@codacy/verity-cli 0.32.0-experimental.cc76941 → 0.32.0-experimental.f0746f7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +2 -103
- package/bin/verity.js +1218 -1841
- package/data/skills/verity-analyze/SKILL.md +0 -7
- package/data/skills/verity-feedback/SKILL.md +0 -6
- package/data/skills/verity-insights/SKILL.md +0 -7
- package/data/skills/verity-learn/SKILL.md +0 -6
- package/data/skills/verity-memory/SKILL.md +0 -7
- package/data/skills/verity-reflect/SKILL.md +0 -6
- package/data/skills/verity-setup/SKILL.md +5 -12
- package/data/skills/verity-status/SKILL.md +0 -6
- package/package.json +1 -1
|
@@ -1,10 +1,3 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: >-
|
|
3
|
-
Run an independent AI review of the current change on demand — a second opinion on quality,
|
|
4
|
-
security, and whether the code matches its stated intent. Use when the user asks to review,
|
|
5
|
-
check, or analyze code before committing, or to get an independent check on work you have
|
|
6
|
-
just finished.
|
|
7
|
-
---
|
|
8
1
|
# /verity-analyze — Run Verity analysis on demand
|
|
9
2
|
|
|
10
3
|
You are running an on-demand Verity analysis. This is like a "second opinion" — the user (or you) can invoke it at any point to get a quality and security review with rich context.
|
|
@@ -1,10 +1,3 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: >-
|
|
3
|
-
Report project quality metrics from accumulated run data, and manage the Standard's evolution
|
|
4
|
-
suggestions. Use when the user asks for quality trends or metrics, or whether the Standard
|
|
5
|
-
should change.
|
|
6
|
-
disable-model-invocation: true
|
|
7
|
-
---
|
|
8
1
|
# /verity-insights — Project quality insights and Standard evolution
|
|
9
2
|
|
|
10
3
|
Surface metrics from accumulated run data and manage Standard evolution suggestions.
|
|
@@ -1,9 +1,3 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: >-
|
|
3
|
-
View and manage the durable project knowledge Verity has accumulated — decisions, patterns,
|
|
4
|
-
gotchas, and conventions extracted from past analysis runs. Use when the user asks what
|
|
5
|
-
Verity has learned, or before changing an area of the code you do not know.
|
|
6
|
-
---
|
|
7
1
|
# /verity-learn — View and manage project knowledge
|
|
8
2
|
|
|
9
3
|
Project knowledge is durable insights extracted from analysis runs — decisions, patterns, gotchas, and conventions. When the memory graph is enabled (`memory_graph_enabled`), this skill delegates to the graph. Otherwise, it uses flat lessons.
|
|
@@ -1,10 +1,3 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: >-
|
|
3
|
-
Browse, query, and extend the project knowledge graph at .verity/memory/ — typed nodes and
|
|
4
|
-
edges covering decisions, patterns, security constraints, and gotchas. Use to pull prior
|
|
5
|
-
context on files you are about to change, or when the user asks to record or inspect project
|
|
6
|
-
knowledge.
|
|
7
|
-
---
|
|
8
1
|
# /verity-memory — Manage the project knowledge graph
|
|
9
2
|
|
|
10
3
|
The memory graph is a collection of markdown nodes at `.verity/memory/` organized into 8 domains. Each node has YAML frontmatter with typed edges that form a graph. The graph is the project's accumulated knowledge — decisions, patterns, gotchas, security constraints, and more.
|
|
@@ -1,9 +1,3 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: >-
|
|
3
|
-
Capture a durable learning at the end of a task: draft a concrete, cited observation from
|
|
4
|
-
what actually happened, then confirm it with the user or record it directly. Use at natural
|
|
5
|
-
task-completion moments, or when the user asks to record a lesson.
|
|
6
|
-
---
|
|
7
1
|
# /verity-reflect — Capture learnings after a task
|
|
8
2
|
|
|
9
3
|
At a natural task-completion moment, **the agent reflects first** — draft a
|
|
@@ -1,10 +1,3 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: >-
|
|
3
|
-
Configure Verity for this project: create or update the project Standard, wire the
|
|
4
|
-
static-analysis tools, and authenticate. Use when setting Verity up for the first time, or
|
|
5
|
-
when the user asks to change quality rules, severity thresholds, or which analysis tools run.
|
|
6
|
-
disable-model-invocation: true
|
|
7
|
-
---
|
|
8
1
|
# /verity-setup — Configure Verity for this project
|
|
9
2
|
|
|
10
3
|
You are finishing Verity's setup: the half that needs a model.
|
|
@@ -35,7 +28,7 @@ propose them from evidence rather than have them invented from a dependency list
|
|
|
35
28
|
3. Write `.codacy/codacy.config.json` with curated, validated pattern ids (Step 5).
|
|
36
29
|
4. Upload both, seed the knowledge base, write `VERITY.md` (Steps 7–8).
|
|
37
30
|
|
|
38
|
-
**Reference files** (
|
|
31
|
+
**Reference files** (installed in this project at `.claude/skills/verity-setup/`):
|
|
39
32
|
- `patterns-reference.yaml` — Research-backed patterns catalog (quality, security, language-specific)
|
|
40
33
|
- `standard-template.yaml` — YAML skeleton for the Standard
|
|
41
34
|
|
|
@@ -155,7 +148,7 @@ user's decision to make at a terminal.
|
|
|
155
148
|
|
|
156
149
|
## Step 4: Synthesize the Standard
|
|
157
150
|
|
|
158
|
-
Read
|
|
151
|
+
Read `.claude/skills/verity-setup/patterns-reference.yaml` and `.claude/skills/verity-setup/standard-template.yaml` from the project root.
|
|
159
152
|
|
|
160
153
|
Generate `.verity/standard.yaml` by filling in the template:
|
|
161
154
|
|
|
@@ -228,7 +221,7 @@ it from the installed adapter. Then **always validate** (next section).
|
|
|
228
221
|
|
|
229
222
|
```bash
|
|
230
223
|
# balanced/thorough: critical + high vulns, secrets, malicious packages
|
|
231
|
-
node
|
|
224
|
+
node <skill-dir>/validate-patterns.mjs --emit Trivy \
|
|
232
225
|
'^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$'
|
|
233
226
|
|
|
234
227
|
# lightweight: drop malicious_packages if you want the minimum
|
|
@@ -413,7 +406,7 @@ alongside this skill. It checks every `patternId` against the IDs the installed
|
|
|
413
406
|
adapters actually define, and exits non-zero on any that does not exist:
|
|
414
407
|
|
|
415
408
|
```bash
|
|
416
|
-
node $
|
|
409
|
+
node "$(dirname "$0")/validate-patterns.mjs" # or: node <skill-dir>/validate-patterns.mjs
|
|
417
410
|
```
|
|
418
411
|
|
|
419
412
|
Expected output:
|
|
@@ -481,7 +474,7 @@ disabled tool produces the same zero findings as clean code, so a quiet run prov
|
|
|
481
474
|
nothing on its own:
|
|
482
475
|
|
|
483
476
|
```bash
|
|
484
|
-
node
|
|
477
|
+
node <skill-dir>/validate-patterns.mjs
|
|
485
478
|
```
|
|
486
479
|
|
|
487
480
|
Then confirm the volume is sane:
|
|
@@ -1,9 +1,3 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: >-
|
|
3
|
-
Show Verity quality status for this project: Standard version, last run summary, quality
|
|
4
|
-
trend, and pending items. Use when the user asks how the project is doing, what Verity found
|
|
5
|
-
recently, or whether the gate is passing.
|
|
6
|
-
---
|
|
7
1
|
# /verity-status — Show Verity quality status
|
|
8
2
|
|
|
9
3
|
You are showing the current Verity quality status for this project. This gives a quick overview of project health without running a new analysis.
|
package/package.json
CHANGED