@codacy/verity-cli 0.35.0-experimental.9fc6b77 → 0.35.0

package/data/skills/verity-init/SKILL.md

@@ -36,10 +36,12 @@ Use this one report:
 - **`blocked` is true** → show the `prerequisites[].remedy` lines and stop.
 - **`hooks.versions.skew` is set** → tell the user first, in one line, with
   `hooks.versions.skew.remedy`.
-- **`artifacts.standard` is true** → this project already has a Standard here.
-  Do not ask question 2. Init keeps the Standard and sends no profile.
+- **`artifacts.standard` or `artifacts.legacyStandard` is true** → this project
+  already has a Standard here. `legacyStandard` is an old GATE.md Standard at
+  `.gate/standard.yaml`: init moves it to `.verity/` first, then keeps it. Do not
+  ask question 2. Init keeps the Standard and sends no profile.
 
-When `artifacts.standard` is false, also run:
+When both are false, also run:
 
 ```bash
 verity standard history
@@ -50,8 +52,26 @@ verity standard history
 - **It prints "No Standard versions found."** → question 2 is **2b**.
 - **It fails** (for example, not signed in) → question 2 is **2b** for now.
   Step 2 checks again after sign-in.
+
+Then check whether the service writes project rules for this project:
+
+```bash
+verity standard generate --status
+```
+
+It prints one word, and sends nothing:
+
+- **`on`** or **`unknown`** → ask 2b, and offer "Create a new one from a repo
+  profile" in 2a.
+- **`off`** or **`unsupported`** → the service would not use a profile. Do not
+  ask 2b, and do not offer "Create a new one from a repo profile" in 2a.
+  Pass `--profile skip`.
+- **It fails** (not signed in) → decide as for `unknown`. Step 2 runs it again
+  after sign-in.
 - **`memory.trackedFiles > 0` and `memory.optedOut` is false** → question 3 applies.
 - **`trackedState.files > 0`** → question 4 applies.
+- **`telemetry.enabled` is false and `answers.telemetry` is not `declined`** →
+  question 5 applies. An earlier "no" is an answer: do not ask again.
 
 ## Step 1: Ask, once, in one prompt
 
@@ -80,7 +100,8 @@ contents of their repositories.
 | `Create a new one with the built-in rules` | The new Standard becomes the next version for the whole team. It has the built-in rules only. Nothing is sent. |
 
 **2b — "Let Verity write review rules for this repository?"** (only when
-`artifacts.standard` is false and 2a does not apply)
+`artifacts.standard` and `artifacts.legacyStandard` are both false, 2a does not
+apply, and the status is `on` or `unknown`)
 
 | Option | Description |
 |---|---|
@@ -106,6 +127,17 @@ say how many files)
 | `Yes, untrack it (recommended)` | These files are machine-local and can include copies of flagged secrets. The files stay on disk, and the removal is staged. |
 | `No, not now` | Nothing changes. |
 
+**5 — "Send Claude Code cost and usage from this machine to Verity?"** (only
+when it applies)
+
+| Option | Description |
+|---|---|
+| `Yes (recommended)` | Token counts, cost, models, tool names and the repository name, from every Claude Code session on this machine. No prompts, no code, no file contents. It needs sign-in. See it on the /usage page. Turn it off any time: `verity telemetry uninstall`. |
+| `No` | Nothing changes, and init does not ask again. Turn it on later: `verity telemetry install`. |
+
+Say that the scope is the whole machine: Claude Code takes these settings only
+from user settings, never from one project.
+
 Do not ask when Verity reviews. All three moments are on by default: each turn,
 each commit and each push. Step 4 tells the user how to change them.
 
@@ -135,9 +167,12 @@ It prints one JSON object on stdout:
   in a terminal later. Go to Step 3.
 
 **After a new sign-in, check the Standard again.** If Step 0 could not run
-`verity standard history` (it failed) and `artifacts.standard` is false, run it
+`verity standard history` (it failed) and `artifacts.standard` and
+`artifacts.legacyStandard` are both false, run it
 now. If it lists versions, ask question 2a now, in its own prompt. Its answer
-replaces the answer to 2b.
+replaces the answer to 2b. Also run `verity standard generate --status` again.
+If it prints `off` or `unsupported`, the answer to 2b has no effect: pass
+`--profile skip`.
 
 When the user says it is approved, or asks you to check:
 
@@ -166,7 +201,7 @@ can sign the machine in to a different server, and the plugin follows that sign-
 One command. It asks nothing:
 
 ```bash
-verity init --yes [--standard <use|new>] --profile <send|skip> [--untrack-memory] [--untrack-state]
+verity init --yes [--standard <use|new>] --profile <send|skip> [--telemetry <on|off>] [--untrack-memory] [--untrack-state]
 ```
 
 - Question 2a: `Use it` → `--standard use`. `Create a new one from a repo
@@ -176,8 +211,10 @@ verity init --yes [--standard <use|new>] --profile <send|skip> [--untrack-memory
   Otherwise `--profile skip`.
 - When question 2 was not asked, leave `--standard` and `--profile` off.
 - `--untrack-memory` and `--untrack-state` only on a yes.
-- Do not pass `--moments` or `--telemetry`. Without them, init keeps the moments
-  the project has, or turns on all three for a new project.
+- Question 5: `--telemetry on` on a yes, `--telemetry off` on a no. When it was
+  not asked, leave `--telemetry` off.
+- Do not pass `--moments`. Without it, init keeps the moments the project has,
+  or turns on all three for a new project.
 - If init exits non-zero, show its error and stop.
 
 Init is idempotent. It removes the project's own `.claude/skills/verity-*` copies
@@ -187,6 +224,8 @@ stops Verity asking at every session start.
 
 With `--profile send`, init prints the rules that Verity wrote. Each rule has an
 id, one sentence, where it applies and why. Show them to the user as printed.
+When init prints the "too little history" line, tell the user that the built-in
+rules apply.
 
 ## Step 4: Report what happened
 
@@ -206,6 +245,15 @@ Summarise from this report and from init's output, not from memory:
   commit;
 - anything untracked, and that the staged removal is the user's to commit;
 - sign-in state;
+- formal verification, when init printed "Formal verification at push: on". Say
+  it as a fact, in init's words: at a push, Verity checks a small model of the
+  riskiest changed function and replays any counterexample on the real code;
+  that function's source is sent to Verity; only a reproduced bug blocks; turn
+  it off with `verity config formal off`. It is a default, like the moments. Do
+  not suggest turning it off, and do not connect it to the user's answers to
+  other questions;
+- when init printed that the kept Standard has no project rules yet, that line
+  and its command (`verity standard generate`);
 - each line of `next`, if any.
 
 ---
@@ -218,3 +266,5 @@ Summarise from this report and from init's output, not from memory:
 - **Do not answer a question for the user**, and do not leave a flag off because
   it seems obvious. An omitted answer is an unattended one.
 - **Do not run plain `verity login`.** See Step 2.
+- **Do not advise turning off a default** (the moments, formal verification)
+  unless the user asks. Say what it does and how to change it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.35.0-experimental.9fc6b77",
+  "version": "0.35.0",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",
@@ -37,20 +37,13 @@
     "tree-sitter-javascript": "0.25.0",
     "tree-sitter-python": "0.25.0",
     "tree-sitter-typescript": "0.23.2",
-    "tsx": "^4.21.0",
+    "tsx": "^4.23.15",
     "typescript": "^5.4",
     "web-tree-sitter": "0.27.0"
   },
   "dependencies": {
+    "@codacy/analysis-cli": "0.25.0",
     "commander": "^12",
     "yaml": "^2"
-  },
-  "peerDependencies": {
-    "@codacy/analysis-cli": ">=1.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@codacy/analysis-cli": {
-      "optional": true
-    }
   }
 }