@codacy/verity-cli 0.33.0-experimental.d60f544 → 0.33.1-experimental.1378de3

package/CHANGELOG.md

@@ -38,6 +38,18 @@ installs are untouched.
 
 ### 🔧 Plugin fixes
 
+- **`verity doctor` and `verity hooks check` now say which build is gating.**
+  Both print the plugin's version and the CLI its hooks actually load, and warn
+  when the `verity` in your terminal is not that CLI. A mismatch never announced
+  itself as a version number before — it showed up as a command that seemed to
+  do nothing, because the gate and the terminal were running different builds.
+  The remedy names the side that is behind: `npm install -g @codacy/verity-cli@…`
+  for a stale global, `claude plugin update verity@verity` for a stale plugin.
+- **The stale-CLI warning no longer fires on installs that are fine.** It
+  compared your global `verity` against the plugin's *manifest* version, which
+  is not what the plugin runs — so a plugin whose manifest and pinned CLI differ
+  produced a warning telling you to install a version the hooks never use. The
+  comparison is now against the CLI the resolver actually loads.
 - **Uninstalling the plugin left projects with no gate at all.** Whether the
   plugin owned a project's hooks was decided by whether its install directory
   existed on disk — and that directory survives an uninstall. Every project the
@@ -64,6 +76,19 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.33.1] — 2026-09-18
+
+**The timed agent review runs for everyone.**
+
+- **On at every commit and push, with nothing to switch on.** The second reviewer
+  that arrived in 0.33.0 was opt-in, and no project ever opted in — it shipped and
+  never ran once. It now runs by default at both git moments: it reads the code
+  the one-shot only saw as a diff, checks what that review claimed, and can clear,
+  downgrade or add findings. `process_constraints.git_moment_agent: off` opts a
+  project out and `push` limits it to pushes; `VERITY_GIT_MOMENT_AGENT=off` skips
+  it on one machine. Only the exact value `off` turns it off — a misspelling
+  leaves the review running.
+
 ## [0.33.0] — 2026-09-16
 
 **Knowledge that holds across your organization's repositories now reaches every
@@ -107,6 +132,22 @@ repository — the reviewer, the agent, and you.**
   ask. It is stored as `source: agent` — Verity thought this, nobody checked it —
   and `--confirmed` marks the words a person authored.
 
+## [0.32.7] — 2026-09-16
+
+**Static analysis works on Windows.**
+
+- **`@codacy/analysis-cli` is found on Windows.** Verity looked for it by running
+  `which`, which does not exist in `cmd.exe`. Every Windows machine therefore
+  reported the analyzer missing even when it was installed and working: static
+  analysis was silently skipped, and `verity init` fell back to documented Trivy
+  pattern ids instead of deriving them from your project. Binaries are now found
+  by walking `PATH` with `PATHEXT`, which also picks up the `.cmd` shims npm
+  installs. The same broken probe was used for `claude` and for `verity` itself.
+- **A missing analyzer is no longer reported as a clean scan.** When
+  `@codacy/analysis-cli` was not installed, Verity sent an empty result that
+  looked identical to a scan that ran and found nothing. It now says the analyzer
+  did not run. No gate decision changes as a result of this.
+
 ## [0.32.6] — 2026-09-14
 
 **The knowledge base is no longer committed to git.**