@codacy/verity-cli 0.32.3 → 0.32.4-experimental.e769665

package/CHANGELOG.md

@@ -64,6 +64,73 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.32.4] — 2026-09-11
+
+**Setup asks you how you want Verity to work.** Until now, installing the Claude
+Code plugin and running setup silently chose **stop-only** review for you — no
+commit gate, no push gate — because the CLI asks its questions on a terminal and
+a skill has none. You were never asked, and nothing said so.
+
+### 🎯 `/verity:init` — the one command after installing
+
+```
+/plugin install verity@verity
+/verity:init
+```
+
+It asks two questions in a single prompt — **when** Verity should review (after
+every turn, before commit, before push) and **how deeply** — then does the whole
+install with your answers. It says plainly that choosing stop-only means your
+commits and pushes are not gated.
+
+It also repairs what an install cannot: the plugin has no post-install hook, so
+only a command you run can remove a project's superseded `.claude/skills/verity-*`
+copies, stand down duplicate hooks, and derive the Standard.
+
+**`verity init` takes the answers directly too**, for a terminal or CI:
+
+```bash
+verity init --moments stop,pre-commit --intensity balanced
+```
+
+An unrecognised moment is refused rather than dropped — a typo cannot quietly
+remove a gate.
+
+**Signing in stays yours.** `verity login` is a device flow that waits on your
+browser, so the skill asks you to run it in your own terminal instead of hanging
+on a tool call.
+
+### 📋 `/verity:setup` keeps the job only a model can do
+
+Project-specific rules — *"every route under `api/` uses the auth middleware"* —
+which the CLI deliberately leaves empty. It no longer runs the install, because a
+skill that quietly answers the setup questions is the thing this release fixes.
+
+### 🔍 Small projects get static analysis again
+
+A service whose whole source was one file derived **no languages at all**, so no
+`.codacy/` config was written and static analysis ran nothing — reported as "No
+static-analysis tool matched this codebase", as though it were a fact about the
+project. The file-count floor exists to stop one stray `.py` turning on Ruff for
+a TypeScript repo; it now applies to a *minority* language rather than to whether
+the project has one.
+
+### 👀 Verity says what it is doing, where you can see it
+
+The notices added in the previous release went to the agent's channel rather than
+yours, so Verity said "this project is not set up" to Claude, silently. They now
+reach your screen. Verity also asks for `/verity:init` once per plugin version —
+returning after an update, quiet in between.
+
+### 🔧 Fixed
+
+- `git add … && git commit` was never reviewed: the hook runs before the command,
+  so the index it read had no staged files. It now works out what the command
+  will stage.
+- On a plugin-only machine, every skill's `verity …` command was `command not
+  found`; Verity now tells the agent how to reach the CLI it ships.
+- A verdict the CLI does not understand is reported as unreviewed, not as a pass.
+
 ## [0.32.3] — 2026-09-10
 
 **Three things the first five minutes got wrong.** All reported from the field

package/bin/verity.js

@@ -10509,7 +10509,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -12936,6 +12936,11 @@ function pluginCliInvocation() {
   if (verityOnPath()) return null;
   return `node ${JSON.stringify((0, import_node_path7.join)(root, "scripts", "verity.mjs"))}`;
 }
+function activePluginVersion() {
+  const fromEnv = process.env.VERITY_PLUGIN_VERSION;
+  if (fromEnv) return fromEnv;
+  return activePluginInstall()?.version ?? null;
+}
 var VERITY_MARKETPLACE = "verity";
 var VERITY_MARKETPLACE_REPO = "codacy/verity";
 function marketplaceConflict() {
@@ -13125,8 +13130,8 @@ async function resolveHookWiring() {
 // src/commands/hooks.ts
 var ALL_MOMENTS = ["stop", "pre-commit", "pre-push"];
 function parseMomentSelection(raw) {
-  const parts = raw.split(",").map((s) => s.trim()).filter(Boolean);
-  if (parts.length === 1 && parts[0].toLowerCase() === "none") return { moments: [] };
+  const parts = raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  if (parts.length === 1 && parts[0] === "none") return { moments: [] };
   if (parts.length === 0) {
     return { error: `--moments was empty. Pass one or more of ${ALL_MOMENTS.join(", ")} \u2014 or "none" to gate nothing.` };
   }
@@ -17080,6 +17085,7 @@ var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
   "shell",
   "dockerfile"
 ]);
+var ACCESSORY_LANGUAGES = /* @__PURE__ */ new Set(["shell", "dockerfile"]);
 var MIN_FILES_FOR_LANGUAGE = 3;
 var IGNORED_SEGMENTS = [
   "node_modules",
@@ -17329,7 +17335,12 @@ function detectProject(root = repoRoot()) {
     if (!lang) continue;
     languageCounts[lang] = (languageCounts[lang] ?? 0) + 1;
   }
-  const languages = Object.entries(languageCounts).filter(([lang, count]) => TOOLED_LANGUAGES.has(lang) && count >= MIN_FILES_FOR_LANGUAGE).sort((a, b) => b[1] - a[1]).map(([lang]) => lang);
+  const tooled = Object.entries(languageCounts).filter(([lang]) => TOOLED_LANGUAGES.has(lang)).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+  let languages = tooled.filter(([, count]) => count >= MIN_FILES_FOR_LANGUAGE).map(([lang]) => lang);
+  if (languages.length === 0) {
+    const primary = tooled.filter(([lang]) => !ACCESSORY_LANGUAGES.has(lang));
+    if (primary.length > 0) languages = [primary[0][0]];
+  }
   const dependencies = declaredDependencies(root, files);
   const existingToolConfigs = [];
   for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
@@ -20937,7 +20948,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.32.3" : "dev";
+    return true ? "0.32.4-experimental.e769665" : "dev";
   } catch {
     return "dev";
   }
@@ -24167,7 +24178,8 @@ var PROJECT_SKILL_NAMES = [
   "verity-learn",
   "verity-memory",
   "verity-insights",
-  "verity-reflect"
+  "verity-reflect",
+  "verity-init"
 ];
 var LEGACY_SKILL_NAMES = [
   "gate-setup",
@@ -24204,16 +24216,37 @@ function registerBaselineCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
+      let sessionId = opts.sessionId;
+      let source = opts.source;
+      if (!process.stdin.isTTY) {
+        const input = (await readStdin()).trim();
+        if (input) {
+          try {
+            const event = JSON.parse(input);
+            sessionId = sessionId ?? event.session_id;
+            source = source ?? event.source;
+          } catch {
+          }
+        }
+      }
       const cli = pluginCliInvocation();
       const cliLine = cli ? `Verity CLI: this machine has no \`verity\` on PATH \u2014 the plugin carries its own copy. When a Verity skill tells you to run \`verity <args>\`, run \`${cli} <args>\` instead. Everything else about the command is identical.` : null;
       if (!verityConfigured()) {
-        const how = isPluginInvocation() ? "Offer to run /verity:setup for the user." : "Offer to run `verity init` (or /verity-setup) for the user.";
+        const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
         ];
         if (cliLine) lines.push(cliLine);
         process.stdout.write(
           JSON.stringify({
+            // ⚠ BOTH FIELDS, AND THEY ARE NOT THE SAME AUDIENCE.
+            // `additionalContext` reaches the AGENT; `systemMessage` reaches
+            // the USER. Emitting only the first is what made this notice
+            // invisible: the agent was told, said nothing unprompted, and a
+            // user who restarted Claude Code specifically to see it saw an
+            // empty screen. guard.ts has carried that distinction in a comment
+            // since 0.30 — the same lesson, unapplied here until someone hit it.
+            systemMessage: isPluginInvocation() ? "Verity: this project is not set up yet, so nothing is being reviewed here. Run /verity:init to configure it." : "Verity: this project is not set up yet, so nothing is being reviewed here. Run `verity init` to configure it.",
             hookSpecificOutput: {
               hookEventName: "SessionStart",
               additionalContext: lines.join("\n")
@@ -24222,21 +24255,32 @@ function registerBaselineCommands(program2) {
         );
         process.exit(0);
       }
-      if (isPluginInvocation()) {
+      const realStart = source === void 0 || source === "startup" || source === "clear";
+      if (isPluginInvocation() && realStart) {
+        const installed2 = activePluginVersion();
+        const state = await readSetupState().catch(() => null);
+        const stale = staleProjectSkills();
         const notices = [];
         if (cliLine) notices.push(cliLine);
-        const stale = staleProjectSkills();
-        if (stale.length > 0) {
-          notices.push(
-            "Verity is already set up in this project, so /verity:setup is NOT being run \u2014 tell the user that, and that they can run it themselves if they want to change the Standard, the analysis tools or the review moments."
-          );
+        const neverRan = !state?.pluginSetup;
+        const ownsItsWiring = state?.wiring === "project";
+        const needsSetup = !ownsItsWiring && (neverRan || stale.length > 0) && !!installed2;
+        let userMsg = null;
+        if (needsSetup) {
+          userMsg = stale.length > 0 ? `Verity: the plugin is installed \u2014 run /verity:init to finish setting it up here (it will also clear ${stale.length} duplicate skills).` : "Verity: the plugin is installed \u2014 run /verity:init to finish setting it up here.";
           notices.push(
-            `This project also still carries ${stale.length} of its own Verity skills (${stale.slice(0, 3).join(", ")}${stale.length > 3 ? ", \u2026" : ""}), left from an npm install. The plugin supersedes them, which is why the slash-command list shows each one twice. Offer to run \`verity init --plugin-mode --yes\` to remove the duplicates; the plugin keeps providing the /verity:* set.`
+            "The Verity plugin is installed here but /verity:init has not been run for this project. Installing the plugin cannot repair a project on its own \u2014 Claude Code has no post-install hook \u2014 so tell the user to run /verity:init (they type it; it is not a skill you can invoke). It asks how they want reviews to run, then does the repair."
           );
+          if (stale.length > 0) {
+            notices.push(
+              `Specifically: this project still carries ${stale.length} of its own Verity skills (${stale.slice(0, 3).join(", ")}${stale.length > 3 ? ", \u2026" : ""}) from an npm install, which is why the slash-command list shows each one twice. /verity:init removes them.`
+            );
+          }
         }
         if (notices.length > 0) {
           process.stdout.write(
             JSON.stringify({
+              ...userMsg ? { systemMessage: userMsg } : {},
               hookSpecificOutput: {
                 hookEventName: "SessionStart",
                 additionalContext: notices.join("\n")
@@ -24245,19 +24289,6 @@ function registerBaselineCommands(program2) {
           );
         }
       }
-      let sessionId = opts.sessionId;
-      let source = opts.source;
-      if (!process.stdin.isTTY) {
-        const input = (await readStdin()).trim();
-        if (input) {
-          try {
-            const event = JSON.parse(input);
-            sessionId = sessionId ?? event.session_id;
-            source = source ?? event.source;
-          } catch {
-          }
-        }
-      }
       if (deferredToPlugin("baseline capture", sessionId ?? process.env.CLAUDE_SESSION_ID ?? null)) {
         process.exit(0);
       }
@@ -26296,7 +26327,8 @@ var SKILLS = [
   "verity-learn",
   "verity-memory",
   "verity-insights",
-  "verity-reflect"
+  "verity-reflect",
+  "verity-init"
 ];
 var INTENSITY_CHOICES = [
   { id: "lightweight", label: "lightweight", hint: "critical security only, fastest (~3s)" },
@@ -26317,21 +26349,23 @@ async function momentsFromInstalledHooks() {
   if (status.guardOn.includes("push")) wired.push("pre-push");
   return wired.length > 0 ? wired : DEFAULT_MOMENTS;
 }
-async function askSetupQuestions(defaultsOnly, previous) {
-  const intensityDefault = previous?.intensity ?? "balanced";
-  const momentsDefault = previous?.moments?.length ? previous.moments : await momentsFromInstalledHooks();
-  if (defaultsOnly) {
+async function askSetupQuestions(defaultsOnly, previous, given = {}) {
+  const intensityDefault = given.intensity ?? previous?.intensity ?? "balanced";
+  const momentsDefault = given.moments ?? (previous?.moments?.length ? previous.moments : await momentsFromInstalledHooks());
+  const askIntensity = !given.intensity;
+  const askMoments = !given.moments;
+  if (defaultsOnly || !askIntensity && !askMoments) {
     return { intensity: intensityDefault, moments: momentsDefault, telemetry: "not-asked" };
   }
   if (previous?.intensity || previous?.moments) {
     printInfo(`Current: ${intensityDefault} \xB7 ${momentsDefault.join(", ")} \u2014 press Enter to keep either.`);
   }
-  const intensity = await promptChoice(
+  const intensity = given.intensity ?? await promptChoice(
     "Analysis intensity \u2014 how deeply should Verity review?",
     INTENSITY_CHOICES,
     intensityDefault
   );
-  const moments = await promptMultiSelect(
+  const moments = given.moments ?? await promptMultiSelect(
     "When should Verity review your code?",
     MOMENT_CHOICES,
     momentsDefault
@@ -26671,7 +26705,13 @@ function registerInitCommand(program2) {
   ).option(
     "--no-plugin",
     "Ignore any Claude Code plugin here and wire this project's own skills and hooks"
-  ).option("--no-adopt", "Don't offer this repository's existing Standard from the service; synthesize a new one").action(async (opts) => {
+  ).option("--no-adopt", "Don't offer this repository's existing Standard from the service; synthesize a new one").option(
+    "--moments <list>",
+    'Answer the review-moments question without asking: stop,pre-commit,pre-push \u2014 or "none"'
+  ).option(
+    "--intensity <level>",
+    "Answer the analysis-intensity question without asking: lightweight | balanced | thorough"
+  ).action(async (opts) => {
     const force = opts.force ?? false;
     const wantsHandoff = opts.setup !== false;
     const wantsAdopt = opts.adopt !== false;
@@ -26739,7 +26779,31 @@ function registerInitCommand(program2) {
     }
     step(defaultsOnly ? "Setup answers (defaults)" : "Your setup answers");
     const previous = await readSetupState();
-    const answers = await askSetupQuestions(defaultsOnly, previous);
+    let givenMoments;
+    if (opts.moments != null) {
+      const parsed = parseMomentSelection(String(opts.moments));
+      if ("error" in parsed) {
+        printError(parsed.error);
+        process.exit(1);
+      }
+      givenMoments = parsed.moments;
+    }
+    let givenIntensity;
+    if (opts.intensity != null) {
+      const want = String(opts.intensity).trim().toLowerCase();
+      const match = INTENSITY_CHOICES.find((c) => c.id === want);
+      if (!match) {
+        printError(
+          `--intensity: unrecognised "${opts.intensity}". Valid: ${INTENSITY_CHOICES.map((c) => c.id).join(", ")}.`
+        );
+        process.exit(1);
+      }
+      givenIntensity = match.id;
+    }
+    const answers = await askSetupQuestions(defaultsOnly, previous, {
+      intensity: givenIntensity,
+      moments: givenMoments
+    });
     const { intensity, moments } = answers;
     if (defaultsOnly) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
@@ -26754,7 +26818,7 @@ function registerInitCommand(program2) {
       ...moments.includes("pre-push") ? ["push"] : []
     ];
     const existingMoments = readProjectConfig();
-    const keepExisting = defaultsOnly && existingMoments.git_moments_source === "user";
+    const keepExisting = !givenMoments && defaultsOnly && existingMoments.git_moments_source === "user";
     if (keepExisting) {
       printInfo(
         `  Keeping the git moments you set: ${existingMoments.git_moments.join(", ") || "none"} (this run asked no questions, so it does not overrule them).`
@@ -26763,10 +26827,15 @@ function registerInitCommand(program2) {
       writeProjectConfig({ git_moments: gitMoments, git_moments_source: "init" });
     }
     const effectiveMoments = keepExisting ? existingMoments.git_moments : gitMoments;
+    const effectiveMomentIds = [
+      ...moments.includes("stop") ? ["stop"] : [],
+      ...effectiveMoments.includes("commit") ? ["pre-commit"] : [],
+      ...effectiveMoments.includes("push") ? ["pre-push"] : []
+    ];
     if (pluginMode) {
-      await adoptPluginWiring(effectiveMoments, moments);
+      await adoptPluginWiring(effectiveMoments, effectiveMomentIds);
     } else {
-      await reconcileOwnWiring(moments);
+      await reconcileOwnWiring(effectiveMomentIds);
     }
     console.log("");
     step("Sign in to Verity (optional)");
@@ -26832,11 +26901,14 @@ function registerInitCommand(program2) {
     try {
       await writeSetupState({
         intensity,
-        moments,
+        // The effective answer, not this run's: the next interactive init
+        // pre-fills from this record, so a stale "stop" here offers "press
+        // Enter to keep" over a commit gate that Enter would remove.
+        moments: effectiveMomentIds,
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.32.3" : "dev"
+          cli_version: true ? "0.32.4-experimental.e769665" : "dev"
         }
       });
     } catch (err) {
@@ -26863,6 +26935,17 @@ function registerInitCommand(program2) {
     console.log(`  Intensity: ${intensity}    Moments: ${moments.join(", ") || "none"}`);
     console.log("");
     if (haveStandard) {
+      if (pluginMode) {
+        const pluginVersion = activePluginVersion();
+        if (pluginVersion) {
+          await writeSetupState({
+            pluginSetup: { version: pluginVersion, completed_at: (/* @__PURE__ */ new Date()).toISOString() },
+            wiring: void 0
+          });
+        }
+      } else if (opts.plugin === false) {
+        await writeSetupState({ wiring: "project" });
+      }
       printInfo("Setup complete \u2014 the gate is live on your next Claude Code session.");
       printInfo('  Add project-specific rules any time: edit .verity/standard.yaml, then "verity standard push".');
       printInfo("  Or have a model propose them: /verity-setup --force in Claude Code.");
@@ -27506,8 +27589,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.32.3").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.3");
+program.name("verity").description("CLI for Verity quality gate service").version("0.32.4-experimental.e769665").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.4-experimental.e769665");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/data/skills/verity-init/SKILL.md

@@ -0,0 +1,113 @@
+---
+description: >-
+  Set Verity up in this project: ask the two setup questions, run the deterministic
+  install, and repair a project the Claude Code plugin has just been added to. Use
+  right after installing the Verity plugin, or when Verity says this project is not
+  set up.
+disable-model-invocation: true
+---
+# /verity-init — set Verity up in this project
+
+You are running the setup a plugin install cannot do for itself.
+
+**Why this skill exists.** Claude Code has no post-install hook and a plugin
+cannot invoke a skill, so installing Verity repairs nothing: it cannot remove a
+project's superseded skills, stand down duplicate hooks, or derive a Standard.
+All of that needs a command someone runs — this one.
+
+**`verity init` prompts on a terminal, and you are not one.** That is the whole
+problem this skill solves. Left to itself the CLI would take `--yes` and silently
+choose **stop-only** review — no pre-commit gate, no pre-push gate — for every
+plugin user, which is exactly the outcome we treat as a serious bug when it
+happens by accident. So **you** ask, in the session, where the user actually is.
+
+---
+
+## Step 1: Ask both questions in ONE prompt
+
+Use `AskUserQuestion` with **both** questions in a single call. Do not ask them
+one at a time, and do not ask them in prose — this is the only interruption the
+setup gets, so spend it once.
+
+**Question 1 — "When should Verity review your code?"** (multi-select)
+
+| Option | Description |
+|---|---|
+| `After every turn (recommended)` | Reviews what the agent just wrote, as you work. Fast feedback, never blocks a commit. |
+| `Before commit` | Reviews the staged diff and blocks the commit on a failing review. |
+| `Before push / PR` | Reviews the commits about to be pushed and blocks on a failing review. |
+
+Pre-select **After every turn**. Say plainly in the question text that choosing
+only the first means **git commits and pushes are not gated**.
+
+**Question 2 — "How deeply should Verity review?"** (single-select)
+
+| Option | Description |
+|---|---|
+| `Balanced (recommended)` | Security + quality, about 8s per review. |
+| `Lightweight` | Critical security only, about 3s. |
+| `Thorough` | All tools, all rules, about 15s. |
+
+## Step 2: Run the install with those answers
+
+Map the answers to flags and run it — one command, no prompts, nothing silently
+defaulted:
+
+```bash
+verity init --yes --no-setup --moments <stop[,pre-commit][,pre-push]> --intensity <balanced|lightweight|thorough>
+```
+
+`--moments none` is the deliberate way to gate nothing; an unrecognised value is
+refused rather than dropped, so a typo cannot quietly remove a gate.
+
+This is idempotent and does the whole job: removes the project's own
+`.claude/skills/verity-*` copies that the plugin supersedes (they are why the
+slash-command list shows every skill twice), stands down duplicate
+`.claude/settings.json` hooks so a turn is reviewed once, derives the Standard
+and the analysis config if there is none, heals a stale one, and records the
+plugin version — which is what stops Verity asking at every session start.
+
+Report what it removed. Those skill directories are usually committed, so the
+deletions will show in `git status` and are the user's to commit.
+
+## Step 3: Tell the user to sign in — in their own terminal
+
+**Do not run `verity login` yourself.** It is a GitHub device flow: it prints a
+code, waits for the user to approve it in a browser, and blocks until they do.
+Started from a tool call it just hangs, and the user never sees the code.
+
+Say this, and stop:
+
+> Verity is set up. One more step, in your own terminal — not here:
+>
+> ```
+> verity login
+> ```
+>
+> It prints a code and a link; approve it in your browser. One login covers every
+> repository you can write to, for 90 days. Without it the gate still reviews
+> your code — it just records nothing, so there is no history, no cloud memory
+> and no dashboard.
+
+If `verity status` already reports an account, skip this step and say so.
+
+## Step 4: Offer the part a lookup cannot produce
+
+The Standard `init` derives covers the research-backed patterns for the
+languages and tools it found. What it deliberately leaves empty is
+`custom_patterns` — rules like *"every route under `api/` uses the auth
+middleware"*, which need something to read the code for intent.
+
+Offer `/verity-setup` for that, and say it is optional: the gate is already
+running.
+
+---
+
+## What NOT to do here
+
+- **Do not wire hooks or edit `.gitignore` yourself.** `verity init` owns that.
+  Doing it here is how the two flows drifted apart before — the skill reconciled
+  hooks init had just installed and silently removed them.
+- **Do not synthesize a Standard by hand.** The CLI derives it in about two
+  seconds from the same catalogue you would be reading.
+- **Do not run `verity login`.** Step 3.

package/data/skills/verity-setup/SKILL.md

@@ -48,20 +48,29 @@ verity doctor --json
 ```
 
 One read gives you prerequisites, which phase is done, the user's recorded
-answers, the hook wiring, and a `next` list. Branch on it:
+answers, the hook wiring, and a `next` list.
 
-- **`phases.init.done` is false** → `verity init` has not run in this project.
-  Run it (it is idempotent, and it is what installed this skill):
+### 1a. If the project is not set up at all, that is init's job, not yours
 
-  ```bash
-  verity init --yes --no-setup
-  ```
+⚠ **If `phases.init.done` is false, stop and say so — naming the command that
+exists on THIS install:**
+
+- **`hooks.source` is `"plugin"`** → `/verity-init`, which the plugin provides.
+- **otherwise (npm install)** → `verity init`, run in a terminal. Do **not** send
+  an npm user to `/verity-init`: it is a plugin skill, and on that path it does
+  not exist. A remedy that names a command the user does not have is worse than
+  no remedy — they cannot tell whether they are stuck or broken.
+
+**Do not run `verity init` from this skill.** That flow asks the user two
+questions before it installs anything, and running it here takes the answers
+away from them — silently choosing stop-only review, which means no commit or
+push gate. One skill owns setup, and it is not this one.
+
+Branch on the same `doctor` output:
 
-  `--yes` takes the recommended answer for every question — use it only because
-  you are already inside a Claude Code session and cannot ask on init's terminal.
-  Tell the user which defaults were taken and that `verity init` (run by hand in a
-  terminal) is where those choices are made. `--no-setup` stops init from trying
-  to launch a second Claude Code session on top of this one.
+- **`phases.init.done` is false** → setup has not run here. Point the user at the
+  command their install actually has (see 1a) and stop. That is the one place the
+  setup questions get asked.
 - **`blocked` is true** → a required prerequisite is missing. Show the
   `prerequisites[].remedy` lines and stop; nothing below can work.
 - **`artifacts.standard` is true and `phases.setup.done` is true** → the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.32.3",
+  "version": "0.32.4-experimental.e769665",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",