@codacy/verity-cli 0.34.5-experimental.7268b07 → 0.34.5-experimental.f1c33b5

package/bin/verity.js

@@ -16946,7 +16946,9 @@ var TOP_KEYS = /* @__PURE__ */ new Set([
   "tool_configuration",
   "created_by",
   "version",
-  "verityignore"
+  "verityignore",
+  "extends",
+  "overrides"
 ]);
 var KNOWLEDGE_SPEC_KEYS = /* @__PURE__ */ new Set([
   "project_name",
@@ -16973,6 +16975,12 @@ var PATTERN_KEYS = /* @__PURE__ */ new Set([
 ]);
 var DIMENSION_KEYS = /* @__PURE__ */ new Set(["id", "description", "signals"]);
 var SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "med", "low"]);
+var PACK_REF = /^[a-z0-9][a-z0-9-]{0,39}\/[a-z0-9][a-z0-9-]{0,39}(@[A-Za-z0-9._-]{1,40})?$/;
+var MAX_EXTENDS = 32;
+var MAX_OVERRIDES = 500;
+var MAX_OVERRIDE_LIST = 50;
+var OVERRIDE_ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,119}$/;
+var OVERRIDE_TOKEN = /^[A-Za-z0-9_.\/*?{}[\],@!:+=-]{1,300}$/;
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var PRINTABLE = /^[^\u0000-\u001f\u007f]+$/;
 var CONTROL_EXCEPT_WHITESPACE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
@@ -17001,6 +17009,51 @@ function checkValues(v, path, depth) {
   }
   return { ok: true };
 }
+function checkPackSettings(content) {
+  if ("extends" in content) {
+    const list2 = content.extends;
+    if (!Array.isArray(list2)) return fail("extends must be an array");
+    if (list2.length > MAX_EXTENDS) return fail(`extends has more than ${MAX_EXTENDS} entries`);
+    const seen = /* @__PURE__ */ new Set();
+    for (const [i2, ref] of list2.entries()) {
+      if (typeof ref !== "string" || !PACK_REF.test(ref)) {
+        return fail(`extends[${i2}] must be a pack reference such as verity/core or verity/core@2026.11`);
+      }
+      if (seen.has(ref)) return fail(`extends[${i2}] repeats ${ref}`);
+      seen.add(ref);
+    }
+  }
+  if ("overrides" in content) {
+    const overrides = content.overrides;
+    if (!isPlainObject(overrides)) return fail("overrides must be an object");
+    const entries = Object.entries(overrides);
+    if (entries.length > MAX_OVERRIDES) return fail(`overrides has more than ${MAX_OVERRIDES} entries`);
+    for (const [id, value] of entries) {
+      if (!OVERRIDE_ID.test(id)) return fail("overrides has a key that is not a pattern id (letters, digits, - _ . :)");
+      const at = `overrides.${id}`;
+      if (value === "off") continue;
+      if (!isPlainObject(value)) return fail(`${at} must be off or an object of settings`);
+      for (const [name2, v] of Object.entries(value)) {
+        if (!OVERRIDE_ID.test(name2)) return fail(`${at} has a setting name that is not a slug (letters, digits, - _ . :)`);
+        const where2 = `${at}.${name2}`;
+        if (Array.isArray(v)) {
+          if (v.length > MAX_OVERRIDE_LIST) return fail(`${where2} has more than ${MAX_OVERRIDE_LIST} entries`);
+          if (!v.every((x) => typeof x === "string" && OVERRIDE_TOKEN.test(x))) {
+            return fail(`${where2} must hold settings, not prose: ids, severities or globs without spaces`);
+          }
+        } else if (typeof v === "string") {
+          if (!OVERRIDE_TOKEN.test(v)) return fail(`${where2} must be a setting, not prose: an id, a severity or a glob without spaces`);
+        } else if (typeof v !== "boolean" && !(typeof v === "number" && Number.isFinite(v))) {
+          return fail(`${where2} must be text, a number, true or false, or a list of text`);
+        }
+      }
+      if ("severity" in value && !SEVERITIES.has(String(value.severity))) {
+        return fail(`${at}.severity must be one of critical, high, medium, low`);
+      }
+    }
+  }
+  return { ok: true };
+}
 function unknownKey(obj, allowed, where2) {
   const extra = Object.keys(obj).find((k) => !allowed.has(k));
   return extra === void 0 ? null : fail(`${where2}.${extra} is not a known field`);
@@ -17027,10 +17080,10 @@ function checkEntries(list2, section, allowed, withSeverity) {
 function validateStandardContent(content, opts = {}) {
   const requireAll = opts.requireAll ?? true;
   if (!isPlainObject(content)) return fail("content is required and must be an object");
-  const size = new TextEncoder().encode(JSON.stringify(content)).length;
-  if (size > MAX_STANDARD_BYTES) return fail(`content is ${size} bytes; the limit is ${MAX_STANDARD_BYTES}`);
   const values = checkValues(content, "", 0);
   if (!values.ok) return values;
+  const size = new TextEncoder().encode(JSON.stringify(content)).length;
+  if (size > MAX_STANDARD_BYTES) return fail(`content is ${size} bytes; the limit is ${MAX_STANDARD_BYTES}`);
   const missing = ["knowledge_spec", "quality_dimensions", "security_patterns", "process_constraints"].filter((k) => !(k in content));
   if (requireAll && missing.length > 0) return fail(`content is missing required keys: ${missing.join(", ")}`);
   const extraTop = unknownKey(content, TOP_KEYS, "content");
@@ -17059,6 +17112,8 @@ function validateStandardContent(content, opts = {}) {
     const custom = checkEntries(content.custom_patterns, "custom_patterns", PATTERN_KEYS, true);
     if (!custom.ok) return custom;
   }
+  const pack = checkPackSettings(content);
+  if (!pack.ok) return pack;
   for (const key of ["created_by", "version"]) {
     if (key in content && content[key] !== null && typeof content[key] !== "string") return fail(`${key} must be a string`);
   }
@@ -28395,7 +28450,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.5-experimental.7268b07" : "dev";
+    return true ? "0.34.5-experimental.f1c33b5" : "dev";
   } catch {
     return "dev";
   }
@@ -41826,6 +41881,7 @@ async function hooksStep(ui, ctx) {
 
 // src/commands/init/standard.ts
 var import_node_fs75 = require("node:fs");
+var import_yaml9 = __toESM2(require_dist());
 
 // src/commands/init/rules.ts
 async function projectLabel(token, serviceUrl, verbose) {
@@ -41850,6 +41906,12 @@ async function rulesOffered(ui, globals) {
   }
   return status === "on" || status === "unknown";
 }
+async function rulesOn(globals) {
+  const token = await resolveToken(globals.token);
+  const url = await resolveServiceUrl(globals.serviceUrl);
+  if (!token.ok || !url.ok) return false;
+  return await generationStatus({ serviceUrl: url.data, token: token.data.token, verbose: globals.verbose }) === "on";
+}
 async function askToSend(ui, profile) {
   const { rail, screen } = ui;
   const lines = consentLines(profile);
@@ -41990,6 +42052,18 @@ function sayAdopted(ui, team) {
 }
 
 // src/commands/init/standard.ts
+function hasProjectRules() {
+  const raw = readRepoFile(STANDARD_FILE);
+  if (raw === null) return true;
+  try {
+    const content = (0, import_yaml9.parse)(raw);
+    const rules = content?.custom_patterns;
+    if (rules === void 0 || rules === null) return false;
+    return !Array.isArray(rules) || rules.length > 0;
+  } catch {
+    return true;
+  }
+}
 async function deriveFromCatalogue(ui, globals) {
   const url = await resolveServiceUrl(globals.serviceUrl);
   try {
@@ -42046,6 +42120,9 @@ async function standardStep(ui, ctx) {
       rail.line(sync.version !== null ? `It was only on this machine. It is shared now as v${sync.version}.` : "It is only on this machine:", sync.version !== null ? "muted" : "warn");
       for (const line2 of sync.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
     }
+    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
+      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    }
     return end({ source: "kept", version: sync.status === "pushed" ? sync.version : null, profile: notAsked });
   }
   const team = await lookUpTeamStandard(ctx);
@@ -42159,7 +42236,31 @@ var import_node_path64 = require("node:path");
 var import_node_child_process22 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
+  let listing = "";
+  try {
+    listing = (0, import_node_child_process22.execSync)(`npm ls -g --depth=0 --json ${pkg}`, { stdio: "pipe", timeout: 6e4 }).toString();
+  } catch (err2) {
+    const stdout = err2.stdout;
+    listing = stdout ? stdout.toString() : "";
+  }
+  const installed2 = parseGlobalListing(listing, pkg);
+  if (installed2 === false) return "absent";
   (0, import_node_child_process22.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  return installed2 ? "removed" : "unknown";
+}
+function parseGlobalListing(listing, pkg) {
+  let parsed;
+  try {
+    parsed = JSON.parse(listing);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if ("error" in parsed) return null;
+  const deps = parsed.dependencies;
+  if (deps === void 0) return false;
+  if (!deps || typeof deps !== "object" || Array.isArray(deps)) return null;
+  return Object.prototype.hasOwnProperty.call(deps, pkg);
 }
 function git2(cwd, args2) {
   (0, import_node_child_process22.execFileSync)("git", hardenedGitArgv(args2), { cwd, stdio: "pipe", env: hardenedGitEnv() });
@@ -42314,8 +42415,11 @@ async function migrateLocalTelemetry(root, actions) {
 function removeLegacyPackage(movedProjectDir, npmRemover, actions) {
   if (!movedProjectDir) return;
   try {
-    npmRemover(LEGACY_NPM_PACKAGE);
-    actions.push(`Removed legacy global package ${LEGACY_NPM_PACKAGE}`);
+    const outcome = npmRemover(LEGACY_NPM_PACKAGE);
+    if (outcome === "removed") actions.push(`Removed legacy global package ${LEGACY_NPM_PACKAGE}`);
+    if (outcome === "unknown") {
+      actions.push(`Ran npm rm -g ${LEGACY_NPM_PACKAGE} in case the old GATE.md CLI was installed (npm could not list its global packages)`);
+    }
   } catch (err2) {
     printWarn(
       `Could not remove ${LEGACY_NPM_PACKAGE} (${err2.message}). Remove it manually: npm rm -g ${LEGACY_NPM_PACKAGE}`
@@ -42410,6 +42514,25 @@ function carryLegacyContents(gateDir, verityDir) {
   walk2("");
   return copied;
 }
+function hasLegacyStandard(root = repoRoot()) {
+  if (!isRealDir((0, import_node_path64.join)(root, ".gate"))) return false;
+  try {
+    if (!(0, import_node_fs76.lstatSync)((0, import_node_path64.join)(root, ".gate", "standard.yaml")).isFile()) return false;
+  } catch {
+    return false;
+  }
+  const verityDir = (0, import_node_path64.join)(root, ".verity");
+  if (pathEntryExists(verityDir) && !isRealDir(verityDir)) return false;
+  return !pathEntryExists((0, import_node_path64.join)(verityDir, "standard.yaml"));
+}
+function pathEntryExists(path) {
+  try {
+    (0, import_node_fs76.lstatSync)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function isRealDir(path) {
   try {
     const st = (0, import_node_fs76.lstatSync)(path);
@@ -42442,6 +42565,7 @@ async function needsMigration(root = repoRoot()) {
     if ((0, import_node_fs76.existsSync)((0, import_node_path64.join)(gateDir, "memory")) && !(0, import_node_fs76.existsSync)((0, import_node_path64.join)(verityDir, "memory"))) {
       return true;
     }
+    if (hasLegacyStandard(root)) return true;
   }
   const claudeMd = (0, import_node_path64.join)(root, "CLAUDE.md");
   if ((0, import_node_fs76.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
@@ -42663,7 +42787,7 @@ async function recordAnswers(ui, momentIds, telemetry) {
     await writeSetupState({
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
-      init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.34.5-experimental.7268b07" : "dev" }
+      init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.34.5-experimental.f1c33b5" : "dev" }
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -42797,6 +42921,7 @@ function registerInitCommand(program2) {
 
 // src/commands/doctor.ts
 var import_node_fs78 = require("node:fs");
+var LEGACY_STANDARD_FILE = ".gate/standard.yaml";
 async function buildReport() {
   const prereqs = await checkPrereqs({ install: false });
   const state = await readSetupState();
@@ -42806,6 +42931,9 @@ async function buildReport() {
   const telemetry = await checkTelemetry();
   const artifacts = {
     standard: (0, import_node_fs78.existsSync)(projectPath(STANDARD_FILE)),
+    // The migration's own answer, not a bare existsSync: /verity:init skips a
+    // question on this, so it must be true only when init will carry the file.
+    legacyStandard: hasLegacyStandard(repoRoot()),
     verityMd: (0, import_node_fs78.existsSync)(projectPath(VERITY_MD_FILE))
   };
   const next = [];
@@ -42813,9 +42941,13 @@ async function buildReport() {
     if (c.status !== "ok" && c.remedy) next.push(c.remedy);
   }
   if (!state?.init) next.push('Run "verity init" \u2014 the deterministic setup phase has not completed here.');
+  const legacyOnly = !artifacts.standard && artifacts.legacyStandard;
+  if (legacyOnly) {
+    next.push(`Run "verity init" \u2014 it moves the old GATE.md install, with its Standard (${LEGACY_STANDARD_FILE}), to .verity/.`);
+  }
   const missing = [
-    !artifacts.standard && ".verity/standard.yaml",
-    !artifacts.verityMd && "VERITY.md"
+    !artifacts.standard && !legacyOnly && ".verity/standard.yaml",
+    !artifacts.verityMd && !legacyOnly && "VERITY.md"
   ].filter((x) => !!x);
   if (missing.length === 2) {
     next.push('Run "verity standard synthesize --push" \u2014 it derives the Standard and VERITY.md from this codebase.');
@@ -42948,7 +43080,7 @@ function registerDoctorCommand(program2) {
     if (process.platform === "win32") printWarn(WINDOWS_STATIC_NOTE);
     else printInfo("Static analysis: Trivy (dependencies, malicious packages, secrets)");
     printInfo("Artifacts:");
-    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : "missing"}`);
+    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : "missing"}`);
     printInfo(`  VERITY.md: ${report.artifacts.verityMd ? "\u2713" : "missing"}`);
     printInfo(
       `  .verity/memory/: ${report.memory.trackedFiles > 0 ? `${report.memory.trackedFiles} file(s) tracked in git \u2014 they appear in every diff` : report.memory.posture === "ignored" ? "machine-local \u2713" : "not tracked"}`
@@ -44640,10 +44772,10 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.5-experimental.7268b07").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.5-experimental.f1c33b5").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.5-experimental.7268b07");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.5-experimental.f1c33b5");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {

package/data/skills/verity-init/SKILL.md

@@ -36,10 +36,12 @@ Use this one report:
 - **`blocked` is true** → show the `prerequisites[].remedy` lines and stop.
 - **`hooks.versions.skew` is set** → tell the user first, in one line, with
   `hooks.versions.skew.remedy`.
-- **`artifacts.standard` is true** → this project already has a Standard here.
-  Do not ask question 2. Init keeps the Standard and sends no profile.
+- **`artifacts.standard` or `artifacts.legacyStandard` is true** → this project
+  already has a Standard here. `legacyStandard` is an old GATE.md Standard at
+  `.gate/standard.yaml`: init moves it to `.verity/` first, then keeps it. Do not
+  ask question 2. Init keeps the Standard and sends no profile.
 
-When `artifacts.standard` is false, also run:
+When both are false, also run:
 
 ```bash
 verity standard history
@@ -98,8 +100,8 @@ contents of their repositories.
 | `Create a new one with the built-in rules` | The new Standard becomes the next version for the whole team. It has the built-in rules only. Nothing is sent. |
 
 **2b — "Let Verity write review rules for this repository?"** (only when
-`artifacts.standard` is false, 2a does not apply, and the status is `on` or
-`unknown`)
+`artifacts.standard` and `artifacts.legacyStandard` are both false, 2a does not
+apply, and the status is `on` or `unknown`)
 
 | Option | Description |
 |---|---|
@@ -165,7 +167,8 @@ It prints one JSON object on stdout:
   in a terminal later. Go to Step 3.
 
 **After a new sign-in, check the Standard again.** If Step 0 could not run
-`verity standard history` (it failed) and `artifacts.standard` is false, run it
+`verity standard history` (it failed) and `artifacts.standard` and
+`artifacts.legacyStandard` are both false, run it
 now. If it lists versions, ask question 2a now, in its own prompt. Its answer
 replaces the answer to 2b. Also run `verity standard generate --status` again.
 If it prints `off` or `unsupported`, the answer to 2b has no effect: pass
@@ -242,6 +245,15 @@ Summarise from this report and from init's output, not from memory:
   commit;
 - anything untracked, and that the staged removal is the user's to commit;
 - sign-in state;
+- formal verification, when init printed "Formal verification at push: on". Say
+  it as a fact, in init's words: at a push, Verity checks a small model of the
+  riskiest changed function and replays any counterexample on the real code;
+  that function's source is sent to Verity; only a reproduced bug blocks; turn
+  it off with `verity config formal off`. It is a default, like the moments. Do
+  not suggest turning it off, and do not connect it to the user's answers to
+  other questions;
+- when init printed that the kept Standard has no project rules yet, that line
+  and its command (`verity standard generate`);
 - each line of `next`, if any.
 
 ---
@@ -254,3 +266,5 @@ Summarise from this report and from init's output, not from memory:
 - **Do not answer a question for the user**, and do not leave a flag off because
   it seems obvious. An omitted answer is an unattended one.
 - **Do not run plain `verity login`.** See Step 2.
+- **Do not advise turning off a default** (the moments, formal verification)
+  unless the user asks. Say what it does and how to change it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.5-experimental.7268b07",
+  "version": "0.34.5-experimental.f1c33b5",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",
@@ -37,7 +37,7 @@
     "tree-sitter-javascript": "0.25.0",
     "tree-sitter-python": "0.25.0",
     "tree-sitter-typescript": "0.23.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.4",
     "web-tree-sitter": "0.27.0"
   },