@codacy/verity-cli 0.34.0-experimental.dc0010f → 0.34.0

package/CHANGELOG.md

@@ -64,6 +64,78 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.34.0] — 2026-09-30
+
+**Formal verification at push: Verity can now prove a bug is real before it
+blocks — and the code map and the knowledge loop tell the reviewer more about
+the code around a change.**
+
+### 🧮 Formal verification, opt-in
+
+A third review at `git push`, next to the one-shot and the agent. It picks the
+riskiest function the push changed, has the Verity service write a small Lean 4
+model of it, checks the model on your machine, and replays any counterexample
+on the real code in an isolated container with the network off. **Only a
+reproduced bug blocks;** a counterexample that does not reproduce on the real
+code is reported, never enforced. Most pushes get no model at all.
+
+- **Off until you say yes.** `verity init` asks once, on a terminal, with "no"
+  as the default, and remembers either answer. `--yes` and headless runs are not
+  asked and never probe for a toolchain. `verity config formal push` turns it on
+  for a checkout, `verity config formal off` turns it off. It needs you to be
+  signed in: ranking, model writing and replay run on the Verity service. The
+  function's source is sent for the replay; no code is stored.
+- **`verity lean install | status | remove`** manages the pinned official Lean 4
+  release under `~/.verity/lean` (≈800 MB download, 2.7 GB on disk). The
+  download is checksum-verified, abandoned after 60 s with nothing received,
+  and refused up front when the disk is short. An elan install is used when it
+  already has the pinned toolchain; Verity never makes elan download one.
+- **On demand:** `verity prove candidates | generate | check | replay | auto`,
+  and the `/verity-prove <worry>` skill, where the words after the command are
+  what you want checked. Under the plugin, `/verity:verity-prove` arrives with
+  the plugin's next release.
+- **A finding holds until the code changes.** Pushing the same bytes again
+  re-blocks without a new model. `verity prove waive <file>` accepts the risk
+  for the file's current bytes, and voids when they change.
+- **Yours, never the repository's.** A `.verity/config.json` that git tracks,
+  or that is reached through a symlink, cannot switch formal verification on —
+  `verity doctor`, `verity config formal` and `verity init` say why it is off.
+  Findings and spend records a repository ships are ignored, and Lean never runs
+  on a `.verity/proofs/` workspace the repository supplies.
+- **Admins can switch it off** per project, organization or globally with the
+  `formal` flag in the dashboard; the push then reports `disabled-by-server`.
+
+### 🗺️ The code map
+
+The CLI now parses TypeScript, TSX, JavaScript, Python, Go and Java with bundled
+tree-sitter grammars (about 6 MB added to the package).
+
+- **The reviewer sees what else touches the same state.** At commit and push,
+  the review's context names the other functions that write the state a change
+  writes, and the agent reviewer can ask for a function's callers and
+  definitions. Formal verification models the exact function, not a guess at
+  its extent.
+- **Reads use the bytes under review:** at a push, the pushed commit; at a
+  commit, the staged files — not whatever is in the working tree.
+- **Paths the project denies are never shown** by the code tools or in the
+  code-map context.
+
+### 🧠 The knowledge loop
+
+- **The reviewer says what it did with each node it was shown** — applied,
+  violated, irrelevant or unclear, each tied to a line in the change — and
+  ranking learns from it which nodes help. One scorer now chooses the nodes for
+  both the review and your agent's prompt.
+- **A known rule said back to the agent.** When a change breaks a rule the
+  project has already learned, Verity can tell the agent which one. This ships
+  in shadow: the decision is made and recorded, and nothing is sent.
+- **Fewer, better nodes.** The extractor's rubric was rewritten from 143
+  human-graded nodes; it no longer records what the code already says, and it
+  checks each new node against the nearest existing ones before adding it.
+- **A failed diff in `verity memory` sync no longer drops a node edit you made.**
+- **A failed knowledge lookup no longer fails a review.** The review runs
+  without knowledge and records that it did.
+
 ### 🎯 `/verity:init` does everything `verity init` does, in the session
 
 Under the plugin, setup used to stop short of the terminal flow: `/verity:init`
@@ -89,6 +161,11 @@ sign-in meant leaving Claude Code for a terminal.
 - **`verity telemetry install|uninstall` update `.verity/setup.json`**, so a
   request deferred until sign-in stops being reported as still to do.
 
+### 🔧 Fixed
+
+- **A swapped `.verity` directory cannot redirect a write.** File writes check
+  the file they opened is the one they meant to write, after opening it.
+
 ## [0.33.3] — 2026-09-24
 
 **The knowledge seed runs once per project, not once per checkout.**

package/bin/verity.js

@@ -14628,7 +14628,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -17221,7 +17221,7 @@ function readConfigFile(path) {
     return {
       git_moments: [...new Set(moments)],
       ...source2 ? { git_moments_source: source2 } : {},
-      ...raw.formal === "push" ? { formal: "push" } : {}
+      ...raw.formal === "push" || raw.formal === "off" ? { formal: raw.formal } : {}
     };
   } catch {
     return DEFAULTS;
@@ -24152,7 +24152,7 @@ function registerConfigCommands(program2) {
   config.command("formal [state]").description('Get or set formal verification at push: "push" or "off" (needs Lean \u2014 verity lean status)').action((state) => {
     if (state === void 0) {
       const cfg = readProjectConfig();
-      process.stdout.write((cfg.formal ?? "off") + "\n");
+      process.stdout.write((cfg.formal === "push" ? "push" : "off") + "\n");
       if (cfg.formal_refused) printWarn(formalRefusalMessage(cfg.formal_refused));
       return;
     }
@@ -24160,7 +24160,7 @@ function registerConfigCommands(program2) {
       printError(`Unrecognised state: ${state}. Use "push" or "off".`);
       process.exit(1);
     }
-    writeProjectConfig({ formal: state === "push" ? "push" : void 0 });
+    writeProjectConfig({ formal: state === "push" ? "push" : "off" });
     const refused2 = state === "push" ? readProjectConfig().formal_refused : void 0;
     if (refused2) {
       printWarn(`Formal verification at push: still off \u2014 ${formalRefusalMessage(refused2)}`);
@@ -27073,7 +27073,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.0-experimental.dc0010f" : "dev";
+    return true ? "0.34.0" : "dev";
   } catch {
     return "dev";
   }
@@ -33869,6 +33869,11 @@ async function rankViaServer(candidates2, ctx, auth2) {
     cmd: "prove-rank"
   });
   if (!res.ok) return { ok: false, ranker: "luna", error: res.error, ranked: fallback };
+  const off = res.data;
+  if (off?.enabled === false) {
+    const why = typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled";
+    return { ok: false, ranker: "luna", error: `formal is off for this project (${why})`, ranked: fallback, disabled: why };
+  }
   const items = Array.isArray(res.data?.items) ? res.data.items : [];
   return { ok: true, ranker: "luna", ranked: applyAnnotations(candidates2, items), costUsd: typeof res.data?.cost_usd === "number" ? res.data.cost_usd : null };
 }
@@ -34593,6 +34598,8 @@ async function generateModel(target, opts) {
     });
     if (!res.ok) return { ok: false, error: res.error };
     const d = res.data ?? {};
+    const off = d;
+    if (off.enabled === false) return { ok: false, error: `formal is off for this project (${typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled"})` };
     if (d.error && typeof d.error === "object") return { ok: false, error: `${d.error.code ?? "SERVICE_ERROR"}: ${d.error.message ?? "the service failed"}` };
     const usage2 = d.usage && typeof d.usage === "object" ? { inputTokens: Number(d.usage.inputTokens ?? 0), outputTokens: Number(d.usage.outputTokens ?? 0) } : null;
     return acceptAnswer(d, usage2, typeof d.cost_usd === "number" ? d.cost_usd : null);
@@ -34772,8 +34779,7 @@ Rules:
 5. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
 6. Nothing you run can reach the network. Do not try.
 7. Keep it under about eight shell calls. Output tokens are time.
-8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters), impact (one word, below).
-9. impact \u2014 AFTER the verdict, and never a reason to change it: what the violation you ran costs a user of this code, the most serious one the run showed. money: a balance, charge, refund, price or stock is wrong. access: someone gets access they should not have, or an auth check is bypassed. data: a user's records are lost, corrupted or wrongly duplicated. external: an effect outside the system happens twice or never (a charge, an email, a shipment, a webhook). count: a counter, metric or statistic is off. cache: a cached or derived value is stale until it refreshes. internal: the program's own bookkeeping is off, with no effect a user would see. none: the verdict is not reproduced.
+8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
 
 "reproduced" means the real code, driven by the trace, reached the property violation the model describes. "diverged" means it did not \u2014 the model is wrong about the code, which is a useful answer. "unreplayable" means you could not run the real function faithfully; say why.`;
 var REPLAY_SCHEMA = {
@@ -34791,10 +34797,9 @@ var REPLAY_SCHEMA = {
         required: ["path", "lines"]
       }
     },
-    executed_output: { type: "string" },
-    impact: { type: "string", enum: ["money", "access", "data", "external", "count", "cache", "internal", "none"] }
+    executed_output: { type: "string" }
   },
-  required: ["verdict", "reason", "harness_files", "executed_output", "impact"]
+  required: ["verdict", "reason", "harness_files", "executed_output"]
 };
 function renderBriefInput(brief) {
   const p = brief.property;
@@ -34821,8 +34826,6 @@ function renderBriefInput(brief) {
   }
   return parts2.join("\n");
 }
-var IMPACTS = ["money", "access", "data", "external", "count", "cache", "internal", "none"];
-var isImpact = (v) => typeof v === "string" && IMPACTS.includes(v);
 function stringsIn(value, out2 = [], depth = 0) {
   if (depth > 8) return out2;
   if (typeof value === "string") out2.push(value);
@@ -34864,8 +34867,7 @@ function parseReplayOutput(output) {
           verdict,
           reason: typeof o.reason === "string" ? o.reason.slice(0, 2e3) : "",
           harness_files: Array.isArray(o.harness_files) ? o.harness_files.filter((f) => typeof f.path === "string").map((f) => ({ path: String(f.path).slice(0, 200), lines: Number.isInteger(f.lines) ? f.lines : 0 })) : [],
-          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : "",
-          impact: isImpact(o.impact) ? o.impact : "none"
+          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : ""
         };
       }
     } catch {
@@ -34873,10 +34875,10 @@ function parseReplayOutput(output) {
   }
   return { claim, shellCalls, executedCalls, shellTexts, outputTexts };
 }
-var RESULT_LINE = /REPLAY_RESULT=(reproduced|diverged)\b/;
+var RESULT_LINE = /REPLAY_RESULT=(reproduced|diverged)\b/g;
 function printedResult(outputTexts) {
   let last = null;
-  for (const t of outputTexts) for (const m of t.matchAll(new RegExp(RESULT_LINE.source, "g"))) last = m[1];
+  for (const t of outputTexts) for (const m of t.matchAll(RESULT_LINE)) last = m[1];
   return last;
 }
 var RESULT_MISSING = "the harness never printed REPLAY_RESULT=reproduced on its own stdout \u2014 the verdict was the model's word, not the run's";
@@ -35066,7 +35068,6 @@ async function runReplayInContainer(brief, opts) {
       ...judged,
       executedCalls,
       shellCalls,
-      ...judged.verdict === "reproduced" && parsed.claim ? { impact: parsed.claim.impact } : {},
       executedOutput: parsed.claim?.executed_output ?? "",
       harnessFiles: parsed.claim?.harness_files ?? [],
       usage,
@@ -35113,6 +35114,11 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     return { claimed: null, verdict: "unverified", reason: "", downgrade: res.error, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: res.error };
   }
   const d = res.data ?? {};
+  if (d.enabled === false) {
+    const why = d.reason;
+    const msg = `formal is off for this project (${typeof why === "string" ? why.slice(0, 40) : "disabled"})`;
+    return { claimed: null, verdict: "unverified", reason: "", downgrade: msg, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: msg };
+  }
   if (d.error && typeof d.error === "object") {
     const e = d.error;
     const msg = `${e.code ?? "SERVICE_ERROR"}: ${e.message ?? "the service failed"}`;
@@ -35125,7 +35131,6 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     verdict: verdict === "reproduced" || verdict === "diverged" || verdict === "unreplayable" ? verdict : "unverified",
     reason: typeof d.reason === "string" ? d.reason : "",
     downgrade: typeof d.downgrade === "string" ? d.downgrade : null,
-    ...isImpact(d.impact) ? { impact: d.impact } : {},
     executedCalls: Number(d.executed_calls ?? 0),
     shellCalls: Number(d.shell_calls ?? 0),
     verbatim: { covered: Number(v.covered ?? 0), total: Number(v.total ?? 0), ratio: Number(v.ratio ?? 0), basis: v.basis === "symbol" || v.basis === "file" ? v.basis : "none" },
@@ -35910,9 +35915,10 @@ function verityLeanHome(env = process.env) {
 function findToolchain(env = process.env) {
   const managedBin = (0, import_node_path43.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
   const elanBin = (0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const path = [managedBin, elanBin, env.PATH ?? ""].filter(Boolean).join(import_node_path43.delimiter);
-  const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const elanHas = (0, import_node_fs58.existsSync)((0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const userPath = (env.PATH ?? "").split(import_node_path43.delimiter).filter((d) => d && (elanHas || (0, import_node_path43.resolve)(d) !== (0, import_node_path43.resolve)(elanBin)));
+  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path43.delimiter);
+  const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
   const candidates2 = [(0, import_node_path43.join)(managedBin, exe), ...elanHas ? [(0, import_node_path43.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
@@ -36107,33 +36113,18 @@ function writeResult(root, report) {
 function isCrashTrace(trace) {
   return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
 }
-var SEVERITY_BY_IMPACT = {
-  money: "high",
-  access: "high",
-  data: "high",
-  external: "high",
-  count: "medium",
-  cache: "medium",
-  internal: "medium",
-  // A reproduced finding always has a real code; 'none' here is a malformed answer, so it blocks.
-  none: "high"
-};
-function formalSeverity(f) {
-  return f.impact && SEVERITY_BY_IMPACT[f.impact] || "high";
-}
 function mergeFormalFindings(response, outcome, pushedFiles) {
-  if (!outcome) return { blocking: 0, warning: 0 };
+  if (!outcome) return { blocking: 0 };
   const norm2 = (p) => p.replace(/\\/g, "/");
   const pushed = new Set(pushedFiles.map(norm2));
-  const reproduced = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
-  if (reproduced.length === 0) return { blocking: 0, warning: 0 };
-  const blocking = reproduced.filter((f) => formalSeverity(f) === "high");
+  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
+  if (blocking.length === 0) return { blocking: 0 };
   const existing = Array.isArray(response.findings) ? response.findings : [];
   response.findings = [
     ...existing,
-    ...reproduced.map((f) => ({
+    ...blocking.map((f) => ({
       pattern_id: "formal-counterexample",
-      severity: formalSeverity(f),
+      severity: "high",
       scope: "change",
       file: f.file,
       line: outcome.target?.lines?.from ?? null,
@@ -36141,15 +36132,14 @@ function mergeFormalFindings(response, outcome, pushedFiles) {
       // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
       // crash between two writes is labelled: reproducing it means injecting
       // the crash, so it is a crash-consistency finding, not a race.
-      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code${f.impact && f.impact !== "none" ? ` (impact: ${f.impact})` : ""}`,
+      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
       description: terminalText(f.reason ?? "", 2e3),
       fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
       source: "formal"
     }))
   ];
-  if (blocking.length > 0) response.gate_decision = "FAIL";
-  else if (response.gate_decision === "PASS" || response.gate_decision == null) response.gate_decision = "WARN";
-  return { blocking: blocking.length, warning: reproduced.length - blocking.length };
+  if (response.gate_decision !== "FAIL") response.gate_decision = "FAIL";
+  return { blocking: blocking.length };
 }
 
 // src/lib/prove/scalpel.ts
@@ -36468,9 +36458,7 @@ async function runFormalPhase(input) {
         symbol: f.symbol,
         verdict: "reproduced",
         reason: f.waived ? `waived ${f.waived.at.slice(0, 10)}: ${f.waived.reason} (standing since ${f.at.slice(0, 10)}; the file has not changed)` : `${f.reason ?? "reproduced on the real code"} (standing since ${f.at.slice(0, 10)}; the file has not changed)`,
-        ...f.waived ? { waived: true } : {},
-        // A hand-edited file cannot invent a code: unknown values read as absent (HIGH).
-        ...isImpact(f.impact) ? { impact: f.impact } : {}
+        ...f.waived ? { waived: true } : {}
       });
     }
   }
@@ -36509,6 +36497,7 @@ async function runFormalPhase(input) {
     return done({ status: "skipped", skip: "not-eligible", detail: `${best.file}: ${isEligible(best, largePush).why}` });
   }
   const ranked = await deps.rank(eligible, root, input.changedLines);
+  if (!ranked.ok && ranked.disabled) return done({ status: "skipped", skip: "disabled-by-server", detail: ranked.error });
   if (ranked.ok) spend(ranked);
   candidates2 = ranked.ranked.slice(0, 5).map((c) => ({ file: c.file, symbol: c.ai?.symbol ?? null, score: c.ai?.score ?? null, criteria: c.ai?.criteria ?? null, reasked: !!c.ai?.reasked, reasons: (c.ai?.reasons ?? []).map((r) => r.slice(0, 200)) }));
   if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off after ranking" });
@@ -36743,7 +36732,7 @@ async function runFormalPhase(input) {
       continue;
     }
     const verdict = r.verdict === "reproduced" ? "reproduced" : r.verdict === "diverged" ? "diverged" : r.verdict === "unreplayable" ? "model-only" : "unverified";
-    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0, ...verdict === "reproduced" && r.impact ? { impact: r.impact } : {} });
+    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0 });
   }
   const reproduced = findings.filter((f) => f.verdict === "reproduced");
   if (reproduced.length > 0 && !cancelled()) {
@@ -36751,7 +36740,7 @@ async function runFormalPhase(input) {
     const others = readPersistedFindings(root).filter((f) => f.file !== top.file);
     writePersistedFindings(root, [
       ...others,
-      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...f.impact ? { impact: f.impact } : {}, ...lines ? { lines } : {}, at: now }))
+      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...lines ? { lines } : {}, at: now }))
     ]);
   }
   const clean2 = findings.every((f) => f.verdict === "diverged");
@@ -37491,8 +37480,6 @@ async function runGuard(opts, globals) {
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
-      // Decision 82: the replay's impact code per reproduced finding; count/cache/internal warn, the rest block.
-      impacts: formalOutcome.findings.filter((f) => f.impact).map((f) => `${f.property}:${f.impact}`),
       // Decision 81: what each property rests on (a rule, or "line"), what was
       // sent back or dropped as ungrounded, and which counterexamples lack their
       // property's trigger (shadow). Ids and rule names only, never code.
@@ -38802,6 +38789,22 @@ var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
 var LEAN_DOWNLOAD_SIZE = "\u2248800 MB download, 2.7 GB on disk";
+var DOWNLOAD_STALL_MS = 6e4;
+var LEAN_DISK_NEEDED_BYTES = 3.75 * 1024 ** 3;
+function freeBytes(dir) {
+  let d = dir;
+  for (let i2 = 0; i2 < 64; i2++) {
+    try {
+      const st = (0, import_node_fs63.statfsSync)(d);
+      return Number(st.bavail) * Number(st.bsize);
+    } catch {
+      const up = (0, import_node_path47.join)(d, "..");
+      if (up === d) return null;
+      d = up;
+    }
+  }
+  return null;
+}
 var LEAN_ASSET_SHA256 = {
   "v4.34.0": {
     "lean-4.34.0-darwin.zip": "75a2a4b8e3d35680e8f51fae5a42c79702f463dd73ee1520fb61e5a9143e336c",
@@ -38860,17 +38863,32 @@ function unzip(zip, dest) {
   }
   return { ok: false, error: errors.join("; ") };
 }
-async function download(url, dest, onProgress) {
-  const res = await fetch(url, { redirect: "follow" });
-  if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status}`);
-  const total = Number(res.headers.get("content-length")) || null;
-  let seen = 0;
-  const stream = import_node_stream.Readable.fromWeb(res.body);
-  stream.on("data", (chunk) => {
-    seen += chunk.length;
-    onProgress(seen, total);
-  });
-  await (0, import_promises18.pipeline)(stream, (0, import_node_fs63.createWriteStream)(dest));
+async function download(url, dest, onProgress, stallMs = DOWNLOAD_STALL_MS) {
+  const ctrl = new AbortController();
+  let timer;
+  const arm = () => {
+    clearTimeout(timer);
+    timer = setTimeout(() => ctrl.abort(), stallMs);
+  };
+  arm();
+  try {
+    const res = await fetch(url, { redirect: "follow", signal: ctrl.signal });
+    if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status}`);
+    const total = Number(res.headers.get("content-length")) || null;
+    let seen = 0;
+    const stream = import_node_stream.Readable.fromWeb(res.body);
+    stream.on("data", (chunk) => {
+      arm();
+      seen += chunk.length;
+      onProgress(seen, total);
+    });
+    await (0, import_promises18.pipeline)(stream, (0, import_node_fs63.createWriteStream)(dest), { signal: ctrl.signal });
+  } catch (err2) {
+    if (ctrl.signal.aborted) throw new Error(`download stalled: nothing received for ${Math.round(stallMs / 1e3)} s`);
+    throw err2;
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function inPlaceProgress(label2, write = (s) => process.stderr.write(s)) {
   let active = false;
@@ -38908,6 +38926,12 @@ async function installLean(opts = {}) {
   const dir = pinnedVersionDir(env);
   const url = `${RELEASES}/${pinnedVersion()}/${asset}`;
   const home = verityLeanHome(env);
+  const free = freeBytes(home);
+  const needed = opts.minFreeBytes ?? LEAN_DISK_NEEDED_BYTES;
+  if (free !== null && free < needed) {
+    const gb = (n) => (n / 1024 ** 3).toFixed(1);
+    return { ok: false, error: `not enough disk space for Lean: ${gb(free)} GB free where ${home} lives, needs about ${gb(needed)} GB` };
+  }
   const tmp = (0, import_node_path47.join)(home, ".tmp");
   (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
   (0, import_node_fs63.mkdirSync)(tmp, { recursive: true });
@@ -39216,8 +39240,10 @@ var INTENSITY_CHOICES = [
   { id: "thorough", label: "thorough", hint: "all tools, all rules (~15s)" }
 ];
 var FORMAL_CHOICES = [
-  { id: "yes", label: "yes", hint: "a Lean model of the riskiest changed function; blocks only on a REPRODUCED counterexample", recommended: true },
-  { id: "no", label: "no", hint: "enable later with: verity config formal push" }
+  { id: "yes", label: "yes", hint: "a Lean model of the riskiest changed function; blocks only on a REPRODUCED counterexample" },
+  // No is the default (review of #255): "yes" downloads ≈800 MB and unpacks
+  // 2.7 GB, and a bare Enter must never do that.
+  { id: "no", label: "no", hint: "enable later with: verity config formal push", recommended: true }
 ];
 var MOMENT_CHOICES = [
   { id: "stop", label: "On stop", hint: "after every agent turn \u2014 fast feedback while you work", recommended: true },
@@ -39623,16 +39649,20 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
     printWarn(`  Formal verification: off \u2014 ${formalRefusalMessage(cfg.formal_refused)}`);
     return;
   }
-  const toolchain = findToolchain();
   if (cfg.formal === "push") {
-    if (toolchain) printInfo("  Formal verification at push \u2713");
+    if (findToolchain()) printInfo("  Formal verification at push \u2713");
     else printWarn("  Formal verification is on but Lean is missing \u2014 run: verity lean install");
     return;
   }
+  if (cfg.formal === "off") {
+    printInfo("  Formal verification: off (enable with: verity config formal push)");
+    return;
+  }
   if (defaultsOnly || !interactive()) {
     printInfo("  Formal verification (a model-based bug finder at push): off \u2014 enable with: verity config formal push");
     return;
   }
+  const toolchain = findToolchain();
   console.log("");
   console.log("  Formal verification review \u2014 a model-based bug finder for your riskiest code.");
   console.log("    At push, Verity picks the riskiest changed function, checks a small model of");
@@ -39640,9 +39670,10 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
   console.log("    Verity for that). Only a reproduced bug can block; most pushes get no model.");
   console.log(`    Adds /verity-prove <worry> to check any code on demand.${toolchain ? "" : ` Needs to install Lean 4 (${LEAN_DOWNLOAD_SIZE}) on "yes".`}`);
   console.log("");
-  const wants = await promptChoice("Formal verification at push?", FORMAL_CHOICES, "yes");
+  const wants = await promptChoice("Formal verification at push?", FORMAL_CHOICES, "no");
   if (wants === "yes" && pluginMode) printInfo("  Plugin: the push check works now; /verity:verity-prove arrives with the plugin's next release.");
   if (wants !== "yes") {
+    writeProjectConfig({ formal: "off" });
     printInfo("  Formal verification: off (enable later with: verity config formal push)");
     return;
   }
@@ -39901,7 +39932,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.0-experimental.dc0010f" : "dev"
+          cli_version: true ? "0.34.0" : "dev"
         }
       });
     } catch (err2) {
@@ -41374,8 +41405,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.dc0010f").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.dc0010f");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.0-experimental.dc0010f",
+  "version": "0.34.0",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",