@codacy/verity-cli 0.32.1-experimental.f2cf829 → 0.32.1

package/CHANGELOG.md

@@ -47,7 +47,10 @@ installs are untouched.
 - **A repository can no longer switch the gate off by shipping a file.**
   Ownership was claimed by `.verity/.plugin-active`, a file inside the project,
   and one naming any directory that happened to exist disabled every hook there.
-  An install Claude Code cannot vouch for is ignored.
+  An install Claude Code cannot vouch for is ignored — and "vouch" now means
+  *for this checkout*: the cache path a real install lives at is predictable, so
+  a marker naming a plugin installed for **somebody else's project** used to be
+  believed here.
 - **A plugin installed from a local marketplace directory is recognised.**
   Claude Code runs a marketplace served from a directory out of that directory
   while recording the cache copy it made, so the two paths disagreed and a live,

package/bin/verity.js

@@ -10509,7 +10509,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -12927,18 +12927,27 @@ function realpathOr(p) {
 function isWithin(want, dir) {
   return want === dir || want.startsWith(dir + import_node_path7.sep);
 }
+function entryAppliesHere(entry, here) {
+  const e = entry;
+  const scope2 = typeof e?.scope === "string" ? e.scope : "user";
+  if (scope2 === "user") return true;
+  const forProject = typeof e?.projectPath === "string" ? realpathOr(e.projectPath) : "";
+  return forProject === here;
+}
 function registrySays(pluginRoot) {
   const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
   const want = (0, import_node_path7.resolve)(pluginRoot);
+  const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
     const at = key.lastIndexOf("@");
     const source = at > 0 ? markets.get(key.slice(at + 1)) : void 0;
-    const claims = (Array.isArray(value) ? value : []).some((entry) => {
+    const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
+    const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
       return typeof installPath === "string" && (0, import_node_path7.resolve)(installPath) === want;
-    }) || source !== void 0 && isWithin(want, source);
+    }) || source !== void 0 && applicable.length > 0 && isWithin(want, source);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
       return (0, import_node_fs6.existsSync)(pluginRoot) ? "live" : "gone";
@@ -12998,11 +13007,7 @@ function registeredVerityPlugin() {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
       if (!installPath || !(0, import_node_fs6.existsSync)(installPath)) continue;
-      const scope2 = typeof e.scope === "string" ? e.scope : "user";
-      if (scope2 !== "user") {
-        const forProject = typeof e.projectPath === "string" ? realpathOr(e.projectPath) : "";
-        if (forProject !== here) continue;
-      }
+      if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
   }
@@ -20867,7 +20872,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.32.1-experimental.f2cf829" : "dev";
+    return true ? "0.32.1" : "dev";
   } catch {
     return "dev";
   }
@@ -24615,36 +24620,50 @@ async function runGuard(opts, globals) {
     process.exit(2);
   }
   resetIter(moment);
+  const notice = verdictNotice({
+    decision,
+    moment,
+    verb,
+    covLine,
+    covDetail,
+    link,
+    viewUrl,
+    narrative: response.assessment?.narrative ?? ""
+  });
+  emitAllowNotice(notice.user, notice.agent);
+}
+function verdictNotice(ctx) {
+  const { moment, verb, covLine, covDetail, link, viewUrl } = ctx;
+  const decision = ctx.decision ?? "(unrecognised)";
+  const report = viewUrl ? `
+Report: ${viewUrl}` : "";
   if (decision === "FAIL") {
-    const narrative = response.assessment?.narrative ?? "";
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
-      `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
-  } else if (decision === "WARN") {
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: WARN \u2014 proceeding (${covLine})${link}`,
-      `Verity ${moment} review: WARN (proceeding).
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
-  } else if (decision === "PASS") {
-    emitAllowNotice(
-      `\u2713 Verity ${moment}: PASS (${covLine})${link}`,
-      `Verity ${moment} review: PASS.
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
-  } else {
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: no verdict came back \u2014 ${verb === "commit" ? "committed" : "pushed"} WITHOUT a usable review (${covLine})${link}`,
-      `Verity ${moment}: the service answered with no recognisable gate decision (${decision}); the ${verb} was allowed, but nothing reviewed it. Treat this as unreviewed, not as a pass.
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
+    const narrative = ctx.narrative ?? "";
+    return {
+      user: `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
+      agent: `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
+${covDetail}${report}`
+    };
+  }
+  if (decision === "WARN") {
+    return {
+      user: `\u26A0 Verity ${moment}: WARN \u2014 proceeding (${covLine})${link}`,
+      agent: `Verity ${moment} review: WARN (proceeding).
+${covDetail}${report}`
+    };
+  }
+  if (decision === "PASS") {
+    return {
+      user: `\u2713 Verity ${moment}: PASS (${covLine})${link}`,
+      agent: `Verity ${moment} review: PASS.
+${covDetail}${report}`
+    };
   }
+  return {
+    user: `\u26A0 Verity ${moment}: no verdict came back \u2014 ${verb === "commit" ? "committed" : "pushed"} WITHOUT a usable review (${covLine})${link}`,
+    agent: `Verity ${moment}: the service answered with no recognisable gate decision (${decision}); the ${verb} was allowed, but nothing reviewed it. Treat this as unreviewed, not as a pass.
+${covDetail}${report}`
+  };
 }
 function writeBlockMessage(moment, response, covDetail) {
   const label2 = moment === "pre-commit" ? "pre-commit" : "pre-push";
@@ -26667,7 +26686,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.32.1-experimental.f2cf829" : "dev"
+          cli_version: true ? "0.32.1" : "dev"
         }
       });
     } catch (err) {
@@ -27347,8 +27366,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.32.1-experimental.f2cf829").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.1-experimental.f2cf829");
+program.name("verity").description("CLI for Verity quality gate service").version("0.32.1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.1");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.32.1-experimental.f2cf829",
+  "version": "0.32.1",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",