@codacy/verity-cli 0.31.1 → 0.31.3

package/CHANGELOG.md

@@ -3,6 +3,130 @@
 All notable changes to Verity are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+**Verity ships as a Claude Code plugin.** `/plugin marketplace add codacy/verity`
+then `/plugin install verity@codacy` gives a working gate with nothing else to
+install — the plugin carries the CLI as a pinned dependency, and Claude Code
+installs and updates it for you.
+
+### 🔌 The plugin
+
+- **Eight skills, namespaced** — `/verity:analyze`, `/verity:status`,
+  `/verity:learn`, `/verity:memory`, `/verity:reflect` are available to Claude
+  directly; `/verity:setup`, `/verity:insights` and `/verity:feedback` are yours
+  to invoke and are not offered to the model at all. The whole plugin adds about
+  500 tokens to a session (`claude plugin details verity`).
+- **All six hooks come from the plugin**, so nothing is written to your
+  `.claude/settings.json`.
+- **One gate decision per turn.** A project carrying both the plugin and the
+  hooks `verity init` used to write no longer reviews each turn twice: when the
+  plugin is present it owns the hooks, and the settings.json copy stands down.
+  `verity init` detects the plugin and removes the duplicate wiring.
+
+### ⚙️ Git-moment gating moved into the project
+
+`verity guard` now reads `.verity/config.json` instead of taking its moments from
+which hook was wired, because a plugin's hooks are the same for everyone. **The
+default gates nothing** — set it with `verity config git-moments commit,push`, or
+answer the question in `verity init`. An explicit `--on` still wins, so existing
+installs are untouched.
+
+**Setup is one command.** `verity init` and `/verity-setup` were two half-flows
+that overlapped — and the overlap was not harmless: init wired the Stop hook,
+then the skill reconciled the hooks to a selection it asked for afterwards,
+silently removing what init had just reported installing. They are now one flow
+with one entry point.
+
+### 🎯 `verity init` is the whole setup
+
+- **It asks the questions whose answers it acts on** — analysis intensity, when
+  to review (on stop / before commit / before push), and cost & usage telemetry.
+  On the terminal, before anything is wired to them.
+- **Then it hands off to Claude Code** to finish the half that needs a model:
+  reading the codebase and synthesizing the Standard (`/verity-setup`). If Claude
+  Code isn't installed, or you are already inside a session, it prints the one
+  command instead. `verity setup` is an alias for the same command.
+- **`--yes` takes every recommended answer and asks nothing** (CI, scripts,
+  agents) — including the GitHub login, whose unattended answer is skip, so the
+  project stays local-only until you run `verity login`. `--no-setup` stops after
+  the deterministic phase. A re-run keeps the answers you gave interactively
+  instead of resetting them to the defaults.
+- **The hooks are written ONCE, to your selection.** Init reconciles instead of
+  installing-then-being-reconciled, so a project that chose commit+push no longer
+  gets a Stop hook installed and then removed. The always-on infra hooks (intent,
+  baseline, post-compact, session-end) are wired by that same path — previously
+  only the legacy installer added the last two, and `verity uninstall` left them
+  behind.
+
+### 🩺 `verity doctor`
+
+- **New command: what is set up here, and what is missing.** Prerequisites, which
+  phase has run, your recorded answers, the hook wiring, telemetry, and the
+  artifacts — plus a `next` list. `--json` is what `/verity-setup` reads, so the
+  skill no longer re-implements init's prerequisite checks (its own version told
+  you to install the analysis CLI by hand, which init had already installed for
+  you).
+
+### ✨ It looks like something now
+
+- **A wordmark on `verity init`**, and the flow is drawn as what it is: `Phase 1 of
+  2 · this machine`, then `Phase 2 of 2 · your Standard`. Steps are numbered
+  `[n/8]`, so a run that stops tells you where.
+- **Spinners on the two waits that are actually long** — the global install of
+  `@codacy/analysis-cli`, and the GitHub device flow, where the elapsed clock is
+  the difference between "waiting for you to approve" and a terminal that looks
+  hung. Nowhere else: seven of init's eight steps take milliseconds, and a spinner
+  on an instant step claims work that isn't happening. No progress bars either —
+  no step has a real percentage, so a bar would be an animation of a guess.
+- **The handoff to `/verity-setup` is framed and then verified.** Before: what
+  phase 2 does and roughly how long. After: what it actually produced, read from
+  disk (`standard.yaml`, the analysis config, `VERITY.md`), with elapsed time — so
+  quitting that session early no longer leaves you with no statement of what got
+  done. (No spinner over it: the Claude Code session owns the terminal and draws
+  its own status, so ours would be painting blind.)
+- **Colour is finally gated.** Every `[verity]` prefix used to carry raw ANSI into
+  CI logs, pipes, and agent transcripts. Colour and art now require a terminal on
+  stderr and honour `NO_COLOR` / `TERM=dumb`, with `FORCE_COLOR=1` to override.
+
+### 🧹 One writer per file
+
+- **`.gitignore`** — one whitelist block from one writer. Init used to write a
+  single `.verity/.snapshot/` line while the skill wrote a block that supersedes
+  it; an install with only the narrow line now upgrades, so `.verity/setup.json`,
+  `.baseline`, `.cache/` and whatever state file ships next are covered by
+  construction rather than by enumeration.
+- **A `.verity/` entry is repaired to `.verity/*`.** With the directory form git
+  cannot re-include the committed standard, and the symptom is not an error: a
+  project that looks configured while `.verity/standard.yaml` is silently ignored.
+  Committed machine state is also detected and offered for untracking.
+- **`CLAUDE.md`** — the post-task reflection instructions moved into the managed
+  block. The skill used to append them beside it, along with a second copy of the
+  memory pointer.
+- **A closed stdin no longer aborts an install.** A question that loses its
+  terminal (Ctrl+D, a pty that ends) falls back to the default instead of
+  crashing init between copying the skills and wiring the hooks.
+
+## [0.31.3] — 2026-09-03
+
+**After a rebase, Verity reviewed the wrong code.** When a branch was rebased
+onto an updated main, the gate could treat all of the upstream changes as the
+session's own work and block the push on findings in code the session never
+touched. The cause was that the review baseline was trusted by whether its commit
+still existed rather than whether it was still part of the current history, so a
+rewritten baseline kept anchoring every diff.
+
+- **The push gate reviews exactly what the push publishes** — the commits the
+  remote does not yet have — so a rebase, a force-push, a first push, or
+  re-pushing an already-published commit each review only their real new work.
+- **The stop-hook baseline is trusted only while it is an ancestor of HEAD.** A
+  rewritten baseline is discarded and re-derived from the commits actually made
+  since, so upstream changes are never attributed to the session.
+- **A commit made during a merge reviews only the files you resolved**, not the
+  whole incoming branch.
+- **A slash command such as `/login` is no longer treated as a task or a goal**,
+  so the review is graded against what you were actually working on.
+
 ## [0.31.1] — 2026-08-27
 
 **Verity stops repeating itself.** A finding it had already closed could keep

package/README.md

@@ -10,7 +10,30 @@ cd your-project
 verity init
 ```
 
-Then open the project in Claude Code and run `/verity-setup`.
+`verity init` is the whole setup. It asks how deeply to review and when
+(on stop / before commit / before push), wires everything, offers the optional
+GitHub login — then launches Claude Code to finish the half that needs a model:
+reading your codebase and synthesizing the Standard (`/verity-setup`).
+
+If Claude Code isn't on your PATH, or you're already inside a session, init prints
+the one command to run instead. `verity setup` is an alias for the same command.
+
+| Flag | Use |
+|------|-----|
+| `--yes` | Take the recommended answer for every question — no prompts at all (CI, scripts, agents). Includes the GitHub login, whose unattended answer is **skip**: the project stays local-only until you run `verity login`. |
+| `--no-setup` | Stop after the deterministic phase; don't launch Claude Code |
+| `--force` | Overwrite the installed skills even when they differ |
+
+Run `verity doctor` any time to see prerequisites, which phase is done, the hook
+wiring, and what is still missing.
+
+### Output
+
+Human output goes to **stderr**; stdout carries only data (`--json`). Colour, the
+wordmark, and the spinners appear only when stderr is a terminal, and honour
+`NO_COLOR` and `TERM=dumb`; `FORCE_COLOR=1` forces them on for a pipe that renders
+ANSI. In CI, in a pipe, or when init runs inside a Claude Code session you get the
+same information as plain lines — no art, no animation, no escape sequences.
 
 ### Permission denied?
 
@@ -49,7 +72,8 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | Command | Description |
 |---------|-------------|
 | **Core** | |
-| `verity init` | Initialize Verity in current project |
+| `verity init` | Set up Verity in this project — asks the setup questions, then hands off to `/verity-setup` (alias: `verity setup`) |
+| `verity doctor` | Prerequisites, setup phase, hook wiring, and what is still missing (`--json` for the machine-readable report) |
 | `verity analyze` | Run analysis on changed files (stop hook) |
 | `verity analyze --mode <mode>` | Force analysis mode (standard/plan/debug/skip) |
 | `verity review --files <paths>` | On-demand analysis (advisory) |
@@ -69,6 +93,7 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | `verity logout --others` | Sign out every OTHER machine (e.g. a lost laptop) |
 | `verity logout --all` | Sign out everywhere, including here |
 | `verity hooks install` | Wire Claude Code hooks |
+| `verity hooks install --moments stop,pre-commit,pre-push` | Change WHEN Verity reviews (what `verity init` asks for) |
 | `verity standard push` | Upload project Standard |
 | **Knowledge** | |
 | `verity reflect` | Trigger knowledge extraction for current task |
@@ -85,7 +110,7 @@ No re-setup needed: your token, Standard, and run history all carry over.
 
 | Skill | Description |
 |-------|-------------|
-| `/verity-setup` | Project configuration wizard |
+| `/verity-setup` | Synthesizes the Standard + analysis config (the half of setup that needs a model; `verity init` launches it) |
 | `/verity-analyze` | On-demand analysis |
 | `/verity-status` | Project health dashboard |
 | `/verity-feedback` | Feedback (general + per-finding) |