacyStart + LEGACY_MD_START.length);
+    if (legacyStart !== -1 && legacyEnd !== -1) {
+      startTag = LEGACY_MD_START;
+      endTag = LEGACY_MD_END;
+      startIdx = legacyStart;
+      endIdx = legacyEnd;
+    } else if (startIdx !== -1 && endIdx === -1 || legacyStart !== -1 && legacyEnd === -1) {
+      printWarn(
+        "CLAUDE.md: found an unterminated memory marker (a start marker with no matching end marker). Leaving the file untouched to avoid erasing your text \u2014 please close or remove the stray marker so Verity can manage the block."
+      );
+      return;
+    }
+  }
+  const hasBlock = startIdx !== -1 && endIdx !== -1 && endIdx > startIdx;
+  let preserved = PRESERVE_PLACEHOLDER;
+  if (hasBlock) {
+    const interior = existing.slice(startIdx + startTag.length, endIdx);
+    const captured = extractPreserveContent(interior);
+    if (captured !== null) {
+      preserved = captured;
+    } else {
+      const rescued = stripKnownProse(interior).trim();
+      if (rescued) {
+        preserved = rescued;
+        printWarn(
+          `CLAUDE.md: moved ${rescued.split("\n").length} line(s) of hand-edited text from inside the verity-memory markers into a preserve region (it now survives regeneration). Put durable guidance OUTSIDE the markers to keep it fully under your control.`
+        );
+      }
+    }
+  }
+  const block = [
+    CLAUDE_MD_START,
+    CLAUDE_MD_PROSE,
+    "",
+    PRESERVE_START,
+    preserved,
+    PRESERVE_END,
+    CLAUDE_MD_END
+  ].join("\n");
+  let next;
+  if (hasBlock) {
+    next = existing.slice(0, startIdx) + block + existing.slice(endIdx + endTag.length);
+  } else if (existing.trim() === "") {
+    next = block + "\n";
+  } else {
+    next = existing.replace(/\n*$/, "") + "\n\n" + block + "\n";
+  }
+  if (next === existing) return;
+  await (0, import_promises8.writeFile)(claudeMdPath, next);
 }
-function shouldSkipForBareAck(input) {
-  if (!isBareAckPrompt(input.prompt)) return false;
-  if (input.turnAuthoredCode) return false;
-  return input.canSeeTurnAuthorship;
+function extractPreserveContent(interior) {
+  for (const [start, end] of [
+    [PRESERVE_START, PRESERVE_END],
+    [LEGACY_PRESERVE_START, LEGACY_PRESERVE_END]
+  ]) {
+    const s = interior.indexOf(start);
+    const e = interior.indexOf(end);
+    if (s !== -1 && e !== -1 && e >= s) {
+      return interior.slice(s + start.length, e).replace(/^\n+|\n+$/g, "");
+    }
+  }
+  return null;
 }
-function isCommandOnlyTurn(input) {
-  if (!input.authorshipIsObservable) return false;
-  if (input.userCommandsTruncated) return false;
-  const commands = input.userCommands ?? [];
-  if (commands.length === 0) return false;
-  if (input.agentAuthoredFiles > 0) return false;
-  if (input.agentToolCalls > 0) return false;
-  return commands.every(isNonAuthoringCommand);
+function stripKnownProse(interior) {
+  const trimmed = interior.replace(/^\n+/, "");
+  for (const prose of [
+    CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_REFLECT,
+    CLAUDE_MD_PROSE_PRE_WAIVE,
+    CLAUDE_MD_PROSE_PRE_IGNORE,
+    CLAUDE_MD_PROSE_LEGACY
+  ]) {
+    if (trimmed.startsWith(prose)) return trimmed.slice(prose.length);
+  }
+  return trimmed;
 }
+var SCHEMA_TEMPLATE = `# Memory Graph Schema (v1)
+
+## Node format
+
+Each node is a markdown file with YAML frontmatter:
+
+\`\`\`yaml
+---
+schema: 1
+id: n001-slug
+kind: decision | quality | security | intent | gotcha | pattern | domain | integration
+title: "Short title (\u2264200 chars)"
+domains: [tag1, tag2]
+file_globs: ["src/auth/**"]
+confidence: 0.5-1.0
+status: active | archived | superseded | orphan_flagged
+source: extractor | user | imported
+# ... (see full schema in MEMORY-GRAPH-PRD \xA76.3)
+---
+
+# Title
+
+Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
+\`\`\`
+
+## Edge types
+
+| Edge | Meaning |
+|------|---------|
+| related | Loose association |
+| supersedes | A replaces B |
+| contradicts | A and B disagree |
+| caused_by | Something in B led to A |
+| example_of | A is an instance of B |
+
+## Domains
+
+| Directory | Purpose |
+|-----------|---------|
+| decisions/ | Architectural choices (ADR-style) |
+| quality/ | Quality patterns |
+| security/ | Security constraints |
+| intent/ | Intent templates |
+| gotchas/ | Footguns and surprises |
+| patterns/ | Code conventions |
+| domain/ | Business logic concepts |
+| integrations/ | External system knowledge |
+| _archive/ | Superseded nodes |
+`;
+
+// src/lib/dossier-session.ts
+var import_node_fs17 = require("node:fs");
+var import_node_crypto7 = require("node:crypto");
+var import_node_path13 = require("node:path");
 
 // src/lib/pending-repeat.ts
 var STOP = /* @__PURE__ */ new Set([
@@ -15863,15 +15902,18 @@ function registerIntentCommands(program2) {
       if (deferredToPlugin("intent capture", event.session_id ?? process.env.CLAUDE_SESSION_ID ?? null)) {
         process.exit(0);
       }
+      const isPrimitive = isSlashCommand(prompt);
       const authForScope = await resolveToken(program2.opts().token);
       const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
       const scopeSession = event.session_id || process.env.CLAUDE_SESSION_ID || "";
-      await appendToConversationBuffer(prompt, sessionScopeKey(scopeToken, scopeSession));
-      try {
-        const tok = await resolveToken(globals.token);
-        const session = sessionDossier(tok.ok ? tok.data.token : null, event.session_id ?? null);
-        if (session) recordGoal(session.d, prompt);
-      } catch {
+      if (!isPrimitive) await appendToConversationBuffer(prompt, sessionScopeKey(scopeToken, scopeSession));
+      if (!isPrimitive) {
+        try {
+          const tok = await resolveToken(globals.token);
+          const session = sessionDossier(tok.ok ? tok.data.token : null, event.session_id ?? null);
+          if (session) recordGoal(session.d, prompt);
+        } catch {
+        }
       }
       try {
         await ensureMemoryDir();
@@ -17807,6 +17849,9 @@ function createRun(opts, globals) {
   };
 }
 
+// src/commands/analyze/index.ts
+var import_node_fs38 = require("node:fs");
+
 // src/lib/repo-context.ts
 var import_node_child_process7 = require("node:child_process");
 var import_node_os3 = require("node:os");
@@ -18831,21 +18876,19 @@ function refResolves(frame, ref) {
   return frameGit(frame, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]) !== "";
 }
 var SHA_RE2 = /^[0-9a-f]{40}$/;
-function baselineShaAt(frame) {
-  if (!frame.worktreeRoot) return null;
-  try {
-    const sha = (0, import_node_fs26.readFileSync)((0, import_node_path19.join)(frame.worktreeRoot, BASELINE_SHA_FILE), "utf-8").trim();
-    if (!SHA_RE2.test(sha)) return null;
-    return refResolves(frame, sha) ? sha : null;
-  } catch {
-    return null;
+function stagedRange(frame) {
+  if (!frame.worktreeRoot) return { kind: "nothing", base: null, head: "INDEX", via: "refused" };
+  const mergeHead = frame.gitDir ? (0, import_node_path19.join)(frame.gitDir, "MERGE_HEAD") : null;
+  if (mergeHead && (0, import_node_fs26.existsSync)(mergeHead)) {
+    const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
+    const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
+    const resolutions = [...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f));
+    return { kind: "merge", base: "HEAD", head: "INDEX", via: "merge-resolutions", files: resolutions };
   }
-}
-function stagedRange() {
   return { kind: "staged", base: "HEAD", head: "INDEX", via: "index" };
 }
 function resolvePushRange(frame, command, on) {
-  const nothing = (via) => ({ kind: "nothing", base: null, head: "HEAD", via });
+  const nothing = (via2) => ({ kind: "nothing", base: null, head: "HEAD", via: via2 });
   if (!frame.worktreeRoot) return nothing("refused");
   const found = findMomentSegment(command, on);
   const segment = found ? splitSegments(command)[found.segmentIndex] : "";
@@ -18853,54 +18896,32 @@ function resolvePushRange(frame, command, on) {
   if (target.isDelete) return nothing("deletion");
   const head = target.srcRef ?? "HEAD";
   if (!refResolves(frame, head)) return nothing(`src-unresolvable:${head}`);
-  const srcName = target.srcRef;
-  const branchForRemote = srcName ?? frame.branch;
-  const candidates = [];
-  if (target.remote && (target.dstRef ?? srcName)) {
-    const dstName = (target.dstRef ?? srcName).replace(/^refs\/heads\//, "");
-    candidates.push({ ref: `refs/remotes/${target.remote}/${dstName}`, via: `refspec:${target.remote}/${dstName}` });
-  }
-  if (target.remote && !srcName && !target.dstRef && frame.branch) {
-    candidates.push({ ref: `refs/remotes/${target.remote}/${frame.branch}`, via: `remote:${target.remote}/${frame.branch}` });
-  }
-  candidates.push({ ref: srcName ? `${srcName}@{push}` : "@{push}", via: "@{push}" });
-  candidates.push({ ref: srcName ? `${srcName}@{upstream}` : "@{upstream}", via: "@{upstream}" });
-  if (branchForRemote) {
-    candidates.push({
-      ref: `refs/remotes/origin/${branchForRemote.replace(/^refs\/heads\//, "")}`,
-      via: `origin/${branchForRemote.replace(/^refs\/heads\//, "")}`
-    });
-  }
-  for (const c of candidates) {
-    if (!refResolves(frame, c.ref)) continue;
-    const mergeBase = frameGit(frame, ["merge-base", c.ref, head]);
-    if (SHA_RE2.test(mergeBase)) return { kind: "push", base: mergeBase, head, via: c.via };
+  const remotePattern = target.remote ? `--remotes=${target.remote}` : "--remotes";
+  const via = target.remote ? `publication:${target.remote}` : "publication";
+  const commits = frameGit(frame, ["rev-list", head, "--not", remotePattern]).split("\n").filter(Boolean);
+  if (commits.length === 0) return { kind: "nothing", base: null, head, via: "already-published" };
+  const boundary = frameGit(frame, ["rev-list", head, "--not", remotePattern, "--boundary"]).split("\n").filter((l) => l.startsWith("-")).map((l) => l.slice(1));
+  const base = boundary.find((s) => SHA_RE2.test(s)) ?? null;
+  const files = /* @__PURE__ */ new Set();
+  for (const sha of commits) {
+    for (const f of frameGit(frame, ["diff-tree", "--no-commit-id", "--name-only", "-r", sha]).split("\n")) {
+      if (f && !isVerityOwnedPath(f)) files.add(f);
+    }
   }
-  const baseline = baselineShaAt(frame);
-  if (baseline) return { kind: "baseline", base: baseline, head, via: "review-baseline" };
-  if (refResolves(frame, `${head}~1`)) return { kind: "last-commit", base: `${head}~1`, head, via: `${head}~1` };
-  return nothing("no-parent");
+  return { kind: "push", base, head, via, files: [...files], commits };
 }
 function rangeFiles(frame, range) {
-  let out;
-  switch (range.kind) {
-    case "staged":
-      out = frameGit(frame, ["diff", "--cached", "--name-only"]);
-      break;
-    case "push":
-    case "baseline":
-    case "last-commit":
-      out = frameGit(frame, ["diff", "--name-only", range.base, range.head === "INDEX" ? "HEAD" : range.head]);
-      break;
-    case "nothing":
-      return [];
+  if (range.files) return range.files.filter((f) => !isVerityOwnedPath(f));
+  if (range.kind === "staged") {
+    return frameGit(frame, ["diff", "--cached", "--name-only"]).split("\n").filter((l) => l.length > 0).filter((f) => !isVerityOwnedPath(f));
   }
-  return out.split("\n").filter((l) => l.length > 0).filter((f) => !isVerityOwnedPath(f));
+  return [];
 }
 function rangeChangeSignals(frame, range, paths) {
   const out = /* @__PURE__ */ new Map();
   if (range.kind === "nothing" || paths.length === 0) return out;
-  const args = range.kind === "staged" ? ["diff", "--cached", "--unified=0"] : ["diff", "--unified=0", range.base, range.head === "INDEX" ? "HEAD" : range.head];
+  if (range.kind === "push" && !range.base) return out;
+  const args = range.kind === "staged" || range.kind === "merge" ? ["diff", "--cached", "--unified=0"] : ["diff", "--unified=0", range.base, range.head === "INDEX" ? "HEAD" : range.head];
   const diff = frameGit(frame, [...args, "--", ...paths]);
   let current = null;
   let oldSide = null;
@@ -18932,8 +18953,9 @@ function rangeChangeSignals(frame, range, paths) {
   return out;
 }
 function rangeMessages(frame, range) {
-  if (range.kind === "staged" || range.kind === "nothing" || !range.base) return "";
-  return frameGit(frame, ["log", `${range.base}..${range.head === "INDEX" ? "HEAD" : range.head}`, "--format=%B%x00"]).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+  if (range.kind !== "push" || !range.commits || range.commits.length === 0) return "";
+  const commits = range.commits.slice(0, 100);
+  return frameGit(frame, ["show", "-s", "--format=%B%x00", ...commits]).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
 }
 function frameTelemetry(frame, range, divergence) {
   const t = {
@@ -19515,7 +19537,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.31.2" : "dev";
+    return true ? "0.31.4" : "dev";
   } catch {
     return "dev";
   }
@@ -20734,7 +20756,20 @@ async function evidence(run2) {
             widened_to: allForReview.length
           });
         }
-        const baseForReview = narrowingIsTrustworthy ? scoped.files : recoveredScope.length > 0 ? recoveredScope : allForReview;
+        const authorshipWasObservable = scoped.signal === "authored" && actionSummary?.transcript_windowed !== "orphaned";
+        if (!narrowingIsTrustworthy && recoveredScope.length === 0 && authorshipWasObservable) {
+          logEvent("authored_nothing_reviewable", {
+            touched: (actionSummary?.files_edited?.length ?? 0) + (actionSummary?.files_created?.length ?? 0),
+            candidates: allForReview.length
+          });
+        }
+        const baseForReview = chooseReviewScope({
+          narrowingIsTrustworthy,
+          scopedFiles: scoped.files,
+          recoveredScope,
+          allForReview,
+          authorshipWasObservable
+        });
         const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
         if (!opts.skipStatic && isCodacyAvailable()) {
           let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
@@ -22700,6 +22735,10 @@ function registerAnalyzeCommand(program2) {
 }
 var tracing = () => process.env.VERITY_TRACE_PHASES === "1";
 async function runAnalyze(opts, globals) {
+  if (!verityConfigured()) {
+    (0, import_node_fs38.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
+    process.exit(0);
+  }
   const run2 = createRun(opts, globals);
   installRunEvidence(run2);
   for (const [name, phase] of PIPELINE) {
@@ -22718,7 +22757,6 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs38 = require("node:fs");
 function registerBaselineCommands(program2) {
   const baseline = program2.command("baseline").description("Manage the task-start working-tree baseline");
   baseline.command("capture").description("Snapshot the working tree at task start (used by SessionStart hook)").option("--session-id <id>", "Session id (overrides any value from stdin)").option("--source <source>", "Lifecycle hint: startup|resume|clear|compact").action(async (opts) => {
@@ -22727,7 +22765,16 @@ function registerBaselineCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs38.existsSync)(VERITY_DIR)) {
+      if (!verityConfigured()) {
+        const how = isPluginInvocation() ? "Offer to run /verity:setup for the user." : "Offer to run `verity init` (or /verity-setup) for the user.";
+        process.stdout.write(
+          JSON.stringify({
+            hookSpecificOutput: {
+              hookEventName: "SessionStart",
+              additionalContext: `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
+            }
+          }) + "\n"
+        );
         process.exit(0);
       }
       let sessionId = opts.sessionId;
@@ -22817,8 +22864,8 @@ async function runReview(opts, globals) {
     for (const p of specPaths) {
       if (!(0, import_node_fs39.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync27 } = await import("node:fs");
-        const content = readFileSync27(p, "utf-8");
+        const { readFileSync: readFileSync26 } = await import("node:fs");
+        const content = readFileSync26(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -22975,13 +23022,14 @@ function registerGuardCommand(program2) {
   });
 }
 function resolveMomentRange(moment, frame, command, on) {
-  return moment === "pre-commit" ? stagedRange() : resolvePushRange(frame, command, on);
+  return moment === "pre-commit" ? stagedRange(frame) : resolvePushRange(frame, command, on);
 }
 function describeRange(range) {
   if (range.kind === "staged") return "staged";
-  if (range.kind === "nothing" || !range.base) return null;
-  const base = /^[0-9a-f]{40}$/.test(range.base) ? range.base.slice(0, 7) : range.base;
-  return `${base}..${range.head} via ${range.via}`;
+  if (range.kind === "merge") return `merge (${range.via})`;
+  if (range.kind === "nothing") return range.via === "already-published" ? "already published" : null;
+  const base = range.base && /^[0-9a-f]{40}$/.test(range.base) ? range.base.slice(0, 7) : range.base;
+  return base ? `${base}..${range.head} via ${range.via}` : `via ${range.via}`;
 }
 function matchFlagValue(command, flags) {
   const re = new RegExp(`(?<![\\w-])(?:${flags})(?:=|\\s+)('((?:[^'\\\\]|\\\\.)*)'|"((?:[^"\\\\]|\\\\.)*)"|([^\\s'"-][^\\s]*))`);
@@ -24645,6 +24693,61 @@ async function reconcileOwnWiring(moments) {
     printWarn("  Enable one: verity hooks install --moments stop");
   }
 }
+async function checkPrerequisites(step) {
+  step("Checking prerequisites");
+  const prereqs = await checkPrereqs({ install: true });
+  for (const c of prereqs.checks) {
+    if (c.status === "ok") {
+      if (c.justInstalled) continue;
+      printInfo(`  ${c.label} ${c.detail} \u2713`);
+    } else {
+      printWarn(`  ${c.label}: ${c.detail}`);
+      if (c.remedy) printWarn(`    ${c.remedy}`);
+    }
+  }
+  if (prereqs.blocked) {
+    printError("A required prerequisite is missing \u2014 cannot continue.");
+    process.exit(1);
+  }
+  return prereqs.checks.some((c) => c.id === "claude" && c.status === "ok");
+}
+async function scaffoldProject(step, defaultsOnly) {
+  step("Knowledge base, .gitignore and CLAUDE.md");
+  await (0, import_promises14.mkdir)(VERITY_DIR, { recursive: true });
+  await ensureMemoryDir();
+  const ignoreResult = ensureVerityGitignore();
+  if (ignoreResult === "failed") {
+    printWarn("  .gitignore: could not write the Verity block \u2014 add it manually");
+    printWarn("    (.verity/ holds copies of analyzed files, including any secret the gate flagged)");
+  } else if (ignoreResult === "conflict") {
+    printWarn("  .gitignore: the Verity block is in place but git still ignores .verity/standard.yaml");
+    printWarn("    Something outside this file covers it \u2014 a global (~/.gitignore) or nested");
+    printWarn("    .gitignore, or a pattern we do not recognise. Check: git check-ignore -v .verity/standard.yaml");
+    printWarn("    Until it is fixed, the Standard and the knowledge graph cannot be committed.");
+  } else if (ignoreResult === "repaired") {
+    printInfo("  .gitignore: rewrote `.verity/` to `.verity/*` so the standard stays committable \u2713");
+  } else {
+    printInfo(`  .gitignore: Verity block ${ignoreResult === "added" ? "added" : "already covered"} \u2713`);
+  }
+  const tracked = committedVerityState();
+  if (tracked.length > 0) {
+    printWarn(`  ${tracked.length} Verity state file(s) are tracked in git (e.g. ${tracked[0]}).`);
+    const untrack = defaultsOnly ? false : await promptYes("  Untrack them now (files stay on disk)? [Y/n] ", { nonInteractive: false });
+    if (untrack) {
+      const result = untrackVerityState();
+      if (result === "untracked") printInfo("  Untracked (staged) \u2014 commit to finish \u2713");
+      else if (result === "failed") printWarn('  Could not untrack \u2014 run "git rm -r --cached .verity" manually');
+    } else {
+      printWarn("  Left tracked. Fix with: git rm -r --cached .verity && git add .verity/standard.yaml .verity/memory");
+    }
+  }
+  try {
+    await ensureClaudeMdPointer();
+    printInfo("  CLAUDE.md instructions \u2713");
+  } catch (err) {
+    printWarn(`  Could not update CLAUDE.md: ${err.message}`);
+  }
+}
 function registerInitCommand(program2) {
   program2.command("init").alias("setup").description("Set up Verity in the current project (asks the setup questions, then hands off to /verity-setup)").option("--force", "Reinstall the skills even when they are already up to date (hooks are always reconciled)").option("-y, --yes", "Take the recommended answer for every question (no prompts)").option("--no-setup", "Skip the /verity-setup handoff at the end").option(
     "--plugin-mode",
@@ -24686,22 +24789,7 @@ function registerInitCommand(program2) {
       }
       console.log("");
     }
-    step("Checking prerequisites");
-    const prereqs = await checkPrereqs({ install: true });
-    for (const c of prereqs.checks) {
-      if (c.status === "ok") {
-        if (c.justInstalled) continue;
-        printInfo(`  ${c.label} ${c.detail} \u2713`);
-      } else {
-        printWarn(`  ${c.label}: ${c.detail}`);
-        if (c.remedy) printWarn(`    ${c.remedy}`);
-      }
-    }
-    if (prereqs.blocked) {
-      printError("A required prerequisite is missing \u2014 cannot continue.");
-      process.exit(1);
-    }
-    const claudeInstalled = prereqs.checks.some((c) => c.id === "claude" && c.status === "ok");
+    const claudeInstalled = await checkPrerequisites(step);
     console.log("");
     if (pluginMode) {
       printInfo("Skipping skills \u2014 the Verity plugin provides them, namespaced as /verity:<name>.");
@@ -24715,41 +24803,7 @@ function registerInitCommand(program2) {
     if (defaultsOnly) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
-    step("Knowledge base, .gitignore and CLAUDE.md");
-    await (0, import_promises14.mkdir)(VERITY_DIR, { recursive: true });
-    await ensureMemoryDir();
-    const ignoreResult = ensureVerityGitignore();
-    if (ignoreResult === "failed") {
-      printWarn("  .gitignore: could not write the Verity block \u2014 add it manually");
-      printWarn("    (.verity/ holds copies of analyzed files, including any secret the gate flagged)");
-    } else if (ignoreResult === "conflict") {
-      printWarn("  .gitignore: the Verity block is in place but git still ignores .verity/standard.yaml");
-      printWarn("    Something outside this file covers it \u2014 a global (~/.gitignore) or nested");
-      printWarn("    .gitignore, or a pattern we do not recognise. Check: git check-ignore -v .verity/standard.yaml");
-      printWarn("    Until it is fixed, the Standard and the knowledge graph cannot be committed.");
-    } else if (ignoreResult === "repaired") {
-      printInfo("  .gitignore: rewrote `.verity/` to `.verity/*` so the standard stays committable \u2713");
-    } else {
-      printInfo(`  .gitignore: Verity block ${ignoreResult === "added" ? "added" : "already covered"} \u2713`);
-    }
-    const tracked = committedVerityState();
-    if (tracked.length > 0) {
-      printWarn(`  ${tracked.length} Verity state file(s) are tracked in git (e.g. ${tracked[0]}).`);
-      const untrack = defaultsOnly ? false : await promptYes("  Untrack them now (files stay on disk)? [Y/n] ", { nonInteractive: false });
-      if (untrack) {
-        const result = untrackVerityState();
-        if (result === "untracked") printInfo("  Untracked (staged) \u2014 commit to finish \u2713");
-        else if (result === "failed") printWarn('  Could not untrack \u2014 run "git rm -r --cached .verity" manually');
-      } else {
-        printWarn("  Left tracked. Fix with: git rm -r --cached .verity && git add .verity/standard.yaml .verity/memory");
-      }
-    }
-    try {
-      await ensureClaudeMdPointer();
-      printInfo("  CLAUDE.md instructions \u2713");
-    } catch (err) {
-      printWarn(`  Could not update CLAUDE.md: ${err.message}`);
-    }
+    await scaffoldProject(step, defaultsOnly);
     const globalVerityDir = (0, import_node_path29.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises14.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
@@ -24811,7 +24865,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.31.2" : "dev"
+          cli_version: true ? "0.31.4" : "dev"
         }
       });
     } catch (err) {
@@ -25480,8 +25534,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.31.2").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.2");
+program.name("verity").description("CLI for Verity quality gate service").version("0.31.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.31.4");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.31.2",
+  "version": "0.31.4",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",