@codacy/verity-cli 0.32.1-experimental.f2cf829 → 0.32.2-experimental.8843567

package/CHANGELOG.md

@@ -10,7 +10,7 @@ All notable changes to Verity are documented here. This project follows
      into its own heading when it is ready to be announced. -->
 
 **Verity ships as a Claude Code plugin.** `/plugin marketplace add codacy/verity`
-then `/plugin install verity@codacy` gives a working gate with nothing else to
+then `/plugin install verity@verity` gives a working gate with nothing else to
 install — the plugin carries the CLI as a pinned dependency, and Claude Code
 installs and updates it for you.
 
@@ -47,7 +47,10 @@ installs are untouched.
 - **A repository can no longer switch the gate off by shipping a file.**
   Ownership was claimed by `.verity/.plugin-active`, a file inside the project,
   and one naming any directory that happened to exist disabled every hook there.
-  An install Claude Code cannot vouch for is ignored.
+  An install Claude Code cannot vouch for is ignored — and "vouch" now means
+  *for this checkout*: the cache path a real install lives at is predictable, so
+  a marker naming a plugin installed for **somebody else's project** used to be
+  believed here.
 - **A plugin installed from a local marketplace directory is recognised.**
   Claude Code runs a marketplace served from a directory out of that directory
   while recording the cache copy it made, so the two paths disagreed and a live,
@@ -61,6 +64,40 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.32.2] — 2026-09-10
+
+**A patch for one bug, which stopped people before Verity was installed at all.**
+
+### 🔌 The plugin marketplace is named `verity`
+
+`/plugin install verity@codacy` is now **`/plugin install verity@verity`**. The
+`marketplace add` line is unchanged — `codacy/verity` is the repository, not the
+name.
+
+Marketplace names are a flat, global namespace on your machine: no per-org
+scoping, so two repositories that declare the same `name` compete for one slot.
+Verity published as `codacy`, which `codacy/codacy-skills` already had — so
+anyone who used that marketplace got
+
+```
+Cannot add marketplace "codacy": its network source differs from the one
+declared for it in settings …
+```
+
+and could never install Verity. The error names neither the file nor the fix.
+
+**If you installed before this release**, the old plugin still runs but will
+never update again:
+
+```
+/plugin uninstall verity@codacy
+/plugin marketplace add codacy/verity
+/plugin install verity@verity
+```
+
+`verity doctor` now detects both cases — a taken marketplace name, and a plugin
+installed from the old one — and prints the file to edit and the commands to
+run, so the next collision is a diagnosis rather than a dead end.
 
 ## [0.32.1] — 2026-09-09
 

package/bin/verity.js

@@ -12917,6 +12917,52 @@ function marketplaceLocations() {
   }
   return out;
 }
+var VERITY_MARKETPLACE = "verity";
+var VERITY_MARKETPLACE_REPO = "codacy/verity";
+function marketplaceConflict() {
+  const wanted = VERITY_MARKETPLACE;
+  for (const file of ["settings.json", "settings.local.json"]) {
+    const path = (0, import_node_path7.join)(claudeConfigDir(), file);
+    const declared = readJsonFile(path)?.extraKnownMarketplaces ?? null;
+    const entry2 = declared && typeof declared === "object" ? declared[wanted] : void 0;
+    if (entry2 && typeof entry2 === "object") {
+      const src = entry2.source;
+      if (!pointsAtVerity(src)) {
+        return { name: wanted, declaredAs: describeSource(src), settingsFile: path };
+      }
+    }
+  }
+  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const entry = known?.[wanted];
+  if (entry && typeof entry === "object" && !pointsAtVerity(entry.source)) {
+    return { name: wanted, declaredAs: describeSource(entry.source) };
+  }
+  return null;
+}
+function pointsAtVerity(src) {
+  if (!src || typeof src !== "object") return false;
+  const repo = typeof src.repo === "string" ? src.repo : "";
+  if (repo.toLowerCase() === VERITY_MARKETPLACE_REPO) return true;
+  const url = typeof src.url === "string" ? src.url : "";
+  return /github\.com[/:]codacy\/verity(\.git)?\/?$/i.test(url);
+}
+function describeSource(src) {
+  if (!src || typeof src !== "object") return "an unrecognised source";
+  const kind = typeof src.source === "string" ? src.source : "unknown";
+  const target = typeof src.repo === "string" && src.repo || typeof src.url === "string" && src.url || typeof src.path === "string" && src.path || "";
+  return target ? `${kind} \u2192 ${target}` : kind;
+}
+function legacyMarketplaceInstall() {
+  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  if (!plugins || typeof plugins !== "object") return null;
+  for (const key of Object.keys(plugins)) {
+    const at = key.lastIndexOf("@");
+    if (at <= 0) continue;
+    if (key.slice(0, at) !== "verity") continue;
+    if (key.slice(at + 1) !== VERITY_MARKETPLACE) return key;
+  }
+  return null;
+}
 function realpathOr(p) {
   try {
     return import_node_fs6.realpathSync.native(p);
@@ -12927,18 +12973,27 @@ function realpathOr(p) {
 function isWithin(want, dir) {
   return want === dir || want.startsWith(dir + import_node_path7.sep);
 }
+function entryAppliesHere(entry, here) {
+  const e = entry;
+  const scope2 = typeof e?.scope === "string" ? e.scope : "user";
+  if (scope2 === "user") return true;
+  const forProject = typeof e?.projectPath === "string" ? realpathOr(e.projectPath) : "";
+  return forProject === here;
+}
 function registrySays(pluginRoot) {
   const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
   const want = (0, import_node_path7.resolve)(pluginRoot);
+  const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
     const at = key.lastIndexOf("@");
     const source = at > 0 ? markets.get(key.slice(at + 1)) : void 0;
-    const claims = (Array.isArray(value) ? value : []).some((entry) => {
+    const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
+    const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
       return typeof installPath === "string" && (0, import_node_path7.resolve)(installPath) === want;
-    }) || source !== void 0 && isWithin(want, source);
+    }) || source !== void 0 && applicable.length > 0 && isWithin(want, source);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
       return (0, import_node_fs6.existsSync)(pluginRoot) ? "live" : "gone";
@@ -12998,11 +13053,7 @@ function registeredVerityPlugin() {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
       if (!installPath || !(0, import_node_fs6.existsSync)(installPath)) continue;
-      const scope2 = typeof e.scope === "string" ? e.scope : "user";
-      if (scope2 !== "user") {
-        const forProject = typeof e.projectPath === "string" ? realpathOr(e.projectPath) : "";
-        if (forProject !== here) continue;
-      }
+      if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
   }
@@ -20867,7 +20918,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.32.1-experimental.f2cf829" : "dev";
+    return true ? "0.32.2-experimental.8843567" : "dev";
   } catch {
     return "dev";
   }
@@ -24615,36 +24666,50 @@ async function runGuard(opts, globals) {
     process.exit(2);
   }
   resetIter(moment);
+  const notice = verdictNotice({
+    decision,
+    moment,
+    verb,
+    covLine,
+    covDetail,
+    link,
+    viewUrl,
+    narrative: response.assessment?.narrative ?? ""
+  });
+  emitAllowNotice(notice.user, notice.agent);
+}
+function verdictNotice(ctx) {
+  const { moment, verb, covLine, covDetail, link, viewUrl } = ctx;
+  const decision = ctx.decision ?? "(unrecognised)";
+  const report = viewUrl ? `
+Report: ${viewUrl}` : "";
   if (decision === "FAIL") {
-    const narrative = response.assessment?.narrative ?? "";
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
-      `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
-  } else if (decision === "WARN") {
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: WARN \u2014 proceeding (${covLine})${link}`,
-      `Verity ${moment} review: WARN (proceeding).
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
-  } else if (decision === "PASS") {
-    emitAllowNotice(
-      `\u2713 Verity ${moment}: PASS (${covLine})${link}`,
-      `Verity ${moment} review: PASS.
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
-  } else {
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: no verdict came back \u2014 ${verb === "commit" ? "committed" : "pushed"} WITHOUT a usable review (${covLine})${link}`,
-      `Verity ${moment}: the service answered with no recognisable gate decision (${decision}); the ${verb} was allowed, but nothing reviewed it. Treat this as unreviewed, not as a pass.
-${covDetail}${viewUrl ? `
-Report: ${viewUrl}` : ""}`
-    );
+    const narrative = ctx.narrative ?? "";
+    return {
+      user: `\u26A0 Verity ${moment}: the ${verb} may not match its stated purpose \u2014 proceeding (${covLine})${link}`,
+      agent: `Verity ${moment}: intent-alignment WARNING (not blocked).${narrative ? " " + narrative : ""}
+${covDetail}${report}`
+    };
+  }
+  if (decision === "WARN") {
+    return {
+      user: `\u26A0 Verity ${moment}: WARN \u2014 proceeding (${covLine})${link}`,
+      agent: `Verity ${moment} review: WARN (proceeding).
+${covDetail}${report}`
+    };
   }
+  if (decision === "PASS") {
+    return {
+      user: `\u2713 Verity ${moment}: PASS (${covLine})${link}`,
+      agent: `Verity ${moment} review: PASS.
+${covDetail}${report}`
+    };
+  }
+  return {
+    user: `\u26A0 Verity ${moment}: no verdict came back \u2014 ${verb === "commit" ? "committed" : "pushed"} WITHOUT a usable review (${covLine})${link}`,
+    agent: `Verity ${moment}: the service answered with no recognisable gate decision (${decision}); the ${verb} was allowed, but nothing reviewed it. Treat this as unreviewed, not as a pass.
+${covDetail}${report}`
+  };
 }
 function writeBlockMessage(moment, response, covDetail) {
   const label2 = moment === "pre-commit" ? "pre-commit" : "pre-push";
@@ -25265,6 +25330,18 @@ async function buildReport() {
   if (state?.telemetry === "deferred") {
     next.push('Telemetry was requested but needs a token \u2014 run "verity login", then "verity telemetry install".');
   }
+  const conflict = marketplaceConflict();
+  if (conflict) {
+    next.push(
+      `The marketplace name "${conflict.name}" is already taken on this machine by ${conflict.declaredAs}, so "/plugin marketplace add codacy/verity" will be refused. ` + (conflict.settingsFile ? `Remove the "${conflict.name}" entry from extraKnownMarketplaces in ${conflict.settingsFile} ` : `Run "/plugin marketplace remove ${conflict.name}" `) + "and restart Claude Code, then add it again."
+    );
+  }
+  const legacy = legacyMarketplaceInstall();
+  if (legacy) {
+    next.push(
+      `The Verity plugin is installed as "${legacy}", from a marketplace name Verity no longer publishes under \u2014 it still runs, but it will never see another update. Run "/plugin uninstall ${legacy}", then "/plugin marketplace add codacy/verity" and "/plugin install verity@verity".`
+    );
+  }
   return {
     prerequisites: prereqs.checks,
     blocked: prereqs.blocked,
@@ -26667,7 +26744,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.32.1-experimental.f2cf829" : "dev"
+          cli_version: true ? "0.32.2-experimental.8843567" : "dev"
         }
       });
     } catch (err) {
@@ -27347,8 +27424,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.32.1-experimental.f2cf829").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.1-experimental.f2cf829");
+program.name("verity").description("CLI for Verity quality gate service").version("0.32.2-experimental.8843567").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.2-experimental.8843567");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.32.1-experimental.f2cf829",
+  "version": "0.32.2-experimental.8843567",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",