@codacy/verity-cli 0.33.3-experimental.9d77663 → 0.33.3-experimental.aea5331

package/bin/verity.js

@@ -27021,7 +27021,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.3-experimental.9d77663" : "dev";
+    return true ? "0.33.3-experimental.aea5331" : "dev";
   } catch {
     return "dev";
   }
@@ -33579,9 +33579,11 @@ function basisOf(source2, files) {
   }
   return { ok: false, why: `line ${n} does not contain "${quoted.slice(0, 60)}"` };
 }
-var NEEDS_FAILURE = /(?<!\beven )\b(?:after|when|if|once|on)\b[^,.;:]{0,60}?\b(?:fails?|failed|errors?|throws?|times? out|timed out|rejects?|rejected|is unavailable|is down)\b|\bon (?:an? )?(?:error|failure|timeout)\b|\ba failed\b/;
-var NEEDS_CRASH = /(?<!\beven )\b(?:after|when|if|on)\b[^,.;:]{0,60}?\bcrash/;
-var HAS_FAILURE = /fail|error|throw|timeout|timedout|timesout|reject|exception|unavailable|down/i;
+var NOT_A_MENTION = "(?<!\\b(?:even|including|also|or) )";
+var UNTIL_FIRST = "(?:(?!\\bor\\b)[^,.;:]){0,60}?";
+var NEEDS_FAILURE = new RegExp(`${NOT_A_MENTION}\\b(?:after|when|if|once|on)\\b${UNTIL_FIRST}\\b(?:fails?|failed|errors?|throws?|times? out|timed out|rejects?|rejected|is unavailable|is down)\\b|${NOT_A_MENTION}\\bon (?:an? )?(?:error|failure|timeout)\\b|\\ba failed\\b`);
+var NEEDS_CRASH = new RegExp(`${NOT_A_MENTION}\\b(?:after|when|if|on)\\b${UNTIL_FIRST}\\bcrash`);
+var HAS_FAILURE = /fail|error|throw|time[sd]?[\s_-]*out|reject|exception|unavailable|\bdown\b|\bis down/i;
 var HAS_CRASH = /crash|die|kill|abort|restart/i;
 function missingTrigger(desc, trace) {
   const d = desc.toLowerCase();
@@ -34336,7 +34338,7 @@ STEP 3 \u2014 Properties: 2 to 4, in this order of priority:
   A counterexample must run the real function: a trace made only of environment moves (another writer, a clock) says nothing about this code. A promise about the END result (nothing lost, nothing charged twice, totals add up) is checked on states where every invocation has finished or crashed \u2014 guard the \`inv\` with the program counters, as exemplar 2's second property does; a violation that exists only while work is still pending is not a bug.
   A property is about an OUTCOME someone would call a bug \u2014 money, stock or records wrong, access granted, work lost or done twice, a job stuck forever \u2014 never about the mechanism's internals (a key's format, two timestamps being distinct, a lease's exact boundary tick). A comment that says HOW the code works ("make each attempt's key unique") is not the promise; the promise is what that mechanism is for.
   A comment that states a SAFE design choice ("a spent token presented again ends every session", "consumers dedupe, so publishing twice is harmless") is the design: never claim the opposite. A comment never makes an UNSAFE outcome safe: granting access on an error, losing or double-counting money, stock or records is a bug whatever the comment says ("don't block people when the permission service is flaky" describes a fail-open bug).
-  Every property says what it rests on, in \`source\`: either \`L<n>: <words copied from that line>\` \u2014 a line of the numbered source above (a comment, docstring, check, error message or name) that states the promise \u2014 or one rule: \`rule:conservation\` (money, stock or counts add up), \`rule:once\` (no double effect, only where the code dedups, as above), \`rule:no-lost-update\`, \`rule:fail-closed\` (an error never grants access or reports success), \`rule:progress\` (nothing stuck forever). A property that neither a line nor one of these rules supports is not a promise: do not state it. A property whose \`source\` is empty, or cites words its line does not contain, sends the model back.
+  Every property says what it rests on, in \`source\`: either \`L<n>: <words copied from that line>\` \u2014 a line of the numbered source above (a comment, docstring, check, error message or name) that states the promise \u2014 or one rule: \`rule:conservation\` (money, stock or counts add up), \`rule:once\` (no double effect: where the code dedups, or where the same input can arrive twice \u2014 a webhook or queue message redelivered, a client or job retry \u2014 even when the code has no dedup at all; a missing dedup is the bug, not a reason to drop the property), \`rule:no-lost-update\`, \`rule:fail-closed\` (an error never grants access or reports success), \`rule:progress\` (nothing stuck forever). A property that neither a line nor one of these rules supports is not a promise: do not state it. A property whose \`source\` is empty, or cites words its line does not contain, sends the model back.
   When the input lists where the function is called, a caller's guard bounds its inputs: never build a counterexample from an input no caller can pass (an empty list a caller refuses).
   Property ids name the promise in snake_case (refund_total_within_capture) \u2014 never P1. \`desc\` states the promise in the code's own terms and names the move the trace needs ("two concurrent calls \u2026", "after the charge succeeded and the call timed out \u2026").
   A PURE computation (no effect sites) is checked with \`Verity.checkData\` on small concrete inputs, including the edge cases (exemplar 3).
@@ -36306,9 +36308,11 @@ async function runFormalPhase(input) {
   progress.usage = usage;
   progress.step = "select";
   let candidates2;
+  const grounding = { sentBack: 0, dropped: [], triggerMissing: [] };
   const done = (partial) => ({
     findings: [],
     ...candidates2 ? { candidates: candidates2 } : {},
+    ...grounding.sentBack || grounding.dropped.length || grounding.triggerMissing.length ? { grounding } : {},
     ...partial,
     usage,
     durationMs: deps.now() - started
@@ -36552,11 +36556,13 @@ async function runFormalPhase(input) {
       });
       if (bad.length > 0) {
         if (round < 2 && timeLeft() >= GENERATE_RESERVE_MS / 2) {
+          grounding.sentBack++;
           previous = { source: gen.source, error: ungroundedMessage(bad.join("; ")) };
           report = null;
           continue;
         }
         const grounded = report.properties.filter((p) => basisOf(p.source, files2).ok);
+        grounding.dropped = report.properties.filter((p) => !grounded.includes(p)).map((p) => p.id);
         if (grounded.length === 0) return done({ status: "skipped", skip: "model-did-not-elaborate", detail: `no property says what it rests on: ${bad.join("; ").slice(0, 240)}`, target, model: { name: gen.name, file: rel, rounds: round } });
         report = { ...report, properties: grounded };
       }
@@ -36578,11 +36584,8 @@ async function runFormalPhase(input) {
   } catch {
   }
   const isCrash = (p) => isCrashTrace(p.trace ?? []) || /\bcrash/i.test(p.desc);
-  const skipsTrigger = new Map(report.properties.filter((p) => p.result === "counterexample").flatMap((p) => {
-    const missing = missingTrigger(p.desc, p.trace ?? []);
-    return missing ? [[p.id, missing]] : [];
-  }));
-  const cexes = report.properties.filter((p) => p.result === "counterexample" && !skipsTrigger.has(p.id)).map((p, i2) => ({ p, i: i2 })).sort((a, b) => Number(isCrash(a.p)) - Number(isCrash(b.p)) || a.i - b.i).map(({ p }) => p);
+  grounding.triggerMissing = report.properties.filter((p) => p.result === "counterexample" && missingTrigger(p.desc, p.trace ?? [])).map((p) => p.id);
+  const cexes = report.properties.filter((p) => p.result === "counterexample").map((p, i2) => ({ p, i: i2 })).sort((a, b) => Number(isCrash(a.p)) - Number(isCrash(b.p)) || a.i - b.i).map(({ p }) => p);
   const baseOf = (p) => ({ property: p.id, desc: p.desc, kind: p.kind, trace: p.trace ?? [], file: top.file, symbol: top.ai.symbol });
   const maxReplays = input.maxReplays ?? MAX_REPLAYS;
   let skipWhy = null;
@@ -36617,10 +36620,6 @@ async function runFormalPhase(input) {
       }).finally(settle);
     }
   });
-  for (const p of report.properties) {
-    const missing = skipsTrigger.get(p.id);
-    if (missing) findings.push({ ...baseOf(p), verdict: "model-only", reason: `not replayed: the property needs ${missing} first, and the counterexample has none` });
-  }
   const replayedIds = new Set(toReplay.map((p) => p.id));
   for (const p of cexes) {
     const r = byId.get(p.id);
@@ -37376,6 +37375,16 @@ async function runGuard(opts, globals) {
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
+      // Decision 81: what each property rests on (a rule, or "line"), what was
+      // sent back or dropped as ungrounded, and which counterexamples lack their
+      // property's trigger (shadow). Ids and rule names only, never code.
+      grounding: {
+        sources: (formalOutcome.properties ?? []).map((p) => /^rule:[a-z-]+$/.test(p.source) ? p.source : p.source ? "line" : "none"),
+        sent_back: formalOutcome.grounding?.sentBack ?? 0,
+        dropped: formalOutcome.grounding?.dropped ?? [],
+        // Shadow: counterexamples whose trace lacks the move their property names. Replayed anyway.
+        trigger_missing: formalOutcome.grounding?.triggerMissing ?? []
+      },
       input_tokens: formalOutcome.usage.inputTokens,
       output_tokens: formalOutcome.usage.outputTokens,
       cost_usd: formalOutcome.usage.costUsd,
@@ -39768,7 +39777,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.3-experimental.9d77663" : "dev"
+          cli_version: true ? "0.33.3-experimental.aea5331" : "dev"
         }
       });
     } catch (err2) {
@@ -41241,8 +41250,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.9d77663").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.9d77663");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.aea5331").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.aea5331");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.33.3-experimental.9d77663",
+  "version": "0.33.3-experimental.aea5331",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",