@codacy/verity-cli 0.34.0-experimental.6aa7092 → 0.34.0-experimental.6f579cf

package/CHANGELOG.md

@@ -64,6 +64,78 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.34.0] — 2026-09-30
+
+**Formal verification at push: Verity can now prove a bug is real before it
+blocks — and the code map and the knowledge loop tell the reviewer more about
+the code around a change.**
+
+### 🧮 Formal verification, opt-in
+
+A third review at `git push`, next to the one-shot and the agent. It picks the
+riskiest function the push changed, has the Verity service write a small Lean 4
+model of it, checks the model on your machine, and replays any counterexample
+on the real code in an isolated container with the network off. **Only a
+reproduced bug blocks;** a counterexample that does not reproduce on the real
+code is reported, never enforced. Most pushes get no model at all.
+
+- **Off until you say yes.** `verity init` asks once, on a terminal, with "no"
+  as the default, and remembers either answer. `--yes` and headless runs are not
+  asked and never probe for a toolchain. `verity config formal push` turns it on
+  for a checkout, `verity config formal off` turns it off. It needs you to be
+  signed in: ranking, model writing and replay run on the Verity service. The
+  function's source is sent for the replay; no code is stored.
+- **`verity lean install | status | remove`** manages the pinned official Lean 4
+  release under `~/.verity/lean` (≈800 MB download, 2.7 GB on disk). The
+  download is checksum-verified, abandoned after 60 s with nothing received,
+  and refused up front when the disk is short. An elan install is used when it
+  already has the pinned toolchain; Verity never makes elan download one.
+- **On demand:** `verity prove candidates | generate | check | replay | auto`,
+  and the `/verity-prove <worry>` skill, where the words after the command are
+  what you want checked. Under the plugin, `/verity:verity-prove` arrives with
+  the plugin's next release.
+- **A finding holds until the code changes.** Pushing the same bytes again
+  re-blocks without a new model. `verity prove waive <file>` accepts the risk
+  for the file's current bytes, and voids when they change.
+- **Yours, never the repository's.** A `.verity/config.json` that git tracks,
+  or that is reached through a symlink, cannot switch formal verification on —
+  `verity doctor`, `verity config formal` and `verity init` say why it is off.
+  Findings and spend records a repository ships are ignored, and Lean never runs
+  on a `.verity/proofs/` workspace the repository supplies.
+- **Admins can switch it off** per project, organization or globally with the
+  `formal` flag in the dashboard; the push then reports `disabled-by-server`.
+
+### 🗺️ The code map
+
+The CLI now parses TypeScript, TSX, JavaScript, Python, Go and Java with bundled
+tree-sitter grammars (about 6 MB added to the package).
+
+- **The reviewer sees what else touches the same state.** At commit and push,
+  the review's context names the other functions that write the state a change
+  writes, and the agent reviewer can ask for a function's callers and
+  definitions. Formal verification models the exact function, not a guess at
+  its extent.
+- **Reads use the bytes under review:** at a push, the pushed commit; at a
+  commit, the staged files — not whatever is in the working tree.
+- **Paths the project denies are never shown** by the code tools or in the
+  code-map context.
+
+### 🧠 The knowledge loop
+
+- **The reviewer says what it did with each node it was shown** — applied,
+  violated, irrelevant or unclear, each tied to a line in the change — and
+  ranking learns from it which nodes help. One scorer now chooses the nodes for
+  both the review and your agent's prompt.
+- **A known rule said back to the agent.** When a change breaks a rule the
+  project has already learned, Verity can tell the agent which one. This ships
+  in shadow: the decision is made and recorded, and nothing is sent.
+- **Fewer, better nodes.** The extractor's rubric was rewritten from 143
+  human-graded nodes; it no longer records what the code already says, and it
+  checks each new node against the nearest existing ones before adding it.
+- **A failed diff in `verity memory` sync no longer drops a node edit you made.**
+- **A failed knowledge lookup no longer fails a review.** The review runs
+  without knowledge and records that it did.
+
 ### 🎯 `/verity:init` does everything `verity init` does, in the session
 
 Under the plugin, setup used to stop short of the terminal flow: `/verity:init`
@@ -89,6 +161,11 @@ sign-in meant leaving Claude Code for a terminal.
 - **`verity telemetry install|uninstall` update `.verity/setup.json`**, so a
   request deferred until sign-in stops being reported as still to do.
 
+### 🔧 Fixed
+
+- **A swapped `.verity` directory cannot redirect a write.** File writes check
+  the file they opened is the one they meant to write, after opening it.
+
 ## [0.33.3] — 2026-09-24
 
 **The knowledge seed runs once per project, not once per checkout.**

package/README.md

@@ -172,11 +172,13 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | **Knowledge** | |
 | `verity reflect` | Trigger knowledge extraction for current task |
 | `verity reflect --user-input "..."` | Save a human reflection as a knowledge node |
+| `verity reflect --user-input -` | Same, reading the text from stdin, so it never passes through shell quoting |
 | `verity reflect --kind decision` | Specify the node kind |
 | `verity memory untrack` | Stop committing `.verity/memory/` — the graph stays on disk and leaves your diffs |
 | `verity memory track` | Commit the graph on purpose, and record that so nothing offers to change it |
 | **Feedback** | |
 | `verity feedback message "text"` | Send general feedback |
+| `verity feedback message -` | Same, reading the message from stdin |
 | `verity feedback finding <run-id> <pattern-id> <action>` | Per-finding feedback |
 | **Tasks** | |
 | `verity task list` | List tasks |