coderifts 1.9.0 → 2.0.0

package/dist/cli.js

@@ -3007,7 +3007,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "1.9.0",
+      version: "2.0.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -3055,7 +3055,7 @@ var require_package = __commonJS({
         "cli-table3": "^0.6.4",
         commander: "^12.0.0",
         inquirer: "^8.2.6",
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^4.3.1",
         "openapi-diff": "^0.24.1",
         ora: "^5.4.1"
       },
@@ -3063,7 +3063,9 @@ var require_package = __commonJS({
         "z-schema": "^7.2.0",
         "json-schema-ref-parser": "npm:@apidevtools/json-schema-ref-parser@^11.7.3",
         "form-data": "^4.0.6",
-        axios: ">=1.18.0"
+        axios: ">=1.18.0",
+        "fast-uri": ">=3.1.5",
+        "brace-expansion": "5.0.9"
       },
       devDependencies: {
         esbuild: "^0.28.1"
@@ -4367,7 +4369,7 @@ var require_templates = __commonJS({
         if (!Number.isNaN(number)) {
           results.push(number);
         } else if (matches = chunk.match(STRING_REGEX)) {
-          results.push(matches[2].replace(ESCAPE_REGEX, (m, escape2, character) => escape2 ? unescape2(escape2) : character));
+          results.push(matches[2].replace(ESCAPE_REGEX, (m, escape, character) => escape ? unescape2(escape) : character));
         } else {
           throw new Error(`Invalid Chalk template style argument: ${chunk} (in style '${name}')`);
         }
@@ -11256,7 +11258,7 @@ var require_omap = __commonJS({
     var _toString = Object.prototype.toString;
     function resolveYamlOmap(data) {
       if (data === null) return true;
-      const objectKeys = [];
+      const objectKeys = {};
       const object = data;
       for (let index = 0, length = object.length; index < length; index += 1) {
         const pair = object[index];
@@ -11270,8 +11272,8 @@ var require_omap = __commonJS({
           }
         }
         if (!pairHasKey) return false;
-        if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey);
-        else return false;
+        if (_hasOwnProperty.call(objectKeys, pairKey)) return false;
+        Object.defineProperty(objectKeys, pairKey, { value: true });
       }
       return true;
     }
@@ -24778,7 +24780,7 @@ var require_lodash = __commonJS({
           position -= target.length;
           return position >= 0 && string.slice(position, end) == target;
         }
-        function escape2(string) {
+        function escape(string) {
           string = toString(string);
           return string && reHasUnescapedHtml.test(string) ? string.replace(reUnescapedHtml, escapeHtmlChar) : string;
         }
@@ -25389,7 +25391,7 @@ var require_lodash = __commonJS({
         lodash.divide = divide;
         lodash.endsWith = endsWith;
         lodash.eq = eq;
-        lodash.escape = escape2;
+        lodash.escape = escape;
         lodash.escapeRegExp = escapeRegExp;
         lodash.every = every;
         lodash.find = find;
@@ -29363,6 +29365,7 @@ var require_utils2 = __commonJS({
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -29505,7 +29508,7 @@ var require_utils2 = __commonJS({
               continue;
             }
           } else if (input[0] === "/") {
-            if (input[1] === "." || input[1] === "/") {
+            if (input[1] === ".") {
               output.push("/");
               break;
             }
@@ -29587,10 +29590,30 @@ var require_utils2 = __commonJS({
       }
       return output;
     }
+    var BYTE_HEX = new Array(256);
+    {
+      const HEX_DIGITS = "0123456789ABCDEF";
+      for (let i = 0; i < 256; i++) {
+        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+      }
+    }
+    function isEscapeSafe(cp) {
+      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+    }
+    function percentEncodeNonAscii(cp) {
+      if (cp < 2048) {
+        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+      }
+      if (cp < 65536) {
+        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+      }
+      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex = input.slice(i + 1, i + 3);
           if (isHexPair(hex)) {
             const normalizedHex = hex.toUpperCase();
@@ -29604,10 +29627,66 @@ var require_utils2 = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(input[i])) {
-          output += input[i];
+        if (isPathCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function normalizeQueryFragmentEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            const normalizedHex = hex.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isQueryFragmentCharacter(ch)) {
+          output += ch;
         } else {
-          output += escape(input[i]);
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
         }
       }
       return output;
@@ -29615,7 +29694,8 @@ var require_utils2 = __commonJS({
     function escapePreservingEscapes(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex = input.slice(i + 1, i + 3);
           if (isHexPair(hex)) {
             output += "%" + hex.toUpperCase();
@@ -29623,7 +29703,22 @@ var require_utils2 = __commonJS({
             continue;
           }
         }
-        output += escape(input[i]);
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
       return output;
     }
@@ -29657,6 +29752,7 @@ var require_utils2 = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      normalizeQueryFragmentEncoding,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -29881,7 +29977,7 @@ var require_schemes = __commonJS({
 var require_fast_uri = __commonJS({
   "node_modules/fast-uri/index.js"(exports2, module2) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils2();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -29895,7 +29991,12 @@ var require_fast_uri = __commonJS({
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
+      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed) {
+        throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+      }
+      const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -30021,6 +30122,7 @@ var require_fast_uri = __commonJS({
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
     var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -30055,9 +30157,23 @@ var require_fast_uri = __commonJS({
         parsed.error = "URI authority must not contain a literal backslash.";
         malformedAuthorityOrPort = true;
       }
+      const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+      if (introducerMatch !== null) {
+        const region = introducerMatch[1];
+        const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+        if (normalizedRegion.length >= 2) {
+          if (normalizedRegion.slice(0, 2) !== "//") {
+            parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+            malformedAuthorityOrPort = true;
+          } else if (region.length !== normalizedRegion.length) {
+            parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+            malformedAuthorityOrPort = true;
+          }
+        }
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
-        parsed.scheme = matches[1];
+        parsed.scheme = matches[1] === void 0 ? void 0 : matches[1].toLowerCase();
         parsed.userinfo = matches[3];
         parsed.host = matches[4];
         parsed.port = parseInt(matches[5], 10);
@@ -30116,12 +30232,11 @@ var require_fast_uri = __commonJS({
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
+          if (parsed.query) {
+            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+          }
           if (parsed.fragment) {
-            try {
-              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-            } catch {
-              parsed.error = parsed.error || "URI malformed";
-            }
+            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -65406,9 +65521,9 @@ var require_diff = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/sdk/dist/cjs/errors.js
+// node_modules/@coderifts/sdk/dist/cjs/errors.js
 var require_errors5 = __commonJS({
-  "../../node_modules/@coderifts/sdk/dist/cjs/errors.js"(exports2) {
+  "node_modules/@coderifts/sdk/dist/cjs/errors.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = void 0;
@@ -65458,9 +65573,9 @@ var require_errors5 = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/sdk/dist/cjs/client.js
+// node_modules/@coderifts/sdk/dist/cjs/client.js
 var require_client = __commonJS({
-  "../../node_modules/@coderifts/sdk/dist/cjs/client.js"(exports2) {
+  "node_modules/@coderifts/sdk/dist/cjs/client.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.CodeRifts = void 0;
@@ -65708,9 +65823,9 @@ var require_client = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/sdk/dist/cjs/decision.js
+// node_modules/@coderifts/sdk/dist/cjs/decision.js
 var require_decision = __commonJS({
-  "../../node_modules/@coderifts/sdk/dist/cjs/decision.js"(exports2) {
+  "node_modules/@coderifts/sdk/dist/cjs/decision.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.readDecision = readDecision;
@@ -65756,9 +65871,9 @@ var require_decision = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/sdk/dist/cjs/index.js
+// node_modules/@coderifts/sdk/dist/cjs/index.js
 var require_cjs3 = __commonJS({
-  "../../node_modules/@coderifts/sdk/dist/cjs/index.js"(exports2) {
+  "node_modules/@coderifts/sdk/dist/cjs/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.readDecision = exports2.AuthError = exports2.RateLimitError = exports2.TimeoutError = exports2.ApiError = exports2.CodeRiftsError = exports2.CodeRifts = void 0;
@@ -65789,9 +65904,9 @@ var require_cjs3 = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/detector.js
+// node_modules/@coderifts/agent-guard/dist/cjs/detector.js
 var require_detector = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/detector.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/detector.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.builtinDetector = exports2.DETECTOR_VERSION = void 0;
@@ -66322,9 +66437,9 @@ var require_detector = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/receipt-binding.js
+// node_modules/@coderifts/agent-guard/dist/cjs/receipt-binding.js
 var require_receipt_binding = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/receipt-binding.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/receipt-binding.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.canonicalJson = canonicalJson;
@@ -66396,9 +66511,9 @@ var require_receipt_binding = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/enforcement-gate.js
+// node_modules/@coderifts/agent-guard/dist/cjs/enforcement-gate.js
 var require_enforcement_gate = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/enforcement-gate.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/enforcement-gate.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.computeArtifactDigest = computeArtifactDigest;
@@ -66472,9 +66587,9 @@ var require_enforcement_gate = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/guard.js
+// node_modules/@coderifts/agent-guard/dist/cjs/guard.js
 var require_guard = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/guard.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/guard.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.guardToolCall = guardToolCall;
@@ -66494,6 +66609,25 @@ var require_guard = __commonJS({
         }
       }
     }
+    function resolvePreviousReceipt(config) {
+      const pr = config.previousReceipt;
+      if (pr === void 0 || pr === null)
+        return void 0;
+      let raw;
+      if (typeof pr === "function") {
+        try {
+          raw = pr();
+        } catch {
+          return void 0;
+        }
+      } else {
+        raw = pr;
+      }
+      if (typeof raw !== "string")
+        return void 0;
+      const s = raw.trim();
+      return s.length > 0 ? s : void 0;
+    }
     function fingerprint(call) {
       const canon = JSON.stringify({ toolName: call.toolName, arguments: call.arguments, artifacts: call.artifacts, filesTouched: call.filesTouched, diff: call.diff });
       return "sha256:" + (0, node_crypto_1.createHash)("sha256").update(canon).digest("hex");
@@ -66663,7 +66797,7 @@ var require_guard = __commonJS({
       const request = {
         artifacts: detection.artifacts,
         context: { operation: config.operation ?? "tool_call", environment: config.environment, audience: config.audience },
-        previous_receipt: void 0,
+        previous_receipt: resolvePreviousReceipt(config),
         idempotency_key: void 0
       };
       const cap = config.maxPayloadBytes ?? 1e6;
@@ -66800,9 +66934,84 @@ var require_guard = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/session-taint.js
+// node_modules/@coderifts/agent-guard/dist/cjs/receipt-chain.js
+var require_receipt_chain = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/receipt-chain.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.RECEIPT_PREV_NULL = void 0;
+    exports2.previousReceiptCommitment = previousReceiptCommitment;
+    exports2.decodeReceiptBodyPrev = decodeReceiptBodyPrev;
+    exports2.verifyReceiptChainLinkage = verifyReceiptChainLinkage;
+    var node_crypto_1 = require("node:crypto");
+    exports2.RECEIPT_PREV_NULL = "null";
+    function previousReceiptCommitment(previousToken) {
+      return "sha256:" + (0, node_crypto_1.createHash)("sha256").update(previousToken, "utf8").digest("hex");
+    }
+    function decodeReceiptBodyPrev(token) {
+      if (typeof token !== "string" || token.length === 0)
+        return null;
+      const parts = token.split(".");
+      if (parts.length !== 2 || !parts[0] || !parts[1])
+        return null;
+      try {
+        const json = Buffer.from(parts[0], "base64url").toString("utf8");
+        const body = JSON.parse(json);
+        if (typeof body.prev !== "string")
+          return null;
+        return { prev: body.prev };
+      } catch {
+        return null;
+      }
+    }
+    function verifyReceiptChainLinkage(tokens) {
+      const length = tokens.length;
+      if (length === 0) {
+        return { ok: true, length: 0 };
+      }
+      for (let i = 0; i < length; i++) {
+        const decoded = decodeReceiptBodyPrev(tokens[i]);
+        if (!decoded) {
+          return {
+            ok: false,
+            length,
+            failedAt: i,
+            reason: "malformed_token"
+          };
+        }
+        if (i === 0) {
+          if (decoded.prev !== exports2.RECEIPT_PREV_NULL) {
+            return {
+              ok: false,
+              length,
+              failedAt: 0,
+              reason: "unexpected_predecessor",
+              expected: exports2.RECEIPT_PREV_NULL,
+              actual: decoded.prev
+            };
+          }
+          continue;
+        }
+        const expected = previousReceiptCommitment(tokens[i - 1]);
+        if (decoded.prev !== expected) {
+          return {
+            ok: false,
+            length,
+            failedAt: i,
+            reason: "broken_link",
+            expected,
+            actual: decoded.prev
+          };
+        }
+      }
+      return { ok: true, length };
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/session-taint.js
 var require_session_taint = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/session-taint.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/session-taint.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.SessionTaintTracker = exports2.SESSION_TAINT_VERSION = void 0;
@@ -67107,9 +67316,9 @@ var require_session_taint = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/resolver-yaml.js
+// node_modules/@coderifts/agent-guard/dist/cjs/resolver-yaml.js
 var require_resolver_yaml = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/resolver-yaml.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/resolver-yaml.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.YamlLiteError = void 0;
@@ -67328,9 +67537,9 @@ var require_resolver_yaml = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/resolver-glob.js
+// node_modules/@coderifts/agent-guard/dist/cjs/resolver-glob.js
 var require_resolver_glob = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/resolver-glob.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/resolver-glob.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.globToRegExp = globToRegExp;
@@ -67383,11 +67592,12 @@ var require_resolver_glob = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/artifact-resolver.js
+// node_modules/@coderifts/agent-guard/dist/cjs/artifact-resolver.js
 var require_artifact_resolver = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/artifact-resolver.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/artifact-resolver.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.classifyByName = classifyByName;
     exports2.resolve = resolve;
     var resolver_yaml_js_1 = require_resolver_yaml();
     var resolver_glob_js_1 = require_resolver_glob();
@@ -67788,14 +67998,15 @@ var require_artifact_resolver = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/tool-registry.js
+// node_modules/@coderifts/agent-guard/dist/cjs/tool-registry.js
 var require_tool_registry = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/tool-registry.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/tool-registry.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.RegistryConstructionError = void 0;
     exports2.guardToolRegistry = guardToolRegistry;
     var guard_js_1 = require_guard();
+    var artifact_resolver_js_1 = require_artifact_resolver();
     var RegistryConstructionError = class extends Error {
       code;
       toolName;
@@ -67872,7 +68083,50 @@ var require_tool_registry = __commonJS({
       }
     }
     function defaultBinder(tool, args) {
-      return { toolName: tool.name, arguments: args };
+      const d = { toolName: tool.name, arguments: args };
+      if (!args || typeof args !== "object")
+        return d;
+      const a = args;
+      if (Array.isArray(a.artifacts)) {
+        d.artifacts = a.artifacts;
+        return d;
+      }
+      const path = typeof a.path === "string" ? a.path : "";
+      if (!path)
+        return d;
+      const type = (0, artifact_resolver_js_1.classifyByName)(path);
+      if (!type)
+        return d;
+      const bothSides = (oldS, newS) => typeof oldS === "string" && oldS.length > 0 && typeof newS === "string" && newS.length > 0;
+      if (Array.isArray(a.edits)) {
+        const lifted = [];
+        for (let i = 0; i < a.edits.length; i++) {
+          const e = a.edits[i];
+          if (!e || typeof e !== "object")
+            continue;
+          const er = e;
+          if (!bothSides(er.old_string, er.new_string))
+            continue;
+          lifted.push({
+            id: `${type}:${path}#${i}`,
+            type,
+            before: er.old_string,
+            after: er.new_string
+          });
+        }
+        if (lifted.length > 0)
+          d.artifacts = lifted;
+        return d;
+      }
+      if (bothSides(a.old_string, a.new_string)) {
+        d.artifacts = [{
+          id: `${type}:${path}`,
+          type,
+          before: a.old_string,
+          after: a.new_string
+        }];
+      }
+      return d;
     }
     var RAW_EXECUTORS = /* @__PURE__ */ new WeakMap();
     function freezeTool(t) {
@@ -68025,9 +68279,9 @@ var require_tool_registry = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/merge-gate.js
+// node_modules/@coderifts/agent-guard/dist/cjs/merge-gate.js
 var require_merge_gate = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/merge-gate.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/merge-gate.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.gateDecision = gateDecision;
@@ -68121,6 +68375,13 @@ var require_merge_gate = __commonJS({
           residual = "protection_advisory_only";
         else
           residual = "protection_not_configured";
+      } else {
+        if (protection.required_check_app_bound === true) {
+        } else if (protection.required_check_app_bound === false) {
+          residual = "required_check_app_not_bound";
+        } else {
+          residual = "required_check_app_binding_unknown";
+        }
       }
       return {
         merge_allowed: true,
@@ -68135,9 +68396,9 @@ var require_merge_gate = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/deploy-gate.js
+// node_modules/@coderifts/agent-guard/dist/cjs/deploy-gate.js
 var require_deploy_gate = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/deploy-gate.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/deploy-gate.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.deployGate = deployGate;
@@ -68176,8 +68437,8 @@ var require_deploy_gate = __commonJS({
       const enf = rc.enforcement || { enforcement: "UNKNOWN", bypass_possible: true };
       const enforcement_state = enf.enforcement;
       const opRequired = rc.operation ?? "deploy";
-      const requireEnv = rc.require_bound_environment !== false;
-      const requireArt = rc.require_bound_artifact !== false;
+      const requireEnv = enforcement_state === "ENFORCING" || rc.require_bound_environment !== false;
+      const requireArt = enforcement_state === "ENFORCING" || rc.require_bound_artifact !== false;
       const allowPending = input.allowPending ?? rc.allowPending ?? false;
       const allowWarnDeploy = input.allowWarnDeploy ?? rc.allowWarnDeploy ?? false;
       const allowPrefix = input.allowPrefixCompare ?? rc.allowPrefixCompare ?? false;
@@ -68260,9 +68521,9 @@ var require_deploy_gate = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/coverage-report.js
+// node_modules/@coderifts/agent-guard/dist/cjs/coverage-report.js
 var require_coverage_report = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/coverage-report.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/coverage-report.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.coverageReport = coverageReport;
@@ -68422,12 +68683,133 @@ var require_coverage_report = __commonJS({
   }
 });
 
-// ../../node_modules/@coderifts/agent-guard/dist/cjs/index.js
+// node_modules/@coderifts/agent-guard/dist/cjs/with-coderifts.js
+var require_with_coderifts = __commonJS({
+  "node_modules/@coderifts/agent-guard/dist/cjs/with-coderifts.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.withCodeRifts = withCodeRifts;
+    var tool_registry_js_1 = require_tool_registry();
+    var COMPOSITION_CALL_POLICY_COMPLETE = false;
+    var RESIDUAL_CALL_POLICY_INCOMPLETE = "composition_call_policy_incomplete";
+    var RESIDUAL_FORCED_READONLY = "composition_forced_readonly_on_heuristic_mutator";
+    var RESIDUAL_UNKNOWN_READONLY = "composition_unknown_treated_as_readonly";
+    var COVERAGE_STRENGTH = {
+      COMPLETE: 3,
+      PARTIAL: 2,
+      BYPASSED: 1,
+      UNKNOWN: 0
+    };
+    function coverageRank(coverage) {
+      return Object.prototype.hasOwnProperty.call(COVERAGE_STRENGTH, coverage) ? COVERAGE_STRENGTH[coverage] : void 0;
+    }
+    async function safeOnOutcome(onOutcome, payload) {
+      try {
+        await Promise.resolve(onOutcome(payload));
+      } catch {
+      }
+    }
+    function wrapGuardedForObservation(tool, onOutcome) {
+      const innerExecute = tool.execute;
+      const toolName = tool.name;
+      const shell = {
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        meta: tool.meta,
+        _coderifts: tool._coderifts,
+        execute: async (args) => {
+          const outcome = await innerExecute(args);
+          await safeOnOutcome(onOutcome, {
+            toolName,
+            // Guarded execute always returns a GuardOutcome from guardToolCall; assert the type for callers.
+            outcome
+          });
+          return outcome;
+        }
+      };
+      if (!Object.isFrozen(shell._coderifts))
+        Object.freeze(shell._coderifts);
+      return Object.freeze(shell);
+    }
+    function withCodeRifts(input) {
+      if (!input || typeof input !== "object") {
+        throw new Error("withCodeRifts: input object is required");
+      }
+      const problems = [];
+      if (typeof input.operation !== "string" || input.operation.trim() === "") {
+        problems.push("`operation` is required and must be a non-empty string (receipts bind to an operation; merge != deploy, so there is no safe default)");
+      }
+      if (input.client == null) {
+        problems.push("`client` is required at construction (guardToolRegistry needs config.guard.client to wrap any mutating tool)");
+      }
+      if (input.requireCoverage !== void 0 && coverageRank(input.requireCoverage) === void 0) {
+        problems.push(`\`requireCoverage\` must be one of COMPLETE | PARTIAL | BYPASSED | UNKNOWN (got ${JSON.stringify(input.requireCoverage)})`);
+      }
+      if (problems.length > 0) {
+        throw new Error(`withCodeRifts: construction aborted \u2014 ${problems.length} condition(s):
+` + problems.map((p) => `  - ${p}`).join("\n"));
+      }
+      const reg = input.registry ?? {};
+      const guard = { client: input.client, operation: input.operation };
+      if (input.onEvent !== void 0) {
+        guard.onEvent = input.onEvent;
+      }
+      if (input.previousReceipt !== void 0) {
+        guard.previousReceipt = input.previousReceipt;
+      }
+      const config = {
+        guard,
+        unknownToolPolicy: reg.unknownToolPolicy ?? "mutating",
+        classify: reg.classify,
+        binders: reg.binders,
+        forceReadonly: reg.forceReadonly,
+        failOnUnguardedMutator: reg.failOnUnguardedMutator
+      };
+      const { tools, report } = (0, tool_registry_js_1.guardToolRegistry)(input.tools, config);
+      if (input.requireCoverage !== void 0) {
+        const requiredRank = coverageRank(input.requireCoverage);
+        const actualRank = coverageRank(report.coverage) ?? -1;
+        if (requiredRank !== void 0 && actualRank < requiredRank) {
+          throw new Error(`withCodeRifts: requireCoverage not met \u2014 registry coverage '${report.coverage}' is weaker than required '${input.requireCoverage}' (strength ordering COMPLETE > PARTIAL > BYPASSED > UNKNOWN). requireCoverage constrains the REGISTRY tool-boundary surface ONLY; a green construction here is NOT a product-level runtime-inescapability guarantee \u2014 composition_assurance.inescapable_runtime stays false until receipt carry-forward and a freshness-safe prior for write-style calls land.`);
+        }
+      }
+      const compositionInescapableRuntime = report.claim.inescapable_runtime && COMPOSITION_CALL_POLICY_COMPLETE;
+      const residuals = [RESIDUAL_CALL_POLICY_INCOMPLETE];
+      if (report.warnings.some((w) => w.startsWith("force_readonly_on_mutator_heuristic:"))) {
+        residuals.push(RESIDUAL_FORCED_READONLY);
+      }
+      if (report.warnings.includes("unknown_treated_as_readonly")) {
+        residuals.push(RESIDUAL_UNKNOWN_READONLY);
+      }
+      const composition_assurance = {
+        coverage: "PARTIAL",
+        inescapable_runtime: compositionInescapableRuntime,
+        residuals
+      };
+      let toolsOut = tools;
+      if (input.onOutcome) {
+        const onOutcome = input.onOutcome;
+        toolsOut = Object.freeze(tools.map((t) => t._coderifts.guarded ? wrapGuardedForObservation(t, onOutcome) : t));
+      }
+      const result = {
+        tools: toolsOut,
+        registry_report: report,
+        composition_assurance
+      };
+      if (input.repository !== void 0)
+        result.repository = input.repository;
+      return result;
+    }
+  }
+});
+
+// node_modules/@coderifts/agent-guard/dist/cjs/index.js
 var require_cjs4 = __commonJS({
-  "../../node_modules/@coderifts/agent-guard/dist/cjs/index.js"(exports2) {
+  "node_modules/@coderifts/agent-guard/dist/cjs/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.coverageReport = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.resolveArtifacts = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.guardToolCall = void 0;
+    exports2.withCodeRifts = exports2.coverageReport = exports2.deployGate = exports2.gateDecision = exports2.RegistryConstructionError = exports2.guardToolRegistry = exports2.globToRegExp = exports2.matchGlob = exports2.classifyByName = exports2.resolveArtifacts = exports2.deriveKeySignal = exports2.pathClass = exports2.classifyCommand = exports2.projectState = exports2.emptySessionState = exports2.computeTainted = exports2.evaluate = exports2.updateSession = exports2.SESSION_TAINT_VERSION = exports2.SessionTaintTracker = exports2.readDecision = exports2.computeBundleFingerprint = exports2.computeArtifactDigest = exports2.evaluateEnvelope = exports2.RECEIPT_PREV_NULL = exports2.decodeReceiptBodyPrev = exports2.previousReceiptCommitment = exports2.verifyReceiptChainLinkage = exports2.canonicalJson = exports2.computeBodyHash = exports2.bindReceiptToEnvelope = exports2.DETECTOR_VERSION = exports2.builtinDetector = exports2.guardToolCall = void 0;
     var guard_js_1 = require_guard();
     Object.defineProperty(exports2, "guardToolCall", { enumerable: true, get: function() {
       return guard_js_1.guardToolCall;
@@ -68449,6 +68831,19 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "canonicalJson", { enumerable: true, get: function() {
       return receipt_binding_js_1.canonicalJson;
     } });
+    var receipt_chain_js_1 = require_receipt_chain();
+    Object.defineProperty(exports2, "verifyReceiptChainLinkage", { enumerable: true, get: function() {
+      return receipt_chain_js_1.verifyReceiptChainLinkage;
+    } });
+    Object.defineProperty(exports2, "previousReceiptCommitment", { enumerable: true, get: function() {
+      return receipt_chain_js_1.previousReceiptCommitment;
+    } });
+    Object.defineProperty(exports2, "decodeReceiptBodyPrev", { enumerable: true, get: function() {
+      return receipt_chain_js_1.decodeReceiptBodyPrev;
+    } });
+    Object.defineProperty(exports2, "RECEIPT_PREV_NULL", { enumerable: true, get: function() {
+      return receipt_chain_js_1.RECEIPT_PREV_NULL;
+    } });
     var enforcement_gate_js_1 = require_enforcement_gate();
     Object.defineProperty(exports2, "evaluateEnvelope", { enumerable: true, get: function() {
       return enforcement_gate_js_1.evaluateEnvelope;
@@ -68498,6 +68893,9 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "resolveArtifacts", { enumerable: true, get: function() {
       return artifact_resolver_js_1.resolve;
     } });
+    Object.defineProperty(exports2, "classifyByName", { enumerable: true, get: function() {
+      return artifact_resolver_js_1.classifyByName;
+    } });
     var resolver_glob_js_1 = require_resolver_glob();
     Object.defineProperty(exports2, "matchGlob", { enumerable: true, get: function() {
       return resolver_glob_js_1.matchGlob;
@@ -68524,6 +68922,10 @@ var require_cjs4 = __commonJS({
     Object.defineProperty(exports2, "coverageReport", { enumerable: true, get: function() {
       return coverage_report_js_1.coverageReport;
     } });
+    var with_coderifts_js_1 = require_with_coderifts();
+    Object.defineProperty(exports2, "withCodeRifts", { enumerable: true, get: function() {
+      return with_coderifts_js_1.withCodeRifts;
+    } });
   }
 });
 
@@ -68667,6 +69069,450 @@ var require_deploy_gate2 = __commonJS({
   }
 });
 
+// src/commands/publish-gate.js
+var require_publish_gate = __commonJS({
+  "src/commands/publish-gate.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var { execFileSync } = require("child_process");
+    var chalk = require_source();
+    var { getApiKey } = require_config();
+    var { cloudDiff } = require_cloud();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var ZERO_SHA = "0000000000000000000000000000000000000000";
+    var CLOSED_ACTIONS = /* @__PURE__ */ new Set([
+      "CONTINUE",
+      "CONTINUE_WITH_MONITORING",
+      "REQUEST_APPROVAL",
+      "STOP"
+    ]);
+    var PERMIT_ACTIONS = /* @__PURE__ */ new Set(["CONTINUE", "CONTINUE_WITH_MONITORING"]);
+    function defaultGit(args, cwd) {
+      return execFileSync("git", args, {
+        cwd: cwd || process.cwd(),
+        encoding: "utf8",
+        maxBuffer: 16 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+    }
+    function gitShow(ref, filePath, { gitImpl = defaultGit, cwd } = {}) {
+      try {
+        const out = gitImpl(["show", `${ref}:${filePath}`], cwd);
+        return { ok: true, content: out == null ? "" : String(out) };
+      } catch (err) {
+        const msg = err && err.stderr ? String(err.stderr) : err && err.message || String(err);
+        return {
+          ok: false,
+          code: "GIT_ERROR",
+          message: `git error reading ${ref}:${filePath}: ${msg.slice(0, 300)}`
+        };
+      }
+    }
+    function readPackageVersion(cwd, readFile = fs.readFileSync) {
+      const pkgPath = path.join(cwd || process.cwd(), "package.json");
+      try {
+        const raw = readFile(pkgPath, "utf8");
+        const pkg2 = JSON.parse(raw);
+        return pkg2 && typeof pkg2.version === "string" ? pkg2.version : null;
+      } catch {
+        return null;
+      }
+    }
+    function resolveBeforeSpec(specPath, {
+      gitImpl = defaultGit,
+      cwd = process.cwd(),
+      readFile = fs.readFileSync,
+      packageVersion = null
+    } = {}) {
+      const version = packageVersion != null ? packageVersion : readPackageVersion(cwd, readFile);
+      const tried = [];
+      if (version) {
+        const tags = [`v${version}`, version];
+        for (const tag of tags) {
+          tried.push(`tag:${tag}`);
+          try {
+            gitImpl(["rev-parse", "--verify", `${tag}^{commit}`], cwd);
+          } catch {
+            continue;
+          }
+          const shown = gitShow(tag, specPath, { gitImpl, cwd });
+          if (!shown.ok) {
+            return {
+              ok: false,
+              code: shown.code || "GIT_ERROR",
+              message: shown.message,
+              tried
+            };
+          }
+          if (shown.content.trim() === "") {
+            return {
+              ok: false,
+              code: "EMPTY_BEFORE",
+              message: `Empty contract artifact at tag ${tag}:${specPath}. Refusing to treat empty before as NEW_ARTIFACT (would false-pass enforce).`,
+              tried
+            };
+          }
+          return { ok: true, content: shown.content, source: `tag:${tag}`, tried };
+        }
+      } else {
+        tried.push("package.json:version (missing)");
+      }
+      const bases = ["origin/main", "origin/master", "main", "master"];
+      for (const base of bases) {
+        tried.push(`merge-base:${base}`);
+        let mb;
+        try {
+          mb = gitImpl(["merge-base", "HEAD", base], cwd);
+        } catch {
+          continue;
+        }
+        if (!mb || mb === ZERO_SHA) continue;
+        const shown = gitShow(mb, specPath, { gitImpl, cwd });
+        if (!shown.ok) {
+          return {
+            ok: false,
+            code: shown.code || "GIT_ERROR",
+            message: shown.message,
+            tried
+          };
+        }
+        if (shown.content.trim() === "") {
+          return {
+            ok: false,
+            code: "EMPTY_BEFORE",
+            message: `Empty contract artifact at merge-base ${mb}:${specPath} (${base}). Refusing to treat empty before as NEW_ARTIFACT (would false-pass enforce).`,
+            tried
+          };
+        }
+        return {
+          ok: true,
+          content: shown.content,
+          source: `merge-base:${base}@${mb.slice(0, 12)}`,
+          tried
+        };
+      }
+      return {
+        ok: false,
+        code: "BEFORE_UNRESOLVED",
+        message: `Could not resolve a non-empty before-spec for ${specPath}. Tried: (a) git tag of package.json version, (b) merge-base with origin/main. Attempts: ${tried.join(", ")}. Fail-closed \u2014 will not publish without a baseline.`,
+        tried
+      };
+    }
+    function resolveAfterSpec(specPath, {
+      cwd = process.cwd(),
+      readFile = fs.readFileSync,
+      exists = fs.existsSync
+    } = {}) {
+      const resolved = path.isAbsolute(specPath) ? specPath : path.join(cwd, specPath);
+      try {
+        if (!exists(resolved)) {
+          return {
+            ok: false,
+            code: "AFTER_MISSING",
+            message: `Working-tree contract artifact not found: ${specPath}`
+          };
+        }
+        const content = readFile(resolved, "utf8");
+        if (content == null || String(content).trim() === "") {
+          return {
+            ok: false,
+            code: "AFTER_EMPTY",
+            message: `Working-tree contract artifact is empty: ${specPath}`
+          };
+        }
+        return { ok: true, content: String(content), path: resolved };
+      } catch (err) {
+        return {
+          ok: false,
+          code: "AFTER_READ_ERROR",
+          message: `Failed to read working-tree ${specPath}: ${err && err.message}`
+        };
+      }
+    }
+    function evaluatePublishPermission(result) {
+      if (!result || typeof result !== "object") {
+        return {
+          allow: false,
+          execution_action: null,
+          decision: null,
+          policy: "fail_closed:unreadable_response"
+        };
+      }
+      const env = result.decision_result && typeof result.decision_result === "object" ? result.decision_result : null;
+      let ea = null;
+      if (env && typeof env.execution_action === "string") ea = env.execution_action;
+      else if (typeof result.execution_action === "string") ea = result.execution_action;
+      const decision = env && env.decision || result.decision || result.omega_decision || null;
+      if (ea && CLOSED_ACTIONS.has(ea)) {
+        const allow = PERMIT_ACTIONS.has(ea);
+        return {
+          allow,
+          execution_action: ea,
+          decision: decision || null,
+          policy: allow ? `permit:execution_action=${ea}` : `block:execution_action=${ea}`
+        };
+      }
+      if (ea != null && ea !== "" && !CLOSED_ACTIONS.has(ea)) {
+        return {
+          allow: false,
+          execution_action: ea,
+          decision: decision || null,
+          policy: `block:unrecognised_execution_action=${ea}`
+        };
+      }
+      if (decision === "BLOCK" || decision === "REQUIRE_APPROVAL") {
+        return {
+          allow: false,
+          execution_action: null,
+          decision,
+          policy: `block:decision=${decision}`
+        };
+      }
+      if (decision === "ALLOW" || decision === "WARN" || decision === "PASS") {
+        return {
+          allow: true,
+          execution_action: null,
+          decision,
+          policy: `permit:decision=${decision}`
+        };
+      }
+      const omega = result.omega_decision;
+      if (omega === "BLOCK" || omega === "REQUIRE_APPROVAL") {
+        return {
+          allow: false,
+          execution_action: null,
+          decision: omega,
+          policy: `block:omega_decision=${omega}`
+        };
+      }
+      return {
+        allow: false,
+        execution_action: ea,
+        decision: decision || omega || null,
+        policy: "fail_closed:no_permission_signal"
+      };
+    }
+    function extractReceiptRef(result) {
+      if (!result || typeof result !== "object") return null;
+      const env = result.decision_result;
+      if (env && env.receipt && typeof env.receipt.token === "string") {
+        return env.receipt.token.slice(0, 24) + (env.receipt.token.length > 24 ? "\u2026" : "");
+      }
+      if (env && typeof env.decision_id === "string") return env.decision_id;
+      if (typeof result.decision_id === "string") return result.decision_id;
+      if (typeof result.fingerprint === "string") return result.fingerprint;
+      if (env && typeof env.fingerprint === "string") return env.fingerprint;
+      return null;
+    }
+    async function defaultPreflight(before, after, { apiKey } = {}) {
+      const key = process.env.CODERIFTS_FORCE_LOCAL_PREFLIGHT ? null : apiKey != null ? apiKey : getApiKey();
+      if (key) {
+        return cloudDiff(before, after, key);
+      }
+      const yaml = require_js_yaml();
+      const { diffSpecs } = require_api2();
+      let oldSpec;
+      let newSpec;
+      try {
+        oldSpec = yaml.load(before);
+        newSpec = yaml.load(after);
+      } catch (e) {
+        const err = new Error(`Failed to parse specs: ${e.message}`);
+        err.code = "PREFLIGHT_UNREACHABLE";
+        throw err;
+      }
+      let diffResult;
+      try {
+        diffResult = await diffSpecs({
+          sourceSpec: { content: JSON.stringify(oldSpec), location: "before.json", format: "openapi3" },
+          destinationSpec: { content: JSON.stringify(newSpec), location: "after.json", format: "openapi3" }
+        });
+      } catch (e) {
+        const err = new Error(`Local preflight engine error: ${e.message}`);
+        err.code = "PREFLIGHT_UNREACHABLE";
+        throw err;
+      }
+      const breaking = (diffResult.breakingDifferences || []).length;
+      const decision = breaking > 0 ? "BLOCK" : "ALLOW";
+      const execution_action = breaking > 0 ? "STOP" : "CONTINUE";
+      return {
+        decision,
+        omega_decision: decision,
+        execution_action,
+        decision_result: {
+          decision,
+          execution_action,
+          decision_id: `local-${Date.now()}`
+        },
+        breaking_changes: diffResult.breakingDifferences || [],
+        risk_score: Math.min(breaking * 15, 100)
+      };
+    }
+    async function runPublishGate(options = {}, deps = {}) {
+      const cwd = deps.cwd || process.cwd();
+      const gitImpl = deps.gitImpl || defaultGit;
+      const readFile = deps.readFile || fs.readFileSync.bind(fs);
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const preflightFn = deps.preflightFn || defaultPreflight;
+      const log = deps.log || console.log.bind(console);
+      const logErr = deps.logErr || console.error.bind(console);
+      let specPath = options.spec;
+      if (!specPath) {
+        try {
+          specPath = gitImpl(["config", "coderifts.specPath"], cwd);
+        } catch {
+          specPath = "";
+        }
+      }
+      if (!specPath) specPath = "api/openapi.yaml";
+      try {
+        gitImpl(["rev-parse", "--is-inside-work-tree"], cwd);
+      } catch (err) {
+        const msg = "CodeRifts publish-gate: GIT_ERROR \u2014 not a git repository (or git unavailable). Cannot resolve before-spec without git. Fail-closed.";
+        logErr(chalk.red(msg));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: "GIT_ERROR",
+          message: msg,
+          policy: "fail_closed:git_error"
+        }, { log, json: options.json });
+      }
+      const beforeRes = resolveBeforeSpec(specPath, {
+        gitImpl,
+        cwd,
+        readFile,
+        packageVersion: deps.packageVersion
+      });
+      if (!beforeRes.ok) {
+        logErr(chalk.red(`CodeRifts publish-gate: ${beforeRes.code} \u2014 ${beforeRes.message}`));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: beforeRes.code,
+          message: beforeRes.message,
+          policy: `fail_closed:${beforeRes.code}`,
+          tried: beforeRes.tried
+        }, { log, json: options.json });
+      }
+      const afterRes = resolveAfterSpec(specPath, { cwd, readFile, exists });
+      if (!afterRes.ok) {
+        logErr(chalk.red(`CodeRifts publish-gate: ${afterRes.code} \u2014 ${afterRes.message}`));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: afterRes.code,
+          message: afterRes.message,
+          policy: `fail_closed:${afterRes.code}`
+        }, { log, json: options.json });
+      }
+      if (beforeRes.content === afterRes.content) {
+        const payload2 = {
+          ok: true,
+          exitCode: 0,
+          code: "UNCHANGED",
+          message: "Contract artifact unchanged vs baseline; publish permitted.",
+          policy: "permit:unchanged",
+          before_source: beforeRes.source,
+          execution_action: "CONTINUE",
+          receipt: null
+        };
+        if (!options.json) {
+          log(chalk.green("CodeRifts publish-gate: ALLOW (unchanged)"));
+          log(`  baseline: ${beforeRes.source}`);
+          log(`  spec:     ${specPath}`);
+        }
+        return finish(payload2, { log, json: options.json });
+      }
+      let result;
+      try {
+        result = await preflightFn(beforeRes.content, afterRes.content, {
+          apiKey: deps.apiKey,
+          cwd
+        });
+      } catch (err) {
+        const msg = `CodeRifts publish-gate: PREFLIGHT_UNREACHABLE \u2014 ${err && err.message}`;
+        logErr(chalk.red(msg));
+        return finish({
+          ok: false,
+          exitCode: 1,
+          code: "PREFLIGHT_UNREACHABLE",
+          message: msg,
+          policy: "fail_closed:preflight_unreachable"
+        }, { log, json: options.json });
+      }
+      const perm = evaluatePublishPermission(result);
+      const receipt = extractReceiptRef(result);
+      if (!perm.allow) {
+        const payload2 = {
+          ok: false,
+          exitCode: 1,
+          code: "BLOCK",
+          message: "Publish not permitted by execution_action / decision.",
+          policy: perm.policy,
+          execution_action: perm.execution_action,
+          decision: perm.decision,
+          before_source: beforeRes.source,
+          receipt,
+          fail_policy: "exit_1_on_block_or_resolver_error_or_unreachable"
+        };
+        if (!options.json) {
+          logErr("");
+          logErr(chalk.red("========================================"));
+          logErr(chalk.red("  CodeRifts: PUBLISH BLOCKED"));
+          logErr(chalk.red("========================================"));
+          logErr(`  Policy:            ${perm.policy}`);
+          logErr(`  execution_action:  ${perm.execution_action || "(none)"}`);
+          logErr(`  decision:          ${perm.decision || "(none)"}`);
+          logErr(`  baseline:          ${beforeRes.source}`);
+          logErr(`  fail policy:       exit 1 on BLOCK / resolver error / preflight unreachability`);
+          logErr(chalk.red("========================================"));
+          logErr("");
+        }
+        return finish(payload2, { log, json: options.json });
+      }
+      const payload = {
+        ok: true,
+        exitCode: 0,
+        code: "ALLOW",
+        message: "Publish permitted.",
+        policy: perm.policy,
+        execution_action: perm.execution_action,
+        decision: perm.decision,
+        before_source: beforeRes.source,
+        receipt
+      };
+      if (!options.json) {
+        log(chalk.green("CodeRifts publish-gate: ALLOW"));
+        log(`  Policy:            ${perm.policy}`);
+        log(`  execution_action:  ${perm.execution_action || "(mapped from decision)"}`);
+        log(`  baseline:          ${beforeRes.source}`);
+        if (receipt) log(`  Receipt reference: ${receipt}`);
+        else log("  Receipt reference: (none issued on this path)");
+      }
+      return finish(payload, { log, json: options.json });
+    }
+    function finish(payload, { log, json }) {
+      if (json) {
+        log(JSON.stringify(payload, null, 2));
+      }
+      return payload;
+    }
+    module2.exports = {
+      runPublishGate,
+      resolveBeforeSpec,
+      resolveAfterSpec,
+      evaluatePublishPermission,
+      extractReceiptRef,
+      gitShow,
+      defaultGit,
+      PERMIT_ACTIONS,
+      CLOSED_ACTIONS
+    };
+  }
+});
+
 // src/commands/init.js
 var require_init = __commonJS({
   "src/commands/init.js"(exports2, module2) {
@@ -94355,6 +95201,8 @@ ${HOOK_MARKER}
 # Checks API spec changes before pushing.
 # The pre-push hook receives lines on stdin:
 #   <local ref> <local sha> <remote ref> <remote sha>
+#
+# Re-install after CLI upgrades: coderifts hook install
 
 CODERIFTS_API_KEY=$(git config coderifts.apiKey)
 SPEC_PATH=$(git config coderifts.specPath || echo "api/openapi.yaml")
@@ -94365,6 +95213,53 @@ if [ -z "$CODERIFTS_API_KEY" ]; then
   exit 0  # Don't block if not configured
 fi
 
+# --- helpers: three-state git blob read (present | absent | error) ---
+# Sets: BLOB_KIND, BLOB_CONTENT, BLOB_ERR. Never maps unreadable \u2192 empty string.
+git_blob_at() {
+  _ref="$1"
+  _path="$2"
+  BLOB_CONTENT=""
+  BLOB_ERR=""
+  BLOB_KIND=""
+  if ! git rev-parse --verify "$_ref^{commit}" >/dev/null 2>&1; then
+    BLOB_KIND=error
+    BLOB_ERR="GIT_ERROR: cannot resolve ref $_ref"
+    return 1
+  fi
+  _errf=$(mktemp 2>/dev/null || echo "/tmp/coderifts-hook-err.$$")
+  if BLOB_CONTENT=$(git show "$_ref:$_path" 2>"$_errf"); then
+    BLOB_KIND=present
+    rm -f "$_errf"
+    return 0
+  fi
+  _err=$(cat "$_errf" 2>/dev/null)
+  rm -f "$_errf"
+  case "$_err" in
+    *"does not exist in"*|*"exists on disk, but not in"*)
+      BLOB_KIND=absent
+      BLOB_CONTENT=""
+      return 0
+      ;;
+  esac
+  BLOB_KIND=error
+  BLOB_ERR="GIT_ERROR: git show $_ref:$_path failed"
+  return 1
+}
+
+# New-branch baseline: merge-base with default branch (not empty before).
+# Prints merge-base SHA on success; nonzero if none can be resolved.
+resolve_new_branch_base_ref() {
+  _local="$1"
+  for _cand in origin/HEAD origin/main origin/master main master; do
+    _mb=$(git merge-base "$_local" "$_cand" 2>/dev/null) || continue
+    if [ -n "$_mb" ] && [ "$_mb" != "$ZERO" ]; then
+      echo "$_mb"
+      return 0
+    fi
+  done
+  return 1
+}
+
 # Read stdin lines provided by git pre-push
 while read LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do
   # Skip delete pushes
@@ -94372,41 +95267,93 @@ while read LOCAL_REF LOCAL_SHA REMOTE_REF REMOTE_SHA; do
     continue
   fi
 
-  # Get the spec at the local (about-to-be-pushed) commit
-  HEAD_SPEC=$(git show "$LOCAL_SHA:$SPEC_PATH" 2>/dev/null)
-  if [ -z "$HEAD_SPEC" ]; then
+  # after = local (about-to-be-pushed) commit \u2014 three-state
+  if ! git_blob_at "$LOCAL_SHA" "$SPEC_PATH"; then
+    echo "CodeRifts: $BLOB_ERR (after=$SPEC_PATH at $LOCAL_SHA). Fail-closed."
+    exit 1
+  fi
+  if [ "$BLOB_KIND" = "absent" ]; then
     continue  # Spec doesn't exist in local commit, skip
   fi
+  HEAD_SPEC=$BLOB_CONTENT
 
-  # Get the spec at the remote (already-pushed) commit
+  # before = remote tip, or for new branch (zero remote SHA) a merge-base baseline
   if [ "$REMOTE_SHA" = "$ZERO" ]; then
-    # New branch \u2014 no remote baseline, use empty spec
-    BASE_SPEC=""
+    BASE_REF=$(resolve_new_branch_base_ref "$LOCAL_SHA") || {
+      echo "CodeRifts: GIT_ERROR \u2014 cannot resolve merge-base baseline for new branch (tried origin/HEAD, origin/main, origin/master, main, master). Fail-closed."
+      exit 1
+    }
   else
-    BASE_SPEC=$(git show "$REMOTE_SHA:$SPEC_PATH" 2>/dev/null || echo "")
+    BASE_REF=$REMOTE_SHA
   fi
 
-  # If base is empty (new spec or new branch), allow
-  if [ -z "$BASE_SPEC" ]; then
-    echo "CodeRifts: New spec detected, allowing push."
+  if ! git_blob_at "$BASE_REF" "$SPEC_PATH"; then
+    echo "CodeRifts: $BLOB_ERR (before=$SPEC_PATH at $BASE_REF). Fail-closed \u2014 not treating as new spec."
+    exit 1
+  fi
+  if [ "$BLOB_KIND" = "absent" ]; then
+    # Honest NEW_ARTIFACT: path genuinely not at baseline
+    echo "CodeRifts: New artifact (spec absent at baseline $BASE_REF:$SPEC_PATH); allowing push."
     continue
   fi
+  BASE_SPEC=$BLOB_CONTENT
 
   # If specs are identical, nothing to check
   if [ "$BASE_SPEC" = "$HEAD_SPEC" ]; then
     continue
   fi
 
-  echo "CodeRifts: Checking API spec changes..."
+  echo "CodeRifts: Checking API spec changes (baseline $BASE_REF)..."
 
   RESULT=$(curl -s -X POST https://app.coderifts.com/api/v1/diff \\
     -H "Authorization: Bearer $CODERIFTS_API_KEY" \\
     -H "Content-Type: application/json" \\
     -d "{\\"before\\": $(echo "$BASE_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))'), \\"after\\": $(echo "$HEAD_SPEC" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}")
 
-  DECISION=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_decision','ALLOW'))" 2>/dev/null)
-  OMEGA=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_api',0))" 2>/dev/null)
-  BREAKING=$(echo $RESULT | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('breaking_changes',[])))" 2>/dev/null)
+  # Prefer closed-set execution_action; omega_decision only when action is absent.
+  # Severity (unchanged): BLOCK/STOP \u2192 exit 1; REQUIRE_APPROVAL/WARN \u2192 warn; unknown action \u2192 halt.
+  DECISION=$(echo "$RESULT" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    print("ALLOW")
+    raise SystemExit(0)
+ea = None
+dr = d.get("decision_result")
+if isinstance(dr, dict) and isinstance(dr.get("execution_action"), str):
+    ea = dr["execution_action"]
+elif isinstance(d.get("execution_action"), str):
+    ea = d["execution_action"]
+closed = {"CONTINUE", "CONTINUE_WITH_MONITORING", "REQUEST_APPROVAL", "STOP"}
+if ea is not None and ea != "":
+    if ea not in closed:
+        print("UNKNOWN")
+        raise SystemExit(0)
+    if ea in ("CONTINUE", "CONTINUE_WITH_MONITORING"):
+        print("ALLOW")
+    elif ea == "STOP":
+        print("BLOCK")
+    else:
+        print("REQUIRE_APPROVAL")
+    raise SystemExit(0)
+od = d.get("omega_decision") or d.get("decision") or "ALLOW"
+print(od)
+' 2>/dev/null)
+  OMEGA=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('omega_api',0))" 2>/dev/null)
+  BREAKING=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('breaking_changes',[])))" 2>/dev/null)
+
+  if [ "$DECISION" = "UNKNOWN" ]; then
+    echo ""
+    echo "========================================"
+    echo "  CodeRifts: PUSH BLOCKED"
+    echo "========================================"
+    echo "  Reason: unrecognised execution_action is not permission"
+    echo "  Fail-closed (unknown present action)."
+    echo "========================================"
+    echo ""
+    exit 1
+  fi
 
   if [ "$DECISION" = "BLOCK" ]; then
     echo ""
@@ -94474,6 +95421,10 @@ exit 0
       console.log("");
       console.log("Optionally set spec path (default: api/openapi.yaml):");
       console.log("  git config coderifts.specPath path/to/openapi.yaml");
+      console.log("");
+      console.log("After upgrading the coderifts CLI, re-run this command so the installed");
+      console.log("hook matches the package (already-installed hooks are not auto-updated):");
+      console.log("  coderifts hook install");
     }
     function uninstall() {
       const gitDir = findGitDir();
@@ -95843,6 +96794,7 @@ var require_mcp_poisoning_detector = __commonJS({
   "../../src/mcp-poisoning-detector.js"(exports2, module2) {
     "use strict";
     var SENSITIVE_OBJECT = "(secrets?|credentials?|tokens?|passwords?|api[\\s_-]?keys?|private[\\s_-]?keys?|env|environment|conversation|chat\\s*history|context|user\\s*data|session)";
+    var SENSITIVE_SCOPE = "(any|all|every|stored|user\\'?s?|the\\s+user\\'?s?|all\\s+environment)";
     var SUSPICIOUS_PATTERNS = [
       // Injection / "ignore your instructions" family. The trailing object
       // (instructions|rules|prompts|context) is OPTIONAL so "ignore previous and ..."
@@ -95855,6 +96807,21 @@ var require_mcp_poisoning_detector = __commonJS({
       /exfiltrate|steal|leak|send\s+to\s+external/i,
       // Exfiltration-intent family: an action verb targeting a sensitive payload.
       /\b(send|forward|copy|upload|post|transmit|exfiltrate|leak)\b[\s\S]{0,40}?\b(conversation|chat|history|context|messages?|credentials?|secrets?|tokens?|api\s*keys?|keys?|passwords?|data)\b/i,
+      // Return/echo scoped sensitive material without a path ("return any stored credentials").
+      // Scope word required — bare "return the new API token" must stay quiet.
+      new RegExp(
+        "\\b(return|echo|reveal|expose|send)\\b[\\s\\S]{0,30}?\\b" + SENSITIVE_SCOPE + "\\s+(secrets?|credentials?|tokens?|passwords?|private[\\s_-]?keys?|environment\\s+variables?|env)\\b",
+        "i"
+      ),
+      // Retrieve private-key material + echo/return (intent without a filesystem path).
+      // Narrow: requires both a retrieve-class verb and an echo/return/reveal verb around key material.
+      /\b(retrieve|fetch|extract|obtain|collect)\b[\s\S]{0,60}?\b(private[\s_-]?keys?(?:\s+material)?|secret[\s_-]?keys?|key\s+material)\b[\s\S]{0,50}?\b(echo|return|send|reveal|expose)\b/i,
+      // Outbound destination without a named secret: exfil-shaped phrasing + http(s) URL.
+      // Bare URL alone stays quiet (legit tools reference docs / configured webhook URLs).
+      // "Sends the result to https://hooks…" (tool purpose) must NOT fire — requires "a copy"
+      // or "also send" as the exfil marker, not mere "send … to <url>".
+      /\b(send|forward|post|upload|transmit)\s+a\s+copy\b[\s\S]{0,50}?https?:\/\//i,
+      /\balso\s+send\b[\s\S]{0,60}?https?:\/\//i,
       /execute\s+(shell|command|code|system)/i,
       /bypass\s+(auth|security|validation|filter)/i,
       /override\s+(safety|policy|rules?)/i,
@@ -95866,8 +96833,8 @@ var require_mcp_poisoning_detector = __commonJS({
       /return\s+secret|exfiltrat|leak\s+data/i
     ];
     var URL_PATTERN = /https?:\/\/[^\s)'"]+/i;
-    var SENSITIVE_PATH_PATTERN = /(~\/\.ssh|~\/\.cursor|~\/\.aws|\.aws\/|\.env\b|\/etc\/|mcp\.json|credentials|id_rsa|\.ssh\/|private[\s_-]?keys?)/i;
-    var CONTENT_MOVE_VERB_PATTERN = /\b(pass|send|return|forward|include|read|upload|post|transmit|copy|exfiltrate|leak)\b/i;
+    var SENSITIVE_PATH_PATTERN = /(~\/\.ssh|~\/\.cursor|~\/\.aws|\.aws\/|\.env\b|\/etc\/|mcp\.json|id_rsa|\.ssh\/|\/credentials(?:\.|\/)|credentials\.(?:json|txt|pem|env)|\.credentials\b)/i;
+    var CONTENT_MOVE_VERB_PATTERN = /\b(pass|send|return|forward|include|read|upload|post|transmit|copy|exfiltrate|leak|echo|reveal|expose)\b/i;
     var BASE64_BLOB_PATTERN = /[A-Za-z0-9+/]{40,}={0,2}/;
     function isLikelyBase64(s) {
       if (/=$/.test(s)) return true;
@@ -96406,6 +97373,13 @@ program.command("deploy-gate").description("Gate a deploy on the current { envir
   const { runDeployGate } = require_deploy_gate2();
   await runDeployGate(options);
 });
+program.command("publish-gate").description("Gate npm publish on contract-artifact preflight (before=git baseline, after=working tree)").option("--spec <path>", "Contract artifact path (default: git config coderifts.specPath or api/openapi.yaml)").option("--json", "Machine-readable JSON result").action(async (options) => {
+  const { runPublishGate } = require_publish_gate();
+  const result = await runPublishGate(options);
+  const code = result && typeof result.exitCode === "number" ? result.exitCode : 1;
+  process.exitCode = code;
+  process.exit(code);
+});
 program.command("init [template]").description("Generate a .coderifts.yml from a policy template (startup, growth, fintech, public-api, microservices)").action(async (template) => {
   const { init } = require_init();
   await init(template);
@@ -96432,7 +97406,11 @@ corpusCmd.command("verify", { isDefault: true }).description("Evaluate every tru
   const { corpusVerify } = require_corpus();
   corpusVerify(options);
 });
-program.parse();
+program.parseAsync(process.argv).catch((err) => {
+  console.error(err);
+  process.exitCode = typeof process.exitCode === "number" && process.exitCode !== 0 ? process.exitCode : 1;
+  process.exit(process.exitCode);
+});
 /*! Bundled license information:
 
 safe-buffer/index.js: