coderifts 1.7.0 → 1.8.0

package/bin/coderifts.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const { program } = require('commander');
+const pkg = require('../package.json');
+
+program
+  .name('coderifts')
+  .description('Detect breaking API changes between OpenAPI specs')
+  .version(pkg.version, '-v, --version');
+
+// ── diff command ──
+program
+  .command('diff <old-spec> <new-spec>')
+  .description('Compare two OpenAPI specs and report breaking changes')
+  .option('-f, --format <format>', 'Output format: terminal (default), json, markdown', 'terminal')
+  .option('--ci', 'CI mode — exit with code 1 if breaking changes exceed threshold')
+  .option('--threshold <number>', 'Risk score threshold for CI mode (0-100)', '50')
+  .option('--cloud', 'Use the CodeRifts cloud API instead of local analysis')
+  .option('-c, --config <path>', 'Path to .coderifts.yml config file')
+  .option('--no-normalize', 'Skip spec normalization (raw diff mode)')
+  .action(async (oldSpec, newSpec, options) => {
+    const { diff } = require('../src/commands/diff');
+    await diff(oldSpec, newSpec, options);
+  });
+
+// ── init command ──
+program
+  .command('init [template]')
+  .description('Generate a .coderifts.yml from a policy template (startup, growth, fintech, public-api, microservices)')
+  .action(async (template) => {
+    const { init } = require('../src/commands/init');
+    await init(template);
+  });
+
+// ── login command ──
+program
+  .command('login')
+  .description('Save your API key for cloud features')
+  .action(async () => {
+    const { login } = require('../src/commands/login');
+    await login();
+  });
+
+// ── hook command group ──
+const hookCmd = program
+  .command('hook')
+  .description('Manage the CodeRifts pre-push Git hook');
+
+hookCmd
+  .command('install')
+  .description('Install the CodeRifts pre-push hook in the current Git repo')
+  .action(() => {
+    const { install } = require('../src/commands/hook');
+    install();
+  });
+
+hookCmd
+  .command('uninstall')
+  .description('Remove the CodeRifts pre-push hook from the current Git repo')
+  .action(() => {
+    const { uninstall } = require('../src/commands/hook');
+    uninstall();
+  });
+
+hookCmd
+  .command('status')
+  .description('Show whether the CodeRifts pre-push hook is installed and configured')
+  .action(() => {
+    const { status } = require('../src/commands/hook');
+    status();
+  });
+
+program.parse();

package/dist/cli.js

@@ -3003,7 +3003,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "1.7.0",
+      version: "1.8.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3013,6 +3013,8 @@ var require_package = __commonJS({
       main: "dist/cli.js",
       files: [
         "dist/",
+        "bin/",
+        "scripts/",
         "README.md"
       ],
       keywords: [
@@ -3056,7 +3058,7 @@ var require_package = __commonJS({
         "json-schema-ref-parser": "npm:@apidevtools/json-schema-ref-parser@^11.7.3"
       },
       devDependencies: {
-        esbuild: "^0.27.3"
+        esbuild: "^0.27.4"
       }
     };
   }
@@ -61464,14 +61466,438 @@ var require_proxy_from_env = __commonJS({
   }
 });
 
-// node_modules/follow-redirects/debug.js
+// ../../node_modules/ms/index.js
+var require_ms = __commonJS({
+  "../../node_modules/ms/index.js"(exports2, module2) {
+    var s = 1e3;
+    var m = s * 60;
+    var h = m * 60;
+    var d = h * 24;
+    var y = d * 365.25;
+    module2.exports = function(val, options) {
+      options = options || {};
+      var type = typeof val;
+      if (type === "string" && val.length > 0) {
+        return parse(val);
+      } else if (type === "number" && isNaN(val) === false) {
+        return options.long ? fmtLong(val) : fmtShort(val);
+      }
+      throw new Error(
+        "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
+      );
+    };
+    function parse(str) {
+      str = String(str);
+      if (str.length > 100) {
+        return;
+      }
+      var match = /^((?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|years?|yrs?|y)?$/i.exec(
+        str
+      );
+      if (!match) {
+        return;
+      }
+      var n = parseFloat(match[1]);
+      var type = (match[2] || "ms").toLowerCase();
+      switch (type) {
+        case "years":
+        case "year":
+        case "yrs":
+        case "yr":
+        case "y":
+          return n * y;
+        case "days":
+        case "day":
+        case "d":
+          return n * d;
+        case "hours":
+        case "hour":
+        case "hrs":
+        case "hr":
+        case "h":
+          return n * h;
+        case "minutes":
+        case "minute":
+        case "mins":
+        case "min":
+        case "m":
+          return n * m;
+        case "seconds":
+        case "second":
+        case "secs":
+        case "sec":
+        case "s":
+          return n * s;
+        case "milliseconds":
+        case "millisecond":
+        case "msecs":
+        case "msec":
+        case "ms":
+          return n;
+        default:
+          return void 0;
+      }
+    }
+    function fmtShort(ms) {
+      if (ms >= d) {
+        return Math.round(ms / d) + "d";
+      }
+      if (ms >= h) {
+        return Math.round(ms / h) + "h";
+      }
+      if (ms >= m) {
+        return Math.round(ms / m) + "m";
+      }
+      if (ms >= s) {
+        return Math.round(ms / s) + "s";
+      }
+      return ms + "ms";
+    }
+    function fmtLong(ms) {
+      return plural(ms, d, "day") || plural(ms, h, "hour") || plural(ms, m, "minute") || plural(ms, s, "second") || ms + " ms";
+    }
+    function plural(ms, n, name) {
+      if (ms < n) {
+        return;
+      }
+      if (ms < n * 1.5) {
+        return Math.floor(ms / n) + " " + name;
+      }
+      return Math.ceil(ms / n) + " " + name + "s";
+    }
+  }
+});
+
+// ../../node_modules/debug/src/debug.js
 var require_debug2 = __commonJS({
+  "../../node_modules/debug/src/debug.js"(exports2, module2) {
+    exports2 = module2.exports = createDebug.debug = createDebug["default"] = createDebug;
+    exports2.coerce = coerce;
+    exports2.disable = disable;
+    exports2.enable = enable;
+    exports2.enabled = enabled;
+    exports2.humanize = require_ms();
+    exports2.names = [];
+    exports2.skips = [];
+    exports2.formatters = {};
+    var prevTime;
+    function selectColor(namespace) {
+      var hash = 0, i;
+      for (i in namespace) {
+        hash = (hash << 5) - hash + namespace.charCodeAt(i);
+        hash |= 0;
+      }
+      return exports2.colors[Math.abs(hash) % exports2.colors.length];
+    }
+    function createDebug(namespace) {
+      function debug() {
+        if (!debug.enabled) return;
+        var self2 = debug;
+        var curr = +/* @__PURE__ */ new Date();
+        var ms = curr - (prevTime || curr);
+        self2.diff = ms;
+        self2.prev = prevTime;
+        self2.curr = curr;
+        prevTime = curr;
+        var args = new Array(arguments.length);
+        for (var i = 0; i < args.length; i++) {
+          args[i] = arguments[i];
+        }
+        args[0] = exports2.coerce(args[0]);
+        if ("string" !== typeof args[0]) {
+          args.unshift("%O");
+        }
+        var index = 0;
+        args[0] = args[0].replace(/%([a-zA-Z%])/g, function(match, format) {
+          if (match === "%%") return match;
+          index++;
+          var formatter = exports2.formatters[format];
+          if ("function" === typeof formatter) {
+            var val = args[index];
+            match = formatter.call(self2, val);
+            args.splice(index, 1);
+            index--;
+          }
+          return match;
+        });
+        exports2.formatArgs.call(self2, args);
+        var logFn = debug.log || exports2.log || console.log.bind(console);
+        logFn.apply(self2, args);
+      }
+      debug.namespace = namespace;
+      debug.enabled = exports2.enabled(namespace);
+      debug.useColors = exports2.useColors();
+      debug.color = selectColor(namespace);
+      if ("function" === typeof exports2.init) {
+        exports2.init(debug);
+      }
+      return debug;
+    }
+    function enable(namespaces) {
+      exports2.save(namespaces);
+      exports2.names = [];
+      exports2.skips = [];
+      var split = (typeof namespaces === "string" ? namespaces : "").split(/[\s,]+/);
+      var len = split.length;
+      for (var i = 0; i < len; i++) {
+        if (!split[i]) continue;
+        namespaces = split[i].replace(/\*/g, ".*?");
+        if (namespaces[0] === "-") {
+          exports2.skips.push(new RegExp("^" + namespaces.substr(1) + "$"));
+        } else {
+          exports2.names.push(new RegExp("^" + namespaces + "$"));
+        }
+      }
+    }
+    function disable() {
+      exports2.enable("");
+    }
+    function enabled(name) {
+      var i, len;
+      for (i = 0, len = exports2.skips.length; i < len; i++) {
+        if (exports2.skips[i].test(name)) {
+          return false;
+        }
+      }
+      for (i = 0, len = exports2.names.length; i < len; i++) {
+        if (exports2.names[i].test(name)) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function coerce(val) {
+      if (val instanceof Error) return val.stack || val.message;
+      return val;
+    }
+  }
+});
+
+// ../../node_modules/debug/src/browser.js
+var require_browser = __commonJS({
+  "../../node_modules/debug/src/browser.js"(exports2, module2) {
+    exports2 = module2.exports = require_debug2();
+    exports2.log = log;
+    exports2.formatArgs = formatArgs;
+    exports2.save = save;
+    exports2.load = load;
+    exports2.useColors = useColors;
+    exports2.storage = "undefined" != typeof chrome && "undefined" != typeof chrome.storage ? chrome.storage.local : localstorage();
+    exports2.colors = [
+      "lightseagreen",
+      "forestgreen",
+      "goldenrod",
+      "dodgerblue",
+      "darkorchid",
+      "crimson"
+    ];
+    function useColors() {
+      if (typeof window !== "undefined" && window.process && window.process.type === "renderer") {
+        return true;
+      }
+      return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // is firebug? http://stackoverflow.com/a/398120/376773
+      typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // is firefox >= v31?
+      // https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
+      typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/) && parseInt(RegExp.$1, 10) >= 31 || // double check webkit in userAgent just in case we are in a worker
+      typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/);
+    }
+    exports2.formatters.j = function(v) {
+      try {
+        return JSON.stringify(v);
+      } catch (err) {
+        return "[UnexpectedJSONParseError]: " + err.message;
+      }
+    };
+    function formatArgs(args) {
+      var useColors2 = this.useColors;
+      args[0] = (useColors2 ? "%c" : "") + this.namespace + (useColors2 ? " %c" : " ") + args[0] + (useColors2 ? "%c " : " ") + "+" + exports2.humanize(this.diff);
+      if (!useColors2) return;
+      var c = "color: " + this.color;
+      args.splice(1, 0, c, "color: inherit");
+      var index = 0;
+      var lastC = 0;
+      args[0].replace(/%[a-zA-Z%]/g, function(match) {
+        if ("%%" === match) return;
+        index++;
+        if ("%c" === match) {
+          lastC = index;
+        }
+      });
+      args.splice(lastC, 0, c);
+    }
+    function log() {
+      return "object" === typeof console && console.log && Function.prototype.apply.call(console.log, console, arguments);
+    }
+    function save(namespaces) {
+      try {
+        if (null == namespaces) {
+          exports2.storage.removeItem("debug");
+        } else {
+          exports2.storage.debug = namespaces;
+        }
+      } catch (e) {
+      }
+    }
+    function load() {
+      var r;
+      try {
+        r = exports2.storage.debug;
+      } catch (e) {
+      }
+      if (!r && typeof process !== "undefined" && "env" in process) {
+        r = process.env.DEBUG;
+      }
+      return r;
+    }
+    exports2.enable(load());
+    function localstorage() {
+      try {
+        return window.localStorage;
+      } catch (e) {
+      }
+    }
+  }
+});
+
+// ../../node_modules/debug/src/node.js
+var require_node2 = __commonJS({
+  "../../node_modules/debug/src/node.js"(exports2, module2) {
+    var tty = require("tty");
+    var util = require("util");
+    exports2 = module2.exports = require_debug2();
+    exports2.init = init;
+    exports2.log = log;
+    exports2.formatArgs = formatArgs;
+    exports2.save = save;
+    exports2.load = load;
+    exports2.useColors = useColors;
+    exports2.colors = [6, 2, 3, 4, 5, 1];
+    exports2.inspectOpts = Object.keys(process.env).filter(function(key) {
+      return /^debug_/i.test(key);
+    }).reduce(function(obj, key) {
+      var prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, function(_, k) {
+        return k.toUpperCase();
+      });
+      var val = process.env[key];
+      if (/^(yes|on|true|enabled)$/i.test(val)) val = true;
+      else if (/^(no|off|false|disabled)$/i.test(val)) val = false;
+      else if (val === "null") val = null;
+      else val = Number(val);
+      obj[prop] = val;
+      return obj;
+    }, {});
+    var fd = parseInt(process.env.DEBUG_FD, 10) || 2;
+    if (1 !== fd && 2 !== fd) {
+      util.deprecate(function() {
+      }, "except for stderr(2) and stdout(1), any other usage of DEBUG_FD is deprecated. Override debug.log if you want to use a different log function (https://git.io/debug_fd)")();
+    }
+    var stream = 1 === fd ? process.stdout : 2 === fd ? process.stderr : createWritableStdioStream(fd);
+    function useColors() {
+      return "colors" in exports2.inspectOpts ? Boolean(exports2.inspectOpts.colors) : tty.isatty(fd);
+    }
+    exports2.formatters.o = function(v) {
+      this.inspectOpts.colors = this.useColors;
+      return util.inspect(v, this.inspectOpts).split("\n").map(function(str) {
+        return str.trim();
+      }).join(" ");
+    };
+    exports2.formatters.O = function(v) {
+      this.inspectOpts.colors = this.useColors;
+      return util.inspect(v, this.inspectOpts);
+    };
+    function formatArgs(args) {
+      var name = this.namespace;
+      var useColors2 = this.useColors;
+      if (useColors2) {
+        var c = this.color;
+        var prefix = "  \x1B[3" + c + ";1m" + name + " \x1B[0m";
+        args[0] = prefix + args[0].split("\n").join("\n" + prefix);
+        args.push("\x1B[3" + c + "m+" + exports2.humanize(this.diff) + "\x1B[0m");
+      } else {
+        args[0] = (/* @__PURE__ */ new Date()).toUTCString() + " " + name + " " + args[0];
+      }
+    }
+    function log() {
+      return stream.write(util.format.apply(util, arguments) + "\n");
+    }
+    function save(namespaces) {
+      if (null == namespaces) {
+        delete process.env.DEBUG;
+      } else {
+        process.env.DEBUG = namespaces;
+      }
+    }
+    function load() {
+      return process.env.DEBUG;
+    }
+    function createWritableStdioStream(fd2) {
+      var stream2;
+      var tty_wrap = process.binding("tty_wrap");
+      switch (tty_wrap.guessHandleType(fd2)) {
+        case "TTY":
+          stream2 = new tty.WriteStream(fd2);
+          stream2._type = "tty";
+          if (stream2._handle && stream2._handle.unref) {
+            stream2._handle.unref();
+          }
+          break;
+        case "FILE":
+          var fs = require("fs");
+          stream2 = new fs.SyncWriteStream(fd2, { autoClose: false });
+          stream2._type = "fs";
+          break;
+        case "PIPE":
+        case "TCP":
+          var net = require("net");
+          stream2 = new net.Socket({
+            fd: fd2,
+            readable: false,
+            writable: true
+          });
+          stream2.readable = false;
+          stream2.read = null;
+          stream2._type = "pipe";
+          if (stream2._handle && stream2._handle.unref) {
+            stream2._handle.unref();
+          }
+          break;
+        default:
+          throw new Error("Implement me. Unknown stream file type!");
+      }
+      stream2.fd = fd2;
+      stream2._isStdio = true;
+      return stream2;
+    }
+    function init(debug) {
+      debug.inspectOpts = {};
+      var keys = Object.keys(exports2.inspectOpts);
+      for (var i = 0; i < keys.length; i++) {
+        debug.inspectOpts[keys[i]] = exports2.inspectOpts[keys[i]];
+      }
+    }
+    exports2.enable(load());
+  }
+});
+
+// ../../node_modules/debug/src/index.js
+var require_src = __commonJS({
+  "../../node_modules/debug/src/index.js"(exports2, module2) {
+    if (typeof process !== "undefined" && process.type === "renderer") {
+      module2.exports = require_browser();
+    } else {
+      module2.exports = require_node2();
+    }
+  }
+});
+
+// node_modules/follow-redirects/debug.js
+var require_debug3 = __commonJS({
   "node_modules/follow-redirects/debug.js"(exports2, module2) {
     var debug;
     module2.exports = function() {
       if (!debug) {
         try {
-          debug = require("debug")("follow-redirects");
+          debug = require_src()("follow-redirects");
         } catch (error) {
         }
         if (typeof debug !== "function") {
@@ -61493,7 +61919,7 @@ var require_follow_redirects = __commonJS({
     var https = require("https");
     var Writable = require("stream").Writable;
     var assert = require("assert");
-    var debug = require_debug2();
+    var debug = require_debug3();
     (function detectUnsupportedEnvironment() {
       var looksLikeNode = typeof process !== "undefined";
       var looksLikeBrowser = typeof window !== "undefined" && typeof document !== "undefined";
@@ -81783,7 +82209,7 @@ var require_password = __commonJS({
 });
 
 // node_modules/chardet/lib/fs/node.js
-var require_node2 = __commonJS({
+var require_node3 = __commonJS({
   "node_modules/chardet/lib/fs/node.js"(exports2, module2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -87285,7 +87711,7 @@ var require_lib6 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.detectFileSync = exports2.detectFile = exports2.analyse = exports2.detect = void 0;
-    var node_1 = __importDefault(require_node2());
+    var node_1 = __importDefault(require_node3());
     var ascii_1 = __importDefault(require_ascii());
     var utf8_1 = __importDefault(require_utf8());
     var unicode = __importStar(require_unicode());
@@ -91638,56 +92064,80 @@ var require_hook = __commonJS({
     var HOOK_MARKER = "# CodeRifts pre-push hook";
     var PRE_PUSH_SCRIPT = `#!/bin/sh
 ${HOOK_MARKER}
-# Checks API spec changes before pushing
+# Checks API spec changes before pushing.
+# The pre-push hook receives lines on stdin:
+#   <local ref> <local sha> <remote ref> <remote sha>
 
 CODERIFTS_API_KEY=$(git config coderifts.apiKey)
 SPEC_PATH=$(git config coderifts.specPath || echo "api/openapi.yaml")
+ZERO="0000000000000000000000000000000000000000"
 
 if [ -z "$CODERIFTS_API_KEY" ]; then
   echo "CodeRifts: No API key configured. Run: git config coderifts.apiKey <your-key>"
   exit 0  # Don't block if not configured
 fi
 
-# Get the base and head specs
-BASE_SPEC=$(git show HEAD:$SPEC_PATH 2>/dev/null)
-HEAD_SPEC=$(cat $SPEC_PATH 2>/dev/null)
-
-if [ -z "$BASE_SPEC" ] || [ -z "$HEAD_SPEC" ]; then
-  exit 0  # No spec found, skip
-fi
-
-if [ "$BASE_SPEC" = "$HEAD_SPEC" ]; then
-  exit 0  # No changes, skip
-fi
-
-echo "CodeRifts: Checking API spec changes..."
-
-RESULT=$(curl -s -X POST https://app.coderifts.com/api/v1/diff \\
-  -H "Authorization: Bearer $CODERIFTS_API_KEY" \\
-  -H "Content-Type: application/json" \\
-  -d "{\\"before\\": $(echo "$BASE_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))'), \\"after\\": $(echo "$HEAD_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}")
-
-DECISION=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_decision','ALLOW'))" 2>/dev/null)
-OMEGA=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_api',0))" 2>/dev/null)
-BREAKING=$(echo $RESULT | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('breaking_changes',[])))" 2>/dev/null)
-
-if [ "$DECISION" = "BLOCK" ]; then
-  echo ""
-  echo "\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"
-  echo "\u2551  CodeRifts: PUSH BLOCKED               \u2551"
-  echo "\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563"
-  echo "\u2551  Risk score:      $OMEGA/100"
-  echo "\u2551  Breaking changes: $BREAKING"
-  echo "\u2551  Decision:        BLOCK"
-  echo "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
-  echo ""
-  echo "Fix breaking changes or use --no-verify to bypass."
-  exit 1
-fi
-
-if [ "$DECISION" = "REQUIRE_APPROVAL" ] || [ "$DECISION" = "WARN" ]; then
-  echo "CodeRifts: \u26A0 $DECISION \u2014 Risk: $OMEGA/100, Breaking: $BREAKING"
-fi
+# Read stdin lines provided by git pre-push
+while read LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do
+  # Skip delete pushes
+  if [ "$LOCAL_SHA" = "$ZERO" ]; then
+    continue
+  fi
+
+  # Get the spec at the local (about-to-be-pushed) commit
+  HEAD_SPEC=$(git show "$LOCAL_SHA:$SPEC_PATH" 2>/dev/null)
+  if [ -z "$HEAD_SPEC" ]; then
+    continue  # Spec doesn't exist in local commit, skip
+  fi
+
+  # Get the spec at the remote (already-pushed) commit
+  if [ "$REMOTE_SHA" = "$ZERO" ]; then
+    # New branch \u2014 no remote baseline, use empty spec
+    BASE_SPEC=""
+  else
+    BASE_SPEC=$(git show "$REMOTE_SHA:$SPEC_PATH" 2>/dev/null || echo "")
+  fi
+
+  # If base is empty (new spec or new branch), allow
+  if [ -z "$BASE_SPEC" ]; then
+    echo "CodeRifts: New spec detected, allowing push."
+    continue
+  fi
+
+  # If specs are identical, nothing to check
+  if [ "$BASE_SPEC" = "$HEAD_SPEC" ]; then
+    continue
+  fi
+
+  echo "CodeRifts: Checking API spec changes..."
+
+  RESULT=$(curl -s -X POST https://app.coderifts.com/api/v1/diff \\
+    -H "Authorization: Bearer $CODERIFTS_API_KEY" \\
+    -H "Content-Type: application/json" \\
+    -d "{\\"before\\": $(echo "$BASE_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))'), \\"after\\": $(echo "$HEAD_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}")
+
+  DECISION=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_decision','ALLOW'))" 2>/dev/null)
+  OMEGA=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_api',0))" 2>/dev/null)
+  BREAKING=$(echo $RESULT | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('breaking_changes',[])))" 2>/dev/null)
+
+  if [ "$DECISION" = "BLOCK" ]; then
+    echo ""
+    echo "========================================"
+    echo "  CodeRifts: PUSH BLOCKED"
+    echo "========================================"
+    echo "  Risk score:       $OMEGA/100"
+    echo "  Breaking changes: $BREAKING"
+    echo "  Decision:         BLOCK"
+    echo "========================================"
+    echo ""
+    echo "Fix breaking changes or use --no-verify to bypass."
+    exit 1
+  fi
+
+  if [ "$DECISION" = "REQUIRE_APPROVAL" ] || [ "$DECISION" = "WARN" ]; then
+    echo "CodeRifts: WARNING \u2014 $DECISION \u2014 Risk: $OMEGA/100, Breaking: $BREAKING"
+  fi
+done
 
 exit 0
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -10,6 +10,8 @@
   "main": "dist/cli.js",
   "files": [
     "dist/",
+    "bin/",
+    "scripts/",
     "README.md"
   ],
   "keywords": [
@@ -53,6 +55,6 @@
     "json-schema-ref-parser": "npm:@apidevtools/json-schema-ref-parser@^11.7.3"
   },
   "devDependencies": {
-    "esbuild": "^0.27.3"
+    "esbuild": "^0.27.4"
   }
 }

package/scripts/postinstall.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/**
+ * Postinstall patch: z-schema v8+ exports { default: ZSchema } instead of ZSchema directly.
+ * This patches @apidevtools/swagger-parser to handle both export styles.
+ */
+const fs = require('fs');
+const path = require('path');
+
+try {
+  const schemaPath = require.resolve('@apidevtools/swagger-parser/lib/validators/schema.js');
+  let content = fs.readFileSync(schemaPath, 'utf8');
+
+  let patched = false;
+  if (!content.includes('_ZSchema')) {
+    content = content.replace(
+      'const ZSchema = require("z-schema");',
+      'const _ZSchema = require("z-schema"); const ZSchema = _ZSchema.default || _ZSchema;'
+    );
+    patched = true;
+  }
+  // z-schema v10+ requires ZSchema.create() instead of new ZSchema()
+  if (content.includes('new ZSchema(') && !content.includes('ZSchema.create')) {
+    content = content.replace(
+      /return new ZSchema\(/g,
+      'return (typeof ZSchema.create === "function" ? ZSchema.create : (opts) => new ZSchema(opts))('
+    );
+    patched = true;
+  }
+  if (patched) {
+    fs.writeFileSync(schemaPath, content);
+    console.log('postinstall: patched z-schema import/constructor in swagger-parser');
+  }
+} catch (err) {
+  console.log('postinstall: skipping z-schema patch:', err.message);
+}
+
+// Patch 2: json-schema-ref-parser v11+ exports { default: $RefParser } instead of $RefParser directly
+// json-schema-diff uses `new RefParser()` which breaks with the new export style
+try {
+  const derefPath = require.resolve('json-schema-diff/dist/json-schema-diff/diff-schemas/dereference-schema.js');
+  let content2 = fs.readFileSync(derefPath, 'utf8');
+
+  if (!content2.includes('_RefParser')) {
+    content2 = content2.replace(
+      'const RefParser = require("json-schema-ref-parser");',
+      'const _RefParser = require("json-schema-ref-parser"); const RefParser = _RefParser.default || _RefParser;'
+    );
+    fs.writeFileSync(derefPath, content2);
+    console.log('postinstall: patched json-schema-ref-parser import in json-schema-diff');
+  }
+} catch (err) {
+  console.log('postinstall: skipping ref-parser patch:', err.message);
+}