@codacy/verity-cli 0.32.0 → 0.32.1-experimental.c640abd

package/CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to Verity are documented here. This project follows
 
 ## [Unreleased]
 
+<!-- Shipped in 0.31.2 – 0.32.0 but deliberately not announced yet: the plugin
+     lane is being closed-loop tested first (Road to 1.0 · Phase 2.6). Cut it
+     into its own heading when it is ready to be announced. -->
+
 **Verity ships as a Claude Code plugin.** `/plugin marketplace add codacy/verity`
 then `/plugin install verity@codacy` gives a working gate with nothing else to
 install — the plugin carries the CLI as a pinned dependency, and Claude Code
@@ -24,16 +28,6 @@ installs and updates it for you.
   plugin is present it owns the hooks, and the settings.json copy stands down.
   `verity init` detects the plugin and removes the duplicate wiring.
 
-### 🚪 A project that was never set up is left alone
-
-Every hook now asks the same question the same way. `verity analyze` used to run
-in a project that had never seen `verity init`, create `.verity/` there, and then —
-with no baseline to compare against — review nothing. It now stands down like the
-other hooks always have, so installing Verity no longer scatters state through
-directories you merely opened. On the first session in such a project, Claude is
-told once that the gate is off here and can offer `/verity:setup` (or `verity init`
-on an npm install). Works correctly from linked git worktrees.
-
 ### ⚙️ Git-moment gating moved into the project
 
 `verity guard` now reads `.verity/config.json` instead of taking its moments from
@@ -42,7 +36,140 @@ default gates nothing** — set it with `verity config git-moments commit,push`,
 answer the question in `verity init`. An explicit `--on` still wins, so existing
 installs are untouched.
 
-### 🎯 Setup finishes in one command
+### 🔧 Plugin fixes
+
+- **Uninstalling the plugin left projects with no gate at all.** Whether the
+  plugin owned a project's hooks was decided by whether its install directory
+  existed on disk — and that directory survives an uninstall. Every project the
+  plugin had ever run in went on standing its own hooks down for a plugin that
+  was gone. Ownership now comes from Claude Code's install registry, and
+  `verity init` clears the stale marker.
+- **A repository can no longer switch the gate off by shipping a file.**
+  Ownership was claimed by `.verity/.plugin-active`, a file inside the project,
+  and one naming any directory that happened to exist disabled every hook there.
+  An install Claude Code cannot vouch for is ignored — and "vouch" now means
+  *for this checkout*: the cache path a real install lives at is predictable, so
+  a marker naming a plugin installed for **somebody else's project** used to be
+  believed here.
+- **A plugin installed from a local marketplace directory is recognised.**
+  Claude Code runs a marketplace served from a directory out of that directory
+  while recording the cache copy it made, so the two paths disagreed and a live,
+  gating install read as unverified — every reporter then said "no analysis
+  moment is active" about a project the plugin was gating on every turn.
+- **`verity init` knows the plugin is here, and says so before it acts.** It
+  does two opposite things depending on that answer — write this project's own
+  hooks, or leave them to the plugin — and it used to choose silently. It now
+  names the install it found and the division of labour, and `--no-plugin`
+  overrules it. It detects a plugin in a project the plugin has never set up,
+  which is the ordinary case for someone whose first Verity install *is* the
+  plugin.
+
+
+## [0.32.1] — 2026-09-09
+
+**The gate said it was on while it wasn't.** Every fix here is the same failure
+seen from a different side: Verity reported itself wired and watching, and the
+commit went through unreviewed. Two of them were shipped by 0.32.0 itself.
+
+```bash
+npm install -g @codacy/verity-cli    # binary only — no re-run of init needed
+```
+
+### 🔒 The gate is on when it says it is
+
+- **Typing `2,3` at the setup question left you with no git gate.** The review
+  moments used to be answered by number — `2,3` *was* the answer — and 0.32.0's
+  arrow-key rewrite kept the digit shortcut on the single-select question and
+  lost it on this one. A digit moved the cursor without ticking anything, the
+  comma was ignored, and Enter then confirmed the untouched default. You got
+  `stop` alone: no pre-commit hook was wired, and the git gate silently did not
+  exist. Reported from the field as *"pre-commit hooks are not added any more"*.
+  A digit toggles again, and the prompt's own legend now names the keys it
+  accepts.
+- **`git add … && git commit` was never reviewed.** The hook runs *before* the
+  command, so the index it inspected had not had the `add` applied yet: nothing
+  staged, and the gate took its "nothing to review" exit — a silent allow, with
+  no trace that a commit had gone unreviewed. It is the shape an agent writes by
+  default, so it was most of the commit gate's coverage. The gate now works out
+  what the command is about to stage, using git's own pathspec matching, and
+  understands `git commit -a` and `git commit <paths>`. Where it genuinely
+  cannot — a pathspec the shell expands before git sees it, an interactive
+  `git add -p` — it says so and lets the commit through **loudly**, rather than
+  reviewing a set it guessed at.
+- **A verdict the CLI does not understand is no longer drawn as a pass.** An
+  absent or unrecognised gate decision — a truncated response, a proxy error
+  page — reached the `✓ PASS` line. It is reported as unreviewed.
+- **`verity hooks install --moments <typo>` no longer removes every gate.**
+  Unrecognised moments were dropped in silence, so a single misspelling
+  reconciled the hooks down to nothing and printed success. It is an error now;
+  `--moments none` is still the way to turn them off on purpose.
+- **`verity init` no longer overwrites the moments you chose.** Re-running init
+  to heal a config replaced an answer you had set with `verity config
+  git-moments`, substituting the shipped default. Your answer is now recorded
+  as yours, kept, and named when init keeps it.
+- **A linked worktree gates what the main checkout gates.** `.verity/` is
+  gitignored, so a fresh `git worktree add` had no configuration of its own and
+  the guard there gated nothing while `verity hooks check` reported it wired. A
+  worktree's own `.verity/config.json` still wins when it has one — including an
+  explicit `none` — and `hooks check` names the file it inherited from.
+- **`verity status`, `verity doctor` and `verity hooks check` answer from one
+  place.** They could disagree about whether a hook was wired, and two of them
+  were wrong from a subdirectory.
+
+### 🔧 Fixed
+
+- `verity status --limit` rejects a value that is not a number instead of
+  quietly ignoring it.
+
+### Migrating
+
+Upgrading the binary is enough for six of the seven — but not for the moments
+question. If you set this project up **on 0.32.0** and answered that question by
+typing numbers, the gates you asked for were never recorded, and a new binary
+cannot know what you meant. Check and repair in one command each:
+
+```bash
+verity status                              # Moments: is pre-commit / pre-push listed?
+verity config git-moments commit,push      # set what you meant; init now keeps it
+```
+
+Projects set up before 0.32.0, or set up with the arrow keys, are unaffected.
+
+
+## [0.32.0] — 2026-09-08
+
+**Setup takes seconds, not minutes — and the reviewer sees more than the diff.**
+Installing Verity used to be two steps: `verity init`, then a Claude Code
+session for `/verity-setup` to write your Standard, which took minutes and was
+the step people skipped. It is now one command that takes seconds: `init`
+builds the Standard from your codebase, or downloads the one your team already
+registered. On the other side, the reviewer stops judging a change in a vacuum:
+it sees the callers, tests and contracts around what you touched, and it can
+only block on things it actually has evidence for. This entry folds in
+0.31.2 and 0.31.4, which shipped without their own headings; 0.31.3 and 0.31.1
+are below.
+
+```bash
+npm install -g @codacy/verity-cli
+verity init   # re-run in existing projects: heals the config, records your answers
+```
+
+### ⚡ One command, no second step
+
+- **`verity init` finishes the whole job.** It used to stop halfway and hand you
+  off to `/verity-setup` in Claude Code to synthesize the Standard — a model
+  turn that took minutes, needed a session open, and was easy to skip. `init`
+  now does it on its own, in seconds, and the gate is live on your next session.
+  `/verity-setup` still exists but is optional: it is for adding
+  project-specific rules on top, not for getting started.
+- **If your team already has a Standard, it comes down from the cloud.** Any
+  repository registered before — by a teammate, by you on another machine, by
+  CI — already has its Standard on Verity, and `init` fetches it and writes the
+  team's configuration to disk (when you are signed in). Cloning a repo that
+  already uses Verity is: install, `init`, done.
+- **If nobody has one yet, `init` derives it** from the codebase — see below.
+
+### 🎯 `init` derives the Standard when there is nothing to adopt
 
 - **`verity init` now derives the Standard itself.** When the service has nothing
   for this repository, the CLI reads the codebase — languages counted, frameworks
@@ -111,30 +238,6 @@ rule list degrades into a filter over it (VRT-108); Semgrep's ids are deliberate
 not derived yet, so the tool is dropped rather than configured empty. Every one of
 those is now an assertion.
 
-### ⌨️ The setup questions answer to arrow keys
-
-- **`verity init` no longer asks you to type a number.** Analysis intensity and
-  the review moments are arrow-key lists: `↑↓` to move, `space` to toggle a
-  moment, `enter` to confirm — with the recommended answer already under the
-  cursor and the default set already ticked, so **Enter alone still gives exactly
-  what it gave before**.
-- **Digits still work.** This prompt used to be "type a number", and muscle memory
-  should not be punished for an interface improvement — a digit moves the cursor
-  rather than confirming, so it composes with the arrows instead of being a
-  second, hidden way to answer. `j`/`k` move too.
-- **An empty moment selection is refused, not accepted.** Unticking everything and
-  pressing Enter says so instead of installing a review tool that reviews nothing
-  — the same invariant the typed prompt held by falling back.
-- **Three rungs of degradation, same default at each.** Arrow keys on a real
-  terminal; the typed number prompt when the terminal cannot do raw mode; the
-  default when there is no terminal at all or stdin ends. An interface improvement
-  must not become a new way for a setup to get stuck — CI, pipes and agent Bash
-  calls behave exactly as before.
-- **The terminal is restored on every exit,** including Ctrl+C, which restores
-  before exiting: raw mode left on outlives the process and makes the user's next
-  shell prompt unusable.
-
-
 ### 🤝 Joining a project that already has a Standard
 
 - **`verity init` now offers the Standard the service already holds** for this
@@ -163,20 +266,28 @@ those is now an assertion.
   silent-forever failure: decline on Monday meaning to synthesize later, forget,
   and every later run stays quiet while the project has no local config at all.
 
-### 🔧 Fixed
-
-- **An upgrade no longer removes the gates you chose.** `.verity/setup.json` only
-  exists from this release, so every project configured before it had no recorded
-  answer — including everyone who picked commit/push gates through the old
-  `/verity-setup`. The first upgraded `verity init` fell back to the shipped
-  default and reconciled those gates away, turning Stop back on. What you chose is
-  still legible in `.claude/settings.json`, so init reads it.
-- `verity doctor` names the artifact that is actually missing instead of telling
-  you to run a phase that will decline: with a Standard adopted and no analysis
-  config, `/verity-setup` would have answered "already configured".
-- The setup skill learned the same case — Standard present, analysis config
-  missing — and writes only the config rather than re-synthesizing the Standard.
+### ⌨️ The setup questions answer to arrow keys
 
+- **`verity init` no longer asks you to type a number.** Analysis intensity and
+  the review moments are arrow-key lists: `↑↓` to move, `space` to toggle a
+  moment, `enter` to confirm — with the recommended answer already under the
+  cursor and the default set already ticked, so **Enter alone still gives exactly
+  what it gave before**.
+- **Digits still work.** This prompt used to be "type a number", and muscle memory
+  should not be punished for an interface improvement — a digit moves the cursor
+  rather than confirming, so it composes with the arrows instead of being a
+  second, hidden way to answer. `j`/`k` move too.
+- **An empty moment selection is refused, not accepted.** Unticking everything and
+  pressing Enter says so instead of installing a review tool that reviews nothing
+  — the same invariant the typed prompt held by falling back.
+- **Three rungs of degradation, same default at each.** Arrow keys on a real
+  terminal; the typed number prompt when the terminal cannot do raw mode; the
+  default when there is no terminal at all or stdin ends. An interface improvement
+  must not become a new way for a setup to get stuck — CI, pipes and agent Bash
+  calls behave exactly as before.
+- **The terminal is restored on every exit,** including Ctrl+C, which restores
+  before exiting: raw mode left on outlives the process and makes the user's next
+  shell prompt unusable.
 
 **Setup is one command.** `verity init` and `/verity-setup` were two half-flows
 that overlapped — and the overlap was not harmless: init wired the Stop hook,
@@ -189,10 +300,11 @@ with one entry point.
 - **It asks the questions whose answers it acts on** — analysis intensity, when
   to review (on stop / before commit / before push), and cost & usage telemetry.
   On the terminal, before anything is wired to them.
-- **Then it hands off to Claude Code** to finish the half that needs a model:
-  reading the codebase and synthesizing the Standard (`/verity-setup`). If Claude
-  Code isn't installed, or you are already inside a session, it prints the one
-  command instead. `verity setup` is an alias for the same command.
+- **Then it finishes the Standard itself** (adopted from the service or derived
+  from the codebase — see above). Handing off to Claude Code for `/verity-setup`
+  survives only as the fallback when neither produced one, and if you are
+  already inside a session it prints the one command instead. `verity setup` is
+  an alias for the same command.
 - **`--yes` takes every recommended answer and asks nothing** (CI, scripts,
   agents) — including the GitHub login, whose unattended answer is skip, so the
   project stays local-only until you run `verity login`. `--no-setup` stops after
@@ -253,6 +365,77 @@ with one entry point.
   terminal (Ctrl+D, a pty that ends) falls back to the default instead of
   crashing init between copying the skills and wiring the hooks.
 
+### 🚪 A project that was never set up is left alone
+
+Every hook now asks the same question the same way. `verity analyze` used to run
+in a project that had never seen `verity init`, create `.verity/` there, and then —
+with no baseline to compare against — review nothing. It now stands down like the
+other hooks always have, so installing Verity no longer scatters state through
+directories you merely opened. On the first session in such a project, Claude is
+told once that the gate is off here and can offer to run `verity init`. Works
+correctly from linked git worktrees.
+
+### 🔭 The reviewer sees the neighborhood
+
+Measured on real commits: every change had at least one caller outside the
+diff (median five), and more than half had a test referencing a changed symbol.
+Verity sent none of it. Now it does — server-side, so it reached every
+installed CLI on deploy day:
+
+- **Context is what the agent actually read.** The files sent alongside your
+  change are the ones the agent opened this task — not the ten most recently
+  touched files in the repo, which is what it was.
+- **Call sites of changed symbols**, one line each — including callers of a
+  function whose body you edited but whose name isn't in the diff.
+- **At commit and push, full excerpts.** Contracts first (interfaces your change
+  implements), then tests, then callers, with real line numbers so the reviewer
+  can cite them.
+- **Findings stay anchored on your change.** A problem your edit causes at a
+  call site is reported against the file you changed. A pre-existing problem in
+  a file Verity only glanced at is out of scope and cannot block you.
+- **Every run says whether this fired**, and why not when it didn't (no tool, no
+  diff, no symbols, no sites, timeout) — in the evidence log and the guard's
+  coverage block. "Never fires" and "not deployed" can no longer look the same.
+- Fixed on the way: the Stop-hook review was running at half its intended file
+  budget (20 files, not 40), and context files reached the reviewer without the
+  line numbers the prompt promised.
+
+### ⚖️ The gate only blocks on evidence it has
+
+Raised from a customer's production runs: 134 of 655 runs blocked, and only a
+third of those blocks cited a line of production source. Two things decide
+whether a finding blocks — how bad *this instance* is, and what *kind* of rule
+it is — and both were owned by the wrong party.
+
+- **Severity is the reviewer's.** It used to be overwritten with the Standard's
+  per-pattern constant, so a finding the reviewer rated `low` (*"appears to be a
+  fixture value"*) blocked as `critical`. The reviewer's judgement now stands.
+- **Category comes from your Standard.** It used to be a label the model
+  re-picked every run — the same pattern landed as `security` on one run and
+  `quality` on the next, and at `high` that label *is* the block. It is now
+  derived from where the pattern sits in your Standard. Note the direction: for
+  patterns you declared under security, every high instance now blocks where the
+  coin flip previously let some through.
+- **A secrets finding needs a witness.** `no-hardcoded-secrets` blocks only when
+  a static tool saw it too, not on the model's word alone.
+- **`exclude_paths` in your Standard actually excludes now.** It was advertised
+  and read by nothing.
+
+### 🔧 Fixed
+
+- **An upgrade no longer removes the gates you chose.** `.verity/setup.json` only
+  exists from this release, so every project configured before it had no recorded
+  answer — including everyone who picked commit/push gates through the old
+  `/verity-setup`. The first upgraded `verity init` fell back to the shipped
+  default and reconciled those gates away, turning Stop back on. What you chose is
+  still legible in `.claude/settings.json`, so init reads it.
+- `verity doctor` names the artifact that is actually missing instead of telling
+  you to run a phase that will decline: with a Standard adopted and no analysis
+  config, `/verity-setup` would have answered "already configured".
+- The setup skill learned the same case — Standard present, analysis config
+  missing — and writes only the config rather than re-synthesizing the Standard.
+
+
 ## [0.31.3] — 2026-09-03
 
 **After a rebase, Verity reviewed the wrong code.** When a branch was rebased