@codacy/verity-cli 0.32.4 → 0.32.5

package/CHANGELOG.md

@@ -64,6 +64,22 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.32.5] — 2026-09-11
+
+**`/verity:init` fixes, reported from its first runs.**
+
+- **An old global `verity` can no longer derail setup.** If the `verity` on your
+  PATH is a different version from the plugin's, Verity's skills now use the
+  plugin's own copy — the one its hooks run — so your setup answers always apply.
+  Verity also tells you when the session starts, before `/verity:init` asks
+  anything, with the `npm install -g` command that brings the global one in line.
+- **"After every turn" says what it is.** With the plugin, the after-every-turn
+  review can't be turned off yet. The setup question now says so instead of
+  calling it "recommended".
+- **The update instructions name commands that exist.** Claude Code has no
+  `/plugin update`. The README now explains auto-update, and `/reload-plugins`
+  picks up a new version without restarting.
+
 ## [0.32.4] — 2026-09-11
 
 **Setup asks you how you want Verity to work.** Until now, installing the Claude

package/bin/verity.js

@@ -6849,6 +6849,7 @@ var require_resolve_props = __commonJS({
               hasSpace = false;
               break;
             }
+          // else fallthrough
           default:
             onError(token, "UNEXPECTED_TOKEN", `Unexpected ${token.type} token`);
             atNewline = false;
@@ -7557,6 +7558,7 @@ var require_resolve_block_scalar = __commonJS({
         switch (token.type) {
           case "space":
             hasSpace = true;
+          // fallthrough
           case "newline":
             length += token.source.length;
             break;
@@ -7572,6 +7574,7 @@ var require_resolve_block_scalar = __commonJS({
             onError(token, "UNEXPECTED_TOKEN", token.message);
             length += token.source.length;
             break;
+          /* istanbul ignore next should not happen */
           default: {
             const message = `Unexpected token in block scalar header: ${token.type}`;
             onError(token, "UNEXPECTED_TOKEN", message);
@@ -7621,6 +7624,7 @@ var require_resolve_flow_scalar = __commonJS({
           _type = Scalar.Scalar.QUOTE_DOUBLE;
           value = doubleQuotedValue(source, _onError);
           break;
+        /* istanbul ignore next should not happen */
         default:
           onError(scalar, "UNEXPECTED_TOKEN", `Expected a flow scalar value, but found: ${type}`);
           return {
@@ -7642,6 +7646,7 @@ var require_resolve_flow_scalar = __commonJS({
     function plainValue(source, onError) {
       let badChar = "";
       switch (source[0]) {
+        /* istanbul ignore next should not happen */
         case "	":
           badChar = "a tab character";
           break;
@@ -8905,6 +8910,7 @@ var require_lexer = __commonJS({
         switch (line[n]) {
           case "#":
             yield* this.pushCount(line.length - n);
+          // fallthrough
           case void 0:
             yield* this.pushNewline();
             return yield* this.parseLineStart();
@@ -9000,6 +9006,7 @@ var require_lexer = __commonJS({
               return "flow";
             }
           }
+          // fallthrough
           default:
             this.flowKey = false;
             return yield* this.parsePlainScalar();
@@ -9077,6 +9084,7 @@ var require_lexer = __commonJS({
               if (next === "\n")
                 break;
             }
+            // fallthrough
             default:
               break loop;
           }
@@ -9194,7 +9202,9 @@ var require_lexer = __commonJS({
           case "&":
             return (yield* this.pushUntil(isNotAnchorChar)) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
           case "-":
+          // this is an error
           case "?":
+          // this is an error outside flow collections
           case ":": {
             const inFlow = this.flowLevel > 0;
             const ch1 = this.charAt(1);
@@ -9343,6 +9353,7 @@ var require_parser = __commonJS({
         }
         case "block-seq":
           return parent.items[parent.items.length - 1].start;
+        /* istanbul ignore next should not happen */
         default:
           return [];
       }
@@ -9576,6 +9587,7 @@ var require_parser = __commonJS({
                 Object.assign(it, { key: token, sep: [] });
               return;
             }
+            /* istanbul ignore next should not happen */
             default:
               yield* this.pop();
               yield* this.pop(token);
@@ -9697,6 +9709,7 @@ var require_parser = __commonJS({
             }
             yield* this.pop();
             break;
+          /* istanbul ignore next should not happen */
           default:
             yield* this.pop();
             yield* this.step();
@@ -10142,6 +10155,7 @@ var require_parser = __commonJS({
             break;
           case "newline":
             this.onKeyLine = false;
+          // fallthrough
           case "space":
           case "comment":
           default:
@@ -11612,6 +11626,7 @@ async function githubDeviceFlow() {
       switch (data.error) {
         case "authorization_pending":
           break;
+        // user hasn't approved yet
         case "slow_down":
           interval += 5;
           break;
@@ -12917,25 +12932,48 @@ function marketplaceLocations() {
   }
   return out;
 }
-function verityOnPath() {
+function verityPathEntry() {
   const path = process.env.PATH;
-  if (!path) return false;
+  if (!path) return null;
   for (const dir of path.split(import_node_path7.delimiter)) {
     if (!dir) continue;
+    const candidate = (0, import_node_path7.join)(dir, "verity");
     try {
-      (0, import_node_fs6.accessSync)((0, import_node_path7.join)(dir, "verity"), import_node_fs6.constants.X_OK);
-      return true;
+      (0, import_node_fs6.accessSync)(candidate, import_node_fs6.constants.X_OK);
+      return candidate;
     } catch {
     }
   }
-  return false;
+  return null;
+}
+function verityOnPath() {
+  return verityPathEntry() !== null;
+}
+function globalVerityVersion() {
+  const entry = verityPathEntry();
+  if (!entry) return null;
+  try {
+    const pkg = readJsonFile((0, import_node_path7.join)((0, import_node_path7.dirname)((0, import_node_fs6.realpathSync)(entry)), "..", "package.json"));
+    if (pkg?.name !== "@codacy/verity-cli" || typeof pkg.version !== "string") return null;
+    return pkg.version;
+  } catch {
+    return null;
+  }
 }
 function pluginCliInvocation() {
   const root = process.env.VERITY_PLUGIN_ROOT;
   if (!root) return null;
-  if (verityOnPath()) return null;
+  const onPath = globalVerityVersion();
+  if (onPath !== null && onPath === activePluginVersion()) return null;
   return `node ${JSON.stringify((0, import_node_path7.join)(root, "scripts", "verity.mjs"))}`;
 }
+function cliVersionSkew() {
+  if (!process.env.VERITY_PLUGIN_ROOT) return null;
+  const onPath = globalVerityVersion();
+  const plugin = activePluginVersion();
+  if (!onPath || !plugin || onPath === plugin) return null;
+  return { global: onPath, plugin };
+}
 function activePluginVersion() {
   const fromEnv = process.env.VERITY_PLUGIN_VERSION;
   if (fromEnv) return fromEnv;
@@ -20596,6 +20634,15 @@ function buildSummary(lines) {
         }
         case "Agent":
         case "Task":
+        // Claude Code's actual subagent tool name (legacy 'Agent' kept)
+        // ⚠ ORCHESTRATION IS DELEGATION. `Workflow` fans work out to many
+        // subagents; `SendMessage` hands it to an existing one.
+        //
+        // Two consumers read this counter and both fail closed without it: a
+        // delegated turn reads as a plain chat reply, so `didAgentInvestigate`
+        // downgrades a plan-mode review to `skip`, and `hasNonEditAuthorship`
+        // loses the rescue that stops delegated code exiting via
+        // `zero-increment` with its PASS intact. See DECISIONS.md D21.
         case "Workflow":
         case "SendMessage":
           subagents++;
@@ -20948,7 +20995,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.32.4" : "dev";
+    return true ? "0.32.5" : "dev";
   } catch {
     return "dev";
   }
@@ -24216,27 +24263,30 @@ function registerBaselineCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      let sessionId = opts.sessionId;
-      let source = opts.source;
+      let sessionId = validSessionId(opts.sessionId);
+      let source = hookSource(opts.source);
       if (!process.stdin.isTTY) {
         const input = (await readStdin()).trim();
         if (input) {
-          try {
-            const event = JSON.parse(input);
-            sessionId = sessionId ?? event.session_id;
-            source = source ?? event.source;
-          } catch {
-          }
+          const event = parseHookEvent(input);
+          if (opts.sessionId === void 0) sessionId = event.sessionId;
+          if (opts.source === void 0) source = event.source;
         }
       }
+      const session = sessionId ?? validSessionId(process.env.CLAUDE_SESSION_ID);
       const cli = pluginCliInvocation();
-      const cliLine = cli ? `Verity CLI: this machine has no \`verity\` on PATH \u2014 the plugin carries its own copy. When a Verity skill tells you to run \`verity <args>\`, run \`${cli} <args>\` instead. Everything else about the command is identical.` : null;
+      const skew = cliVersionSkew();
+      const why = skew ? `the \`verity\` on PATH is ${skew.global} but this plugin runs ${skew.plugin}, so it is not the CLI the hooks use` : verityOnPath() ? "the `verity` on PATH is a separate install whose version could not be read" : "this machine has no `verity` on PATH \u2014 the plugin carries its own copy";
+      const cliLine = cli ? `Verity CLI: ${why}. When a Verity skill tells you to run \`verity <args>\`, run \`${cli} <args>\` instead. Everything else about the command is identical.` : null;
+      const skewMsg = skew ? `Verity: your global \`verity\` CLI is ${skew.global} but the plugin runs ${skew.plugin}. Update it before using \`verity\` in a terminal: npm install -g @codacy/verity-cli@${skew.plugin}` : null;
+      const skewNote = skew ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the plugin runs ${skew.plugin}, and \`npm install -g @codacy/verity-cli@${skew.plugin}\` fixes it. Until they have, do not send them to run \`verity login\` in a terminal: that runs the global one, which can sign this machine in to a different server.` : null;
       if (!verityConfigured()) {
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
         ];
         if (cliLine) lines.push(cliLine);
+        if (skewNote) lines.unshift(skewNote);
         process.stdout.write(
           JSON.stringify({
             // ⚠ BOTH FIELDS, AND THEY ARE NOT THE SAME AUDIENCE.
@@ -24246,7 +24296,11 @@ function registerBaselineCommands(program2) {
             // user who restarted Claude Code specifically to see it saw an
             // empty screen. guard.ts has carried that distinction in a comment
             // since 0.30 — the same lesson, unapplied here until someone hit it.
-            systemMessage: isPluginInvocation() ? "Verity: this project is not set up yet, so nothing is being reviewed here. Run /verity:init to configure it." : "Verity: this project is not set up yet, so nothing is being reviewed here. Run `verity init` to configure it.",
+            // The mismatch first: it decides whether the setup that follows can work.
+            systemMessage: [
+              skewMsg,
+              isPluginInvocation() ? "Verity: this project is not set up yet, so nothing is being reviewed here. Run /verity:init to configure it." : "Verity: this project is not set up yet, so nothing is being reviewed here. Run `verity init` to configure it."
+            ].filter(Boolean).join("\n"),
             hookSpecificOutput: {
               hookEventName: "SessionStart",
               additionalContext: lines.join("\n")
@@ -24261,6 +24315,7 @@ function registerBaselineCommands(program2) {
         const state = await readSetupState().catch(() => null);
         const stale = staleProjectSkills();
         const notices = [];
+        if (skewNote) notices.push(skewNote);
         if (cliLine) notices.push(cliLine);
         const neverRan = !state?.pluginSetup;
         const ownsItsWiring = state?.wiring === "project";
@@ -24280,7 +24335,7 @@ function registerBaselineCommands(program2) {
         if (notices.length > 0) {
           process.stdout.write(
             JSON.stringify({
-              ...userMsg ? { systemMessage: userMsg } : {},
+              ...userMsg || skewMsg ? { systemMessage: [skewMsg, userMsg].filter(Boolean).join("\n") } : {},
               hookSpecificOutput: {
                 hookEventName: "SessionStart",
                 additionalContext: notices.join("\n")
@@ -24289,12 +24344,12 @@ function registerBaselineCommands(program2) {
           );
         }
       }
-      if (deferredToPlugin("baseline capture", sessionId ?? process.env.CLAUDE_SESSION_ID ?? null)) {
+      if (deferredToPlugin("baseline capture", session ?? null)) {
         process.exit(0);
       }
       const authForScope = await resolveToken(program2.opts().token);
       const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
-      const scopeSession = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+      const scopeSession = session;
       const result = captureBaseline({ sessionId: sessionScopeKey(scopeToken, scopeSession), source });
       logEvent("baseline_capture", {
         created: result.created,
@@ -24307,12 +24362,35 @@ function registerBaselineCommands(program2) {
     process.exit(0);
   });
 }
+var MAX_HOOK_EVENT_BYTES = 64 * 1024;
+var HOOK_SOURCES = /* @__PURE__ */ new Set(["startup", "resume", "clear", "compact"]);
+var SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 async function readStdin() {
   const chunks = [];
+  let size = 0;
   for await (const chunk of process.stdin) {
-    chunks.push(chunk);
+    size += chunk.length;
+    if (size <= MAX_HOOK_EVENT_BYTES) chunks.push(chunk);
+  }
+  return size > MAX_HOOK_EVENT_BYTES ? "" : Buffer.concat(chunks).toString("utf-8");
+}
+function parseHookEvent(input) {
+  let event;
+  try {
+    event = JSON.parse(input);
+  } catch {
+    return {};
   }
-  return Buffer.concat(chunks).toString("utf-8");
+  if (!event || typeof event !== "object" || Array.isArray(event)) return {};
+  const { session_id: id, source } = event;
+  return { sessionId: validSessionId(id), source: hookSource(source) };
+}
+function validSessionId(value) {
+  return typeof value === "string" && SESSION_ID_RE.test(value) ? value : void 0;
+}
+function hookSource(value) {
+  if (typeof value !== "string") return void 0;
+  return HOOK_SOURCES.has(value) ? value : "unknown";
 }
 
 // src/commands/review.ts
@@ -26908,7 +26986,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.32.4" : "dev"
+          cli_version: true ? "0.32.5" : "dev"
         }
       });
     } catch (err) {
@@ -27589,8 +27667,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.32.4").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.4");
+program.name("verity").description("CLI for Verity quality gate service").version("0.32.5").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.32.5");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/data/skills/verity-init/SKILL.md

@@ -23,6 +23,17 @@ happens by accident. So **you** ask, in the session, where the user actually is.
 
 ---
 
+## Step 0: Check the CLI before asking anything
+
+If this session's context says the `verity` on PATH is a different version from
+the plugin's, **tell the user that first**, in one line, before the questions —
+with the `npm install -g` command the context gives. Finding out after they have
+answered is the failure this step exists to prevent: an older CLI cannot take the
+answers.
+
+Then run every command below the way the context says (the plugin's own copy),
+not with plain `verity`.
+
 ## Step 1: Ask both questions in ONE prompt
 
 Use `AskUserQuestion` with **both** questions in a single call. Do not ask them
@@ -33,12 +44,14 @@ setup gets, so spend it once.
 
 | Option | Description |
 |---|---|
-| `After every turn (recommended)` | Reviews what the agent just wrote, as you work. Fast feedback, never blocks a commit. |
+| `After every turn (always on with the plugin, for now)` | Reviews what the agent just wrote, as you work. Fast feedback, never blocks a commit. Under the Claude Code plugin it cannot be turned off yet. |
 | `Before commit` | Reviews the staged diff and blocks the commit on a failing review. |
 | `Before push / PR` | Reviews the commits about to be pushed and blocks on a failing review. |
 
-Pre-select **After every turn**. Say plainly in the question text that choosing
-only the first means **git commits and pushes are not gated**.
+Pre-select **After every turn**, and do not call it "recommended": under the
+plugin it runs whatever the answer, and a user who unticks it should not find
+that out afterwards. Say plainly in the question text that choosing only the
+first means **git commits and pushes are not gated**.
 
 **Question 2 — "How deeply should Verity review?"** (single-select)
 
@@ -60,6 +73,10 @@ verity init --yes --no-setup --moments <stop[,pre-commit][,pre-push]> --intensit
 `--moments none` is the deliberate way to gate nothing; an unrecognised value is
 refused rather than dropped, so a typo cannot quietly remove a gate.
 
+Pass `stop` only if they ticked it. Under the plugin the Stop review runs either
+way and `verity init` says so; recording their real answer is what lets it be
+honoured once Stop can be turned off.
+
 This is idempotent and does the whole job: removes the project's own
 `.claude/skills/verity-*` copies that the plugin supersedes (they are why the
 slash-command list shows every skill twice), stands down duplicate
@@ -91,6 +108,11 @@ Say this, and stop:
 
 If `verity status` already reports an account, skip this step and say so.
 
+If Step 0 found a version mismatch, the `verity` in their terminal is the old
+global one, not the plugin's: tell them to update it first (the `npm install -g`
+command from Step 0), then log in. An older or experimental build can sign the
+machine in to a different server, and the plugin follows that sign-in.
+
 ## Step 4: Offer the part a lookup cannot produce
 
 The Standard `init` derives covers the research-backed patterns for the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.32.4",
+  "version": "0.32.5",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",
@@ -23,14 +23,14 @@
   },
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --import tsx --test $(find tests -name '*.test.ts' -not -path 'tests/e2e/*' | sort)",
+    "test": "npm run build && VERITY_TEST_PREBUILT=1 node --import tsx --test $(find tests -name '*.test.ts' -not -path 'tests/e2e/*' | sort)",
     "test:e2e": "node --import tsx --test --test-concurrency=1 tests/e2e/*.test.ts",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "npm run typecheck && npm run build"
   },
   "devDependencies": {
     "@types/node": "^20",
-    "esbuild": "^0.21",
+    "esbuild": "^0.25.12",
     "tsx": "^4.21.0",
     "typescript": "^5.4"
   },