coderifts 1.8.4 → 2.0.0

package/README.md

@@ -64,6 +64,48 @@ Interactive configuration generator. Creates a `.coderifts.yml` file with indust
 
 Save your CodeRifts API key for cloud features. Get a free key at [app.coderifts.com/api/signup](https://app.coderifts.com/api/signup).
 
+### `coderifts publish-gate`
+
+Gate **npm publish** on the same contract-preflight family as the pre-push hook:
+`before` = last published / merge-base baseline, `after` = working tree. Exit **0**
+only when `execution_action` permits publish; **BLOCK**, resolver errors, empty
+before, and preflight unreachability all exit **1** (fail-closed). Empty `before`
+is **never** treated as a silent NEW_ARTIFACT pass.
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `--spec <path>` | Contract artifact path | `git config coderifts.specPath` or `api/openapi.yaml` |
+| `--json` | Machine-readable result | `false` |
+
+**Recommended package.json wiring:**
+
+```json
+{
+  "scripts": {
+    "prepublishOnly": "coderifts publish-gate"
+  }
+}
+```
+
+**Before resolution order (fail-closed):**
+1. Git tag of `package.json` version (`vX.Y.Z`, then `X.Y.Z`)
+2. `git merge-base HEAD origin/main` (fallbacks: `origin/master`, `main`, `master`)
+3. Exit 1 with a clear error — never invent an empty baseline
+
+On success the command prints a **receipt reference** when the preflight path issues one.
+
+### Git hook (`coderifts hook install`)
+
+Installs a **pre-push** hook that diffs the configured OpenAPI path against a
+resolved baseline (remote tip, or for new branches a merge-base with the
+default branch). Empty-before allow is not used. The hook prefers closed-set
+`execution_action` from the diff API (legacy `omega_decision` only when action
+is absent). Configure with `git config coderifts.apiKey` and optional
+`git config coderifts.specPath`.
+
+After upgrading the `coderifts` CLI, re-run `coderifts hook install` so the
+installed hook matches the package (already-installed hooks are not
+auto-updated).
 ## CI/CD Integration
 
 ### GitHub Actions

package/bin/coderifts.js

@@ -25,6 +25,40 @@ program
     await diff(oldSpec, newSpec, options);
   });
 
+// ── deploy-gate command (deploy-gate #8, phase-1 ADVISORY) ──
+// Gates a deploy on the current { environment, artifact } via a preflight receipt. Phase 1 is
+// advisory: it reports but exits 0 even on deny unless the step is marked --enforce /
+// CODERIFTS_DEPLOY_ENFORCE=true. Composes the validated pure deployGate (@coderifts/agent-guard).
+program
+  .command('deploy-gate')
+  .description('Gate a deploy on the current { environment, artifact } using a preflight receipt (phase-1 advisory)')
+  .option('--env <environment>', 'Target environment (e.g. production, staging)')
+  .option('--artifact <artifact_id>', 'Immutable artifact identity being deployed (content digest or commit SHA)')
+  .option('--receipt <file>', 'Path to the deploy-scoped receipt JSON produced by preflight')
+  .option('--json', 'Output the binding result as JSON')
+  .option('--enforce', 'Treat the step as enforcing: attest ENFORCING and exit non-zero on a gate failure')
+  .action(async (options) => {
+    const { runDeployGate } = require('../src/commands/deploy-gate');
+    await runDeployGate(options);
+  });
+
+// ── publish-gate — npm prepublishOnly (same decision family as pre-push, fail-closed before) ──
+// Exit status is set only at this command boundary (library never process.exit).
+// program.parse() does not await async actions; process.exit here makes the gate's
+// fail-closed status authoritative for npm prepublishOnly / child_process callers.
+program
+  .command('publish-gate')
+  .description('Gate npm publish on contract-artifact preflight (before=git baseline, after=working tree)')
+  .option('--spec <path>', 'Contract artifact path (default: git config coderifts.specPath or api/openapi.yaml)')
+  .option('--json', 'Machine-readable JSON result')
+  .action(async (options) => {
+    const { runPublishGate } = require('../src/commands/publish-gate');
+    const result = await runPublishGate(options);
+    const code = result && typeof result.exitCode === 'number' ? result.exitCode : 1;
+    process.exitCode = code;
+    process.exit(code);
+  });
+
 // ── init command ──
 program
   .command('init [template]')
@@ -90,4 +124,13 @@ corpusCmd
     corpusVerify(options);
   });
 
-program.parse();
+// parseAsync: required so async command actions (publish-gate, diff, deploy-gate, …)
+// complete before the process ends. program.parse() discards the action promise and
+// can leave process.exitCode at the default 0 even after a fail-closed gate printed errors.
+program.parseAsync(process.argv).catch((err) => {
+  console.error(err);
+  process.exitCode = typeof process.exitCode === 'number' && process.exitCode !== 0
+    ? process.exitCode
+    : 1;
+  process.exit(process.exitCode);
+});