coderifts 4.10.0 → 4.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "4.10.0",
+  "version": "4.12.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -45,7 +45,7 @@
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^9.0.0",
+    "@coderifts/agent-guard": "^10.0.0",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",

package/scripts/assert-guard-major.js

@@ -12,15 +12,63 @@
  * Why: evening audit 2.4 — CLI sat on ^1.6.0 while published guard is 6.x.
  * 4.0.0: floor raised to 8 (deployGate inescapable_deploy includes fingerprint rebound).
  * 4.4.1: floor raised to 9 (TOKEN / VERIFIED-VIEW; bare currently_authorized is unverified_receipt_view).
+ * 4.12.0: floor raised to 10 (ENFORCING_STRICT requires the execution chain — a strict
+ *   composition that built under 9.x refuses to construct under 10.x, so a CLI that documents or
+ *   scaffolds strict must not run against a guard with the older meaning).
  */
 
 const fs = require('fs');
 const path = require('path');
 
-/** Minimum acceptable major for @coderifts/agent-guard (published line). */
-const MIN_GUARD_MAJOR = 9;
+/** Minimum acceptable major for @coderifts/agent-guard in THIS package (the CLI). */
+const MIN_GUARD_MAJOR = 10;
 const DEP = '@coderifts/agent-guard';
 
+/**
+ * EVERY checkout that declares the guard — not just this one (roadmap 1058).
+ *
+ * WHY THIS TABLE EXISTS: this gate checked packages/cli only, while the app ROOT — where
+ * PRODUCTION uses the guard (src/mergegate/webhook-integration.js imports gateDecision) — sat on
+ * ^3.0.0 against a published 10.0.0. A seven-major gap survived precisely because the gate did not
+ * look there. A gate that inspects one of two call sites is not a gate.
+ *
+ * ONE FILE, PER-CHECKOUT FLOORS — chosen over a separate sibling check so there is ONE history
+ * section to record the next raise in. Two files would mean two floors with no structural reason
+ * they are ever raised together, which is the drift that produced this finding.
+ *
+ * Floors differ ON PURPOSE. A single shared floor would fail immediately and truthfully, but the
+ * fix for that is a dependency bump this gate must not force: see the app-root entry.
+ */
+const CHECKOUTS = [
+  {
+    id: 'cli',
+    label: 'packages/cli',
+    pkgPath: path.join(__dirname, '..', 'package.json'),
+    floor: MIN_GUARD_MAJOR,
+    why: 'CLI floor history is recorded in the module docblock above.',
+  },
+  {
+    id: 'app-root',
+    label: 'coderifts-app (root)',
+    pkgPath: path.join(__dirname, '..', '..', '..', 'package.json'),
+    floor: 3,
+    /**
+     * DELIBERATE, MEASURED, AND LOWER THAN THE CLI'S — recorded so it is a decision, not a default.
+     *
+     * 2026-08-26: bumping the root to ^10 breaks three merge-gate tests. gateDecision under 10.0.0
+     * returns residuals: [] where the app expects 'required_check_app_not_bound'
+     * (test/mergegate-webhook.test.js: 46/46 on 3.0.0, 3 failures on 10.0.0). The app's own comment
+     * at webhook-integration.js:336-339 records why 3.x has been SAFE rather than merely unnoticed:
+     * the app ANDs three conditions so a stale package can never fail-open.
+     *
+     * So the floor is pinned at 3 to stop it drifting LOWER unnoticed, and raising it is a separate
+     * round that must first reconcile the residual vocabulary. Raise this number in that round and
+     * record the reason on the line below, in the style of the CLI history above.
+     */
+    why: 'root pinned at 3 pending the gateDecision residual-vocabulary reconciliation (see comment).',
+  },
+];
+
 function fail(msg) {
   console.error(`assert-guard-major: FAIL — ${msg}`);
   process.exit(1);
@@ -47,81 +95,80 @@ function floorMajorFromRange(range) {
   return parseInt(m[1], 10);
 }
 
-function main() {
-  const pkgPath = path.join(__dirname, '..', 'package.json');
-  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+/** Resolve the installed guard version for a checkout dir, or null. */
+function resolvedVersionFor(startDir) {
+  try {
+    let dir = path.dirname(require.resolve(DEP, { paths: [startDir] }));
+    for (let i = 0; i < 6; i += 1) {
+      const cand = path.join(dir, 'package.json');
+      if (fs.existsSync(cand)) {
+        const rp = JSON.parse(fs.readFileSync(cand, 'utf8'));
+        if (rp.name === DEP) return rp.version;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch (_) { /* not installed here */ }
+  return null;
+}
+
+/** Check ONE checkout. Returns a line for the summary; calls fail() and exits on a violation. */
+function checkCheckout(c) {
+  if (!fs.existsSync(c.pkgPath)) {
+    fail(`${c.label}: package.json not found at ${c.pkgPath}`);
+  }
+  const pkg = JSON.parse(fs.readFileSync(c.pkgPath, 'utf8'));
   const range = pkg.dependencies && pkg.dependencies[DEP];
-  if (!range) fail(`${DEP} missing from dependencies`);
+  if (!range) fail(`${c.label}: ${DEP} missing from dependencies`);
 
   const floor = floorMajorFromRange(range);
   if (floor == null) {
     fail(
-      `${DEP} range ${JSON.stringify(range)} has no parseable major floor `
-      + `(wildcards/non-semver not allowed; need e.g. ^${MIN_GUARD_MAJOR}.0.0)`,
+      `${c.label}: ${DEP} range ${JSON.stringify(range)} has no parseable major floor `
+      + `(wildcards/non-semver not allowed; need e.g. ^${c.floor}.0.0)`,
     );
   }
-  if (floor < MIN_GUARD_MAJOR) {
+  if (floor < c.floor) {
     fail(
-      `${DEP} range ${JSON.stringify(range)} floors at major ${floor}; `
-      + `minimum acceptable major is ${MIN_GUARD_MAJOR}`,
+      `${c.label}: ${DEP} range ${JSON.stringify(range)} floors at major ${floor}; `
+      + `minimum acceptable major for this checkout is ${c.floor} — ${c.why}`,
     );
   }
 
-  // Optional: resolved install must not lag the declared floor (stale node_modules).
-  try {
-    const resolved = require(path.join(
-      path.dirname(require.resolve(`${DEP}`)),
-      // package root: require('@coderifts/agent-guard') → dist/cjs/index.js
-      '..',
-      '..',
-      'package.json',
-    ));
-    // From dist/cjs → package root is ../..
-  } catch (_) {
-    // try alternate resolve
+  const resolved = resolvedVersionFor(path.dirname(c.pkgPath));
+  if (!resolved) {
+    return `${c.label}: declared ${range} (floor ${floor} >= ${c.floor}); not resolved in tree`;
   }
-
-  let resolvedVersion = null;
-  try {
-    // Walk up from the main entry to package.json (exports block ./package.json).
-    let dir = path.dirname(require.resolve(DEP));
-    for (let i = 0; i < 6; i++) {
-      const cand = path.join(dir, 'package.json');
-      if (fs.existsSync(cand)) {
-        const rp = JSON.parse(fs.readFileSync(cand, 'utf8'));
-        if (rp.name === DEP) {
-          resolvedVersion = rp.version;
-          break;
-        }
-      }
-      const parent = path.dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
-    }
-  } catch (err) {
-    // Not installed — range check alone is enough for prepublish if install follows.
-    ok(`declared ${DEP}@${range} (floor major ${floor} ≥ ${MIN_GUARD_MAJOR}); package not resolved in tree (${err && err.message})`);
-    return;
+  const rm = /^(\d+)/.exec(resolved);
+  const rMajor = rm ? parseInt(rm[1], 10) : null;
+  if (rMajor == null || rMajor < c.floor) {
+    fail(`${c.label}: resolved ${DEP}@${resolved} major ${rMajor} is below minimum ${c.floor}`);
   }
-
-  if (resolvedVersion) {
-    const rm = /^(\d+)/.exec(resolvedVersion);
-    const rMajor = rm ? parseInt(rm[1], 10) : null;
-    if (rMajor == null || rMajor < MIN_GUARD_MAJOR) {
-      fail(
-        `resolved ${DEP}@${resolvedVersion} major ${rMajor} is below minimum ${MIN_GUARD_MAJOR}`,
-      );
-    }
-    if (rMajor < floor) {
-      fail(
-        `resolved ${DEP}@${resolvedVersion} major ${rMajor} is below declared range floor ${floor}`,
-      );
-    }
-    ok(`declared ${DEP}@${range} (floor ${floor}); resolved ${resolvedVersion} (major ≥ ${MIN_GUARD_MAJOR})`);
-    return;
+  if (rMajor < floor) {
+    fail(`${c.label}: resolved ${DEP}@${resolved} major ${rMajor} is below declared range floor ${floor}`);
   }
+  return `${c.label}: declared ${range} (floor ${floor} >= ${c.floor}); resolved ${resolved}`;
+}
 
-  ok(`declared ${DEP}@${range} (floor major ${floor} ≥ ${MIN_GUARD_MAJOR})`);
+function main() {
+  const lines = CHECKOUTS.map(checkCheckout);
+  for (const l of lines) ok(l);
+
+  // DIVERGENCE NOTICE — visible, never fatal. The floors differ deliberately (see CHECKOUTS), so
+  // failing here would block a publish over a state we chose. Printing it keeps the gap from
+  // going quiet again, which is how it survived seven majors.
+  const floors = CHECKOUTS.map((c) => c.floor);
+  if (new Set(floors).size > 1) {
+    console.log(
+      `assert-guard-major: NOTE — checkout floors differ (${CHECKOUTS.map((c) => `${c.id}=${c.floor}`).join(', ')}). `
+      + 'Deliberate; each reason is recorded in CHECKOUTS. Not a failure.',
+    );
+  }
 }
 
-main();
+// Run only when executed directly, so the gate's own tests can import CHECKOUTS /
+// floorMajorFromRange without triggering a process.exit.
+if (require.main === module) main();
+
+module.exports = { CHECKOUTS, floorMajorFromRange, MIN_GUARD_MAJOR, DEP };