coderifts 4.2.0 → 4.2.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 4.2.1
+
+### Added
+
+- **`claude-hook` exit-0 proof block (S4).** On a governed write that is
+  ALLOW / CONTINUE_WITH_MONITORING (sink wired), stderr prints a compact
+  3–5 line AUTHORIZED block: `decision` + `execution_action` + `decision_id`
+  + receipt fingerprint prefix + the boundary sentence
+  `authorized; execution/commit not proven by this hook`. Reuses the
+  `renderFinalAnswerProof` wording class. **Never stdout.** Non-governed
+  paths (docs-only skip, identical content) stay silent. JSONL
+  `hook_continue` gains additive `proof: { decision_id, fp_prefix }`.
+  Exit codes unchanged.
+
 ## 4.1.1
 
 ### Fixed

package/dist/cli.js

@@ -3007,7 +3007,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.2.0",
+      version: "4.2.1",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -101401,6 +101401,27 @@ var require_claude_hook = __commonJS({
       const fp = dr.fingerprint || d.fingerprint || d.verdict_fingerprint || d.input_fingerprint;
       return typeof fp === "string" && fp.length > 0 ? fp : void 0;
     }
+    function fingerprintPrefix(fp) {
+      if (typeof fp !== "string" || fp.length === 0) return void 0;
+      const colon = fp.indexOf(":");
+      if (colon > 0 && colon < fp.length - 1) {
+        const scheme = fp.slice(0, colon + 1);
+        const rest = fp.slice(colon + 1);
+        return scheme + rest.slice(0, 12) + (rest.length > 12 ? "\u2026" : "");
+      }
+      return fp.length > 16 ? `${fp.slice(0, 16)}\u2026` : fp;
+    }
+    function renderAllowProofBlock({ decision, executionAction, decisionId, fingerprint } = {}) {
+      const decPart = decision ? ` decision=${decision}` : "";
+      const eaPart = executionAction ? ` execution_action=${executionAction}` : "";
+      const idPart = decisionId ? ` decision_id=${decisionId}` : "";
+      const lines = [`CodeRifts claude-hook: AUTHORIZED${decPart}${eaPart}${idPart}`];
+      const pref = fingerprintPrefix(fingerprint);
+      if (pref) lines.push(`- receipt: ${pref}`);
+      lines.push("- Interpretation: authorized at verify time for the bound scope only \u2014 see Limits.");
+      lines.push("- authorized; execution/commit not proven by this hook");
+      return lines.join("\n");
+    }
     function hookSessionId(env) {
       const fromEnv = env && env.CODERIFTS_SESSION_ID && String(env.CODERIFTS_SESSION_ID).trim();
       if (fromEnv) return fromEnv;
@@ -101696,7 +101717,17 @@ var require_claude_hook = __commonJS({
         } else if (r.exitCode === 0 && r.site && advisory && !strict) {
           logEv({ type: "hook_advisory_passthrough", exit: 0, decision: r.decision || null, ...extra, cause: r.site });
         } else {
-          logEv({ type: "hook_continue", exit: 0, ...extra, cause: r.reason });
+          const proof = r.reason === "allow" ? {
+            decision_id: r.decisionId != null ? r.decisionId : extra.decisionId || null,
+            fp_prefix: fingerprintPrefix(r.fingerprint) || null
+          } : void 0;
+          logEv({
+            type: "hook_continue",
+            exit: 0,
+            ...extra,
+            cause: r.reason,
+            ...proof ? { proof } : {}
+          });
         }
         return r;
       };
@@ -101866,20 +101897,34 @@ var require_claude_hook = __commonJS({
             decisionId: mapped.decisionId
           });
         }
+        errLog(renderAllowProofBlock({
+          decision: mapped.decision,
+          executionAction: mapped.executionAction,
+          decisionId: mapped.decisionId,
+          fingerprint
+        }));
         return emitTerminal({
           exitCode: 0,
           reason: "allow",
           severity: mapped.severity === "WARN" ? "MONITOR" : mapped.severity,
           decision: mapped.decision,
-          decisionId: mapped.decisionId
+          decisionId: mapped.decisionId,
+          fingerprint
         });
       }
+      errLog(renderAllowProofBlock({
+        decision: mapped.decision,
+        executionAction: mapped.executionAction,
+        decisionId: mapped.decisionId,
+        fingerprint
+      }));
       return emitTerminal({
         exitCode: 0,
         reason: "allow",
         severity: "ALLOW",
         decision: mapped.decision,
-        decisionId: mapped.decisionId
+        decisionId: mapped.decisionId,
+        fingerprint
       });
     }
     module2.exports = {
@@ -101903,6 +101948,8 @@ var require_claude_hook = __commonJS({
       USAGE,
       appendGuardEventLog,
       extractFingerprint,
+      fingerprintPrefix,
+      renderAllowProofBlock,
       HOOK_TRIGGER_SOURCE
     };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",