@codacy/verity-cli 0.32.0-experimental.f0746f7 → 0.32.1-experimental.1371ba8

package/CHANGELOG.md

@@ -5,6 +5,49 @@ All notable changes to Verity are documented here. This project follows
 
 ## [Unreleased]
 
+**Verity ships as a Claude Code plugin.** `/plugin marketplace add codacy/verity`
+then `/plugin install verity@codacy` gives a working gate with nothing else to
+install — the plugin carries the CLI as a pinned dependency, and Claude Code
+installs and updates it for you.
+
+### 🔌 The plugin
+
+- **Eight skills, namespaced** — `/verity:analyze`, `/verity:status`,
+  `/verity:learn`, `/verity:memory`, `/verity:reflect` are available to Claude
+  directly; `/verity:setup`, `/verity:insights` and `/verity:feedback` are yours
+  to invoke and are not offered to the model at all. The whole plugin adds about
+  500 tokens to a session (`claude plugin details verity`).
+- **All six hooks come from the plugin**, so nothing is written to your
+  `.claude/settings.json`.
+- **One gate decision per turn.** A project carrying both the plugin and the
+  hooks `verity init` used to write no longer reviews each turn twice: when the
+  plugin is present it owns the hooks, and the settings.json copy stands down.
+  `verity init` detects the plugin and removes the duplicate wiring.
+
+### 🚪 A project that was never set up is left alone
+
+Every hook now asks the same question the same way. `verity analyze` used to run
+in a project that had never seen `verity init`, create `.verity/` there, and then —
+with no baseline to compare against — review nothing. It now stands down like the
+other hooks always have, so installing Verity no longer scatters state through
+directories you merely opened. On the first session in such a project, Claude is
+told once that the gate is off here and can offer `/verity:setup` (or `verity init`
+on an npm install). Works correctly from linked git worktrees.
+
+### ⚙️ Git-moment gating moved into the project
+
+`verity guard` now reads `.verity/config.json` instead of taking its moments from
+which hook was wired, because a plugin's hooks are the same for everyone. **The
+default gates nothing** — set it with `verity config git-moments commit,push`, or
+answer the question in `verity init`. An explicit `--on` still wins, so existing
+installs are untouched.
+
+Linked git worktrees inherit the setting from the main checkout: `.verity/` is
+gitignored, so a fresh `git worktree add` had no config of its own and the guard
+there gated nothing while `verity hooks check` said "wired but gating nothing".
+A worktree's own `.verity/config.json`, when present, still wins — including an
+explicit `none` — and `hooks check` names the file it inherited from.
+
 ### 🎯 Setup finishes in one command
 
 - **`verity init` now derives the Standard itself.** When the service has nothing
@@ -97,7 +140,6 @@ those is now an assertion.
   before exiting: raw mode left on outlives the process and makes the user's next
   shell prompt unusable.
 
-## [Unreleased]
 
 ### 🤝 Joining a project that already has a Standard
 
@@ -141,7 +183,6 @@ those is now an assertion.
 - The setup skill learned the same case — Standard present, analysis config
   missing — and writes only the config rather than re-synthesizing the Standard.
 
-## [Unreleased]
 
 **Setup is one command.** `verity init` and `/verity-setup` were two half-flows
 that overlapped — and the overlap was not harmless: init wired the Stop hook,
@@ -218,6 +259,71 @@ with one entry point.
   terminal (Ctrl+D, a pty that ends) falls back to the default instead of
   crashing init between copying the skills and wiring the hooks.
 
+### 🔒 Fixed — four ways the gate could be off while reporting itself on
+
+- **`git add x && git commit` was never reviewed.** A Claude Code hook runs
+  *before* the command, so the index it read had not had the `add` applied:
+  no files, and the gate's "nothing staged" exit — a silent allow, with no
+  trace that a commit had gone unreviewed. It is the shape an agent writes by
+  default, so it was most of the pre-commit gate's coverage. The gate now works
+  out what the command will stage, using git's own pathspec matching, and
+  handles `git commit -a`. Where it cannot — a pathspec the shell expands,
+  `git add -p` — it says so and lets the commit through **loudly** rather than
+  reviewing a set it guessed at.
+- **Uninstalling the Claude Code plugin left projects with no gate at all.**
+  Whether the plugin owned a project's hooks was decided by whether its install
+  directory existed — and that directory survives an uninstall. Every project
+  the plugin had ever run in went on standing its own hooks down for a plugin
+  that was gone. Ownership now comes from Claude Code's install registry, and
+  `verity init` clears the stale marker.
+- **`verity init` now says which mode it is in before it acts on it** — the
+  plugin's hooks or this project's own — with the install it found and
+  `--no-plugin` to overrule it. It does two opposite things depending on that
+  answer, and it used to make the choice silently.
+- **A plugin installed from a local marketplace is recognised too.** Claude Code
+  runs a marketplace served from a *directory* out of that directory while
+  recording the cache copy it made, so the two paths disagree and a live,
+  gating install read as unverified — every reporter then said "no analysis
+  moment is active" about a project the plugin was gating on every turn.
+- **A repository can no longer switch the gate off by shipping a file.**
+  Ownership was claimed by `.verity/.plugin-active`, which is a file inside the
+  project. One naming any directory that happened to exist disabled every hook
+  in that project. An install Claude Code cannot vouch for is now ignored.
+- **`verity status` and `verity doctor` agree with `verity hooks check`.** Under
+  the plugin both used to report "Stop: off" and tell you to install hooks that
+  were firing on every turn. All three read one answer now, and it is correct
+  from a subdirectory too.
+- **A commit gate on a linked worktree gates what the main checkout gates.**
+  `.verity/config.json` is machine-local, so every `git worktree add` started
+  with no moments and reviewed nothing.
+- **A verdict the client does not understand is no longer rendered as a pass.**
+  An absent or unrecognised gate decision — a truncated response, a proxy error
+  page — reached the "✓ PASS" line. It is reported as unreviewed.
+- **`verity hooks install --moments <typo>` no longer removes every gate.**
+  Unrecognised moments were dropped, so a misspelling reconciled to nothing and
+  reported success. It is an error now; `--moments none` turns them off on
+  purpose.
+
+## [0.31.3] — 2026-09-03
+
+**After a rebase, Verity reviewed the wrong code.** When a branch was rebased
+onto an updated main, the gate could treat all of the upstream changes as the
+session's own work and block the push on findings in code the session never
+touched. The cause was that the review baseline was trusted by whether its commit
+still existed rather than whether it was still part of the current history, so a
+rewritten baseline kept anchoring every diff.
+
+- **The push gate reviews exactly what the push publishes** — the commits the
+  remote does not yet have — so a rebase, a force-push, a first push, or
+  re-pushing an already-published commit each review only their real new work.
+- **The stop-hook baseline is trusted only while it is an ancestor of HEAD.** A
+  rewritten baseline is discarded and re-derived from the commits actually made
+  since, so upstream changes are never attributed to the session.
+- **A commit made during a merge reviews only the files you resolved**, not the
+  whole incoming branch.
+- **A slash command such as `/login` is no longer treated as a task or a goal**,
+  so the review is graded against what you were actually working on.
+
 ## [0.31.1] — 2026-08-27
 
 **Verity stops repeating itself.** A finding it had already closed could keep