@codacy/verity-cli 0.33.3-experimental.f081164 → 0.34.0-experimental.007b74f

package/bin/verity.js

@@ -27021,7 +27021,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.3-experimental.f081164" : "dev";
+    return true ? "0.34.0-experimental.007b74f" : "dev";
   } catch {
     return "dev";
   }
@@ -34334,11 +34334,11 @@ STEP 3 \u2014 Properties: 2 to 4, in this order of priority:
   4. conservation \u2014 money, stock and counts add up: parts sum to the total, nothing credited twice or lost, no row skipped;
   5. progress \u2014 no deadlock, nothing stuck forever, retries end;
   6. crash consistency \u2014 AT MOST ONE, listed LAST: "after a crash between X and Y and the recovery the code relies on, \u2026", or, where nothing recovers, only when the crash loses money or records for good.
-  A property must be something the code PROMISES. An operation whose job is to apply an effect on every call (a withdrawal, a charge, a send) promises "no double effect" only where the code dedups it (an idempotency key, a unique insert, a conditional update). When a comment says duplicates are by design (consumers dedupe on an id), do not claim "no double effect". An upsert, a set-to-value or a delete applied twice is not a double effect.
+  A property must be something the code PROMISES. An operation whose job is to apply an effect on every call (a withdrawal, a charge, a send) promises "no double effect" where the code dedups it (an idempotency key, a unique insert, a conditional update), or where the SAME input \u2014 one that carries its own event, message, delivery or request id \u2014 can be delivered or retried twice; there a missing dedup is the bug. Two calls whose input carries no such identity are two operations, not a double effect. When a comment says duplicates are by design (consumers dedupe on an id), do not claim "no double effect". An upsert, a set-to-value or a delete applied twice is not a double effect.
   A counterexample must run the real function: a trace made only of environment moves (another writer, a clock) says nothing about this code. A promise about the END result (nothing lost, nothing charged twice, totals add up) is checked on states where every invocation has finished or crashed \u2014 guard the \`inv\` with the program counters, as exemplar 2's second property does; a violation that exists only while work is still pending is not a bug.
   A property is about an OUTCOME someone would call a bug \u2014 money, stock or records wrong, access granted, work lost or done twice, a job stuck forever \u2014 never about the mechanism's internals (a key's format, two timestamps being distinct, a lease's exact boundary tick). A comment that says HOW the code works ("make each attempt's key unique") is not the promise; the promise is what that mechanism is for.
-  A comment that states a SAFE design choice ("a spent token presented again ends every session", "consumers dedupe, so publishing twice is harmless") is the design: never claim the opposite. A comment never makes an UNSAFE outcome safe: granting access on an error, losing or double-counting money, stock or records is a bug whatever the comment says ("don't block people when the permission service is flaky" describes a fail-open bug).
-  Every property says what it rests on, in \`source\`: either \`L<n>: <words copied from that line>\` \u2014 a line of the numbered source above (a comment, docstring, check, error message or name) that states the promise \u2014 or one rule: \`rule:conservation\` (money, stock or counts add up), \`rule:once\` (no double effect, only where the code dedups, as above), \`rule:no-lost-update\`, \`rule:fail-closed\` (an error never grants access or reports success), \`rule:progress\` (nothing stuck forever). A property that neither a line nor one of these rules supports is not a promise: do not state it. A property whose \`source\` is empty, or cites words its line does not contain, sends the model back.
+  A comment that states a SAFE design choice ("a spent token presented again ends every session", "consumers dedupe, so publishing twice is harmless") is the design: never claim the opposite. A comment never makes an UNSAFE outcome safe: granting access on an error, losing or double-counting money, stock or records is a bug whatever the comment says ("don't block people when the permission service is flaky" describes a fail-open bug). Fail-open means an ACCESS decision: running WITHOUT an optional check when the check itself is unavailable, and saying so (a warning, a log line), is a stated degradation, not a fail-open \u2014 never claim it must fail closed.
+  Every property says what it rests on, in \`source\`: either \`L<n>: <words copied from that line>\` \u2014 a line of the numbered source above (a comment, docstring, check, error message or name) that states the promise \u2014 or one rule: \`rule:conservation\` (money, stock or counts add up), \`rule:once\` (no double effect: where the code dedups, or where the SAME input can arrive twice \u2014 an input that carries its own identity, such as an event, message, delivery or request id, redelivered or retried \u2014 even when the code has no dedup at all; a missing dedup is the bug, not a reason to drop the property. Two calls whose input carries no such identity are two operations: reserving a seat twice or creating a record twice from two requests is what the caller asked for, not a double effect), \`rule:no-lost-update\`, \`rule:fail-closed\` (an error in an access decision never grants access; an operation that failed is never reported as done), \`rule:progress\` (nothing stuck forever). A property that neither a line nor one of these rules supports is not a promise: do not state it. A property whose \`source\` is empty, or cites words its line does not contain, sends the model back.
   When the input lists where the function is called, a caller's guard bounds its inputs: never build a counterexample from an input no caller can pass (an empty list a caller refuses).
   Property ids name the promise in snake_case (refund_total_within_capture) \u2014 never P1. \`desc\` states the promise in the code's own terms and names the move the trace needs ("two concurrent calls \u2026", "after the charge succeeded and the call timed out \u2026").
   A PURE computation (no effect sites) is checked with \`Verity.checkData\` on small concrete inputs, including the edge cases (exemplar 3).
@@ -34720,7 +34720,8 @@ Rules:
 5. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
 6. Nothing you run can reach the network. Do not try.
 7. Keep it under about eight shell calls. Output tokens are time.
-8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
+8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters), impact (one word, below).
+9. impact \u2014 AFTER the verdict, and never a reason to change it: what the violation you ran costs a user of this code, the most serious one the run showed. money: a balance, charge, refund, price or stock is wrong. access: someone gets access they should not have, or an auth check is bypassed. data: a user's records are lost, corrupted or wrongly duplicated. external: an effect outside the system happens twice or never (a charge, an email, a shipment, a webhook). count: a counter, metric or statistic is off. cache: a cached or derived value is stale until it refreshes. internal: the program's own bookkeeping is off, with no effect a user would see. none: the verdict is not reproduced.
 
 "reproduced" means the real code, driven by the trace, reached the property violation the model describes. "diverged" means it did not \u2014 the model is wrong about the code, which is a useful answer. "unreplayable" means you could not run the real function faithfully; say why.`;
 var REPLAY_SCHEMA = {
@@ -34738,9 +34739,10 @@ var REPLAY_SCHEMA = {
         required: ["path", "lines"]
       }
     },
-    executed_output: { type: "string" }
+    executed_output: { type: "string" },
+    impact: { type: "string", enum: ["money", "access", "data", "external", "count", "cache", "internal", "none"] }
   },
-  required: ["verdict", "reason", "harness_files", "executed_output"]
+  required: ["verdict", "reason", "harness_files", "executed_output", "impact"]
 };
 function renderBriefInput(brief) {
   const p = brief.property;
@@ -34767,6 +34769,8 @@ function renderBriefInput(brief) {
   }
   return parts2.join("\n");
 }
+var IMPACTS = ["money", "access", "data", "external", "count", "cache", "internal", "none"];
+var isImpact = (v) => typeof v === "string" && IMPACTS.includes(v);
 function stringsIn(value, out2 = [], depth = 0) {
   if (depth > 8) return out2;
   if (typeof value === "string") out2.push(value);
@@ -34808,7 +34812,8 @@ function parseReplayOutput(output) {
           verdict,
           reason: typeof o.reason === "string" ? o.reason.slice(0, 2e3) : "",
           harness_files: Array.isArray(o.harness_files) ? o.harness_files.filter((f) => typeof f.path === "string").map((f) => ({ path: String(f.path).slice(0, 200), lines: Number.isInteger(f.lines) ? f.lines : 0 })) : [],
-          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : ""
+          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : "",
+          impact: isImpact(o.impact) ? o.impact : "none"
         };
       }
     } catch {
@@ -35009,6 +35014,7 @@ async function runReplayInContainer(brief, opts) {
       ...judged,
       executedCalls,
       shellCalls,
+      ...judged.verdict === "reproduced" && parsed.claim ? { impact: parsed.claim.impact } : {},
       executedOutput: parsed.claim?.executed_output ?? "",
       harnessFiles: parsed.claim?.harness_files ?? [],
       usage,
@@ -35067,6 +35073,7 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     verdict: verdict === "reproduced" || verdict === "diverged" || verdict === "unreplayable" ? verdict : "unverified",
     reason: typeof d.reason === "string" ? d.reason : "",
     downgrade: typeof d.downgrade === "string" ? d.downgrade : null,
+    ...isImpact(d.impact) ? { impact: d.impact } : {},
     executedCalls: Number(d.executed_calls ?? 0),
     shellCalls: Number(d.shell_calls ?? 0),
     verbatim: { covered: Number(v.covered ?? 0), total: Number(v.total ?? 0), ratio: Number(v.ratio ?? 0), basis: v.basis === "symbol" || v.basis === "file" ? v.basis : "none" },
@@ -36021,18 +36028,33 @@ function writeResult(root, report) {
 function isCrashTrace(trace) {
   return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
 }
+var SEVERITY_BY_IMPACT = {
+  money: "high",
+  access: "high",
+  data: "high",
+  external: "high",
+  count: "medium",
+  cache: "medium",
+  internal: "medium",
+  // A reproduced finding always has a real code; 'none' here is a malformed answer, so it blocks.
+  none: "high"
+};
+function formalSeverity(f) {
+  return f.impact && SEVERITY_BY_IMPACT[f.impact] || "high";
+}
 function mergeFormalFindings(response, outcome, pushedFiles) {
-  if (!outcome) return { blocking: 0 };
+  if (!outcome) return { blocking: 0, warning: 0 };
   const norm2 = (p) => p.replace(/\\/g, "/");
   const pushed = new Set(pushedFiles.map(norm2));
-  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
-  if (blocking.length === 0) return { blocking: 0 };
+  const reproduced = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
+  if (reproduced.length === 0) return { blocking: 0, warning: 0 };
+  const blocking = reproduced.filter((f) => formalSeverity(f) === "high");
   const existing = Array.isArray(response.findings) ? response.findings : [];
   response.findings = [
     ...existing,
-    ...blocking.map((f) => ({
+    ...reproduced.map((f) => ({
       pattern_id: "formal-counterexample",
-      severity: "high",
+      severity: formalSeverity(f),
       scope: "change",
       file: f.file,
       line: outcome.target?.lines?.from ?? null,
@@ -36040,14 +36062,15 @@ function mergeFormalFindings(response, outcome, pushedFiles) {
       // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
       // crash between two writes is labelled: reproducing it means injecting
       // the crash, so it is a crash-consistency finding, not a race.
-      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
+      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code${f.impact && f.impact !== "none" ? ` (impact: ${f.impact})` : ""}`,
       description: terminalText(f.reason ?? "", 2e3),
       fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
       source: "formal"
     }))
   ];
-  if (response.gate_decision !== "FAIL") response.gate_decision = "FAIL";
-  return { blocking: blocking.length };
+  if (blocking.length > 0) response.gate_decision = "FAIL";
+  else if (response.gate_decision === "PASS" || response.gate_decision == null) response.gate_decision = "WARN";
+  return { blocking: blocking.length, warning: reproduced.length - blocking.length };
 }
 
 // src/lib/prove/scalpel.ts
@@ -36356,7 +36379,9 @@ async function runFormalPhase(input) {
         symbol: f.symbol,
         verdict: "reproduced",
         reason: f.waived ? `waived ${f.waived.at.slice(0, 10)}: ${f.waived.reason} (standing since ${f.at.slice(0, 10)}; the file has not changed)` : `${f.reason ?? "reproduced on the real code"} (standing since ${f.at.slice(0, 10)}; the file has not changed)`,
-        ...f.waived ? { waived: true } : {}
+        ...f.waived ? { waived: true } : {},
+        // A hand-edited file cannot invent a code: unknown values read as absent (HIGH).
+        ...isImpact(f.impact) ? { impact: f.impact } : {}
       });
     }
   }
@@ -36629,7 +36654,7 @@ async function runFormalPhase(input) {
       continue;
     }
     const verdict = r.verdict === "reproduced" ? "reproduced" : r.verdict === "diverged" ? "diverged" : r.verdict === "unreplayable" ? "model-only" : "unverified";
-    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0 });
+    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0, ...verdict === "reproduced" && r.impact ? { impact: r.impact } : {} });
   }
   const reproduced = findings.filter((f) => f.verdict === "reproduced");
   if (reproduced.length > 0 && !cancelled()) {
@@ -36637,7 +36662,7 @@ async function runFormalPhase(input) {
     const others = readPersistedFindings(root).filter((f) => f.file !== top.file);
     writePersistedFindings(root, [
       ...others,
-      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...lines ? { lines } : {}, at: now }))
+      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...f.impact ? { impact: f.impact } : {}, ...lines ? { lines } : {}, at: now }))
     ]);
   }
   const clean2 = findings.every((f) => f.verdict === "diverged");
@@ -37375,6 +37400,8 @@ async function runGuard(opts, globals) {
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
+      // Decision 82: the replay's impact code per reproduced finding; count/cache/internal warn, the rest block.
+      impacts: formalOutcome.findings.filter((f) => f.impact).map((f) => `${f.property}:${f.impact}`),
       // Decision 81: what each property rests on (a rule, or "line"), what was
       // sent back or dropped as ungrounded, and which counterexamples lack their
       // property's trigger (shadow). Ids and rule names only, never code.
@@ -39777,7 +39804,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.3-experimental.f081164" : "dev"
+          cli_version: true ? "0.34.0-experimental.007b74f" : "dev"
         }
       });
     } catch (err2) {
@@ -41250,8 +41277,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.f081164").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.f081164");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.007b74f").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.007b74f");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.33.3-experimental.f081164",
+  "version": "0.34.0-experimental.007b74f",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",