@codacy/verity-cli 0.22.0 → 0.23.1

package/bin/verity.js

@@ -10648,6 +10648,10 @@ async function apiRequest(options) {
   if (token) {
     headers["Authorization"] = `Bearer ${token}`;
   }
+  const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
+  if (testMockScenario) {
+    headers["X-Verity-Mock-Scenario"] = testMockScenario;
+  }
   printVerbose(`${method} ${url}`, verbose);
   let serializedBody;
   if (body !== void 0 && body !== null) {
@@ -10719,6 +10723,20 @@ async function apiRequest(options) {
   });
   return { ok: true, data };
 }
+function analyzeRequest(options) {
+  return apiRequest({
+    method: "POST",
+    path: "/analyze",
+    serviceUrl: options.serviceUrl,
+    token: options.token,
+    body: options.body,
+    timeout: options.timeout,
+    cmd: options.cmd,
+    verbose: options.verbose,
+    retry: options.retry,
+    encodeBody: true
+  });
+}
 
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
@@ -10830,8 +10848,21 @@ var VERITY_INTENT_HOOK = {
   type: "command",
   command: "verity intent capture"
 };
+var GUARD_TIMEOUT = 300;
+function buildGuardHook(on) {
+  return {
+    type: "command",
+    command: `verity guard --on ${on.join(",")}`,
+    timeout: GUARD_TIMEOUT,
+    statusMessage: "Running Verity git-moment review"
+  };
+}
 var VERITY_STOP_RE = /(?:^|[\/\s"'])verity\s+analyze\b/;
 var VERITY_INTENT_RE = /(?:^|[\/\s"'])verity\s+intent\s+capture\b/;
+var VERITY_GUARD_RE = /(?:^|[\/\s"'])verity\s+guard\b/;
+function isVerityGuardHook(entry) {
+  return VERITY_GUARD_RE.test(entry.command ?? "");
+}
 var LEGACY_STOP_RE = /(?:^|[\/\s"'])gate\s+analyze\b/;
 var LEGACY_INTENT_RE = /(?:^|[\/\s"'])gate\s+intent\s+capture\b/;
 function isVerityStopHook(entry) {
@@ -10843,7 +10874,7 @@ function isVerityIntentHook(entry) {
   return VERITY_INTENT_RE.test(c) || LEGACY_INTENT_RE.test(c) || c.includes(".verity/hooks/capture-intent.sh") || c.includes(".gate/hooks/capture-intent.sh");
 }
 function isVerityHook(entry) {
-  return isVerityStopHook(entry) || isVerityIntentHook(entry);
+  return isVerityStopHook(entry) || isVerityIntentHook(entry) || isVerityGuardHook(entry);
 }
 function isCurrentVerityStopHook(entry) {
   const c = entry.command ?? "";
@@ -10854,7 +10885,7 @@ function isCurrentVerityIntentHook(entry) {
   return VERITY_INTENT_RE.test(c) || c.includes(".verity/hooks/capture-intent.sh");
 }
 function isCurrentVerityHook(entry) {
-  return isCurrentVerityStopHook(entry) || isCurrentVerityIntentHook(entry);
+  return isCurrentVerityStopHook(entry) || isCurrentVerityIntentHook(entry) || isVerityGuardHook(entry);
 }
 function settingsHasLegacyHook(settings) {
   for (const groups of Object.values(settings.hooks ?? {})) {
@@ -10894,12 +10925,16 @@ async function readAllSettings() {
 async function checkAllVerityHooks() {
   let stop = false;
   let intent = false;
+  let guard = false;
+  let guardOn = [];
   for (const settings of await readAllSettings()) {
     const r = checkVerityHooks(settings);
     stop = stop || r.stop;
     intent = intent || r.intent;
+    guard = guard || r.guard;
+    if (r.guardOn.length > guardOn.length) guardOn = r.guardOn;
   }
-  return { stop, intent };
+  return { stop, intent, guard, guardOn };
 }
 async function checkAllVerityHooksDetailed() {
   let stop = false;
@@ -10962,7 +10997,19 @@ function checkVerityHooks(settings) {
   const hasIntent = intentGroups.some(
     (g) => g.hooks?.some((h) => isCurrentVerityIntentHook(h))
   );
-  return { stop: hasStop, intent: hasIntent };
+  let guard = false;
+  let guardOn = [];
+  for (const g of hooks["PreToolUse"] ?? []) {
+    for (const h of g.hooks ?? []) {
+      if (!isVerityGuardHook(h)) continue;
+      guard = true;
+      const m = (h.command ?? "").match(/--on[=\s]+([a-z,]+)/);
+      if (m) {
+        guardOn = m[1].split(",").filter((x) => x === "commit" || x === "push");
+      }
+    }
+  }
+  return { stop: hasStop, intent: hasIntent, guard, guardOn };
 }
 function installVerityHooks(settings, force, externalPresent = { stop: false, intent: false }) {
   const local = checkVerityHooks(settings);
@@ -11011,6 +11058,7 @@ function installVerityHooks(settings, force, externalPresent = { stop: false, in
 function removeVerityHooks(settings) {
   const newSettings = { ...settings };
   if (!newSettings.hooks) return newSettings;
+  newSettings.hooks = { ...newSettings.hooks };
   for (const key of Object.keys(newSettings.hooks)) {
     const groups = newSettings.hooks[key];
     if (!groups) continue;
@@ -11027,12 +11075,60 @@ function removeVerityHooks(settings) {
   }
   return newSettings;
 }
+function reconcileMomentHooks(settings, moments, externalPresent = {
+  stop: false,
+  intent: false,
+  guardOn: []
+}) {
+  const s = removeVerityHooks(settings);
+  if (!s.hooks) s.hooks = {};
+  const push = (event, group) => {
+    (s.hooks[event] ??= []).push(group);
+  };
+  if (!externalPresent.intent) push("UserPromptSubmit", { hooks: [VERITY_INTENT_HOOK] });
+  if (moments.includes("stop") && !externalPresent.stop) {
+    push("Stop", { hooks: [VERITY_STOP_HOOK] });
+  }
+  const on = [];
+  if (moments.includes("pre-commit")) on.push("commit");
+  if (moments.includes("pre-push")) on.push("push");
+  const remaining = on.filter((m) => !externalPresent.guardOn.includes(m));
+  if (remaining.length > 0) {
+    push("PreToolUse", { matcher: "Bash", hooks: [buildGuardHook(remaining)] });
+  }
+  for (const k of Object.keys(s.hooks)) {
+    if (s.hooks[k].length === 0) delete s.hooks[k];
+  }
+  if (Object.keys(s.hooks).length === 0) delete s.hooks;
+  return s;
+}
 
 // src/commands/hooks.ts
+var ALL_MOMENTS = ["stop", "pre-commit", "pre-push"];
+function parseMoments(raw) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+    if (ALL_MOMENTS.includes(part)) seen.add(part);
+  }
+  return ALL_MOMENTS.filter((m) => seen.has(m));
+}
 function registerHooksCommands(program2) {
   const hooks = program2.command("hooks").description("Manage Claude Code hook wiring");
-  hooks.command("install").description("Install Verity hooks into Claude Code settings").option("--force", "Overwrite existing Verity hooks").action(async (opts) => {
+  hooks.command("install").description("Install Verity hooks into Claude Code settings").option("--force", "Overwrite existing Verity hooks").option("--moments <list>", "Reconcile to exactly these moments: stop,pre-commit,pre-push").action(async (opts) => {
     const force = opts.force ?? false;
+    if (opts.moments != null) {
+      const moments = parseMoments(opts.moments);
+      const external = await checkAllVerityHooks();
+      const settings2 = reconcileMomentHooks(await readSettings(), moments, external);
+      await writeSettings(settings2);
+      const status = await checkAllVerityHooks();
+      printInfo("Verity hooks reconciled in .claude/settings.json:");
+      printInfo(`  Stop (verity analyze): ${moments.includes("stop") ? "on" : "off"}`);
+      printInfo(`  Pre-commit gate: ${status.guardOn.includes("commit") ? "on" : "off"}`);
+      printInfo(`  Pre-push/PR gate: ${status.guardOn.includes("push") ? "on" : "off"}`);
+      printInfo("  UserPromptSubmit (verity intent capture): on");
+      return;
+    }
     const detail = await checkAllVerityHooksDetailed();
     const present = { stop: detail.stop, intent: detail.intent };
     if (detail.legacyOnly) {
@@ -11070,7 +11166,12 @@ function registerHooksCommands(program2) {
     const status = await checkAllVerityHooks();
     printInfo(`Stop hook (verity analyze): ${status.stop ? "installed" : "not installed"}`);
     printInfo(`Intent hook (verity intent capture): ${status.intent ? "installed" : "not installed"}`);
-    if (!status.stop || !status.intent) {
+    const gates = status.guard ? status.guardOn.join(", ") : "none";
+    printInfo(`Git-moment gate (verity guard): ${status.guard ? `installed [${gates}]` : "not installed"}`);
+    if (!status.stop && !status.guard) {
+      printWarn('No analysis moment is active (neither Stop nor a git-moment gate) \u2014 code changes will not be reviewed. Run "verity hooks install --moments stop" (or /verity-setup) to enable one.');
+    }
+    if (!status.intent) {
       printWarn('Run "verity hooks install" to install missing hooks.');
     }
   });
@@ -12437,6 +12538,12 @@ function registerStatusCommand(program2) {
       printInfo(`Standard:    v${s.version} (${s.quality_dimensions} quality, ${s.security_patterns} security, ${s.custom_patterns} custom)`);
       printInfo(`Languages:   ${s.languages.join(", ")}`);
     }
+    const hookStatus = await checkAllVerityHooks();
+    const moments = [];
+    if (hookStatus.stop) moments.push("stop");
+    if (hookStatus.guardOn.includes("commit")) moments.push("pre-commit");
+    if (hookStatus.guardOn.includes("push")) moments.push("pre-push/PR");
+    printInfo(`Moments:     ${moments.length > 0 ? moments.join(", ") : "none (run /verity-setup)"}`);
     if (mem.recent_runs) {
       const r = mem.recent_runs;
       printInfo("");
@@ -12677,6 +12784,31 @@ function getChangedFiles() {
   const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
   return { files: filtered, hasRecentCommitFiles };
 }
+function getStagedFiles() {
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function getPushRangeFiles() {
+  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const resolvers = [
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
+    () => {
+      const branch = execGit("git rev-parse --abbrev-ref HEAD");
+      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
+    }
+  ];
+  for (const resolve of resolvers) {
+    const range = resolve();
+    if (range) return { files: diff(range), range };
+  }
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const files = diff(`${baseline}..HEAD`);
+    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
+  }
+  const last = diff("HEAD~1..HEAD");
+  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
+}
 function getWorktreeFiles() {
   const result = [];
   const worktreeDir = ".claude/worktrees";
@@ -14431,16 +14563,13 @@ async function runAnalyze(opts, globals) {
     requestBody.intent_context = intentContext;
   }
   const ANALYZE_TIMEOUT_MS = 1e5;
-  let result = await apiRequest({
-    method: "POST",
-    path: "/analyze",
+  let result = await analyzeRequest({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
     body: requestBody,
     verbose: globals.verbose,
     timeout: ANALYZE_TIMEOUT_MS,
-    cmd: "analyze",
-    encodeBody: true
+    cmd: "analyze"
   });
   if (!result.ok && shouldWarmRetryAnalyze(result)) {
     logEvent("analyze_warm_retry", {
@@ -14457,17 +14586,14 @@ async function runAnalyze(opts, globals) {
       timeout: 15e3,
       cmd: "analyze_warmup"
     });
-    result = await apiRequest({
-      method: "POST",
-      path: "/analyze",
+    result = await analyzeRequest({
       serviceUrl: urlResult.data,
       token: tokenResult.data.token,
       body: requestBody,
       verbose: globals.verbose,
       timeout: ANALYZE_TIMEOUT_MS,
       cmd: "analyze",
-      retry: true,
-      encodeBody: true
+      retry: true
     });
   }
   if (!result.ok) {
@@ -14728,8 +14854,8 @@ async function runReview(opts, globals) {
     for (const p of specPaths) {
       if (!(0, import_node_fs19.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync10 } = await import("node:fs");
-        const content = readFileSync10(p, "utf-8");
+        const { readFileSync: readFileSync11 } = await import("node:fs");
+        const content = readFileSync11(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -14759,14 +14885,13 @@ async function runReview(opts, globals) {
     if (plans.length > 0) intentContext.plans = plans;
     requestBody.intent_context = intentContext;
   }
-  const result = await apiRequest({
-    method: "POST",
-    path: "/analyze",
+  const result = await analyzeRequest({
     serviceUrl: urlResult.data,
     token: tokenResult.data.token,
     body: requestBody,
     verbose: globals.verbose,
-    timeout: 12e4
+    timeout: 12e4,
+    cmd: "review"
   });
   if (!result.ok) {
     printError(`Service error: ${result.error}`);
@@ -14786,15 +14911,270 @@ async function runReview(opts, globals) {
   process.exit(0);
 }
 
+// src/commands/guard.ts
+var import_node_fs20 = require("node:fs");
+var import_node_path14 = require("node:path");
+var GUARD_BLOCK_CAP = 2;
+var GUARD_ITER_FILE = (0, import_node_path14.join)(VERITY_DIR, ".guard-iteration");
+function readPreToolUseStdin() {
+  const empty = { command: "", cwd: null, sessionId: null };
+  return new Promise((resolve) => {
+    try {
+      if (process.stdin.isTTY) return resolve(empty);
+      const chunks = [];
+      let timer;
+      let settled = false;
+      const onData = (c) => chunks.push(c);
+      const settle = (value) => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        process.stdin.removeListener("data", onData);
+        process.stdin.removeListener("end", onEnd);
+        process.stdin.removeListener("error", onError);
+        process.stdin.pause();
+        resolve(value);
+      };
+      const onEnd = () => {
+        try {
+          const data = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+          settle({
+            command: typeof data?.tool_input?.command === "string" ? data.tool_input.command : "",
+            cwd: typeof data?.cwd === "string" ? data.cwd : null,
+            sessionId: typeof data?.session_id === "string" ? data.session_id : null
+          });
+        } catch {
+          settle(empty);
+        }
+      };
+      const onError = () => settle(empty);
+      timer = setTimeout(() => settle(empty), 2e3);
+      process.stdin.on("data", onData);
+      process.stdin.on("end", onEnd);
+      process.stdin.on("error", onError);
+      process.stdin.resume();
+    } catch {
+      resolve(empty);
+    }
+  });
+}
+function buildCommandRe(head) {
+  return new RegExp(`(?:^|[\\s;&|(])${head}|(?:^|[;&|(])\\s*[^\\s;&|()'"]*\\/${head}`);
+}
+var GIT_GLOBAL_OPTS = "(?:\\s+(?:-[Cc]\\s+\\S+|--?[\\w-]+(?:=\\S+)?))*";
+var COMMIT_RE = buildCommandRe(`git${GIT_GLOBAL_OPTS}\\s+commit(?![\\w-])`);
+var PUSH_RE = buildCommandRe(`git${GIT_GLOBAL_OPTS}\\s+push\\b`);
+var GH_PR_RE = buildCommandRe(`gh${GIT_GLOBAL_OPTS}\\s+pr\\s+create\\b`);
+function classifyCommand(command, on) {
+  let commit = false;
+  let push = false;
+  for (const seg of (command ?? "").split(/&&|\|\||;|\n/)) {
+    if (/--dry-run\b/.test(seg)) continue;
+    if (COMMIT_RE.test(seg)) commit = true;
+    if (PUSH_RE.test(seg) || GH_PR_RE.test(seg)) push = true;
+  }
+  if (commit && on.includes("commit")) return "pre-commit";
+  if (push && on.includes("push")) return "pre-push";
+  return null;
+}
+function readIterMap() {
+  try {
+    const raw = JSON.parse((0, import_node_fs20.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    if (raw && typeof raw === "object") {
+      if (typeof raw.moment === "string" && typeof raw.count === "number") {
+        return { [raw.moment]: raw.count };
+      }
+      const out = {};
+      for (const m of ["pre-commit", "pre-push"]) {
+        if (typeof raw[m] === "number") out[m] = raw[m];
+      }
+      return out;
+    }
+  } catch {
+  }
+  return {};
+}
+function readIter(moment) {
+  return readIterMap()[moment] ?? 0;
+}
+function writeIter(moment, count) {
+  try {
+    (0, import_node_fs20.mkdirSync)(VERITY_DIR, { recursive: true });
+    const map = readIterMap();
+    map[moment] = count;
+    (0, import_node_fs20.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+  } catch {
+  }
+}
+function resetIter(moment) {
+  try {
+    const map = readIterMap();
+    if (!(moment in map)) return;
+    delete map[moment];
+    if (Object.keys(map).length === 0) {
+      if ((0, import_node_fs20.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs20.unlinkSync)(GUARD_ITER_FILE);
+    } else {
+      (0, import_node_fs20.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs20.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    }
+  } catch {
+  }
+}
+function registerGuardCommand(program2) {
+  program2.command("guard").description("Git-moment gate: review staged/to-push changes before a commit/push (PreToolUse hook)").option("--on <moments>", "Which git moments to gate: commit,push", "commit,push").option("--json", "Output raw JSON response (debug)").action(async (opts) => {
+    const globals = program2.opts();
+    try {
+      await runGuard(opts, globals);
+    } catch {
+      process.exit(0);
+    }
+  });
+}
+function getMomentFiles(moment) {
+  return moment === "pre-commit" ? getStagedFiles() : getPushRangeFiles().files;
+}
+function buildGuardRequest(moment, files, iter, sessionId) {
+  const analyzable = filterAnalyzable(files);
+  const securityFiles = filterSecurity(files);
+  let staticResults;
+  if (isCodacyAvailable()) {
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs20.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+    staticResults = runCodacyAnalysis(scannable);
+  } else {
+    staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
+  }
+  const codeDelta = collectCodeDelta(files);
+  if (codeDelta.total_files === 0) return null;
+  const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
+  const requestBody = {
+    static_results: staticResults,
+    code_delta: codeDelta,
+    changed_files: files,
+    standard_version: "latest",
+    context: {
+      agent_model: process.env.CLAUDE_MODEL ?? "unknown",
+      agent_harness: "claude-code",
+      // Prefer the session id Claude Code passes on the hook payload; fall back
+      // to the env var, then 'unknown'.
+      session_id: sessionId ?? process.env.CLAUDE_SESSION_ID ?? "unknown",
+      trigger,
+      iteration: iter + 1
+    }
+  };
+  const specs = discoverSpecs();
+  const plans = discoverPlans();
+  if (specs.length > 0 || plans.length > 0) {
+    const intentContext = {};
+    if (specs.length > 0) intentContext.specs = specs;
+    if (plans.length > 0) intentContext.plans = plans;
+    requestBody.intent_context = intentContext;
+  }
+  return requestBody;
+}
+function allowWithNotice(moment, decision) {
+  resetIter(moment);
+  if (decision === "WARN") {
+    process.stderr.write(`${YELLOW}Verity ${moment}: WARN \u2014 proceeding. See findings in the report.${NC}
+`);
+  }
+  process.exit(0);
+}
+async function runGuard(opts, globals) {
+  const on = opts.on.split(",").map((s) => s.trim()).filter((s) => s === "commit" || s === "push");
+  const { command, cwd, sessionId } = await readPreToolUseStdin();
+  if (cwd && (0, import_node_fs20.existsSync)(cwd)) {
+    try {
+      process.chdir(cwd);
+    } catch {
+    }
+  }
+  const moment = classifyCommand(command, on);
+  if (!moment) process.exit(0);
+  const iter = readIter(moment);
+  if (iter >= GUARD_BLOCK_CAP) {
+    process.stderr.write(`${DIM}Verity ${moment}: ${GUARD_BLOCK_CAP} review cycles reached \u2014 allowing through.${NC}
+`);
+    resetIter(moment);
+    process.exit(0);
+  }
+  const files = getMomentFiles(moment);
+  if (files.length === 0) process.exit(0);
+  const tokenResult = await resolveToken(globals.token);
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!tokenResult.ok || !urlResult.ok) process.exit(0);
+  const requestBody = buildGuardRequest(moment, files, iter, sessionId);
+  if (!requestBody) process.exit(0);
+  const result = await analyzeRequest({
+    serviceUrl: urlResult.data,
+    token: tokenResult.data.token,
+    body: requestBody,
+    verbose: globals.verbose,
+    timeout: 29e4,
+    cmd: "guard"
+  });
+  if (!result.ok) {
+    process.stderr.write(`${DIM}Verity ${moment}: service unavailable \u2014 allowing commit/push (${result.error}).${NC}
+`);
+    process.exit(0);
+  }
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(result.data) + "\n");
+  }
+  const response = result.data;
+  const decision = response.gate_decision ?? "PASS";
+  if (decision === "FAIL") {
+    writeIter(moment, iter + 1);
+    writeBlockMessage(moment, response);
+    process.exit(2);
+  }
+  allowWithNotice(moment, decision);
+}
+function writeBlockMessage(moment, response) {
+  const label2 = moment === "pre-commit" ? "pre-commit" : "pre-push";
+  const verb = moment === "pre-commit" ? "commit" : "push";
+  const assessment = response.assessment;
+  const narrative = assessment?.narrative ?? "";
+  const findings = response.findings ?? [];
+  const viewUrl = response.view_url ?? "";
+  process.stderr.write(`${RED}${BOLD}\u2501\u2501\u2501 Verity ${label2} gate: FAIL \u2501\u2501\u2501${NC}
+
+`);
+  if (narrative) process.stderr.write(`${DIM}${narrative}${NC}
+
+`);
+  const agentFindings = findings.filter((f) => f.scope !== "pre-existing");
+  if (agentFindings.length > 0) {
+    process.stderr.write(`${BOLD}${agentFindings.length} issue(s) in the ${verb} \u2014 fix critical/high severity before ${verb === "commit" ? "committing" : "pushing"}:${NC}
+
+`);
+    for (const f of agentFindings) {
+      const severity = (f.severity ?? "").toUpperCase();
+      const fix = f.fix;
+      process.stderr.write(`[${severity}] ${f.title ?? ""}
+`);
+      process.stderr.write(`  File: ${f.file ?? ""}:${f.line ?? ""}
+`);
+      process.stderr.write(`  Fix: ${fix?.description ?? "See description"}
+
+`);
+    }
+  }
+  if (viewUrl) process.stderr.write(`${CYAN}Full report: ${viewUrl}${NC}
+
+`);
+  process.stderr.write(`${BOLD}Fix these, then re-run the ${verb}.${NC}
+`);
+}
+
 // src/commands/init.ts
-var import_node_fs21 = require("node:fs");
+var import_node_fs22 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
-var import_node_path15 = require("node:path");
+var import_node_path16 = require("node:path");
 var import_node_child_process9 = require("node:child_process");
 
 // src/commands/migrate.ts
-var import_node_fs20 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_path15 = require("node:path");
 var import_node_child_process8 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -14830,12 +15210,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path14.join)(root, ".gate");
-  const verityDir = (0, import_node_path14.join)(root, ".verity");
-  if ((0, import_node_fs20.existsSync)(gateDir) && !(0, import_node_fs20.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path15.join)(root, ".gate");
+  const verityDir = (0, import_node_path15.join)(root, ".verity");
+  if ((0, import_node_fs21.existsSync)(gateDir) && !(0, import_node_fs21.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs20.existsSync)(gateDir) && (0, import_node_fs20.existsSync)(verityDir)) {
+  if ((0, import_node_fs21.existsSync)(gateDir) && (0, import_node_fs21.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -14856,13 +15236,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs20.existsSync)(gateDir)) {
+    if ((0, import_node_fs21.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs20.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs21.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -14878,18 +15258,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs20.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs21.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path14.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path14.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs20.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs20.existsSync)(verityCreds)) {
-    (0, import_node_fs20.mkdirSync)((0, import_node_path14.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path15.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path15.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs21.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs21.existsSync)(verityCreds)) {
+    (0, import_node_fs21.mkdirSync)((0, import_node_path15.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -14911,8 +15291,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path14.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs20.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path15.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs21.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -14922,9 +15302,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path14.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path14.join)(root, "VERITY.md");
-  if (!(0, import_node_fs20.existsSync)(gateMd) || (0, import_node_fs20.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path15.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path15.join)(root, "VERITY.md");
+  if (!(0, import_node_fs21.existsSync)(gateMd) || (0, import_node_fs21.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -14936,7 +15316,7 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs20.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs21.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 function removeLegacyPackage(movedProjectDir, npmRemover, actions) {
@@ -14970,14 +15350,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs20.writeFileSync)(verityCreds, verityContent + sep + toAppend.join("\n") + "\n");
+    (0, import_node_fs21.writeFileSync)(verityCreds, verityContent + sep + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs20.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs21.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs20.readFileSync)(path, "utf-8");
+    return (0, import_node_fs21.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -14992,35 +15372,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs20.renameSync)(from, to);
+    (0, import_node_fs21.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs20.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs20.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs21.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs21.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs20.renameSync)(from, to);
+    (0, import_node_fs21.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs20.cpSync)(from, to);
-    (0, import_node_fs20.rmSync)(from, { force: true });
+    (0, import_node_fs21.cpSync)(from, to);
+    (0, import_node_fs21.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
-    const srcDir = (0, import_node_path14.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs20.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path14.join)(relDir, entry) : entry;
-      const src = (0, import_node_path14.join)(gateDir, rel);
-      const dest = (0, import_node_path14.join)(verityDir, rel);
-      if ((0, import_node_fs20.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path15.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs21.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path15.join)(relDir, entry) : entry;
+      const src = (0, import_node_path15.join)(gateDir, rel);
+      const dest = (0, import_node_path15.join)(verityDir, rel);
+      if ((0, import_node_fs21.statSync)(src).isDirectory()) {
         walk(rel);
-      } else if (!(0, import_node_fs20.existsSync)(dest)) {
-        (0, import_node_fs20.mkdirSync)((0, import_node_path14.dirname)(dest), { recursive: true });
-        (0, import_node_fs20.cpSync)(src, dest);
+      } else if (!(0, import_node_fs21.existsSync)(dest)) {
+        (0, import_node_fs21.mkdirSync)((0, import_node_path15.dirname)(dest), { recursive: true });
+        (0, import_node_fs21.cpSync)(src, dest);
         copied++;
       }
     }
@@ -15029,22 +15409,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path14.join)(root, ".gate");
-  const verityDir = (0, import_node_path14.join)(root, ".verity");
-  if ((0, import_node_fs20.existsSync)(gateDir) && !(0, import_node_fs20.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs20.existsSync)(gateDir) && (0, import_node_fs20.existsSync)(verityDir)) {
-    if ((0, import_node_fs20.existsSync)((0, import_node_path14.join)(gateDir, "credentials")) && !(0, import_node_fs20.existsSync)((0, import_node_path14.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path15.join)(root, ".gate");
+  const verityDir = (0, import_node_path15.join)(root, ".verity");
+  if ((0, import_node_fs21.existsSync)(gateDir) && !(0, import_node_fs21.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs21.existsSync)(gateDir) && (0, import_node_fs21.existsSync)(verityDir)) {
+    if ((0, import_node_fs21.existsSync)((0, import_node_path15.join)(gateDir, "credentials")) && !(0, import_node_fs21.existsSync)((0, import_node_path15.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs20.existsSync)((0, import_node_path14.join)(gateDir, "memory")) && !(0, import_node_fs20.existsSync)((0, import_node_path14.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs21.existsSync)((0, import_node_path15.join)(gateDir, "memory")) && !(0, import_node_fs21.existsSync)((0, import_node_path15.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path14.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs20.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path15.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs21.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs20.existsSync)((0, import_node_path14.join)(root, "GATE.md")) && !(0, import_node_fs20.existsSync)((0, import_node_path14.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs21.existsSync)((0, import_node_path15.join)(root, "GATE.md")) && !(0, import_node_fs21.existsSync)((0, import_node_path15.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -15072,15 +15452,15 @@ function registerMigrateCommand(program2) {
 // src/commands/init.ts
 function resolveDataDir() {
   const candidates = [
-    (0, import_node_path15.join)(__dirname, "..", "data"),
+    (0, import_node_path16.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path15.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path16.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path15.join)(process.cwd(), "cli", "data")
+    (0, import_node_path16.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs21.existsSync)((0, import_node_path15.join)(candidate, "skills"))) {
+    if ((0, import_node_fs22.existsSync)((0, import_node_path16.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -15096,7 +15476,7 @@ function registerInitCommand(program2) {
   program2.command("init").description("Initialize Verity in the current project").option("--force", "Overwrite existing skills and hooks").action(async (opts) => {
     const force = opts.force ?? false;
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs21.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs22.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -15159,21 +15539,21 @@ function registerInitCommand(program2) {
     console.log("");
     printInfo("Installing skills...");
     const dataDir = resolveDataDir();
-    const skillsSource = (0, import_node_path15.join)(dataDir, "skills");
+    const skillsSource = (0, import_node_path16.join)(dataDir, "skills");
     const skillsDest = ".claude/skills";
     const skills = ["verity-setup", "verity-analyze", "verity-status", "verity-feedback", "verity-learn", "verity-memory", "verity-insights", "verity-reflect"];
     let skillsInstalled = 0;
     for (const skill of skills) {
-      const src = (0, import_node_path15.join)(skillsSource, skill);
-      const dest = (0, import_node_path15.join)(skillsDest, skill);
-      if (!(0, import_node_fs21.existsSync)(src)) {
+      const src = (0, import_node_path16.join)(skillsSource, skill);
+      const dest = (0, import_node_path16.join)(skillsDest, skill);
+      if (!(0, import_node_fs22.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
-      if ((0, import_node_fs21.existsSync)(dest) && !force) {
-        const srcSkill = (0, import_node_path15.join)(src, "SKILL.md");
-        const destSkill = (0, import_node_path15.join)(dest, "SKILL.md");
-        if ((0, import_node_fs21.existsSync)(destSkill)) {
+      if ((0, import_node_fs22.existsSync)(dest) && !force) {
+        const srcSkill = (0, import_node_path16.join)(src, "SKILL.md");
+        const destSkill = (0, import_node_path16.join)(dest, "SKILL.md");
+        if ((0, import_node_fs22.existsSync)(destSkill)) {
           try {
             const srcContent = await (0, import_promises12.readFile)(srcSkill, "utf-8");
             const destContent = await (0, import_promises12.readFile)(destSkill, "utf-8");
@@ -15209,7 +15589,7 @@ function registerInitCommand(program2) {
     } catch (err) {
       printWarn(`  Could not update CLAUDE.md: ${err.message}`);
     }
-    const globalVerityDir = (0, import_node_path15.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path16.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises12.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     printInfo("Verity initialized!");
@@ -15232,8 +15612,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path17 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -15252,11 +15632,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path16.join)(skillsRoot, name);
-      if ((0, import_node_fs22.existsSync)(dir)) {
+      const dir = (0, import_node_path17.join)(skillsRoot, name);
+      if ((0, import_node_fs23.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -15270,24 +15650,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs22.existsSync)(verityDir)) {
+    if ((0, import_node_fs23.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs22.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs23.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs22.existsSync)(verityMd)) {
+      if ((0, import_node_fs23.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs22.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs23.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs22.existsSync)(path) && (0, import_node_fs22.statSync)(path).isDirectory() && (0, import_node_fs22.readdirSync)(path).length === 0) {
-        (0, import_node_fs22.rmdirSync)(path);
+      if ((0, import_node_fs23.existsSync)(path) && (0, import_node_fs23.statSync)(path).isDirectory() && (0, import_node_fs23.readdirSync)(path).length === 0) {
+        (0, import_node_fs23.rmdirSync)(path);
       }
     };
     actions.push({
@@ -15298,11 +15678,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path16.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs22.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path17.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs23.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs22.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs23.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -15496,8 +15876,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path18 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -15534,11 +15914,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs23.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs23.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs24.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs24.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs23.unlinkSync)((0, import_node_path17.join)(cacheDir, entry));
+            (0, import_node_fs24.unlinkSync)((0, import_node_path18.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -15553,19 +15933,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs23.existsSync)(file)) {
+      if ((0, import_node_fs24.existsSync)(file)) {
         try {
-          (0, import_node_fs23.writeFileSync)(file, "");
+          (0, import_node_fs24.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs23.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs23.readdirSync)(logsDir)) {
+      if ((0, import_node_fs24.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs24.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs23.unlinkSync)((0, import_node_path17.join)(logsDir, entry));
+            (0, import_node_fs24.unlinkSync)((0, import_node_path18.join)(logsDir, entry));
           } catch {
           }
         }
@@ -15803,7 +16183,7 @@ function registerRunCommand(program2) {
 
 // src/lib/telemetry.ts
 var import_promises13 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
 var GITIGNORE_FILE = ".gitignore";
 var GITIGNORE_ENTRY = ".claude/settings.local.json";
@@ -15841,7 +16221,7 @@ async function readSettingsLocal() {
 }
 async function writeSettingsLocal(settings) {
   const file = projectPath(SETTINGS_LOCAL_FILE2);
-  await (0, import_promises13.mkdir)((0, import_node_path18.dirname)(file), { recursive: true });
+  await (0, import_promises13.mkdir)((0, import_node_path19.dirname)(file), { recursive: true });
   await (0, import_promises13.writeFile)(file, JSON.stringify(settings, null, 2) + "\n");
 }
 async function ensureGitignore() {
@@ -15937,7 +16317,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.22.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.23.1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);
@@ -15947,6 +16327,7 @@ registerStatusCommand(program);
 registerFeedbackCommand(program);
 registerAnalyzeCommand(program);
 registerReviewCommand(program);
+registerGuardCommand(program);
 registerInitCommand(program);
 registerUninstallCommand(program);
 registerTaskCommands(program);

package/data/skills/verity-setup/SKILL.md

@@ -75,6 +75,32 @@ Default to `balanced` if the user says "default" or doesn't specify a preference
 
 ---
 
+## Step 3a: Choose analysis moments
+
+This decides **when** Verity reviews code. Use the **AskUserQuestion** tool with
+`multiSelect: true`:
+
+> **When should Verity review your code? (select all that apply)**
+> - **On stop** (recommended) — after every agent turn. Fast feedback while you work.
+> - **Before commit** — gates `git commit`; reviews the **staged** diff and blocks the commit on FAIL.
+> - **Before push / PR** — gates `git push` and `gh pr create`; reviews the **to-be-pushed** commits and blocks on FAIL.
+>
+> Default: **On stop**
+
+Notes to convey if asked:
+- The git-moment gates run an independent reviewer at the boundary the customer cares
+  about; a FAIL blocks the commit/push so the agent fixes issues before they land
+  (capped at 2 review cycles so you're never stuck).
+- These are **Claude Code** hooks (they fire when the agent runs `git commit`/`git push`),
+  not native git hooks — no `.git/hooks` files, no GitHub App.
+- "On stop" alone matches today's behavior. Many teams pick **Before commit + Before push**
+  and turn **On stop** off to review only at real boundaries.
+
+Map the selection to moment ids: On stop → `stop`, Before commit → `pre-commit`,
+Before push/PR → `pre-push`. Remember this list; you apply it in **Step 9**.
+
+---
+
 ## Step 3b: Ask about cost & usage telemetry (opt-in)
 
 Cost & usage observability is **opt-in** and **required** for the `/usage` dashboard — all
@@ -414,27 +440,37 @@ These blocks enable two capabilities:
 
 ---
 
-## Step 9: Verify hooks
+## Step 9: Wire the selected moments
 
-The installer already wired the Claude Code hooks via `verity hooks install`. Verify they're in place:
+Apply the moments the user chose in **Step 3a**. Pass the comma-separated moment ids
+(always include the always-on intent hook automatically):
+
+```bash
+# Example: user chose On stop + Before commit + Before push
+verity hooks install --moments stop,pre-commit,pre-push
+```
+
+`--moments` reconciles Verity's own hooks in `.claude/settings.json` to **exactly**
+the selection (adding the git-moment gate, removing the Stop hook if unselected),
+while preserving every non-Verity hook. The `verity intent capture` hook is always
+installed. If the user picked only `stop` (the default), pass `--moments stop`.
+
+Then verify:
 
 ```bash
 verity hooks check
 ```
 
-Expected output:
+Expected output (for `stop,pre-commit,pre-push`):
 ```
 [verity] Stop hook (verity analyze): installed
 [verity] Intent hook (verity intent capture): installed
+[verity] Git-moment gate (verity guard): installed [commit, push]
 ```
 
-If hooks are missing (e.g., user installed manually without the installer), install them:
-
-```bash
-verity hooks install
-```
-
-This wires both the Stop hook (`verity analyze`) and UserPromptSubmit hook (`verity intent capture`) into `.claude/settings.json`, preserving any existing hooks.
+The git-moment gate is a single `PreToolUse(Bash)` hook (`verity guard`) that
+intercepts `git commit` / `git push` / `gh pr create` and reviews the staged or
+to-be-pushed diff before it lands.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.22.0",
+  "version": "0.23.1",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "repository": {
@@ -24,7 +24,8 @@
   },
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --import tsx --test $(find tests -name '*.test.ts' | sort)",
+    "test": "node --import tsx --test $(find tests -name '*.test.ts' -not -path 'tests/e2e/*' | sort)",
+    "test:e2e": "node --import tsx --test --test-concurrency=1 tests/e2e/*.test.ts",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "npm run typecheck && npm run build"
   },