@codacy/verity-cli 0.35.2 → 0.35.3

package/CHANGELOG.md

@@ -64,6 +64,32 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.35.3] — 2026-11-05
+
+### 🔧 Fixes
+
+- **`verity init` on a repository the Verity GitHub App cannot see gives it
+  access in the same run.** Init offers a GitHub sign-in that opens the page
+  where you add the repository to the Verity app, waits for it, and then
+  continues. Init says why a second sign-in is needed: Verity reads your
+  repository access from GitHub only when you sign in. With `--yes` or no
+  terminal, init names the one action instead.
+- **Init states a refusal as a refusal.** When the service refuses access to
+  the repository, init writes nothing, says that Verity cannot access the
+  repository yet, names the one action, and exits 1. Before, it said the
+  service did not answer and told you to run `verity init` again.
+- **A turn with nothing new to review no longer prints a Verity line.**
+  Before, a line such as "No files modified since last analysis" showed under
+  every message. `verity config verbose on` brings the line back. Turns that
+  wrote code still get their review, and a change that nobody reviewed is
+  still reported.
+- **The upgrade link in a plan-limit message is clickable.** It keeps its
+  `https://`.
+- **`verity usage` says "your plan" for the plan you own, and `verity status`
+  no longer lists that plan under "member of".** A team you belong to is still
+  listed as a team.
+- Includes security fixes.
+
 ## [0.35.2] — 2026-10-30
 
 ### 🔧 Fixes

package/bin/verity.js

@@ -15325,7 +15325,7 @@ function pinRefusalMessage(verdict, targetUrl) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.35.2" : "dev";
+    return true ? "0.35.3" : "dev";
   } catch {
     return "dev";
   }
@@ -19207,13 +19207,21 @@ function readConfigFile(path) {
         git_moments: [...new Set(moments)],
         ...source2 ? { git_moments_source: source2 } : {},
         ...raw.formal === "push" || raw.formal === "off" ? { formal: raw.formal } : {},
-        ...raw.turn_review === "on" || raw.turn_review === "off" ? { turn_review: raw.turn_review } : {}
+        ...raw.turn_review === "on" || raw.turn_review === "off" ? { turn_review: raw.turn_review } : {},
+        ...raw.verbose === "on" || raw.verbose === "off" ? { verbose: raw.verbose } : {}
       }
     };
   } catch {
     return { cfg: DEFAULTS };
   }
 }
+function readVerbose() {
+  try {
+    return readProjectConfigRaw().verbose === "on";
+  } catch {
+    return false;
+  }
+}
 function configRefusalMessage(reason) {
   switch (reason) {
     case "link":
@@ -19285,12 +19293,13 @@ function formalRefusalMessage(reason) {
   }
 }
 function writeProjectConfig(patch) {
-  const { git_moments, git_moments_source, formal, turn_review } = readProjectConfigRaw();
+  const { git_moments, git_moments_source, formal, turn_review, verbose } = readProjectConfigRaw();
   const next = {
     git_moments,
     ...git_moments_source ? { git_moments_source } : {},
     ...formal ? { formal } : {},
     ...turn_review ? { turn_review } : {},
+    ...verbose ? { verbose } : {},
     ...patch
   };
   writeRepoFile(PROJECT_CONFIG_FILE, JSON.stringify(next, null, 2) + "\n");
@@ -21715,6 +21724,112 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "Knowledge the organization's other repositories learned is mirrored outside the",
+  "repo at `~/.verity/orgs/<host>/<owner>/memory/` (`verity memory org` lists it).",
+  "Each claim says where it came from; one that is wrong here is demoted for",
+  'everyone with `verity memory demote <id> --reason "\u2026"`.',
+  "",
+  "## Quality gate: accepted risks",
+  "",
+  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
+  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
+  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
+  "the user saying so in this conversation. The --reason must cite that source.",
+  "",
+  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
+  "binds to the file's current bytes and voids automatically when the file changes,",
+  "and every waive is recorded in the run ledger. For a pattern-level false positive",
+  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
+  "",
+  "## Post-task reflection",
+  "",
+  `When a task is complete (you've created a PR, the user says "done" or "ship it",`,
+  "or the work is clearly finished), **draft the reflection yourself** \u2014 1\u20133",
+  "concrete things worth remembering (a decision, a gotcha, or a pattern), each",
+  "cited with the files / PR / commands / error-signatures it came from. Skip",
+  "entirely if nothing non-obvious happened \u2014 that judgement is the ONLY filter,",
+  "because nothing reviews the reflection before it lands.",
+  "",
+  "Then record it straight away. There is no confirm step, in any environment:",
+  "",
+  "```bash",
+  "verity reflect --user-input - --kind <kind> <<'VERITY_EOF_<random>'",
+  "<your draft>",
+  "VERITY_EOF_<random>",
+  "```",
+  "",
+  'The draft goes through the quoted heredoc, never inside `"\u2026"` on the command',
+  'line, where a `"` or `$(\u2026)` in it would run in the shell. Replace `<random>`',
+  "with 8 random letters and digits that you pick for this call, the same at both",
+  "ends. Text written before you picked them cannot end the heredoc early.",
+  "",
+  "Add `--confirmed` ONLY when the user authored or dictated the words. Without",
+  "it the node is stored as `source: agent` \u2014 Verity thought this, nobody checked",
+  "it. With it, `source: user` at full confidence \u2014 a person stands behind this.",
+  "Never claim the second for your own draft, however good it is.",
+  "",
+  "**Name the files in the text.** Verity scopes the reflection to the paths it",
+  "cites, and a reflection that names no file in this repo is never retrieved for",
+  "a later review \u2014 it is recorded and then invisible. The command says so when it",
+  "happens; `--file-globs '<path or glob>'` is the fix when the prose cannot carry",
+  "the paths.",
+  "",
+  "Then tell the user, in one line, what you recorded and where: the command",
+  "prints the node id, the path under `.verity/memory/`, and a dashboard link.",
+  "They did not agree to it in advance, so say it happened \u2014 editing or deleting",
+  "that file is how they correct it.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason.",
+  "",
+  "## Verity settings",
+  "",
+  "Change these only when the user asks. Each command prints what it changed.",
+  "",
+  "- When Verity reviews: `verity config moments turn,commit,push`. Give any of the",
+  "  three, or `none`. With no list, it prints the current setting.",
+  "- Formal verification at push: `verity config formal push`, or `verity config formal off`.",
+  "- The line Verity prints when a turn has nothing new to review: `verity config verbose on`,",
+  "  or `verity config verbose off` (the default).",
+  "- Project rules, written by Verity from this repository's history and docs:",
+  "  `verity standard generate`. It works only for a project with no Standard on the",
+  "  service. It writes `.verity/repo-profile.json` and sends nothing without consent.",
+  "  Show the user that file. Run the command again with `--yes` only after they agree.",
+  "- The rules themselves: edit `.verity/standard.yaml`, then run `verity standard push`."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_VERBOSE = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -22351,6 +22466,7 @@ function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
   for (const prose of [
     CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_VERBOSE,
     CLAUDE_MD_PROSE_PRE_SETTINGS,
     CLAUDE_MD_PROSE_PRE_STDIN,
     CLAUDE_MD_PROSE_PRE_ORG,
@@ -26343,6 +26459,18 @@ function registerConfigCommands(program2) {
     printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off");
     if (state === "push") printInfo("The phase runs with your Verity login (a push without one is skipped and says so: not-logged-in)");
   });
+  config.command("verbose [state]").description('Get or set the line Verity prints when a turn has nothing new to review: "on" or "off" (the default)').action((state) => {
+    if (state === void 0) {
+      process.stdout.write((readProjectConfig().verbose === "on" ? "on" : "off") + "\n");
+      return;
+    }
+    if (state !== "on" && state !== "off") {
+      printError(`Unrecognised state: ${state}. Use "on" or "off".`);
+      process.exit(1);
+    }
+    writeProjectConfig({ verbose: state });
+    printInfo(state === "on" ? "Verbose: on. A turn with nothing new to review now says so." : "Verbose: off. A turn with nothing new to review says nothing.");
+  });
   config.command("push").description("Upload .codacy/codacy.config.json to the service (not used by the gate, which runs Trivy only)").option("--file <path>", "Path to config file", CODACY_CONFIG_FILE).action(async (opts) => {
     const globals = program2.opts();
     const tokenResult = await resolveToken(globals.token);
@@ -26818,8 +26946,8 @@ function timeAgo(isoDate) {
 }
 var PLAN_NAME = { free: "Free", pro: "Pro", fleet: "Fleet", enterprise: "Enterprise" };
 function planLine(plan, accounts) {
-  const teams = accounts.filter((a) => a.kind !== "personal").map((a) => `${a.name} (${PLAN_NAME[a.plan] ?? a.plan})`);
-  return `${PLAN_NAME[plan] ?? plan}${teams.length ? ` \xB7 member of ${teams.join(", ")}` : ""} \u2014 limits: "verity usage"`;
+  const teams = accounts.filter((a) => !(a.is_owner ?? a.kind === "personal")).map((a) => `${terminalText(a.name)} (${PLAN_NAME[a.plan] ?? terminalText(a.plan)})`);
+  return `${PLAN_NAME[plan] ?? terminalText(plan)}${teams.length ? ` \xB7 member of ${teams.join(", ")}` : ""} \u2014 limits: "verity usage"`;
 }
 function registerStatusCommand(program2) {
   program2.command("status").description("Show project quality status").option("--history", "Include recent run history").option("--limit <n>", "Number of history entries (1-100)", "5").option("--json", "Output raw JSON").action(async (opts) => {
@@ -27070,7 +27198,7 @@ function dollars(cents2) {
   return `$${((cents2 ?? 0) / 100).toFixed(2)}`;
 }
 function link(l) {
-  return (l.upgrade_url ?? "https://verity.md/upgrade").replace(/^https?:\/\//, "");
+  return terminalUrl(l.upgrade_url) || "https://verity.md/upgrade";
 }
 function detail(l, now) {
   const reset = resetPhrase(l, now, true);
@@ -27081,7 +27209,8 @@ function detail(l, now) {
     return `Extra usage reached this month's ${dollars(l.limit)} cap. ${Reset}. ${way2}`;
   }
   if (l.period === "week") {
-    const who = shared && l.account ? `${l.account} used its` : "You used your";
+    const team = shared ? terminalText(l.account) : "";
+    const who = team ? `${team} used its` : "You used your";
     const way2 = l.budget === "free" ? `Upgrade: ${link(l)}` : shared ? `An admin can turn on extra usage, or upgrade: ${link(l)}` : `Turn on extra usage or upgrade: ${link(l)}`;
     return `${who} ${l.limit} ${METER[l.meter]} this week. ${Reset}. ${way2}`;
   }
@@ -27160,8 +27289,11 @@ function windowText(w, resetsAt, now, weekly) {
 function cents(n2) {
   return n2 === null ? "\u2014" : n2 < 100 ? `${n2}\xA2` : `$${(n2 / 100).toFixed(2)}`;
 }
+function ownsAccount(b) {
+  return b?.account?.is_owner ?? b?.account?.kind === "personal";
+}
 function extraOffText(b, ui) {
-  if (b.account?.kind === "personal") return `off \u2014 turn it on at ${ui}/account/billing`;
+  if (ownsAccount(b)) return `off \u2014 turn it on at ${ui}/account/billing`;
   return "off \u2014 a team admin can turn it on";
 }
 function renderBudget(b, now = /* @__PURE__ */ new Date(), ui = uiBase()) {
@@ -27177,12 +27309,14 @@ function renderBudget(b, now = /* @__PURE__ */ new Date(), ui = uiBase()) {
   return lines;
 }
 function budgetName(b) {
-  return b.account ? `${PLAN2[b.plan]} \xB7 ${b.account.name} (${b.account.kind})` : PLAN2[b.plan];
+  if (!b.account) return PLAN2[b.plan];
+  const name2 = terminalText(b.account.name);
+  return ownsAccount(b) ? `${PLAN2[b.plan]} \xB7 ${name2} (your plan)` : `${PLAN2[b.plan]} \xB7 ${name2}`;
 }
 function payerText(b) {
   if (!b || !b.account) return "your Free plan";
-  if (b.account.kind === "personal") return `your personal ${PLAN2[b.plan]} plan`;
-  return `the ${PLAN2[b.plan]} plan of ${b.account.name}`;
+  if (ownsAccount(b)) return `your ${PLAN2[b.plan]} plan`;
+  return `the ${PLAN2[b.plan]} plan of ${terminalText(b.account.name)}`;
 }
 function renderLimits(d, now = /* @__PURE__ */ new Date()) {
   const ui = d.ui_url ? d.ui_url.replace(/\/+$/, "") : uiBase();
@@ -27190,10 +27324,10 @@ function renderLimits(d, now = /* @__PURE__ */ new Date()) {
   if (!d.enforced) lines.push(d.mode === "shadow" ? "Limits are counted, not yet enforced." : "Limits are not active.");
   const payer = d.budgets.find((b) => b.applies_here);
   if (d.team_here && !d.team_here.member) {
-    lines.push(d.team_here.auto_join ? `${d.team_here.name} pays for Verity in this repository. Your first review here makes you a member (${d.team_here.default_plan}).` : `${d.team_here.name} pays for Verity here for its members. An admin approves new members. Until an admin adds you, ${payerText(payer)} pays for your reviews here.`);
+    lines.push(d.team_here.auto_join ? `${terminalText(d.team_here.name)} pays for Verity in this repository. Your first review here makes you a member (${terminalText(d.team_here.default_plan)}).` : `${terminalText(d.team_here.name)} pays for Verity here for its members. An admin approves new members. Until an admin adds you, ${payerText(payer)} pays for your reviews here.`);
   }
-  const hasPersonal = d.budgets.some((b) => b.account?.kind === "personal");
-  const shown = d.budgets.filter((b) => !(hasPersonal && b.budget === "free"));
+  const hasOwn = d.budgets.some((b) => ownsAccount(b));
+  const shown = d.budgets.filter((b) => !(hasOwn && b.budget === "free"));
   const full = payer ? shown.filter((b) => b === payer) : shown;
   for (const b of full) {
     lines.push("");
@@ -30244,7 +30378,13 @@ async function passAndExit(run4, reason, skip, kindOverride) {
   const AGENT_SILENT_SKIPS = /* @__PURE__ */ new Set([]);
   const agentNote = AGENT_SILENT_SKIPS.has(skip) ? null : note;
   const HUMAN_SILENT_SKIPS = /* @__PURE__ */ new Set(["command-only-turn"]);
-  const humanNote = HUMAN_SILENT_SKIPS.has(skip) ? null : `Verity: ${reason}`;
+  const quiet = quietSkip({
+    skip,
+    kind: skipKind,
+    nothingChanged: nothingChanged(run4),
+    verbose: readVerbose()
+  });
+  const humanNote = HUMAN_SILENT_SKIPS.has(skip) || quiet ? null : `Verity: ${reason}`;
   printJsonCompact(
     buildHookOutput(
       verdict,
@@ -30257,6 +30397,22 @@ async function passAndExit(run4, reason, skip, kindOverride) {
   );
   process.exit(0);
 }
+var NOTHING_NEW = /* @__PURE__ */ new Set(["no-delta-since-last-review", "no-analyzable-files"]);
+var QUIET_ON_CLEAN_TREE = /* @__PURE__ */ new Set([
+  "debounce",
+  "verity-command",
+  "bare-acknowledgment",
+  "reflection-prompt",
+  "skip-mode",
+  "zero-increment"
+]);
+function quietSkip(s) {
+  if (s.verbose || s.kind !== "policy") return false;
+  return NOTHING_NEW.has(s.skip) || QUIET_ON_CLEAN_TREE.has(s.skip) && s.nothingChanged;
+}
+function nothingChanged(run4) {
+  return partitionVerityOwned(run4.changedUniverse).kept.length === 0;
+}
 
 // src/commands/analyze/phases/02-scope.ts
 async function scope(run4) {
@@ -31148,7 +31304,8 @@ async function evidence(run4) {
         const scoped = scopeToAuthored(allForReview, actionSummary);
         const canTrustNoneAuthored = scoped.signal === "none-authored" && authorshipIsObservable;
         if (canTrustNoneAuthored && !hasNonEditAuthorship(actionSummary, sessionAuthoredCode)) {
-          await passAndExit(run4, "No agent-authored code this turn \u2014 working-tree changes were not authored by this session", "zero-increment");
+          const why = nothingChanged(run4) ? "No code changed this turn" : "No agent-authored code this turn \u2014 working-tree changes were not authored by this session";
+          await passAndExit(run4, why, "zero-increment");
         }
         if (scoped.signal === "none-authored" && !authorshipIsObservable) {
           logEvent("none_authored_unverifiable", {
@@ -43499,13 +43656,20 @@ function sayPacks(ui, plan) {
 }
 
 // src/commands/init/team-standard.ts
+function refusalOutcome(code) {
+  return code === "FORBIDDEN" ? "denied" : "sign-in-needed";
+}
 async function lookUpTeamStandard(opts) {
   if (!opts.adopt) return { status: "skipped", why: "no-adopt" };
   const token = await resolveToken(opts.globals.token);
   const url = await resolveServiceUrl(opts.globals.serviceUrl);
   if (!token.ok || !url.ok) return { status: "skipped", why: "not-signed-in" };
   const found = await fetchRemoteSetup({ token: token.data.token, serviceUrl: url.data, verbose: opts.globals.verbose });
-  if (found.status === "unavailable") return { status: "unavailable", reason: terminalText(found.reason, 300) };
+  if (found.status === "unavailable") {
+    const denial = authDenialRemedy(found.reason);
+    if (denial) return { status: "denied", code: denial.code, reason: terminalText(found.reason, 300) };
+    return { status: "unavailable", reason: terminalText(found.reason, 300) };
+  }
   if (found.status === "none") return { status: "none" };
   if (opts.previous?.declinedStandardVersion === found.standard.version) {
     return { status: "declined-before", version: found.standard.version, found };
@@ -43679,12 +43843,12 @@ async function standardStep(ui, ctx) {
       return end({ source: "adopted", version: again.version, profile: profile2 });
     }
     removeLocalStandard();
-    if (again.status === "write-failed" || again.status === "unavailable") rail.line(terminalText(again.reason, 300));
-    return { ...leaveTeamStandard(again.status === "write-failed" ? "write-failed" : "unavailable", null), profile: profile2 };
+    if (again.status === "write-failed" || again.status === "unavailable" || again.status === "denied") rail.line(terminalText(again.reason, 300));
+    return { ...leaveTeamStandard(again.status === "write-failed" ? "write-failed" : again.status === "denied" ? refusalOutcome(again.code) : "unavailable", null), profile: profile2 };
   };
   const leaveTeamStandard = (why, version) => {
-    rail.line(why === "write-failed" ? `The team's Standard${version !== null ? ` v${version}` : ""} stays in effect for reviews. Nothing was sent to the service.` : "If the team has a Standard on the service, it stays in effect for reviews. Nothing was written here or to the service.");
-    rail.line(why === "unavailable" ? "Run verity init again once the Verity service answers." : "Fix the cause above, then run verity init again.");
+    rail.line(why === "write-failed" ? `The team's Standard${version !== null ? ` v${version}` : ""} stays in effect for reviews. Nothing was sent to the service.` : why === "denied" ? "Verity has no access to this repository, so nothing was read or written here or on the service." : why === "sign-in-needed" ? "The Verity service did not accept your sign-in, so nothing was read or written here or on the service." : "If the team has a Standard on the service, it stays in effect for reviews. Nothing was written here or to the service.");
+    rail.line(why === "unavailable" ? "Run verity init again once the Verity service answers." : why === "denied" ? "Give the Verity GitHub App access to this repository (the line above says how), then run: verity login, and verity init. Verity reads your repository access from GitHub only when you sign in." : why === "sign-in-needed" ? "Sign in again: run verity login, then verity init." : "Fix the cause above, then run verity init again.");
     return end({ source: "none", version: null, profile: notAsked, teamInEffect: why });
   };
   const useTeam = async (team2) => {
@@ -43706,7 +43870,7 @@ async function standardStep(ui, ctx) {
       rail.line(`Reviews use the team's Standard v${team2.version} on the service. Fix ${STANDARD_FILE}, or replace it with the team's: verity standard pull`);
       return end({ source: "kept", version: team2.version, profile: notAsked });
     }
-    rail.line(team2.status === "none" ? `There is no Standard on the service either, so reviews have no rules. Fix ${STANDARD_FILE}, or delete it, then run verity init again.` : team2.status === "unavailable" ? `The Verity service did not answer (${terminalText(team2.reason, 200)}), so no Standard is confirmed. Fix ${STANDARD_FILE}, then run verity init again.` : `No Standard on the service was looked up. Fix ${STANDARD_FILE}, or sign in, then run verity init again.`);
+    rail.line(team2.status === "none" ? `There is no Standard on the service either, so reviews have no rules. Fix ${STANDARD_FILE}, or delete it, then run verity init again.` : team2.status === "unavailable" ? `The Verity service did not answer (${terminalText(team2.reason, 200)}), so no Standard is confirmed. Fix ${STANDARD_FILE}, then run verity init again.` : team2.status === "denied" && refusalOutcome(team2.code) === "denied" ? `Verity has no access to this repository (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, give the Verity GitHub App access, then run verity login and verity init.` : team2.status === "denied" ? `The Verity service did not accept your sign-in (${terminalText(team2.reason, 200)}). Fix ${STANDARD_FILE}, then run verity login and verity init.` : `No Standard on the service was looked up. Fix ${STANDARD_FILE}, or sign in, then run verity init again.`);
     return end({ source: "none", version: null, profile: notAsked });
   };
   if (ctx.standard === "new" && (0, import_node_fs77.lstatSync)(projectPath(STANDARD_FILE), { throwIfNoEntry: false })) {
@@ -43761,6 +43925,12 @@ async function standardStep(ui, ctx) {
     rail.line(terminalText(team.reason, 300));
     return leaveTeamStandard("unavailable", null);
   }
+  if (team.status === "denied") {
+    const refused2 = refusalOutcome(team.code);
+    rail.warn(refused2 === "denied" ? "Verity cannot access this repository yet" : "The Verity service did not accept your sign-in");
+    rail.line(terminalText(team.reason, 300));
+    return leaveTeamStandard(refused2, null);
+  }
   if (team.status === "skipped") return derived(notAsked);
   if (!await rulesOffered(ui, ctx.globals)) return derived(notAsked);
   const profile = buildRepoProfile();
@@ -43811,10 +43981,10 @@ async function standardStep(ui, ctx) {
       sayAdopted(ui, again);
       return end({ source: "adopted", version: again.version, profile: { outcome: "ok", detail: detail2 } });
     }
-    if (again.status === "unavailable" || again.status === "write-failed") {
-      rail.warn(again.status === "unavailable" ? "Could not read the team's new Standard from the Verity service" : "Could not write the team's Standard here");
+    if (again.status === "unavailable" || again.status === "write-failed" || again.status === "denied") {
+      rail.warn(again.status === "write-failed" ? "Could not write the team's Standard here" : "Could not read the team's new Standard from the Verity service");
       rail.line(terminalText(again.reason, 300));
-      return { ...leaveTeamStandard(again.status, null), profile: { outcome: "ok", detail: detail2 } };
+      return { ...leaveTeamStandard(again.status === "denied" ? refusalOutcome(again.code) : again.status, null), profile: { outcome: "ok", detail: detail2 } };
     }
   }
   return derived({ outcome: "ok", detail: detail2 });
@@ -43830,8 +44000,8 @@ async function finishRun(ui, ctx) {
     sayChanged(ui, ctx.before);
     if (ctx.teamInEffect) {
       rail.end(
-        ctx.teamInEffect === "unavailable" ? `${s.yellow}Not finished:${s.reset} the Verity service did not answer, so this machine has no Standard yet.` : `${s.yellow}Not finished:${s.reset} the team's Standard could not be written on this machine. Reviews still use it on the service.`,
-        ctx.teamInEffect === "unavailable" ? "Run verity init again once the Verity service answers." : "Fix the error above, then run verity init again."
+        ctx.teamInEffect === "unavailable" ? `${s.yellow}Not finished:${s.reset} the Verity service did not answer, so this machine has no Standard yet.` : ctx.teamInEffect === "denied" ? `${s.yellow}Not finished:${s.reset} Verity has no access to this repository yet, so it cannot review it.` : ctx.teamInEffect === "sign-in-needed" ? `${s.yellow}Not finished:${s.reset} the Verity service did not accept your sign-in, so this machine has no Standard yet.` : `${s.yellow}Not finished:${s.reset} the team's Standard could not be written on this machine. Reviews still use it on the service.`,
+        ctx.teamInEffect === "unavailable" ? "Run verity init again once the Verity service answers." : ctx.teamInEffect === "denied" ? "Give the Verity GitHub App access to this repository, then run: verity login, and verity init. Verity reads your repository access from GitHub only when you sign in." : ctx.teamInEffect === "sign-in-needed" ? "Sign in again: run verity login, then verity init." : "Fix the error above, then run verity init again."
       );
       return;
     }
@@ -44227,13 +44397,14 @@ async function classifyExistingLogin(serviceUrl, remote, opts) {
   if (!existing.ok) return { kind: "none" };
   const who = await whoami(existing.data.token, serviceUrl, opts.verbose);
   if (who.ok && who.data.logged_in) {
+    const nudge = reverifyNudge(who.data);
     return {
       kind: "signed-in",
       identity: terminalText(who.data.email ?? `user #${who.data.user_id}`, 120),
       // Being logged in does not mean THIS repo is covered (VRT-83): grants come
       // from the login sweep. grant_status is non-null only when a grant exists.
       covered: remote ? who.data.grant_status != null : null,
-      nudge: reverifyNudge(who.data)
+      nudge: nudge && terminalText(nudge, 200)
     };
   }
   if (!who.ok) {
@@ -44263,6 +44434,7 @@ function coverageLines(ui, repo, covered) {
   } else {
     ui.rail.line(`${repo} is not covered by your Verity access, so nothing syncs.`, "warn");
     ui.rail.line("Give the Verity GitHub App access to it, then run: verity login");
+    ui.rail.line("Verity reads your repository access from GitHub only when you sign in. The new sign-in is how Verity sees the repository.", "muted");
   }
 }
 async function signInStep(ui, resolution, opts) {
@@ -44283,6 +44455,7 @@ async function signInStep(ui, resolution, opts) {
   const heal = await maybeHealServiceUrl(resolution, opts.verbose);
   const serviceUrl = heal.serviceUrl;
   const remote = gitRemote();
+  let grantAccess = false;
   if (heal.healed) {
     rail.warn("The saved Verity service no longer answers");
     rail.line("Sign in again to repair ~/.verity/credentials.");
@@ -44290,9 +44463,14 @@ async function signInStep(ui, resolution, opts) {
     const state = await classifyExistingLogin(serviceUrl, remote, opts);
     if (state.kind === "signed-in") {
       rail.done(`Signed in as ${s.bold}${state.identity}${s.reset}`);
-      coverageLines(ui, opts.repo, state.covered);
       if (state.nudge) rail.line(state.nudge, "warn");
-      return end("already");
+      if (state.covered !== false || !ui.asking) {
+        coverageLines(ui, opts.repo, state.covered);
+        return end("already");
+      }
+      rail.line(`Verity can't see ${opts.repo} yet: the Verity GitHub App has no access to it.`, "warn");
+      grantAccess = true;
+      rail.settle();
     }
     if (state.kind === "cached") {
       rail.done(state.identity ? `Signed in as ${s.bold}${state.identity}${s.reset} (cached)` : "Using your existing Verity token");
@@ -44313,16 +44491,28 @@ async function signInStep(ui, resolution, opts) {
     sayWhatASkipCosts(ui);
     return end("unattended");
   }
-  rail.active("Sign in with GitHub");
-  rail.line("One sign-in covers every repository on this machine.");
-  rail.line("Signing in does not give Verity access to the contents of your repositories.");
+  if (grantAccess) {
+    rail.active(`Give Verity access to ${opts.repo}`);
+    rail.line("Verity reads your repository access from GitHub only when you sign in.");
+    rail.line("So sign in again: Verity opens the page where you add this repository to its app, and waits.");
+    rail.line("When the repository is added, Verity can see it, and this run continues.");
+  } else {
+    rail.active("Sign in with GitHub");
+    rail.line("One sign-in covers every repository on this machine.");
+    rail.line("Signing in does not give Verity access to the contents of your repositories.");
+  }
   rail.gap();
   rail.keys([["Enter", "open the browser"], ["s", "skip"]]);
   const choice = await screen.key(["enter", "s"], "s");
   if (choice === "s") {
     rail.collapse();
-    rail.warn("Sign-in skipped");
-    sayWhatASkipCosts(ui);
+    rail.warn(grantAccess ? "Access skipped" : "Sign-in skipped");
+    if (grantAccess) {
+      rail.line(`Verity can't review ${opts.repo} until its GitHub App has access to it.`);
+      rail.line("Later: add the repository to the Verity app, then run verity login. Verity reads your repository access from GitHub only when you sign in.");
+    } else {
+      sayWhatASkipCosts(ui);
+    }
     return end("declined");
   }
   const failed = (why) => {
@@ -44338,20 +44528,23 @@ async function signInStep(ui, resolution, opts) {
   const dc = code.data;
   const copied = copyToClipboard(dc.user_code);
   const opened = openInBrowser(dc.verification_uri);
-  rail.line(opened ? `Opened ${dc.verification_uri} in your browser. If no window appeared, open it and enter the code.` : `Open ${dc.verification_uri} and enter the code.`, opened ? "muted" : "plain");
+  const where2 = terminalText(dc.verification_uri, 200);
+  const userCode = terminalText(dc.user_code, 40);
+  rail.line(opened ? `Opened ${where2} in your browser. If no window appeared, open it and enter the code.` : `Open ${where2} and enter the code.`, opened ? "muted" : "plain");
   const prefix = `${s.gray}\u2502${s.reset}  `;
   const polled = await screen.breathe(
     prefix,
-    () => `Waiting for you in the browser \xB7 code ${s.bold}${dc.user_code}${s.reset}${copied ? ` ${s.gray}(copied)${s.reset}` : ""}`,
+    () => `Waiting for you in the browser \xB7 code ${s.bold}${userCode}${s.reset}${copied ? ` ${s.gray}(copied)${s.reset}` : ""}`,
     pollDeviceToken(dc, { codeExpiresAt: Date.now() + dc.expires_in * 1e3, quiet: true })
   );
   if (!polled.ok) return failed(polled.error);
   let gaveUp = null;
   const appInstallUi = {
     wait: async (ctx, visible) => {
-      rail.line(`The Verity GitHub App cannot see ${ctx.owner}/${ctx.repo} yet. Install it${ctx.opened ? " (opened in your browser)" : ""}:`, "warn");
-      rail.line(ctx.installUrl, "plain");
-      return screen.breathe(prefix, () => `Waiting for the install on ${ctx.owner}`, visible);
+      const owner = terminalText(ctx.owner, 100);
+      rail.line(`The Verity GitHub App cannot see ${owner}/${terminalText(ctx.repo, 100)} yet. Install it${ctx.opened ? " (opened in your browser)" : ""}:`, "warn");
+      rail.line(terminalText(ctx.installUrl, 300), "plain");
+      return screen.breathe(prefix, () => `Waiting for the install on ${owner}`, visible);
     },
     gaveUp: (message) => {
       gaveUp = message;
@@ -44372,7 +44565,7 @@ async function signInStep(ui, resolution, opts) {
   if (gaveUp) rail.line(terminalText(gaveUp, 300), "warn");
   for (const line2 of report.slice(1)) {
     if (line2.level === "verbose") continue;
-    rail.line(line2.text.trim().replace(/^✓\s*/, ""), line2.level === "warn" ? "warn" : "muted");
+    rail.line(terminalText(line2.text.trim().replace(/^✓\s*/, ""), 300), line2.level === "warn" ? "warn" : "muted");
   }
   return end("new");
 }
@@ -44412,7 +44605,7 @@ async function recordAnswers(ui, momentIds, telemetry, completed) {
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
       // A failed run also clears an earlier stamp: "done" describes this checkout now.
-      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.2" : "dev" } : void 0
+      init: completed ? { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.35.3" : "dev" } : void 0
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -46335,10 +46528,10 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.35.2").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.35.3").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.2");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.35.3");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.35.2",
+  "version": "0.35.3",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",