@codacy/verity-cli 0.23.0 → 0.23.2

package/bin/verity.js

@@ -10902,7 +10902,9 @@ function isLegacyHook(entry) {
   return LEGACY_STOP_RE.test(c) || LEGACY_INTENT_RE.test(c) || c.includes(".gate/hooks/analyze.sh") || c.includes(".gate/hooks/capture-intent.sh");
 }
 var SETTINGS_LOCAL_FILE = ".claude/settings.local.json";
-var GLOBAL_SETTINGS_FILE = `${process.env.HOME || process.env.USERPROFILE || ""}/.claude/settings.json`;
+function globalSettingsFile() {
+  return `${process.env.HOME || process.env.USERPROFILE || ""}/.claude/settings.json`;
+}
 async function readSettings() {
   try {
     const content = await (0, import_promises4.readFile)(CLAUDE_SETTINGS_FILE, "utf-8");
@@ -10912,7 +10914,7 @@ async function readSettings() {
   }
 }
 async function readAllSettings() {
-  const files = [CLAUDE_SETTINGS_FILE, SETTINGS_LOCAL_FILE, GLOBAL_SETTINGS_FILE];
+  const files = [CLAUDE_SETTINGS_FILE, SETTINGS_LOCAL_FILE, globalSettingsFile()];
   const out = [];
   for (const f of files) {
     try {
@@ -10936,6 +10938,24 @@ async function checkAllVerityHooks() {
   }
   return { stop, intent, guard, guardOn };
 }
+async function checkExternalVerityHooks() {
+  let stop = false;
+  let intent = false;
+  let guardOn = [];
+  for (const f of [SETTINGS_LOCAL_FILE, globalSettingsFile()]) {
+    let settings;
+    try {
+      settings = JSON.parse(await (0, import_promises4.readFile)(f, "utf-8"));
+    } catch {
+      continue;
+    }
+    const r = checkVerityHooks(settings);
+    stop = stop || r.stop;
+    intent = intent || r.intent;
+    if (r.guardOn.length > guardOn.length) guardOn = r.guardOn;
+  }
+  return { stop, intent, guardOn };
+}
 async function checkAllVerityHooksDetailed() {
   let stop = false;
   let intent = false;
@@ -11102,6 +11122,12 @@ function reconcileMomentHooks(settings, moments, externalPresent = {
   if (Object.keys(s.hooks).length === 0) delete s.hooks;
   return s;
 }
+async function applyMomentSelection(moments) {
+  const external = await checkExternalVerityHooks();
+  const settings = reconcileMomentHooks(await readSettings(), moments, external);
+  await writeSettings(settings);
+  return settings;
+}
 
 // src/commands/hooks.ts
 var ALL_MOMENTS = ["stop", "pre-commit", "pre-push"];
@@ -11118,15 +11144,13 @@ function registerHooksCommands(program2) {
     const force = opts.force ?? false;
     if (opts.moments != null) {
       const moments = parseMoments(opts.moments);
-      const external = await checkAllVerityHooks();
-      const settings2 = reconcileMomentHooks(await readSettings(), moments, external);
-      await writeSettings(settings2);
+      await applyMomentSelection(moments);
       const status = await checkAllVerityHooks();
       printInfo("Verity hooks reconciled in .claude/settings.json:");
-      printInfo(`  Stop (verity analyze): ${moments.includes("stop") ? "on" : "off"}`);
+      printInfo(`  Stop (verity analyze): ${status.stop ? "on" : "off"}`);
       printInfo(`  Pre-commit gate: ${status.guardOn.includes("commit") ? "on" : "off"}`);
       printInfo(`  Pre-push/PR gate: ${status.guardOn.includes("push") ? "on" : "off"}`);
-      printInfo("  UserPromptSubmit (verity intent capture): on");
+      printInfo(`  UserPromptSubmit (verity intent capture): ${status.intent ? "on" : "off"}`);
       return;
     }
     const detail = await checkAllVerityHooksDetailed();
@@ -16317,7 +16341,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.23.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.23.2").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);

package/data/skills/verity-setup/SKILL.md

@@ -75,6 +75,32 @@ Default to `balanced` if the user says "default" or doesn't specify a preference
 
 ---
 
+## Step 3a: Choose analysis moments
+
+This decides **when** Verity reviews code. Use the **AskUserQuestion** tool with
+`multiSelect: true`:
+
+> **When should Verity review your code? (select all that apply)**
+> - **On stop** (recommended) — after every agent turn. Fast feedback while you work.
+> - **Before commit** — gates `git commit`; reviews the **staged** diff and blocks the commit on FAIL.
+> - **Before push / PR** — gates `git push` and `gh pr create`; reviews the **to-be-pushed** commits and blocks on FAIL.
+>
+> Default: **On stop**
+
+Notes to convey if asked:
+- The git-moment gates run an independent reviewer at the boundary the customer cares
+  about; a FAIL blocks the commit/push so the agent fixes issues before they land
+  (capped at 2 review cycles so you're never stuck).
+- These are **Claude Code** hooks (they fire when the agent runs `git commit`/`git push`),
+  not native git hooks — no `.git/hooks` files, no GitHub App.
+- "On stop" alone matches today's behavior. Many teams pick **Before commit + Before push**
+  and turn **On stop** off to review only at real boundaries.
+
+Map the selection to moment ids: On stop → `stop`, Before commit → `pre-commit`,
+Before push/PR → `pre-push`. Remember this list; you apply it in **Step 9**.
+
+---
+
 ## Step 3b: Ask about cost & usage telemetry (opt-in)
 
 Cost & usage observability is **opt-in** and **required** for the `/usage` dashboard — all
@@ -414,27 +440,37 @@ These blocks enable two capabilities:
 
 ---
 
-## Step 9: Verify hooks
+## Step 9: Wire the selected moments
 
-The installer already wired the Claude Code hooks via `verity hooks install`. Verify they're in place:
+Apply the moments the user chose in **Step 3a**. Pass the comma-separated moment ids
+(always include the always-on intent hook automatically):
+
+```bash
+# Example: user chose On stop + Before commit + Before push
+verity hooks install --moments stop,pre-commit,pre-push
+```
+
+`--moments` reconciles Verity's own hooks in `.claude/settings.json` to **exactly**
+the selection (adding the git-moment gate, removing the Stop hook if unselected),
+while preserving every non-Verity hook. The `verity intent capture` hook is always
+installed. If the user picked only `stop` (the default), pass `--moments stop`.
+
+Then verify:
 
 ```bash
 verity hooks check
 ```
 
-Expected output:
+Expected output (for `stop,pre-commit,pre-push`):
 ```
 [verity] Stop hook (verity analyze): installed
 [verity] Intent hook (verity intent capture): installed
+[verity] Git-moment gate (verity guard): installed [commit, push]
 ```
 
-If hooks are missing (e.g., user installed manually without the installer), install them:
-
-```bash
-verity hooks install
-```
-
-This wires both the Stop hook (`verity analyze`) and UserPromptSubmit hook (`verity intent capture`) into `.claude/settings.json`, preserving any existing hooks.
+The git-moment gate is a single `PreToolUse(Bash)` hook (`verity guard`) that
+intercepts `git commit` / `git push` / `gh pr create` and reviews the staged or
+to-be-pushed diff before it lands.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.23.0",
+  "version": "0.23.2",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "repository": {