@codacy/verity-cli 0.34.0-experimental.cc5f6ec → 0.34.0-experimental.d4649a0

package/data/skills/verity-analyze/SKILL.md

@@ -151,18 +151,30 @@ Use the `verity review` command with all the context you gathered:
 
 ```bash
 verity review \
-  --files "src/auth/pkce.ts,src/auth/callback.ts,src/auth/types.ts,src/middleware/auth.ts" \
-  --changed "src/auth/pkce.ts,src/auth/callback.ts" \
-  --intent "I am adding OAuth2 PKCE authentication flow..." \
-  --specs "spec/AUTH.md,CLAUDE.md"
+  --files 'src/auth/pkce.ts,src/auth/callback.ts,src/auth/types.ts,src/middleware/auth.ts' \
+  --changed 'src/auth/pkce.ts,src/auth/callback.ts' \
+  --specs 'spec/AUTH.md,CLAUDE.md' \
+  --intent - <<'VERITY_EOF_<random>'
+I am adding OAuth2 PKCE authentication flow...
+VERITY_EOF_<random>
 ```
 
 **Arguments:**
 - `--files` (required): Comma-separated list of ALL files to include (changed + context)
 - `--changed` (optional): Comma-separated list of actually-modified files (subset of --files). If omitted, all files are treated as changed.
-- `--intent` (optional): Your synthesized intent description. Quote it.
+- `--intent -` (optional): Your synthesized intent description, read from the heredoc (`-` means stdin).
 - `--specs` (optional): Comma-separated list of spec file paths to include.
 
+**Keep the shell out of it.** The intent carries the user's words, so it goes
+through the quoted heredoc (`<<'VERITY_EOF_<random>'`), never inside `"…"` on the
+command line, where a `"`, a backtick or `$(…)` would run in the shell.
+Replace `<random>` with 8 random letters and digits that you pick for this call,
+the same at both ends. Text written before you picked them cannot contain the
+line that ends the heredoc, so it cannot end it early.
+
+Path lists go in single quotes, which expand nothing. Leave out any path that
+itself contains a `'`.
+
 The CLI handles static analysis, file reading with size limits, payload construction, and the API call.
 
 ---

package/data/skills/verity-feedback/SKILL.md

@@ -13,9 +13,18 @@ If the user provided a message (e.g., `/verity-feedback the analysis is too slow
 If they just typed `/verity-feedback` with no message, ask: "What feedback would you like to share?"
 
 ```bash
-verity feedback message "<their exact message>"
+verity feedback message - <<'VERITY_EOF_<random>'
+<their exact message>
+VERITY_EOF_<random>
 ```
 
+The message goes through the quoted heredoc, never inside `"…"` on the command
+line: there, a `"`, a backtick or `$(…)` in the user's words would run in the
+shell. The quotes around the first `VERITY_EOF_<random>` are what stop the shell
+expanding anything. Replace `<random>` with 8 random letters and digits that you
+pick for this call, the same at both ends. Text written before you picked them
+cannot contain the line that ends the heredoc, so it cannot end it early.
+
 On success: "Thanks, feedback sent!"
 On error: "Couldn't send feedback right now. Your message: [repeat it so it's not lost]."
 
@@ -29,16 +38,23 @@ Ask for the required info if not provided:
 - **action**: one of `false_positive`, `acknowledged`, `will_fix_later`, `wrong_severity`, `useful`
 
 ```bash
-verity feedback finding <run-id> <pattern-id> <action> "optional note"
+verity feedback finding <run-id> <pattern-id> <action> - <<'VERITY_EOF_<random>'
+<optional note, in the user's words>
+VERITY_EOF_<random>
 ```
 
+Leave out the `-` and the heredoc when there is no note.
+
 Optional flags:
 - `--file <path>` — the file the finding applies to
 - `--line <n>` — the line number
 
 Example: marking a test file's fake JWT as a false positive:
 ```bash
-verity feedback finding run-20260420-abc1 no-hardcoded-secrets false_positive "Fake JWT used in tests" --file src/auth/tokens.test.ts --line 42
+verity feedback finding run-20260420-abc1 no-hardcoded-secrets false_positive \
+  --file 'src/auth/tokens.test.ts' --line 42 - <<'VERITY_EOF_<random>'
+Fake JWT used in tests
+VERITY_EOF_<random>
 ```
 
 On success: report whether auto-suppression is now active (requires ≥2 independent dismissals for the same pattern+file pattern).

package/data/skills/verity-learn/SKILL.md

@@ -34,14 +34,24 @@ curl -s -H "Authorization: Bearer $VERITY_TOKEN" \
 curl -s -X POST -H "Authorization: Bearer $VERITY_TOKEN" \
   -H "Content-Type: application/json" \
   "$(verity config service-url)/compound/lessons" \
-  -d '{
-    "kind": "gotcha",
-    "title": "RLS policies and cleanup cron are coupled",
-    "body": "Changing RLS policies without updating the cleanup cron will break retention.",
-    "file_globs": ["server/supabase/migrations/**"]
-  }'
+  -d @- <<'VERITY_EOF_<random>'
+{
+  "kind": "gotcha",
+  "title": "RLS policies and cleanup cron are coupled",
+  "body": "Changing RLS policies without updating the cleanup cron will break retention.",
+  "file_globs": ["server/supabase/migrations/**"]
+}
+VERITY_EOF_<random>
 ```
 
+The body is read from the quoted heredoc (`-d @-`), never from a `'…'` string on
+the command line, where a quote or `$(…)` in the user's words would run in the
+shell. Inside it is plain JSON: escape `"` as `\"` and `\` as `\\`.
+
+Replace `<random>` with 8 random letters and digits that you pick for this call,
+the same at both ends. Text written before you picked them cannot contain the
+line that ends the heredoc, so it cannot end it early.
+
 Valid kinds: `bug_pattern`, `architectural_decision`, `gotcha`, `preferred_convention`, `false_positive_rule`, `intent_template`.
 
 ### Archive a lesson
@@ -59,7 +69,9 @@ curl -s -X PATCH -H "Authorization: Bearer $VERITY_TOKEN" \
 curl -s -X POST -H "Authorization: Bearer $VERITY_TOKEN" \
   -H "Content-Type: application/json" \
   "$(verity config service-url)/compound/extract" \
-  -d '{"task_id": "<task-uuid>"}'
+  -d @- <<'VERITY_EOF_<random>'
+{"task_id": "<task-uuid>"}
+VERITY_EOF_<random>
 ```
 
 ## How it works

package/data/skills/verity-memory/SKILL.md

@@ -42,7 +42,9 @@ Find related knowledge by seeding from files you're working on:
 curl -s -X POST -H "Authorization: Bearer $VERITY_TOKEN" \
   -H "Content-Type: application/json" \
   "$(verity config service-url)/compound/memory/walk" \
-  -d '{"seed_files": ["src/auth/tokens.ts"], "max_hops": 2, "budget_tokens": 2000}'
+  -d @- <<'VERITY_EOF_<random>'
+{"seed_files": ["src/auth/tokens.ts"], "max_hops": 2, "budget_tokens": 2000}
+VERITY_EOF_<random>
 ```
 
 ### Add a node (user-authored)
@@ -53,15 +55,26 @@ User-authored nodes get `confidence: 1.0` and are never auto-archived:
 curl -s -X POST -H "Authorization: Bearer $VERITY_TOKEN" \
   -H "Content-Type: application/json" \
   "$(verity config service-url)/compound/memory/nodes" \
-  -d '{
-    "kind": "gotcha",
-    "title": "RLS policies and cleanup cron are coupled",
-    "body": "Changing RLS policies without updating the cleanup cron will break retention.",
-    "file_globs": ["server/supabase/migrations/**"],
-    "domains": ["security", "database"]
-  }'
+  -d @- <<'VERITY_EOF_<random>'
+{
+  "kind": "gotcha",
+  "title": "RLS policies and cleanup cron are coupled",
+  "body": "Changing RLS policies without updating the cleanup cron will break retention.",
+  "file_globs": ["server/supabase/migrations/**"],
+  "domains": ["security", "database"]
+}
+VERITY_EOF_<random>
 ```
 
+The body is read from the quoted heredoc (`-d @-`), never from a `'…'` or
+`"…"` string on the command line, where a quote or `$(…)` in the user's words
+would run in the shell. Inside the heredoc it is plain JSON: escape `"` as `\"`
+and `\` as `\\` in the title and body, as JSON requires.
+
+Replace `<random>` with 8 random letters and digits that you pick for this call,
+the same at both ends. Text written before you picked them cannot contain the
+line that ends the heredoc, so it cannot end it early.
+
 Valid kinds: `decision`, `quality`, `security`, `intent`, `gotcha`, `pattern`, `domain`, `integration`.
 
 Or create the markdown file directly at `.verity/memory/<domain>/<slug>.md` with proper frontmatter (see `.verity/memory/SCHEMA.md` for the template).

package/data/skills/verity-prove/SKILL.md

@@ -32,10 +32,19 @@ commit or a push.
 ### 1. Candidates — one command
 
 ```bash
-verity prove candidates --hint "$ARGUMENTS" --json    # hint given
 verity prove candidates --limit 8 --json              # no hint
+verity prove candidates --hint - --json <<'VERITY_EOF_<random>'
+<the hint>
+VERITY_EOF_<random>
 ```
 
+The hint is the user's words, so it goes through the quoted heredoc (`-` means
+stdin), never inside `"…"` on the command line, where a `"`, a backtick or `$(…)`
+in it would run in the shell. The quotes around the first `VERITY_EOF_<random>`
+stop the shell expanding anything. Replace `<random>` with 8 random letters and
+digits that you pick for this call, the same at both ends. Text written before you
+picked them cannot contain the line that ends the heredoc, so it cannot end it early.
+
 The hint **widens the pool** (files it names by path or content come first) and the
 service ranks it, naming a symbol and the properties worth checking per file. Do not
 search for the code yourself: if the ranker's list does not contain what the user
@@ -67,10 +76,18 @@ If Lean is missing, say what will be installed and where before running
 ### 4. Generate the model — one command
 
 ```bash
-verity prove generate src/pay.ts#charge --hint "$ARGUMENTS"
-verity prove generate src/handler.ts --lines 120-180 --hint "$ARGUMENTS"   # a region
+verity prove generate src/pay.ts#charge --hint - <<'VERITY_EOF_<random>'
+<the hint>
+VERITY_EOF_<random>
+# a region:
+verity prove generate src/handler.ts --lines 120-180 --hint - <<'VERITY_EOF_<random>'
+<the hint>
+VERITY_EOF_<random>
 ```
 
+Leave out `--hint -` and the heredoc when there is no hint. Pick new letters for
+`<random>` on each call.
+
 The service writes the model, the linter fences it, this machine elaborates it, with
 up to **3** rounds on compiler errors — all inside the command. It prints the check:
 per property `✓ holds to bound k`, `✗ COUNTEREXAMPLE` with the trace, or `? inconclusive`.
@@ -95,17 +112,24 @@ before every verdict is in. Read the verdict:
 
 - **REPRODUCED** — the real code does this. **This is final: do not replay by hand
   as well.** Report it as a bug (step 6).
-- **DIVERGED** — the model is wrong about the code. Revise it **at most twice**, each
-  time saying what the replay showed:
-  `verity prove generate <target> --revise <Name> --note "<what the replay showed>"`,
-  then replay again. After two divergences, report "no faithful model found for
-  `<symbol>`" — that is a valid result, not a bug.
+- **DIVERGED** — the model is wrong about the code. Revise it **at most twice** with
+  the revise command below, each time saying what the replay showed, then replay
+  again. After two divergences, report "no faithful model found for `<symbol>`" —
+  that is a valid result, not a bug.
 - **UNVERIFIED / UNREPLAYABLE** — not evidence either way. Only now replay by hand:
   a throwaway harness in a scratch directory that loads the real module and stubs only
   I/O boundaries **in memory**. Never edit the user's source files, and never read from
   or write to the user's databases, services or local stacks to do this — ask first if
   a stub cannot be faithful.
 
+The revise command. The note goes through the heredoc, as the hint does:
+
+```bash
+verity prove generate <target> --revise <Name> --note - <<'VERITY_EOF_<random>'
+<what the replay showed>
+VERITY_EOF_<random>
+```
+
 Never weaken or delete a property to get green; never add one to make something fail.
 
 ### 6. Report, in a few lines
@@ -116,7 +140,9 @@ commit the model** — `.verity/proofs/` is machine-local and ignores itself. Wh
 the team is the bug report and, when asked, the fix. Then record the outcome:
 
 ```bash
-verity reflect --user-input "Modelled runSeed (cli/src/lib/seed-runner.ts): P1 at-most-once refuted in 2 steps, replayed — guard checks a path the server never writes." --kind gotcha
+verity reflect --user-input - --kind gotcha <<'VERITY_EOF_<random>'
+Modelled runSeed (cli/src/lib/seed-runner.ts): P1 at-most-once refuted in 2 steps, replayed — guard checks a path the server never writes.
+VERITY_EOF_<random>
 ```
 
 The abstracted file's content leaves the machine for the Verity service and its

package/data/skills/verity-reflect/SKILL.md

@@ -39,16 +39,27 @@ surfaces again, in any future review. So write `src/payments/retry.ts:88`, not
 ### 2. Record it
 
 ```bash
-verity reflect --user-input "<your draft>" --kind <kind>
+verity reflect --user-input - --kind <kind> <<'VERITY_EOF_<random>'
+<your draft>
+VERITY_EOF_<random>
 ```
 
 That is the whole step. It never blocks, never prompts, and works the same in a
 TTY, a hook, CI, or a cron run.
 
+The text goes through the quoted heredoc, never inside `"…"` on the command
+line: there, a `"`, a backtick or `$(…)` in the words would run in the shell.
+The quotes around the first `VERITY_EOF_<random>` are what stop the shell
+expanding anything. Replace `<random>` with 8 random letters and digits that you
+pick for this call, the same at both ends. Text written before you picked them
+cannot contain the line that ends the heredoc, so it cannot end it early.
+
 If the reflection genuinely cannot name its files in prose, scope it explicitly:
 
 ```bash
-verity reflect --user-input "<your draft>" --kind <kind> --file-globs "src/auth/**"
+verity reflect --user-input - --kind <kind> --file-globs 'src/auth/**' <<'VERITY_EOF_<random>'
+<your draft>
+VERITY_EOF_<random>
 ```
 
 The command warns when a reflection resolved to no files, so you will know when
@@ -58,7 +69,9 @@ this is needed rather than discovering it months later as a node nobody read.
 a lesson in their own terms — add `--confirmed`:
 
 ```bash
-verity reflect --user-input "<what they said>" --kind <kind> --confirmed
+verity reflect --user-input - --kind <kind> --confirmed <<'VERITY_EOF_<random>'
+<what they said>
+VERITY_EOF_<random>
 ```
 
 This is not a formality. Without the flag a reflection is stored as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.0-experimental.cc5f6ec",
+  "version": "0.34.0-experimental.d4649a0",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",