@codacy/verity-cli 0.33.3-experimental.46f0715 → 0.33.3-experimental.53cd005

package/bin/verity.js

@@ -26771,7 +26771,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.3-experimental.46f0715" : "dev";
+    return true ? "0.33.3-experimental.53cd005" : "dev";
   } catch {
     return "dev";
   }
@@ -28487,6 +28487,13 @@ function definitionsIn(root, spec) {
       } else if (bound && p.type === "pair") {
         const key = p.childForFieldName("key");
         if (key && (key.type === "property_identifier" || key.type === "identifier")) add(key.text, kind2, p, n, p);
+      } else if (p.type === "arguments" && moduleCall(p.parent)) {
+        const call = p.parent;
+        const route = p.namedChildren[0];
+        const quoted = route && route.id !== n.id && route.type === "string" ? unquote2(route.text) : null;
+        const path = quoted && /^[\w/:.{}*-]{1,60}$/.test(quoted) ? quoted : null;
+        const callee = call.childForFieldName("function").text;
+        add(path ? `${callee} ${path}` : callee, kind2, call.parent, n, call);
       }
     }
     for (const c of n.namedChildren) visit(c);
@@ -28494,6 +28501,10 @@ function definitionsIn(root, spec) {
   visit(root);
   return out2;
 }
+function moduleCall(call) {
+  const f = call?.type === "call_expression" ? call.childForFieldName("function") : null;
+  return !!f && (f.type === "identifier" || f.type === "member_expression") && f.text.length <= 40 && !f.text.includes("\n") && call.parent?.type === "expression_statement" && call.parent.parent?.type === "program";
+}
 function unquote2(s) {
   const body2 = s.replace(/^[rRbBuUfF]{0,2}(?=["'`])/, "");
   const q3 = body2.startsWith('"""') || body2.startsWith("'''");
@@ -28562,6 +28573,25 @@ function factsOf(def, spec, defs, path) {
   const loops = [];
   const tries = [];
   const locks = [];
+  const bindings = {};
+  const bind = (n) => {
+    let name2 = null;
+    let value = null;
+    if (n.type === "variable_declarator") {
+      name2 = n.childForFieldName("name");
+      value = n.childForFieldName("value");
+    } else if (n.type === "assignment" && spec.id === "python") {
+      name2 = n.childForFieldName("left");
+      value = n.childForFieldName("right");
+    } else if (n.type === "short_var_declaration") {
+      const l = n.childForFieldName("left"), r = n.childForFieldName("right");
+      if (l?.namedChildren.length === 1 && r?.namedChildren.length === 1) {
+        name2 = l.namedChildren[0];
+        value = r.namedChildren[0];
+      }
+    }
+    if (name2?.type === "identifier" && value && Object.keys(bindings).length < 40 && !(name2.text in bindings)) bindings[name2.text] = cap(value.text, TEXT_CAP);
+  };
   const throwsIn = (n) => {
     if (spec.throws.has(n.type)) return true;
     if (defs.has(n.id) || spec.functionValues.has(n.type)) return false;
@@ -28571,6 +28601,7 @@ function factsOf(def, spec, defs, path) {
     const anonymousMember = n.parent?.type === "class_body" && n.parent.parent?.type === "object_creation_expression";
     if (n.id !== def.fn.id && !anonymousMember && (defs.has(n.id) || spec.classes.has(n.type) || spec.definitions[n.type])) return;
     const t = n.type;
+    bind(n);
     const down = (c, next = ctx) => walk2(c, next);
     if (spec.calls.has(t)) {
       const { receiver, name: name2, args: args2 } = callParts(n, spec);
@@ -28640,7 +28671,8 @@ function factsOf(def, spec, defs, path) {
     loops,
     tries,
     locks: [...new Set(locks)].sort((a, b) => a - b),
-    hasError: def.last.hasError
+    hasError: def.last.hasError,
+    ...Object.keys(bindings).length ? { bindings } : {}
   };
 }
 function endOf(def, spec) {
@@ -28676,6 +28708,54 @@ function outlineOf(rt, path, content, deadlineAt) {
     tree.delete();
   }
 }
+var BLOCKS = /* @__PURE__ */ new Set(["statement_block", "block", "switch_body"]);
+function regionOf(rt, path, content, fn, changed, maxLines, deadlineAt) {
+  const started = Date.now();
+  const lang = languageOf2(path);
+  if (!lang) return { source: "fallback", reason: "unsupported-language", elapsedMs: 0 };
+  const inside2 = changed.filter((r) => r.from <= fn.end.line && fn.start.line <= r.to);
+  if (inside2.length === 0) return { source: "fallback", reason: "not-in-function", elapsedMs: 0 };
+  const from = Math.max(fn.start.line, Math.min(...inside2.map((r) => r.from)));
+  const to = Math.min(fn.end.line, Math.max(...inside2.map((r) => r.to)));
+  if (to - from + 1 > maxLines) return { source: "fallback", reason: "change-too-wide", elapsedMs: 0 };
+  if (Buffer.byteLength(content) > MAX_PARSE_BYTES) return { source: "fallback", reason: "too-large", elapsedMs: 0 };
+  const tree = parseWithin(rt, lang, content, deadlineAt);
+  if (!tree) return { source: "fallback", reason: "deadline", elapsedMs: Date.now() - started };
+  try {
+    const lines = content.split("\n");
+    let n = tree.rootNode.descendantForPosition({ row: from - 1, column: 0 }, { row: to - 1, column: (lines[to - 1] ?? "").length });
+    let block = null;
+    for (; n && line(n) >= fn.start.line; n = n.parent) {
+      if (BLOCKS.has(n.type) && n.endPosition.row + 1 - line(n) + 1 > maxLines) {
+        block = n;
+        break;
+      }
+    }
+    if (!block) return { source: "fallback", reason: "no-block", elapsedMs: Date.now() - started };
+    const stmts = block.namedChildren.filter((c) => c.type !== "comment");
+    const end = (c) => c.endPosition.row + 1;
+    let lo = stmts.findIndex((c) => end(c) >= from);
+    let hi = stmts.length - 1 - [...stmts].reverse().findIndex((c) => line(c) <= to);
+    if (lo < 0 || hi < lo) return { source: "fallback", reason: "no-block", elapsedMs: Date.now() - started };
+    const fits = (a, b) => end(stmts[b]) - line(stmts[a]) + 1 <= maxLines;
+    if (!fits(lo, hi)) return { source: "fallback", reason: "change-too-wide", elapsedMs: Date.now() - started };
+    for (let grew = true; grew; ) {
+      grew = false;
+      if (lo > 0 && fits(lo - 1, hi)) {
+        lo--;
+        grew = true;
+      }
+      if (hi < stmts.length - 1 && fits(lo, hi + 1)) {
+        hi++;
+        grew = true;
+      }
+    }
+    const holder = block.parent && block.parent.type !== "program" ? block.parent : block;
+    return { source: "tree-sitter", value: { from: line(stmts[lo]), to: end(stmts[hi]), within: cap(holder.text.split("\n")[0].trim(), 60) }, elapsedMs: Date.now() - started };
+  } finally {
+    tree.delete();
+  }
+}
 
 // src/lib/code/effects.ts
 function literalName(literal) {
@@ -28696,7 +28776,18 @@ function argResource(kind, arg) {
     const n = literalName(arg.literal);
     return n ? { kind, name: n.name, confidence: n.confidence } : { kind, name: null, confidence: "unknown" };
   }
-  return SIMPLE_EXPRESSION.test(arg.text) && STABLE_EXPRESSION(arg.text) ? { kind, name: arg.text, confidence: "expression" } : { kind, name: null, confidence: "unknown" };
+  if (SIMPLE_EXPRESSION.test(arg.text) && STABLE_EXPRESSION(arg.text)) return { kind, name: arg.text, confidence: "expression" };
+  const keyed = keyedCall(arg.text);
+  return keyed ? { kind, name: keyed, confidence: "expression" } : { kind, name: null, confidence: "unknown" };
+}
+function keyedCall(text) {
+  const t = text.trim();
+  const open = t.indexOf("(");
+  if (open <= 0 || !t.endsWith(")")) return null;
+  const callee = t.slice(0, open);
+  if (!/^[A-Za-z_$][\w$.]*$/.test(callee)) return null;
+  const constant = /\b[A-Z][A-Z0-9_]{2,}\b/.exec(t.slice(open + 1, -1));
+  return constant ? `${callee}(${constant[0]})` : null;
 }
 function snake(s) {
   return s.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
@@ -28932,10 +29023,18 @@ function memory(c, fn, state) {
   const op = MEMORY_WRITE.has(c.name) ? "write" : MEMORY_READ.has(c.name) ? "read" : null;
   return op ? { op, resource: { kind: "memory", name: `${fn.path}#${c.receiver}`, confidence: "literal" }, rule: "memory.module" } : null;
 }
+function resolveLocal(a, bindings) {
+  if (a.literal !== null || !/^[A-Za-z_$][\w$]*$/.test(a.text)) return a;
+  const init2 = bindings[a.text];
+  if (!init2) return a;
+  const quoted = /^(['"`])([^'"`$]*)\1$/.exec(init2.trim());
+  return { ...a, text: init2, literal: quoted ? quoted[2] : null };
+}
 function directEffects(fn, lang, state) {
   const out2 = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const c of fn.calls) {
+  for (const raw of fn.calls) {
+    const c = fn.bindings ? { ...raw, args: raw.args.map((a) => resolveLocal(a, fn.bindings)) } : raw;
     let m = memory(c, fn, state);
     if (!m) {
       for (const rule of RULES) if (m = rule(c, fn, lang)) break;
@@ -28993,7 +29092,11 @@ function sameResource(a, b) {
 function searchTerms(r) {
   if (!r.name || r.confidence === "unknown") return [];
   if (r.kind === "service" || r.kind === "memory") return [];
-  if (r.confidence === "expression") return [r.name.endsWith("()") ? r.name.slice(0, -1) : r.name];
+  if (r.confidence === "expression") {
+    const keyed = /^[A-Za-z_$][\w$.]*\(([A-Z][A-Z0-9_]+)\)$/.exec(r.name);
+    if (keyed) return [keyed[1]];
+    return [r.name.endsWith("()") ? r.name.slice(0, -1) : r.name];
+  }
   if (r.kind === "table" && r.confidence === "inferred") {
     const one = tableKey(r.name);
     const plural = (w) => /[^aeiou]y$/.test(w) ? `${w.slice(0, -1)}ies` : /(?:s|x|ch|sh)$/.test(w) ? `${w}es` : `${w}s`;
@@ -29978,6 +30081,13 @@ function makeCodeMap(rt) {
         return { source: "fallback", reason: `error: ${String(e?.message ?? e).slice(0, 120)}`, elapsedMs: Date.now() - started };
       }
     },
+    regionAt(path, content, target, changed, maxLines, deadlineAt = Date.now() + DEFAULT_PARSE_MS) {
+      try {
+        return regionOf(rt, path, content, target, changed, maxLines, deadlineAt);
+      } catch (e) {
+        return { source: "fallback", reason: `error: ${String(e?.message ?? e).slice(0, 120)}`, elapsedMs: 0 };
+      }
+    },
     functionContaining(path, content, line2, deadlineAt) {
       return pick(outline(path, content, deadlineAt), (fns) => fns.filter((f) => f.start.line <= line2 && line2 <= f.end.line).sort((a, b) => a.end.line - a.start.line - (b.end.line - b.start.line))[0], "no-enclosing-function");
     }
@@ -33206,6 +33316,10 @@ var STRUCTURAL_CATALOGUE = [
   "check_then_act_is_atomic",
   "no_double_effect"
 ];
+function combineScore(c) {
+  const f = (x) => Math.max(0.01, Math.min(1, x));
+  return Math.round(Math.pow(f(c.hazard), 0.45) * Math.pow(f(c.critical), 0.35) * Math.pow(f(c.error_prone), 0.2) * 1e3) / 1e3;
+}
 function deterministicOrder(candidates2) {
   return candidates2.map((c, i2) => ({ ...c, rank: i2 + 1 }));
 }
@@ -33215,37 +33329,51 @@ var deterministicRanker = {
     return { ok: true, ranker: "deterministic", ranked: deterministicOrder(candidates2) };
   }
 };
-function excerpt(root, file, bytes, readSource, changed, codeMap) {
+function excerpt(root, file, bytes, readSource, changed, codeMap, codeSource) {
   const read2 = readSource ? readSource(file, EXCERPT_SOURCE_CAP_BYTES) : readRegularFileInRoot(root, file, EXCERPT_SOURCE_CAP_BYTES);
   if (!read2.ok) return "";
   if (changed && changed.length > 0) {
-    const touched = codeMap ? touchedFunctions(codeMap, file, read2.content, changed) : "";
+    const touched = codeMap ? touchedFunctions(codeMap, file, read2.content, changed, { source: codeSource, fixSubjects: (from, to) => fixSubjects(root, file, from, to) }) : "";
     return touched + changedExcerpt(read2.content, changed, bytes - touched.length);
   }
   return read2.content.length > bytes ? read2.content.slice(0, bytes) + "\n\u2026 (truncated)" : read2.content;
 }
-function touchedFunctions(codeMap, file, content, changed) {
+function touchedFunctions(codeMap, file, content, changed, evidence2 = {}) {
   const r = codeMap.outline(file, content);
   if (r.source !== "tree-sitter") return "";
   const size = (f) => f.end.line - f.start.line;
   const names2 = [];
+  const fixes = [];
   for (const range of changed) {
     const around = r.value.filter((f) => f.start.line <= range.to && range.from <= f.end.line).sort((a, b) => size(a) - size(b));
     const hit = around[0];
     const outer = hit ? r.value.filter((f) => f !== hit && f.start.line <= hit.start.line && hit.end.line <= f.end.line).sort((a, b) => size(a) - size(b))[0] : void 0;
-    const label2 = hit ? `${hit.qualified} (lines ${hit.start.line}\u2013${hit.end.line}${outer ? `, inside ${outer.qualified}` : ""}${hit ? sharedState(codeMap, file, content, hit) : ""})` : null;
-    if (label2 && !names2.includes(label2)) names2.push(label2);
+    const label2 = hit ? `${hit.qualified} (lines ${hit.start.line}\u2013${hit.end.line}${outer ? `, inside ${outer.qualified}` : ""}${hit ? sharedState(codeMap, file, content, hit, evidence2.source) : ""})` : null;
+    if (label2 && !names2.includes(label2)) {
+      names2.push(label2);
+      for (const s of hit && evidence2.fixSubjects ? evidence2.fixSubjects(hit.start.line, hit.end.line) : []) if (!fixes.includes(s)) fixes.push(s);
+    }
   }
-  return names2.length > 0 ? `Functions this push changed: ${names2.slice(0, 8).join(", ")}
+  if (names2.length === 0) return "";
+  const history = fixes.length > 0 ? `Fix commits that changed these lines: ${fixes.slice(0, 4).map((s) => `"${s}"`).join("; ")}
 ` : "";
+  return `Functions this push changed: ${names2.slice(0, 8).join(", ")}
+${history}`;
 }
-function sharedState(codeMap, file, content, fn) {
-  const r = codeMap.access(file, content, fn);
+function fixSubjects(root, file, from, to) {
+  const r = runGitSync(root, ["log", "-n", "40", "--no-patch", "--format=%s", "-L", `${from},${to}:${file}`], { timeoutMs: 2e3, maxBuffer: 1 << 20 });
+  if (!r.ok) return [];
+  return [...new Set(r.stdout.split("\n").map((s) => s.trim()).filter((s) => s && FIX_SUBJECT.test(s)))].slice(0, 4).map((s) => s.slice(0, 120));
+}
+function sharedState(codeMap, file, content, fn, source2) {
+  const r = codeMap.access(file, content, fn, source2 ? { source: source2, deadlineAt: Date.now() + 800 } : void 0);
   if (r.source !== "tree-sitter") return "";
   const notes = [];
-  const others = r.value.accessors.slice(0, 2).map((a) => a.fn.qualified);
+  const others = r.value.accessors.slice(0, 2).map((a) => a.fn.path === file ? a.fn.qualified : `${a.fn.qualified} in ${a.fn.path}`);
   if (others.length) notes.push(`shares state with ${others.join(" and ")}`);
   if (r.value.signals.checkThenAct.length) notes.push(`reads then writes ${r.value.signals.checkThenAct[0].split(" ")[0]}`);
+  const kinds = [...new Set(r.value.effects.filter((e) => e.resource.name).map((e) => `${e.op} ${e.resource.kind}:${e.resource.name}`))].slice(0, 4);
+  if (kinds.length) notes.push(`effects: ${kinds.join(", ")}`);
   return notes.length ? `; ${notes.join("; ")}` : "";
 }
 function changedExcerpt(content, changed, bytes, context = 30) {
@@ -33285,25 +33413,27 @@ var LUNA_SCHEMA = {
         additionalProperties: false,
         properties: {
           file: { type: "string" },
-          score: { type: "number" },
+          critical: { type: "number" },
+          hazard: { type: "number" },
+          error_prone: { type: "number" },
           reasons: { type: "array", items: { type: "string" } },
           symbol: { type: "string" },
           properties: { type: "array", items: { type: "string", enum: [...STRUCTURAL_CATALOGUE] } }
         },
-        required: ["file", "score", "reasons", "symbol", "properties"]
+        required: ["file", "critical", "hazard", "error_prone", "reasons", "symbol", "properties"]
       }
     }
   },
   required: ["items"]
 };
 var LUNA_INSTRUCTIONS = `You decide whether a push deserves a FORMAL MODEL: a Lean 4 transition system explored over every interleaving, retry, failure and crash, then replayed on the real code. It costs the developer about a minute of their push, and blocks it only on a bug reproduced on the real code. It is a scalpel: most pushes deserve NO model.
-For each file you get its git-history signals (commits, fix commits), risk keyword counts and an excerpt. Score each 0-1 for "a model of ONE function here is worth that minute, because it would likely expose a real, costly bug". A high score needs ALL THREE:
-  - CRITICAL: a mistake costs money, data, access or a stuck workflow (payments, balances, stock, ledgers, auth and permissions, jobs and queues, sync, status machines, anything that must happen exactly once);
-  - A HAZARD a model can explore: two or more effects that can interleave (read then write, check then act), a retry or a redelivery, an external call whose failure path matters, a lock, a lease, a cache, a cursor, a crash window between writes \u2014 or pure arithmetic on money or counts;
-  - ERROR-PRONE or COMPLEX: fix commits in its history, high churn, several branches or error paths, a concurrency primitive \u2014 a hazard nobody sees by reading the function once.
-Score LOW (below 0.5) when any is missing: rendering, formatting, configuration, command registration, wiring, types, a single read, a single write with nothing before it, logging, or a function whose correctness is plain from reading it. A crash window alone (an external call, then a local write, where a re-run repairs the state and nothing is lost for good) is not enough for a high score. A model of a function longer than about 150 lines abstracts too much to find anything: name the smaller function inside it that holds the hazard, or score lower.
-Name the single symbol (function) most worth modelling, and the applicable properties from the catalogue only. Reasons: at most 3, each a short concrete sentence about THIS code that names the hazard. Return every file you were given, exactly once.
-When a file lists \`changed\` lines, this is a review of a push: the excerpt is numbered around the changes (changed lines starred). Name the function that CONTAINS a changed line, and score THAT FUNCTION'S CURRENT CODE as a whole, never the edit itself. A one-line change (a log line, a rename) to a function that meets all three still scores high: a latent bug in it is exactly what this is for. A large change to a function that misses one still scores low. An excerpt may open with "Functions this push changed:", from a parser: when it says a changed function "shares state with" another, judge the PAIR \u2014 a function that alone is a single write or an invalidation is error-prone when the other reads and repopulates, or also writes, the same state (a cache invalidated here and refilled there, two writers of one ledger or file); score it as that pair would be scored, but name ONE symbol \u2014 the changed function, never both ("a/b", "a and b" name nothing). "reads then writes" names a check-then-act the parser saw with no transaction or lock around it.`;
+For each file you get its git-history signals (commits, fix commits), risk keyword counts and an excerpt. Pick the ONE function here most worth a model, and rate it 0-1 on each of three criteria, separately \u2014 the service combines them (a model is worth the minute only when all three hold):
+  - critical: a mistake costs money, data, access or a stuck workflow (payments, balances, stock, ledgers, auth and permissions, jobs and queues, sync, status machines, anything that must happen exactly once or at most once \u2014 duplicated records, nodes, charges, emails or seeds count, and so does state that two processes can leave inconsistent);
+  - hazard: something a model can explore \u2014 two or more effects that can interleave (read then write, check then act), a retry or a redelivery, an external call whose failure path matters, a lock, a lease, a cache, a cursor, a crash window between writes \u2014 or pure arithmetic on money or counts;
+  - error_prone: fix commits in its history (the strongest evidence: this code has already been wrong), high churn, several branches or error paths, a concurrency primitive \u2014 a hazard nobody sees by reading the function once.
+Rate a criterion LOW (below 0.5) when it is missing: rendering, formatting, configuration, command registration, wiring, types, a single read, a single write with nothing before it, logging, or a function whose correctness is plain from reading it. A crash window alone (an external call, then a local write, where a re-run repairs the state and nothing is lost for good) is not enough for a high score. A model of a function longer than about 150 lines abstracts too much to find anything: name the smaller function inside it that holds the hazard, or score lower.
+Name the single symbol (function) most worth modelling, and the applicable properties from the catalogue only. Reasons: at most 3, each a short concrete sentence about THIS code \u2014 its hazard, what a mistake costs, its history \u2014 never about the change. Return every file you were given, exactly once.
+When a file lists \`changed\` lines, this is a review of a push: the excerpt is numbered around the changes (changed lines starred). Name the function that CONTAINS a changed line, and score THAT FUNCTION'S CURRENT CODE as a whole, never the edit itself. A one-line change (a log line, a rename) to a function that meets all three still scores high: a latent bug in it is exactly what this is for. A large change to a function that misses one still scores low. An excerpt may open with "Functions this push changed:", from a parser: when it says a changed function "shares state with" another, judge the PAIR \u2014 a function that alone is a single write or an invalidation is error-prone when the other reads and repopulates, or also writes, the same state (a cache invalidated here and refilled there, two writers of one ledger or file); score it as that pair would be scored, but name ONE symbol \u2014 the changed function, never both ("a/b", "a and b" name nothing). "reads then writes" names a check-then-act the parser saw with no transaction or lock around it. "effects" lists the state the function reads and writes (a table, a file, a cache key, a queue, an outside service). "Fix commits that changed these lines" quotes the history of THIS code: each one is evidence it has been wrong before (error_prone), and its subject often says what a mistake cost (critical) \u2014 a subject about duplicates, lost writes, double charges or stuck jobs is a costly mistake that already happened.`;
 var lunaRanker = {
   name: "luna",
   async rank(candidates2, ctx) {
@@ -33358,7 +33488,12 @@ var lunaRanker = {
       const text = (data.output ?? []).flatMap((o) => o.content ?? []).find((c) => c.type === "output_text")?.text;
       if (!text) return { ok: false, ranker: "luna", error: "no output_text in response", ranked: fallback };
       const parsed = JSON.parse(text);
-      return { ok: true, ranker: "luna", ranked: applyAnnotations(candidates2, parsed.items) };
+      const items = parsed.items.map((i2) => {
+        const legacy = i2.critical === void 0 && i2.hazard === void 0 && i2.error_prone === void 0;
+        const criteria = legacy ? { critical: Number(i2.score) || 0, hazard: Number(i2.score) || 0, error_prone: Number(i2.score) || 0 } : { critical: Number(i2.critical) || 0, hazard: Number(i2.hazard) || 0, error_prone: Number(i2.error_prone) || 0 };
+        return { ...i2, criteria, score: legacy ? Number(i2.score) || 0 : combineScore(criteria) };
+      });
+      return { ok: true, ranker: "luna", ranked: applyAnnotations(candidates2, items) };
     } catch (err2) {
       const msg = err2.name === "AbortError" ? "timed out" : err2.message;
       return { ok: false, ranker: "luna", error: msg, ranked: fallback };
@@ -33382,7 +33517,7 @@ async function rankViaServer(candidates2, ctx, auth2) {
         fix_commits: c.fixCommits,
         risk: c.risk,
         lines: c.lines,
-        excerpt: excerpt(ctx.root, c.file, excerptBytes, ctx.readSource, ctx.changedLines?.get(c.file), ctx.codeMap),
+        excerpt: excerpt(ctx.root, c.file, excerptBytes, ctx.readSource, ctx.changedLines?.get(c.file), ctx.codeMap, ctx.codeSource),
         ...ctx.changedLines?.get(c.file)?.length ? { changed_lines: ctx.changedLines.get(c.file).slice(0, 50) } : {}
       })),
       ...ctx.hint ? { hint: ctx.hint.slice(0, 500) } : {}
@@ -33402,6 +33537,11 @@ function applyAnnotations(candidates2, items) {
     const properties = (a.properties ?? []).filter((p) => STRUCTURAL_CATALOGUE.includes(p));
     const score = Math.max(0, Math.min(1, Number(a.score) || 0));
     const ai = { score, reasons: (a.reasons ?? []).slice(0, 3), properties };
+    if (a.criteria && typeof a.criteria === "object") {
+      const u = (v) => Math.max(0, Math.min(1, Number(v) || 0));
+      ai.criteria = { critical: u(a.criteria.critical), hazard: u(a.criteria.hazard), error_prone: u(a.criteria.error_prone) };
+    }
+    if (a.reasked) ai.reasked = true;
     if (a.symbol && a.symbol.trim()) ai.symbol = a.symbol.trim();
     return { ...c, rank: 0, ai };
   });
@@ -35728,6 +35868,7 @@ function contextHazard(ctx) {
 var AUTO_MODELS_DIR = `${MODELS_DIR}/.auto`;
 var DEFAULT_MIN_SCORE = 0.7;
 var MAX_MODEL_FUNCTION_LINES = 300;
+var REGION_MIN_SCORE = 0.8;
 var REPLAYABLE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|py)$/;
 var LARGE_PUSH_FILES = 25;
 var DAILY_MODEL_CAP = 5;
@@ -35824,7 +35965,7 @@ function sha256Of(content) {
 function defaultDeps(opts) {
   const env = opts.env ?? process.env;
   return {
-    rank: (candidates2, root, changedLines) => lunaRanker.rank(candidates2, { root, auth: opts.auth, env, fetchImpl: opts.fetchImpl, readSource: opts.readSource, codeMap: opts.codeMap, ...changedLines ? { changedLines } : {} }),
+    rank: (candidates2, root, changedLines) => lunaRanker.rank(candidates2, { root, auth: opts.auth, env, fetchImpl: opts.fetchImpl, readSource: opts.readSource, codeMap: opts.codeMap, ...opts.codeSource ? { codeSource: opts.codeSource } : {}, ...changedLines ? { changedLines } : {} }),
     // The push phase writes with the FAST tier; `prove generate` asks for DEEP (decision 56).
     generate: (target, previous, budgetMs) => generateModel(target, { auth: opts.auth, apiKey: opts.apiKey, env, fetchImpl: opts.fetchImpl, previous, tier: opts.tier ?? "fast", ...budgetMs ? { budgetMs } : {} }),
     check: (root, modelFile) => checkModelAsync(opts.toolchain, root, modelFile),
@@ -35841,8 +35982,10 @@ async function runFormalPhase(input) {
   const progress = input.progress ?? {};
   progress.usage = usage;
   progress.step = "select";
+  let candidates2;
   const done = (partial) => ({
     findings: [],
+    ...candidates2 ? { candidates: candidates2 } : {},
     ...partial,
     usage,
     durationMs: deps.now() - started
@@ -35907,17 +36050,42 @@ async function runFormalPhase(input) {
   const signals = collectRiskSignals(root, { paths: files, limit: 10 });
   if (signals.length === 0) return done({ status: "skipped", skip: "no-source-files" });
   const largePush = signals.length >= LARGE_PUSH_FILES || files.length >= LARGE_PUSH_FILES * 2;
-  const eligible = signals.filter((s) => isEligible(s, largePush).ok).slice(0, 5);
+  const mapEligible = (file) => {
+    const changed = input.changedLines?.get(file);
+    if (!deps.codeMap || largePush || !changed?.length) return false;
+    const read2 = readSrc(file, 96 * 1024);
+    if (!read2.ok) return false;
+    const outline = deps.codeMap.outline(file, read2.content);
+    if (outline.source !== "tree-sitter") return false;
+    return outline.value.some((f) => changed.some((r) => f.start.line <= r.to && r.from <= f.end.line) && (() => {
+      const a = deps.codeMap.access(file, read2.content, f);
+      return a.source === "tree-sitter" && a.value.effects.length >= 2;
+    })());
+  };
+  const eligible = signals.filter((s) => isEligible(s, largePush).ok || mapEligible(s.file)).slice(0, 5);
   if (eligible.length === 0) {
     const best = signals[0];
     return done({ status: "skipped", skip: "not-eligible", detail: `${best.file}: ${isEligible(best, largePush).why}` });
   }
   const ranked = await deps.rank(eligible, root, input.changedLines);
   if (ranked.ok) spend(ranked);
+  candidates2 = ranked.ranked.slice(0, 5).map((c) => ({ file: c.file, symbol: c.ai?.symbol ?? null, score: c.ai?.score ?? null, criteria: c.ai?.criteria ?? null, reasked: !!c.ai?.reasked, reasons: (c.ai?.reasons ?? []).map((r) => r.slice(0, 200)) }));
   if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off after ranking" });
   const minScore = input.minScore ?? DEFAULT_MIN_SCORE;
-  const qualified = ranked.ranked.filter((c) => c.ai && c.ai.score >= minScore);
-  if (qualified.length === 0) return done({ status: "skipped", skip: "no-candidate", detail: ranked.ok ? `best score ${Math.round((ranked.ranked[0]?.ai?.score ?? 0) * 100)}% of ${eligible.length} eligible` : `rank unavailable: ${ranked.error ?? ""}` });
+  let qualified = ranked.ranked.filter((c) => c.ai && c.ai.score >= minScore);
+  let floor = false;
+  if (qualified.length === 0 && ranked.ok && deps.codeMap && input.changedLines) {
+    const pick = floorCandidate(ranked.ranked, input.changedLines, deps, readSrc, root);
+    if (pick) {
+      qualified = [pick];
+      floor = true;
+    }
+  }
+  if (qualified.length === 0) {
+    const best = ranked.ranked[0];
+    const why2 = best?.ai ? `${best.ai.symbol ?? best.file}${best.ai.criteria ? ` (critical ${best.ai.criteria.critical}, hazard ${best.ai.criteria.hazard}, error-prone ${best.ai.criteria.error_prone})` : ""}${best.ai.reasons[0] ? ` \u2014 ${best.ai.reasons[0].slice(0, 160)}` : ""}` : "";
+    return done({ status: "skipped", skip: "no-candidate", detail: ranked.ok ? `best score ${Math.round((best?.ai?.score ?? 0) * 100)}% of ${eligible.length} eligible${why2 ? `: ${why2}` : ""}` : `rank unavailable: ${ranked.error ?? ""}` });
+  }
   let chosen = null;
   let why = null;
   const note = (skip, detail) => {
@@ -35934,7 +36102,18 @@ async function runFormalPhase(input) {
       note("read-failed", `${c.file}: ${read2.reason}`);
       continue;
     }
-    const d = describeTarget(read2.content, c.ai.symbol, c.file, void 0, { codeMap: deps.codeMap, prefer: input.changedLines?.get(c.file) });
+    let d = describeTarget(read2.content, c.ai.symbol, c.file, void 0, { codeMap: deps.codeMap, prefer: input.changedLines?.get(c.file) });
+    if (!d.lines && deps.codeMap && input.changedLines?.get(c.file)?.length) {
+      const only = changedFunction(deps.codeMap, c.file, read2.content, input.changedLines.get(c.file));
+      if (only) {
+        const again = describeTarget(read2.content, only, c.file, void 0, { codeMap: deps.codeMap, prefer: input.changedLines.get(c.file) });
+        if (again.lines) {
+          c.ai.reasons = [`the ranker named ${c.ai.symbol}, which is not a function here; the push changed ${only}`, ...c.ai.reasons].slice(0, 4);
+          c.ai.symbol = only;
+          d = again;
+        }
+      }
+    }
     if (d.resolved && d.resolved !== c.ai.symbol) c.ai.symbol = d.resolved;
     if (input.changedLines) {
       const changed = input.changedLines.get(c.file) ?? [];
@@ -35954,13 +36133,30 @@ async function runFormalPhase(input) {
     if (d.lines) {
       const size = d.lines.to - d.lines.from + 1;
       if (size > MAX_MODEL_FUNCTION_LINES) {
-        note("too-large", `${c.ai.symbol}: ${size} lines (at most ${MAX_MODEL_FUNCTION_LINES} are modelled)`);
-        continue;
+        const fn = deps.codeMap?.functionAt(c.file, read2.content, c.ai.symbol, input.changedLines?.get(c.file));
+        const region = fn?.source === "tree-sitter" && input.changedLines?.get(c.file)?.length ? deps.codeMap.regionAt(c.file, read2.content, fn.value, input.changedLines.get(c.file), MAX_MODEL_FUNCTION_LINES) : null;
+        if (region?.source !== "tree-sitter") {
+          note("too-large", `${c.ai.symbol}: ${size} lines (at most ${MAX_MODEL_FUNCTION_LINES} are modelled)`);
+          continue;
+        }
+        const { from, to, within } = region.value;
+        const ctx = deps.codeMap ? targetContext({ codeMap: deps.codeMap, codeSource: deps.codeSource, readSource: readSrc, file: c.file, content: read2.content, symbol: c.ai.symbol, prefer: input.changedLines?.get(c.file) }) : null;
+        const inRegion = (ctx?.signals.checkThenAct ?? []).some((x) => {
+          const m = /\(L(\d+)→L(\d+)\)/.exec(x);
+          return !!m && from <= Number(m[1]) && Number(m[2]) <= to;
+        });
+        if (c.ai.score < REGION_MIN_SCORE || !inRegion) {
+          note("too-large", `${c.ai.symbol}: ${size} lines, and no read-then-write of state in lines ${from}\u2013${to} scored ${REGION_MIN_SCORE} or more`);
+          continue;
+        }
+        d = { ...describeTarget(read2.content, c.ai.symbol, c.file, { from, to }), extent: "region" };
+        c.ai.reasons = [`region: lines ${from}\u2013${to} of the ${size}-line ${c.ai.symbol}, in \`${within}\``, ...c.ai.reasons].slice(0, 4);
       }
       context = deps.codeMap ? targetContext({ codeMap: deps.codeMap, codeSource: deps.codeSource, readSource: readSrc, file: c.file, content: read2.content, symbol: c.ai.symbol, prefer: input.changedLines?.get(c.file) }) : null;
       const hazard = hasHazard(functionHazard(d.numbered));
       const shared = contextHazard(context);
-      if (!hazard.ok && !shared?.ok) {
+      const judged = (c.ai.criteria?.hazard ?? 0) >= 0.8;
+      if (!hazard.ok && !shared?.ok && !judged) {
         note("no-hazard", `${c.ai.symbol}: ${hazard.why}`);
         continue;
       }
@@ -35981,7 +36177,7 @@ async function runFormalPhase(input) {
   const top = chosen.top;
   const sha2562 = sha256Of(chosen.content);
   const { lines, numbered: numbered2 } = chosen;
-  const target = { file: top.file, symbol: top.ai.symbol, lines, score: top.ai.score, reasons: [...top.reasons, ...top.ai.reasons], extent: chosen.extent, ...chosen.context ? { context: chosen.context.stats } : {} };
+  const target = { file: top.file, symbol: top.ai.symbol, lines, score: top.ai.score, reasons: [...top.reasons, ...top.ai.reasons], extent: chosen.extent, ...chosen.context ? { context: chosen.context.stats } : {}, ...floor ? { floor: true } : {} };
   progress.target = target;
   if (!REPLAYABLE.test(top.file)) return done({ status: "skipped", skip: "replay-unsupported", detail: `${top.file}: replay supports TS/JS and Python`, target });
   if (timeLeft() < GENERATE_RESERVE_MS) return done({ status: "skipped", skip: "not-enough-time", detail: `${Math.round(timeLeft() / 1e3)} s left before generation`, target });
@@ -36203,7 +36399,40 @@ async function prepareFormalPhase(root, env = process.env, auth2, readSource, co
   const build = await buildLibraryAsync(toolchain, root, 9e4);
   if (!build.ok) return { ok: false, skip: "library-build-failed", detail: build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).join(" ").slice(0, 200) };
   const loaded = await loadCodeMap(env);
-  return { ok: true, deps: { ...defaultDeps({ auth: auth2, apiKey, env, toolchain, readSource, codeMap: loaded.ok ? loaded.map : null }), codeSource: codeSource ?? withoutPaths(worktreeSource(root), isDeniedPath) } };
+  const source2 = codeSource ?? withoutPaths(worktreeSource(root), isDeniedPath);
+  return { ok: true, deps: { ...defaultDeps({ auth: auth2, apiKey, env, toolchain, readSource, codeMap: loaded.ok ? loaded.map : null, codeSource: source2 }), codeSource: source2 } };
+}
+function changedFunction(codeMap, file, content, changed) {
+  const outline = codeMap.outline(file, content);
+  if (outline.source !== "tree-sitter") return null;
+  const size = (f) => f.end.line - f.start.line;
+  const touched = new Set(changed.map((r) => outline.value.filter((f) => f.start.line <= r.to && r.from <= f.end.line).sort((a, b) => size(a) - size(b))[0]?.qualified).filter(Boolean));
+  return touched.size === 1 ? [...touched][0] : null;
+}
+function floorCandidate(ranked, changedLines, deps, readSrc, root) {
+  for (const c of ranked.slice(0, 3)) {
+    const changed = changedLines.get(c.file);
+    if (!changed?.length || !deps.codeMap) continue;
+    const read2 = readSrc(c.file, 96 * 1024);
+    if (!read2.ok) continue;
+    const outline = deps.codeMap.outline(c.file, read2.content);
+    if (outline.source !== "tree-sitter") continue;
+    const size = (f) => f.end.line - f.start.line;
+    const touched = [...new Set(changed.map((r) => outline.value.filter((f) => f.start.line <= r.to && r.from <= f.end.line).sort((a, b) => size(a) - size(b))[0]).filter(Boolean))];
+    if ((c.ai?.criteria?.hazard ?? 0) < 0.5) continue;
+    for (const fn of touched.slice(0, 2)) {
+      if (size(fn) + 1 > MAX_MODEL_FUNCTION_LINES) continue;
+      const context = targetContext({ codeMap: deps.codeMap, codeSource: deps.codeSource, readSource: readSrc, file: c.file, content: read2.content, symbol: fn.qualified, prefer: changed });
+      const checkThenAct = context?.signals.checkThenAct ?? [];
+      if (checkThenAct.length === 0) continue;
+      const writers = context?.signals.otherWriters ?? 0;
+      const fixes = writers > 0 ? [] : fixSubjects(root, c.file, fn.start.line, fn.end.line);
+      if (writers === 0 && fixes.length === 0) continue;
+      const why = writers > 0 ? `floor: another function writes the same state (${context?.fields.coAccessors?.map((a) => a.symbol).join(", ") || "found by search"}) and it reads then writes ${checkThenAct[0].split(" ")[0]}` : `floor: fixed before ("${fixes[0]}") and it reads then writes ${checkThenAct[0].split(" ")[0]}`;
+      return { ...c, ai: { score: c.ai?.score ?? 0, symbol: fn.qualified, reasons: [why, ...c.ai?.reasons ?? []].slice(0, 3), properties: c.ai?.properties ?? [], ...c.ai?.criteria ? { criteria: c.ai.criteria } : {} } };
+    }
+  }
+  return null;
 }
 function runFormalPhaseWithin(input) {
   const left = input.deadlineAt - input.deps.now();
@@ -36772,6 +37001,10 @@ async function runGuard(opts, globals) {
       extent: formalOutcome.target?.extent ?? null,
       // The code map's context for generation: counts only (day 2).
       context: formalOutcome.target?.context ?? null,
+      // Why this push was, or was not, modelled (VRT-260): the ranker's scores and criteria per candidate.
+      candidates: (formalOutcome.candidates ?? []).map((c) => ({ file: c.file, symbol: c.symbol, score: c.score, criteria: c.criteria, reasked: c.reasked })),
+      floor: formalOutcome.target?.floor ?? false,
+      detail: formalOutcome.detail ?? null,
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
@@ -39119,7 +39352,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.3-experimental.46f0715" : "dev"
+          cli_version: true ? "0.33.3-experimental.53cd005" : "dev"
         }
       });
     } catch (err2) {
@@ -40581,8 +40814,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.46f0715").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.46f0715");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.53cd005").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.53cd005");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.33.3-experimental.46f0715",
+  "version": "0.33.3-experimental.53cd005",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",