coderifts 4.1.0 → 4.1.1

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 4.1.1
+
+### Fixed
+
+- **P0-2: `mapDecisionSeverity` never maps missing `execution_action` to ALLOW.**
+  Missing EA in any body shape → `INDETERMINATE` (exit 2). Legacy decision→severity
+  map is allowed only when `decision_spec_version === "1.0"` on a non-v2 body
+  (no `decision_result`, no `preflight_mode`). Top-level-only `{decision:"ALLOW"}`
+  without that pin is not permission.
+- **P0-3: parse-gap is fail-closed by default.** Unparseable stdin and missing
+  `tool_input.file_path` → **exit 2**, stderr
+  `unparseable input — refusing (fail-closed); set CODERIFTS_ADVISORY=1 to soften`,
+  JSONL `hook_blocked` with `cause: stdin_unparseable|missing_file_path`.
+  `CODERIFTS_ADVISORY=1` restores exit 0. API-key-before-parse order is unchanged
+  (garbage stdin + no key → `missing_api_key`). Non-spec Write stays exit 0.
+  Unknown-tool-on-spec was already exit 2.
+
 ## 4.1.0
 
 ### Added

package/dist/cli.js

@@ -3007,7 +3007,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.1.0",
+      version: "4.1.1",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -101231,8 +101231,10 @@ var require_claude_hook = __commonJS({
       "  no API key / API unreachable / disk unreadable / edit-apply failure on the spec path",
       "  Absence of a key is not permission. Explicit opt-out: CODERIFTS_ADVISORY=1|true.",
       "",
-      "Still exit 0 (nothing to govern): unparseable stdin, missing file_path, non-spec path,",
-      "identical content.",
+      "Parse-gap DEFAULT (exit 2): unparseable stdin / missing file_path \u2014 refusing (fail-closed);",
+      "  set CODERIFTS_ADVISORY=1 to soften. JSONL hook_blocked cause stdin_unparseable|missing_file_path.",
+      "",
+      "Still exit 0 (nothing to govern): non-spec path, identical content.",
       "",
       "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
       "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
@@ -101431,13 +101433,22 @@ var require_claude_hook = __commonJS({
       }
       return { ok: false, reason: `unsupported tool_name for content derive: ${name}` };
     }
+    function isV2DecisionBody(d, dr) {
+      if (dr && typeof dr === "object") return true;
+      if (d.preflight_mode != null && d.preflight_mode !== "") return true;
+      const ver = d.decision_spec_version;
+      return typeof ver === "string" && ver.startsWith("2.");
+    }
+    function allowLegacyDecisionMap(d, dr) {
+      return d.decision_spec_version === "1.0" && !isV2DecisionBody(d, dr);
+    }
     function mapDecisionSeverity(result) {
       const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
       let ea = null;
       const dr = d.decision_result;
-      if (dr && typeof dr === "object" && typeof dr.execution_action === "string") {
+      if (dr && typeof dr === "object" && typeof dr.execution_action === "string" && dr.execution_action !== "") {
         ea = dr.execution_action;
-      } else if (typeof d.execution_action === "string") {
+      } else if (typeof d.execution_action === "string" && d.execution_action !== "") {
         ea = d.execution_action;
       }
       const hasDecision = d.omega_decision != null && d.omega_decision !== "" || d.decision != null && d.decision !== "" || dr && typeof dr === "object" && dr.execution_action;
@@ -101462,7 +101473,7 @@ var require_claude_hook = __commonJS({
         } else {
           severity = "REQUIRE_APPROVAL";
         }
-      } else {
+      } else if (allowLegacyDecisionMap(d, dr)) {
         const od = d.omega_decision || d.decision;
         if (od == null || od === "") {
           severity = "INDETERMINATE";
@@ -101470,6 +101481,8 @@ var require_claude_hook = __commonJS({
         else if (od === "REQUIRE_APPROVAL") severity = "REQUIRE_APPROVAL";
         else if (od === "WARN") severity = "WARN";
         else severity = "ALLOW";
+      } else {
+        severity = "INDETERMINATE";
       }
       const decision = dr && dr.decision || d.decision || d.omega_decision || null;
       const decisionId = dr && dr.decision_id || d.decision_id || null;
@@ -101480,6 +101493,45 @@ var require_claude_hook = __commonJS({
         executionAction: ea
       };
     }
+    function renderDecisionWhy(result, opts = {}) {
+      const maxFixes = Number.isInteger(opts.maxFixes) ? opts.maxFixes : 5;
+      const maxLines = Number.isInteger(opts.maxLines) ? opts.maxLines : 13;
+      const d = result && typeof result === "object" && !Array.isArray(result) ? result : {};
+      const dr = d.decision_result && typeof d.decision_result === "object" ? d.decision_result : {};
+      const pick = (k) => dr[k] !== void 0 ? dr[k] : d[k];
+      const arr = (v) => Array.isArray(v) ? v : [];
+      const str = (v) => typeof v === "string" ? v.trim() : "";
+      const lines = [];
+      const reasonCodes = [];
+      for (const r of arr(pick("blocking_reasons"))) {
+        if (!r || typeof r !== "object") continue;
+        const code = str(r.code);
+        const message = str(r.message);
+        if (code) reasonCodes.push(code);
+        if (!code && !message) continue;
+        lines.push(`- ${code || "REASON"}${message ? `: ${message}` : ""}`);
+      }
+      for (const r of arr(pick("degraded_reasons"))) {
+        if (!r || typeof r !== "object") continue;
+        const code = str(r.code);
+        const message = str(r.message);
+        if (!code && !message) continue;
+        lines.push(`- degraded: ${[code, message].filter(Boolean).join(": ")}`);
+      }
+      const action = str(pick("required_action"));
+      if (action) lines.push(`- action: ${action}`);
+      const rt = pick("remediation_transaction");
+      const changes = arr(rt && typeof rt === "object" ? rt.required_changes : null).filter((c) => c && typeof c === "object");
+      const shown = changes.slice(0, maxFixes);
+      for (const c of shown) {
+        const target = str(c.target);
+        const instruction = str(c.instruction);
+        if (!instruction && !target) continue;
+        lines.push(`- fix${target ? ` (${target})` : ""}: ${instruction || str(c.precise_label)}`);
+      }
+      if (changes.length > shown.length) lines.push(`- fix: +${changes.length - shown.length} more`);
+      return { lines: lines.slice(0, maxLines), reasonCodes };
+    }
     async function runClaudeHook(options = {}, deps = {}) {
       const errLog = deps.errLog || ((m) => console.error(String(m)));
       const readStdin = deps.readStdin || (() => {
@@ -101515,7 +101567,14 @@ var require_claude_hook = __commonJS({
           decisionId: r.decisionId != null ? r.decisionId : void 0
         };
         if (r.exitCode === 2) {
-          logEv({ type: "hook_blocked", exit: 2, ...extra, cause: r.reason || r.site });
+          const reasons = Array.isArray(r.reasons) && r.reasons.length ? r.reasons : void 0;
+          logEv({
+            type: "hook_blocked",
+            exit: 2,
+            ...extra,
+            reasons,
+            cause: r.reason || r.site
+          });
         } else if (r.exitCode === 0 && r.site && advisory && !strict) {
           logEv({ type: "hook_advisory_passthrough", exit: 0, decision: r.decision || null, ...extra, cause: r.site });
         } else {
@@ -101535,20 +101594,27 @@ var require_claude_hook = __commonJS({
           errLog
         }));
       }
+      const PARSE_GAP_STDERR = "unparseable input \u2014 refusing (fail-closed); set CODERIFTS_ADVISORY=1 to soften";
       const raw = typeof options.stdin === "string" ? options.stdin : readStdin();
       const parsed = parseStdinJson(raw);
       if (!parsed.ok) {
-        errLog(`CodeRifts claude-hook: ${parsed.reason} \u2014 allowing (soft; never block on parse gap)`);
-        logEv({ type: "detection_skip", signals: ["stdin_unparseable"] });
-        return emitTerminal({ exitCode: 0, reason: "stdin_unparseable" });
+        if (advisory && !strict) {
+          errLog(`CodeRifts claude-hook: ${parsed.reason} \u2014 allowing (CODERIFTS_ADVISORY)`);
+          return emitTerminal({ exitCode: 0, reason: "stdin_unparseable", site: "stdin_unparseable" });
+        }
+        errLog(`CodeRifts claude-hook: ${PARSE_GAP_STDERR}`);
+        return emitTerminal({ exitCode: 2, reason: "stdin_unparseable" });
       }
       const { toolName, toolInput } = parsed;
       tool = toolName;
       const filePath = toolInput.file_path || toolInput.filePath || toolInput.path;
       if (!filePath || typeof filePath !== "string") {
-        errLog("CodeRifts claude-hook: tool_input.file_path missing \u2014 allowing (soft)");
-        logEv({ type: "detection_skip", signals: ["missing_file_path"], tool });
-        return emitTerminal({ exitCode: 0, reason: "missing_file_path" });
+        if (advisory && !strict) {
+          errLog("CodeRifts claude-hook: tool_input.file_path missing \u2014 allowing (CODERIFTS_ADVISORY)");
+          return emitTerminal({ exitCode: 0, reason: "missing_file_path", site: "missing_file_path" });
+        }
+        errLog(`CodeRifts claude-hook: ${PARSE_GAP_STDERR}`);
+        return emitTerminal({ exitCode: 2, reason: "missing_file_path" });
       }
       filePathKnown = filePath;
       const specPath = resolveSpecPath({ ...deps, cwd });
@@ -101635,27 +101701,37 @@ var require_claude_hook = __commonJS({
         });
       }
       if (mapped.severity === "BLOCK" || mapped.severity === "UNKNOWN") {
+        const why = renderDecisionWhy(result);
         errLog(
-          `CodeRifts claude-hook: BLOCKED${decPart}${eaPart}${idPart}` + (mapped.severity === "UNKNOWN" ? " (unrecognised execution_action)" : "")
+          [
+            `CodeRifts claude-hook: BLOCKED${decPart}${eaPart}${idPart}` + (mapped.severity === "UNKNOWN" ? " (unrecognised execution_action)" : ""),
+            ...why.lines
+          ].join("\n")
         );
         return emitTerminal({
           exitCode: 2,
           reason: mapped.severity === "UNKNOWN" ? "unknown_action" : "block",
           severity: mapped.severity,
           decision: mapped.decision,
-          decisionId: mapped.decisionId
+          decisionId: mapped.decisionId,
+          reasons: why.reasonCodes
         });
       }
       if (mapped.severity === "REQUIRE_APPROVAL") {
+        const why = renderDecisionWhy(result);
         errLog(
-          `CodeRifts claude-hook: BLOCKED approval_required${decPart}${eaPart}${idPart}`
+          [
+            `CodeRifts claude-hook: BLOCKED approval_required${decPart}${eaPart}${idPart}`,
+            ...why.lines
+          ].join("\n")
         );
         return emitTerminal({
           exitCode: 2,
           reason: "approval_required",
           severity: mapped.severity,
           decision: mapped.decision,
-          decisionId: mapped.decisionId
+          decisionId: mapped.decisionId,
+          reasons: why.reasonCodes
         });
       }
       if (mapped.severity === "MONITOR" || mapped.severity === "WARN") {
@@ -101694,6 +101770,7 @@ var require_claude_hook = __commonJS({
       isSpecPath,
       deriveAfterContent,
       mapDecisionSeverity,
+      renderDecisionWhy,
       resolveApiKey,
       resolveSpecPath,
       readGitConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",