@codacy/verity-cli 0.34.0-experimental.ec5aae9 → 0.34.1-experimental.542af3d

package/CHANGELOG.md

@@ -64,6 +64,33 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.34.1] — 2026-10-08
+
+**Fixes from user feedback: large changes get reviewed again, and `verity init`
+sets up the right tools.**
+
+### 🐛 Fixes
+
+- **Large changes are reviewed again.** On large requests the Verity service
+  could run out of CPU time and answer HTTP 546, so the change went unreviewed.
+  The service now bounds the work it does per request. The CLI no longer treats
+  a 546 as a cold start and does not retry it.
+- **Reviews answer sooner.** The service sends the review first and writes its
+  records after the answer.
+- **Your home directory is not a project.** A session started in your home
+  directory no longer sends requests to the service.
+- **The commit and push gate no longer reviews Verity's own skills.** It skips
+  a `.claude/skills/verity-*` file only when it matches the installed copy byte
+  for byte. A skill that you edited is still reviewed.
+- **`verity init` finds your languages before your first commit.** It counts
+  files that git does not track yet, but not the files that it installs itself.
+- **No `no-undef` on runtime globals.** The ESLint configuration no longer
+  reports `process`, `console` and other runtime globals as undefined.
+- **Long sessions no longer grow the session ledger on every turn.**
+- **Clearer text** in the formal verification review menu. `verity init` under
+  Claude Code now ends at step `[9/9]`.
+- Includes security fixes.
+
 ## [0.34.0] — 2026-09-30
 
 **Formal verification at push: Verity can now prove a bug is real before it

package/bin/verity.js

@@ -27257,7 +27257,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.0-experimental.ec5aae9" : "dev";
+    return true ? "0.34.1-experimental.542af3d" : "dev";
   } catch {
     return "dev";
   }
@@ -37197,7 +37197,19 @@ async function generateAndCheck(root, req, opts) {
   const read2 = readSrc(req.file, 96 * 1024);
   if (!read2.ok) return { ok: false, error: `${req.file}: ${read2.reason}`, rounds: 0, costUsd: 0 };
   const sha2562 = sha256Of(read2.content);
-  const { lines, numbered: numbered2 } = describeTarget(read2.content, req.symbol, req.file, req.lines, { codeMap: opts.deps.codeMap });
+  const { lines, numbered: numbered2, extent } = describeTarget(read2.content, req.symbol, req.file, req.lines, { codeMap: opts.deps.codeMap });
+  let warning;
+  if (!lines) {
+    const outline = extent === "fallback:not-found" ? opts.deps.codeMap?.outline(req.file, read2.content) : void 0;
+    if (outline?.source === "tree-sitter") {
+      const names2 = [...new Set(outline.value.filter((f) => f.name && f.kind !== "lambda").map((f) => f.qualified))];
+      const last = (req.symbol.split(/[.#:]/).pop() ?? req.symbol).toLowerCase();
+      const close = names2.filter((n) => n.toLowerCase().includes(last));
+      const shown = (close.length > 0 ? close : names2).slice(0, 12);
+      return { ok: false, error: `no function \`${req.symbol}\` in ${req.file}${shown.length ? ` (it has: ${shown.join(", ")})` : ""}. Name one as ${req.file}#<name>, or pass --lines a-b`, rounds: 0, costUsd: 0 };
+    }
+    warning = `could not find the lines of \`${req.symbol}\` in ${req.file} (${extent}): the model is written from the start of the file, and a replay must copy half of the whole file. Pass --lines a-b to name the code.`;
+  }
   const target = {
     file: req.file,
     symbol: req.symbol,
@@ -37205,7 +37217,9 @@ async function generateAndCheck(root, req, opts) {
     sha256: sha2562,
     numbered: numbered2,
     reasons: req.hint ? [`the user's worry, in their words: ${req.hint.slice(0, 280)}`] : [],
-    properties: []
+    properties: [],
+    // The run row records which extractor answered, as at push.
+    extentSource: extent
   };
   const context = opts.deps.codeMap && !req.lines ? targetContext({ codeMap: opts.deps.codeMap, codeSource: opts.deps.codeSource, readSource: readSrc, file: req.file, content: read2.content, symbol: req.symbol }) : null;
   Object.assign(target, context?.fields ?? {});
@@ -37241,14 +37255,14 @@ async function generateAndCheck(root, req, opts) {
         const g = basisOf(p.source, files);
         return g.ok ? [] : [`${p.id}: ${g.why}`];
       });
-      if (bad.length === 0) return { ok: true, name: gen.name, file: rel, report, rounds: round, costUsd };
+      if (bad.length === 0) return { ok: true, name: gen.name, file: rel, report, rounds: round, costUsd, ...warning ? { warning } : {} };
       lastError = ungroundedMessage(bad.join("; "));
       if (round < maxRounds) {
         previous = { source: gen.source, error: lastError };
         continue;
       }
       const grounded = report.properties.filter((p) => basisOf(p.source, files).ok);
-      if (grounded.length > 0) return { ok: true, name: gen.name, file: rel, report: { ...report, properties: grounded }, rounds: round, costUsd };
+      if (grounded.length > 0) return { ok: true, name: gen.name, file: rel, report: { ...report, properties: grounded }, rounds: round, costUsd, ...warning ? { warning } : {} };
       break;
     }
     lastError = stray ? `the model abstracts ${stray.file}, not ${req.file}` : report.error ?? (report.malformed ? "the model printed malformed VERITY lines" : "the model reported no property");
@@ -37274,9 +37288,16 @@ async function prepareFormalPhase(root, env = process.env, auth2, readSource, co
   }
   const build = await buildLibraryAsync(toolchain, root, 9e4);
   if (!build.ok) return { ok: false, skip: "library-build-failed", detail: build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).join(" ").slice(0, 200) };
+  const code = await loadCodeContext(root, env, codeSource);
+  return { ok: true, deps: { ...defaultDeps({ auth: auth2, apiKey, env, toolchain, readSource, ...code }), codeSource: code.codeSource } };
+}
+async function loadCodeContext(root, env = process.env, codeSource) {
   const loaded = await loadCodeMap(env);
-  const source2 = codeSource ?? withoutPaths(worktreeSource(root), isDeniedPath);
-  return { ok: true, deps: { ...defaultDeps({ auth: auth2, apiKey, env, toolchain, readSource, codeMap: loaded.ok ? loaded.map : null, codeSource: source2 }), codeSource: source2 } };
+  return { codeMap: loaded.ok ? loaded.map : null, codeSource: codeSource ?? withoutPaths(worktreeSource(root), isDeniedPath) };
+}
+async function onDemandDeps(root, opts) {
+  const code = await loadCodeContext(root, opts.env);
+  return { ...defaultDeps({ ...opts, tier: "deep", ...code }), codeSource: code.codeSource };
 }
 function changedFunction(codeMap, file, content, changed) {
   const outline = codeMap.outline(file, content);
@@ -40354,7 +40375,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.0-experimental.ec5aae9" : "dev"
+          cli_version: true ? "0.34.1-experimental.542af3d" : "dev"
         }
       });
     } catch (err2) {
@@ -41688,21 +41709,22 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
       printError("Verity library did not build");
       process.exit(2);
     }
-    const deps = defaultDeps({ auth: auth2 ?? void 0, apiKey: process.env.VERITY_PROVE_DIRECT === "1" ? process.env.OPENAI_API_KEY : void 0, toolchain: tc, tier: "deep" });
+    const deps = await onDemandDeps(root, { auth: auth2 ?? void 0, apiKey: process.env.VERITY_PROVE_DIRECT === "1" ? process.env.OPENAI_API_KEY : void 0, toolchain: tc });
     if (!opts.json) printInfo(`asking the Verity service for a model of ${symbol || `${file}:${opts.lines}`} \u2026`);
     const out2 = await generateAndCheck(root, { file, symbol: symbol || `${file}:${opts.lines}`, lines, hint: opts.hint, revise }, { deps, maxRounds: 3 });
     if (!out2.ok) {
       if (opts.json) printJson(out2);
-      else printError(`${out2.error} (${out2.rounds} round(s)${out2.costUsd ? `, $${out2.costUsd.toFixed(2)}` : ""}) \u2014 write the model by hand (Models/README.md) or narrow the target`);
+      else printError(out2.rounds === 0 ? out2.error : `${out2.error} (${out2.rounds} round(s)${out2.costUsd ? `, $${out2.costUsd.toFixed(2)}` : ""}) \u2014 write the model by hand (Models/README.md) or narrow the target`);
       process.exit(2);
     }
+    if (out2.warning && !opts.json) printWarn(out2.warning);
     try {
       writeResult(root, out2.report);
     } catch (err2) {
       if (!(err2 instanceof SafeWriteError)) throw err2;
     }
     if (opts.json) {
-      printJson({ name: out2.name, file: out2.file, rounds: out2.rounds, cost_usd: out2.costUsd, report: { ...out2.report, passes: reportPasses(out2.report), summary: summarize(out2.report) } });
+      printJson({ name: out2.name, file: out2.file, rounds: out2.rounds, cost_usd: out2.costUsd, ...out2.warning ? { warning: out2.warning } : {}, report: { ...out2.report, passes: reportPasses(out2.report), summary: summarize(out2.report) } });
       return;
     }
     printInfo(`wrote ${out2.file} (${out2.rounds} round(s)${out2.costUsd ? `, $${out2.costUsd.toFixed(2)}` : ""})`);
@@ -41850,8 +41872,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.ec5aae9").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.ec5aae9");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.1-experimental.542af3d").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.1-experimental.542af3d");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.0-experimental.ec5aae9",
+  "version": "0.34.1-experimental.542af3d",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",