@codacy/verity-cli 0.34.5-experimental.eb39cc6 → 0.34.5-experimental.f1c33b5

package/bin/verity.js

@@ -28450,7 +28450,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.5-experimental.eb39cc6" : "dev";
+    return true ? "0.34.5-experimental.f1c33b5" : "dev";
   } catch {
     return "dev";
   }
@@ -41881,6 +41881,7 @@ async function hooksStep(ui, ctx) {
 
 // src/commands/init/standard.ts
 var import_node_fs75 = require("node:fs");
+var import_yaml9 = __toESM2(require_dist());
 
 // src/commands/init/rules.ts
 async function projectLabel(token, serviceUrl, verbose) {
@@ -41905,6 +41906,12 @@ async function rulesOffered(ui, globals) {
   }
   return status === "on" || status === "unknown";
 }
+async function rulesOn(globals) {
+  const token = await resolveToken(globals.token);
+  const url = await resolveServiceUrl(globals.serviceUrl);
+  if (!token.ok || !url.ok) return false;
+  return await generationStatus({ serviceUrl: url.data, token: token.data.token, verbose: globals.verbose }) === "on";
+}
 async function askToSend(ui, profile) {
   const { rail, screen } = ui;
   const lines = consentLines(profile);
@@ -42045,6 +42052,18 @@ function sayAdopted(ui, team) {
 }
 
 // src/commands/init/standard.ts
+function hasProjectRules() {
+  const raw = readRepoFile(STANDARD_FILE);
+  if (raw === null) return true;
+  try {
+    const content = (0, import_yaml9.parse)(raw);
+    const rules = content?.custom_patterns;
+    if (rules === void 0 || rules === null) return false;
+    return !Array.isArray(rules) || rules.length > 0;
+  } catch {
+    return true;
+  }
+}
 async function deriveFromCatalogue(ui, globals) {
   const url = await resolveServiceUrl(globals.serviceUrl);
   try {
@@ -42101,6 +42120,9 @@ async function standardStep(ui, ctx) {
       rail.line(sync.version !== null ? `It was only on this machine. It is shared now as v${sync.version}.` : "It is only on this machine:", sync.version !== null ? "muted" : "warn");
       for (const line2 of sync.lines) if (!line2.startsWith("Standard pushed")) rail.line(terminalText(line2, 600), "warn");
     }
+    if (!hasProjectRules() && await rulesOn(ctx.globals)) {
+      rail.line("It has no project rules yet. Add them from a repo profile: verity standard generate");
+    }
     return end({ source: "kept", version: sync.status === "pushed" ? sync.version : null, profile: notAsked });
   }
   const team = await lookUpTeamStandard(ctx);
@@ -42214,7 +42236,31 @@ var import_node_path64 = require("node:path");
 var import_node_child_process22 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
+  let listing = "";
+  try {
+    listing = (0, import_node_child_process22.execSync)(`npm ls -g --depth=0 --json ${pkg}`, { stdio: "pipe", timeout: 6e4 }).toString();
+  } catch (err2) {
+    const stdout = err2.stdout;
+    listing = stdout ? stdout.toString() : "";
+  }
+  const installed2 = parseGlobalListing(listing, pkg);
+  if (installed2 === false) return "absent";
   (0, import_node_child_process22.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  return installed2 ? "removed" : "unknown";
+}
+function parseGlobalListing(listing, pkg) {
+  let parsed;
+  try {
+    parsed = JSON.parse(listing);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if ("error" in parsed) return null;
+  const deps = parsed.dependencies;
+  if (deps === void 0) return false;
+  if (!deps || typeof deps !== "object" || Array.isArray(deps)) return null;
+  return Object.prototype.hasOwnProperty.call(deps, pkg);
 }
 function git2(cwd, args2) {
   (0, import_node_child_process22.execFileSync)("git", hardenedGitArgv(args2), { cwd, stdio: "pipe", env: hardenedGitEnv() });
@@ -42369,8 +42415,11 @@ async function migrateLocalTelemetry(root, actions) {
 function removeLegacyPackage(movedProjectDir, npmRemover, actions) {
   if (!movedProjectDir) return;
   try {
-    npmRemover(LEGACY_NPM_PACKAGE);
-    actions.push(`Removed legacy global package ${LEGACY_NPM_PACKAGE}`);
+    const outcome = npmRemover(LEGACY_NPM_PACKAGE);
+    if (outcome === "removed") actions.push(`Removed legacy global package ${LEGACY_NPM_PACKAGE}`);
+    if (outcome === "unknown") {
+      actions.push(`Ran npm rm -g ${LEGACY_NPM_PACKAGE} in case the old GATE.md CLI was installed (npm could not list its global packages)`);
+    }
   } catch (err2) {
     printWarn(
       `Could not remove ${LEGACY_NPM_PACKAGE} (${err2.message}). Remove it manually: npm rm -g ${LEGACY_NPM_PACKAGE}`
@@ -42465,6 +42514,25 @@ function carryLegacyContents(gateDir, verityDir) {
   walk2("");
   return copied;
 }
+function hasLegacyStandard(root = repoRoot()) {
+  if (!isRealDir((0, import_node_path64.join)(root, ".gate"))) return false;
+  try {
+    if (!(0, import_node_fs76.lstatSync)((0, import_node_path64.join)(root, ".gate", "standard.yaml")).isFile()) return false;
+  } catch {
+    return false;
+  }
+  const verityDir = (0, import_node_path64.join)(root, ".verity");
+  if (pathEntryExists(verityDir) && !isRealDir(verityDir)) return false;
+  return !pathEntryExists((0, import_node_path64.join)(verityDir, "standard.yaml"));
+}
+function pathEntryExists(path) {
+  try {
+    (0, import_node_fs76.lstatSync)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function isRealDir(path) {
   try {
     const st = (0, import_node_fs76.lstatSync)(path);
@@ -42497,6 +42565,7 @@ async function needsMigration(root = repoRoot()) {
     if ((0, import_node_fs76.existsSync)((0, import_node_path64.join)(gateDir, "memory")) && !(0, import_node_fs76.existsSync)((0, import_node_path64.join)(verityDir, "memory"))) {
       return true;
     }
+    if (hasLegacyStandard(root)) return true;
   }
   const claudeMd = (0, import_node_path64.join)(root, "CLAUDE.md");
   if ((0, import_node_fs76.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
@@ -42718,7 +42787,7 @@ async function recordAnswers(ui, momentIds, telemetry) {
     await writeSetupState({
       moments: momentIds,
       ...telemetry ? { telemetry } : {},
-      init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.34.5-experimental.eb39cc6" : "dev" }
+      init: { completed_at: (/* @__PURE__ */ new Date()).toISOString(), cli_version: true ? "0.34.5-experimental.f1c33b5" : "dev" }
     });
   } catch (err2) {
     ui.rail.line(`Could not record the setup answers: ${terminalText(err2.message, 200)}`, "warn");
@@ -42852,6 +42921,7 @@ function registerInitCommand(program2) {
 
 // src/commands/doctor.ts
 var import_node_fs78 = require("node:fs");
+var LEGACY_STANDARD_FILE = ".gate/standard.yaml";
 async function buildReport() {
   const prereqs = await checkPrereqs({ install: false });
   const state = await readSetupState();
@@ -42861,6 +42931,9 @@ async function buildReport() {
   const telemetry = await checkTelemetry();
   const artifacts = {
     standard: (0, import_node_fs78.existsSync)(projectPath(STANDARD_FILE)),
+    // The migration's own answer, not a bare existsSync: /verity:init skips a
+    // question on this, so it must be true only when init will carry the file.
+    legacyStandard: hasLegacyStandard(repoRoot()),
     verityMd: (0, import_node_fs78.existsSync)(projectPath(VERITY_MD_FILE))
   };
   const next = [];
@@ -42868,9 +42941,13 @@ async function buildReport() {
     if (c.status !== "ok" && c.remedy) next.push(c.remedy);
   }
   if (!state?.init) next.push('Run "verity init" \u2014 the deterministic setup phase has not completed here.');
+  const legacyOnly = !artifacts.standard && artifacts.legacyStandard;
+  if (legacyOnly) {
+    next.push(`Run "verity init" \u2014 it moves the old GATE.md install, with its Standard (${LEGACY_STANDARD_FILE}), to .verity/.`);
+  }
   const missing = [
-    !artifacts.standard && ".verity/standard.yaml",
-    !artifacts.verityMd && "VERITY.md"
+    !artifacts.standard && !legacyOnly && ".verity/standard.yaml",
+    !artifacts.verityMd && !legacyOnly && "VERITY.md"
   ].filter((x) => !!x);
   if (missing.length === 2) {
     next.push('Run "verity standard synthesize --push" \u2014 it derives the Standard and VERITY.md from this codebase.');
@@ -43003,7 +43080,7 @@ function registerDoctorCommand(program2) {
     if (process.platform === "win32") printWarn(WINDOWS_STATIC_NOTE);
     else printInfo("Static analysis: Trivy (dependencies, malicious packages, secrets)");
     printInfo("Artifacts:");
-    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : "missing"}`);
+    printInfo(`  .verity/standard.yaml: ${report.artifacts.standard ? "\u2713" : report.artifacts.legacyStandard ? `not yet (an old GATE.md Standard is at ${LEGACY_STANDARD_FILE}; verity init moves it)` : "missing"}`);
     printInfo(`  VERITY.md: ${report.artifacts.verityMd ? "\u2713" : "missing"}`);
     printInfo(
       `  .verity/memory/: ${report.memory.trackedFiles > 0 ? `${report.memory.trackedFiles} file(s) tracked in git \u2014 they appear in every diff` : report.memory.posture === "ignored" ? "machine-local \u2713" : "not tracked"}`
@@ -44695,10 +44772,10 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.5-experimental.eb39cc6").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.5-experimental.f1c33b5").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
   const isTelemetryHelper = actionCommand.name() === "headers" && actionCommand.parent?.name() === "telemetry";
   if (!isTelemetryHelper) {
-    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.5-experimental.eb39cc6");
+    installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.5-experimental.f1c33b5");
   }
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {

package/data/skills/verity-init/SKILL.md

@@ -36,10 +36,12 @@ Use this one report:
 - **`blocked` is true** → show the `prerequisites[].remedy` lines and stop.
 - **`hooks.versions.skew` is set** → tell the user first, in one line, with
   `hooks.versions.skew.remedy`.
-- **`artifacts.standard` is true** → this project already has a Standard here.
-  Do not ask question 2. Init keeps the Standard and sends no profile.
+- **`artifacts.standard` or `artifacts.legacyStandard` is true** → this project
+  already has a Standard here. `legacyStandard` is an old GATE.md Standard at
+  `.gate/standard.yaml`: init moves it to `.verity/` first, then keeps it. Do not
+  ask question 2. Init keeps the Standard and sends no profile.
 
-When `artifacts.standard` is false, also run:
+When both are false, also run:
 
 ```bash
 verity standard history
@@ -98,8 +100,8 @@ contents of their repositories.
 | `Create a new one with the built-in rules` | The new Standard becomes the next version for the whole team. It has the built-in rules only. Nothing is sent. |
 
 **2b — "Let Verity write review rules for this repository?"** (only when
-`artifacts.standard` is false, 2a does not apply, and the status is `on` or
-`unknown`)
+`artifacts.standard` and `artifacts.legacyStandard` are both false, 2a does not
+apply, and the status is `on` or `unknown`)
 
 | Option | Description |
 |---|---|
@@ -165,7 +167,8 @@ It prints one JSON object on stdout:
   in a terminal later. Go to Step 3.
 
 **After a new sign-in, check the Standard again.** If Step 0 could not run
-`verity standard history` (it failed) and `artifacts.standard` is false, run it
+`verity standard history` (it failed) and `artifacts.standard` and
+`artifacts.legacyStandard` are both false, run it
 now. If it lists versions, ask question 2a now, in its own prompt. Its answer
 replaces the answer to 2b. Also run `verity standard generate --status` again.
 If it prints `off` or `unsupported`, the answer to 2b has no effect: pass
@@ -242,6 +245,15 @@ Summarise from this report and from init's output, not from memory:
   commit;
 - anything untracked, and that the staged removal is the user's to commit;
 - sign-in state;
+- formal verification, when init printed "Formal verification at push: on". Say
+  it as a fact, in init's words: at a push, Verity checks a small model of the
+  riskiest changed function and replays any counterexample on the real code;
+  that function's source is sent to Verity; only a reproduced bug blocks; turn
+  it off with `verity config formal off`. It is a default, like the moments. Do
+  not suggest turning it off, and do not connect it to the user's answers to
+  other questions;
+- when init printed that the kept Standard has no project rules yet, that line
+  and its command (`verity standard generate`);
 - each line of `next`, if any.
 
 ---
@@ -254,3 +266,5 @@ Summarise from this report and from init's output, not from memory:
 - **Do not answer a question for the user**, and do not leave a flag off because
   it seems obvious. An omitted answer is an unattended one.
 - **Do not run plain `verity login`.** See Step 2.
+- **Do not advise turning off a default** (the moments, formal verification)
+  unless the user asks. Say what it does and how to change it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.5-experimental.eb39cc6",
+  "version": "0.34.5-experimental.f1c33b5",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",
@@ -37,7 +37,7 @@
     "tree-sitter-javascript": "0.25.0",
     "tree-sitter-python": "0.25.0",
     "tree-sitter-typescript": "0.23.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.4",
     "web-tree-sitter": "0.27.0"
   },