@codacy/verity-cli 0.35.4 → 0.36.0

package/CHANGELOG.md

@@ -64,6 +64,102 @@ installs are untouched.
   which is the ordinary case for someone whose first Verity install *is* the
   plugin.
 
+## [0.36.0] — 2026-11-12
+
+### 🧠 Curate your project's knowledge from the CLI
+
+- **`verity memory edit <node-id>`** changes a node's title, files, status or
+  body. Verity checks the change before it writes anything, and the change
+  reaches the service at once, with no review needed.
+- **`verity memory delete <node-id> --reason "…"`** removes a node that is wrong
+  or out of date, and **`verity memory restore <node-id>`** brings it back. The
+  reason stays on your machine.
+- **`verity memory ask "<question>"`** (also `recall`) answers from your
+  project's knowledge. It quotes the matching nodes with their ids. It runs on
+  your machine, with no model, and sends nothing.
+- **`verity memory dream`** shows a plan to merge near-identical nodes, retire
+  superseded ones and remove empty placeholders. `--apply` makes the changes,
+  `--revert <dream-id>` undoes them, and `--list` shows past runs. A node that
+  a person confirmed is never changed.
+- **`verity reflect` fixes:** an edited node now reaches the service, the title
+  comes from the first line, and paths written as globs, folders or in
+  backticks are scoped. A placeholder node that you removed stays removed.
+
+### 🎯 Findings outside your change no longer block it
+
+- **At a commit and a push, Verity now knows which lines your change wrote.**
+  The CLI sends line numbers, never extra code. A finding more than 3 lines
+  away from every changed line is marked pre-existing: it is still shown, but
+  it does not block.
+- **Your own problems still block.** A finding that a static tool reports keeps
+  its scope, and so does a problem that a removed line causes. A file that a
+  merge combined is reviewed as before. When the CLI cannot prove that the
+  line numbers fit the code it sent, the file is reviewed as before.
+
+### 🔒 What Verity sends, and where
+
+- **Includes security fixes.**
+- **The plugin README now lists every destination**: what Verity sends, where
+  it goes, and how long it is kept.
+- **The local scan runs offline**, with no telemetry and no update checks. For
+  Maven (`pom.xml`) projects, offline mode can miss some dependency findings.
+- **To find known malicious packages**, the CLI sends the names and versions
+  of the packages in a changed dependency file to OSV.dev, a vulnerability
+  database that Google runs. This includes the names of private packages. It
+  sends no code. The Privacy Notice names OSV.dev.
+- **The service now deletes raw telemetry on schedule**: metric points after 14
+  days and spans after 30 days. Daily totals are kept.
+
+### 🪟 Windows
+
+- **The hooks no longer open console windows**
+  ([codacy/verity#1](https://github.com/codacy/verity/issues/1)). Every
+  process that the CLI starts is hidden, and git commands run without a shell.
+  The browser for sign-in still opens normally.
+
+### ✂️ Fewer false blocks
+
+- **A null or missing field that only makes one request or one script run fail
+  no longer blocks as a critical input-sanitization finding.** It is reported
+  as its own finding, at its real severity. A null field that makes a check
+  fail open, and a wrong type that changes what a query or command does, still
+  count under the rule.
+
+### 📦 Dependencies
+
+- **`@codacy/analysis-cli` 0.25.0 → 0.29.0.** A fresh install now shows 0
+  `npm audit` findings (it showed 11 moderate). The local scan uses Trivy
+  0.74.
+
+## [0.35.5] — 2026-11-11
+
+### 🔬 Formal verification at push is on by default
+
+- **Every project gets the formal check at push**, also a project set up
+  before. Until now it ran only where `formal: "push"` was written, and
+  `verity init` wrote that only for a new project. At a push, Verity can check
+  a small Lean model of the riskiest changed function and replay a
+  counterexample on the real code. Only a reproduced bug can block. For the
+  replay, the source of that function goes to the Verity service. Turn it off
+  for a checkout with `verity config formal off`, or for a shell with
+  `VERITY_GIT_MOMENT_FORMAL=off`.
+- **The first session after the upgrade starts the Lean 4 download** (about
+  800 MB, 2.7 GB on disk) on a machine with no install record, and says once
+  per machine that formal is on and how to turn it off. When Lean will not
+  come (`VERITY_NO_LEAN=1`, CI, too little disk, no release for the platform,
+  a failed download), it says why, and that a push skips the formal check.
+  `VERITY_NO_LEAN=1` and CI are checked before any probe for Lean.
+- **An "off" counts only from a file that you control.** An "off" in a
+  `.verity/config.json` that git tracks, or that is a link, is ignored: a
+  repository cannot switch the review off for its clones. `verity config
+  formal`, `verity doctor`, `verity init` and the notice say so, and name
+  `git rm --cached .verity/config.json`. When git cannot tell, the "off" is
+  kept and the push says `formal: skipped (off-unverified: …)`.
+- **Breaking:** `verity config formal` prints `push` when nothing is set
+  (it printed `off`). A re-run of `verity init` starts the Lean download in an
+  existing project. An earlier "off" in a tracked `.verity/config.json` no
+  longer counts.
+
 ## [0.35.4] — 2026-11-10
 
 ### 📐 The Standard file is machine-local

package/README.md

@@ -205,8 +205,9 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | `verity memory untrack` | Stop committing `.verity/memory/` — the graph stays on disk and leaves your diffs |
 | `verity memory track` | Commit the graph on purpose, and record that so nothing offers to change it |
 | **Formal verification** | |
-| `verity config formal push` | Turn it on for this checkout: at push, one risky changed function may get a Lean model, checked and replayed (see below). On by default for a new project |
-| `verity config formal off` | Turn it off |
+| `verity config formal` | Show the setting in force: `push` (the default) or `off` |
+| `verity config formal off` | Turn it off for this checkout. The answer stays: nothing turns it on again |
+| `verity config formal push` | Turn it back on for this checkout: at push, one risky changed function may get a Lean model, checked and replayed (see below) |
 | `verity lean status` / `install` / `remove` | The managed Lean 4 toolchain the models are checked with (≈800 MB download, 2.7 GB on disk) |
 | `verity prove candidates [paths]` | Rank the riskiest code from git history and shape signals, no model |
 | `verity prove auto [files]` | Run the push-time phase by hand on the commits ahead of upstream |
@@ -233,7 +234,7 @@ No re-setup needed: your token, Standard, and run history all carry over.
 | `/verity-reflect` | Capture learnings after a task |
 | `/verity-prove <worry>` | Formal verification on demand: pick a function together, model it in Lean, replay any counterexample on the real code |
 
-## Formal verification (opt-in)
+## Formal verification (on by default)
 
 At `git push`, beside the review, Verity can build a **small Lean 4 model of one
 risky function in the change**, search every interleaving of its actions up to a
@@ -249,13 +250,24 @@ or plain code stops in under a second with a named reason. Counterexamples can
 only be replayed for **TypeScript, JavaScript and Python**; other languages stop
 before any model is paid for.
 
-For a new project, `verity init` turns this on and starts the Lean 4 download
-in the background (≈800 MB, 2.7 GB on disk; `verity lean status` shows the
-progress). Until Lean is ready, a push reports `formal: skipped (no-toolchain:
-Lean installing, 63%)` and the gate decision does not change. Init does not
-start the download in CI (unless `VERITY_LEAN=1`), with `VERITY_NO_LEAN=1`,
-with formal off, or with less than 3.75 GB free. A re-run of init never turns
-formal on.
+Formal verification is on by default in every project, unless someone turned
+it off with `verity config formal off` (or `VERITY_GIT_MOMENT_FORMAL=off`). An
+"off" is an answer and stays. It does not count from a `.verity/config.json`
+that git tracks or that is a link: a repository cannot switch the review off
+for its clones. When git cannot tell, the "off" is kept and the push says
+`formal: skipped (off-unverified: …)`.
+
+The Lean 4 toolchain downloads in the background (≈800 MB, 2.7 GB on disk;
+`verity lean status` shows the progress). `verity init` starts the download,
+and the first Claude Code session after an upgrade starts it on a machine that
+never tried. That session also says once, per machine, that formal is on, how
+to turn it off, and why Lean will not come when it cannot.
+
+Until Lean is ready, a push reports `formal: skipped (no-toolchain: Lean
+installing, 63%)` and the gate decision does not change. The download does not
+start in CI (unless `VERITY_LEAN=1`), with `VERITY_NO_LEAN=1`, with formal off,
+or with less than 3.75 GB free. A failed download is not retried at each
+session start: run `verity lean install`.
 
 ```bash
 verity config formal off      # turn it off for this checkout