coderifts 4.6.0 → 4.8.0

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## 4.8.0
+
+### Fixed
+- **VS Code / Copilot PreToolUse camelCase (DRIFT 1).** VS Code Agent hooks
+  pass `toolName` / `toolInput` / `filePath` (and `targetFile`). The hook
+  already tolerated `toolName`/`toolInput` but missed several property
+  aliases, so flattened camelCase payloads and `targetFile` were refused as
+  unparseable (fail-closed, safe, unusable). Every Claude-shaped read site
+  now accepts snake_case and camelCase: `tool_name`/`toolName`,
+  `tool_input`/`toolInput`, `file_path`/`filePath`/`path`/`target_file`/`targetFile`,
+  `content`/`contents`. Snake_case behaviour is unchanged. Garbage is still
+  fail-closed.
+
+### Changed
+- **Matcher-inert hosts (DRIFT 2, documented, not a host fix).** VS Code
+  parses hook matchers but does not apply them — the hook fires on every
+  tool call. Non-Write/Edit/MultiEdit tools now exit **0** silently with no
+  network and **without requiring an API key** (parse → skip → key, so a
+  missing key cannot brick Read/Bash). Non-contract Write paths skip before
+  the key gate too. Garbage is still fail-closed (`stdin_unparseable`).
+  Spec-path Write/Edit/MultiEdit without a key is still fail-closed.
+
+### Added
+- **`copilot` MCP host (DRIFT 3).** `MCP_HOSTS` grows a third entry:
+  `.vscode/mcp.json`, root key **`servers`** (not `mcpServers`),
+  `type: "http"` + `url`. The writer special-cases the root key; Claude and
+  Cursor stay on `mcpServers`. `coderifts init --agents --hosts` accepts
+  `copilot` and includes it in `all`. Merge preserves other `servers` (and
+  any leftover keys). `--check` uses the same predicate.
+- README Copilot section: `hook install --claude` arms VS Code agent mode
+  (measured), matcher-inert behaviour, honest boundary (hooks gate the
+  agent, not the human; inline completions are not tool calls).
+
+## 4.7.0
+
+### Added
+- **`coderifts enforce --check`** — provider-native CD enforcement evidence.
+  Queries GitHub (and local workflow files) and reports, per layer,
+  `VERIFIED` / `NOT_VERIFIED` / `UNVERIFIABLE(reason)`:
+  1. required check `CodeRifts / contract-gate` on default-branch protection
+  2. `enforce_admins` (admin bypass)
+  3. `required_status_checks.strict`
+  4. GitHub Environment protection rules (`--env`)
+  5. workflow references `coderifts/contract-gate@v0` (local)
+  6. workflow runs `coderifts deploy-gate` (local)
+
+  `inescapable_deploy` is **true only when every layer is VERIFIED**. Otherwise
+  the field stays false and the JSON carries the queried facts. `--json`
+  includes each layer's status, the API endpoint consulted, and `queried_at`.
+
+  Auth: `GITHUB_TOKEN` / `GH_TOKEN` (user). App installation token
+  (`GITHUB_APP_TOKEN`) is accepted but **cannot** query branch protection —
+  the GitHub App permission set is contents:read, pull_requests, checks
+  (AUDIT.md §2.4); `GET .../protection` needs `administration:read`. No
+  token → `UNVERIFIABLE` with the exact instruction. Token values are never
+  printed. GitLab/Bitbucket: no adapter (UNVERIFIABLE, never stubbed).
+
+### Changed
+- **`observeCDEnforcement`:** `CODERIFTS_DEPLOY_NO_BYPASS` is recorded as
+  `host_claim_no_bypass` and no longer sets `bypass_possible: false`.
+  `--enforce` still marks the step ENFORCING (exit is already fail-closed)
+  but is a **host claim**. `bypass_possible` is false only when
+  `providerEvidence.inescapable_deploy === true` from `enforce --check`.
+  Guard `deployGate` still consumes `{ enforcement, bypass_possible }` — the
+  CLI must not pass a flag-derived “no bypass”.
+
 ## 4.6.0
 
 **Version pick:** the parallel Cursor-hook round claimed **4.5.0**

package/README.md

@@ -72,6 +72,7 @@ coderifts init --agents                  # all hosts, all four pieces
 coderifts init --agents --dry-run        # plan only — writes nothing
 coderifts init --agents --hosts=claude   # Claude Code only
 coderifts init --agents --hosts=cursor   # Cursor only
+coderifts init --agents --hosts=copilot  # GitHub Copilot / VS Code only
 coderifts init --agents --no-hook        # skip host hook install
 coderifts init --agents --no-workflow    # skip .github/workflows/coderifts.yml
 coderifts init --agents --check          # which of the four pieces are present
@@ -79,9 +80,9 @@ coderifts init --agents --check          # which of the four pieces are present
 
 | Piece | What it writes | Host-specific shape |
 |-------|----------------|---------------------|
-| **MCP config** | `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor) | Claude: `mcpServers.coderifts` with `type: "http"` + `url`. Cursor: `url` only (no `type`). Never `httpUrl` (that is Gemini, extension-level — this command does not write it). |
-| **Agent rules** | generated host files via `agent-setup`'s writer | `AGENTS.md` is always written. Claude also gets `CLAUDE.md`; Cursor also gets `.cursor/rules/coderifts.mdc`. `--hosts=all` adds Copilot, LangGraph, and OpenAI instructions. (`coderifts init agent` is a different command — it writes a `.coderifts.yml` template.) |
-| **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent) |
+| **MCP config** | `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor), `.vscode/mcp.json` (Copilot / VS Code) | Three shapes, never normalised into one: Claude `mcpServers` + `type: "http"` + `url`; Cursor `mcpServers` + `url` only (no `type`); Copilot **`servers`** (not `mcpServers`) + `type: "http"` + `url`. Never `httpUrl` (that is Gemini, extension-level — this command does not write it). |
+| **Agent rules** | generated host files via `agent-setup`'s writer | `AGENTS.md` is always written. Claude also gets `CLAUDE.md`; Cursor also gets `.cursor/rules/coderifts.mdc`; Copilot also gets `.github/copilot-instructions.md`. `--hosts=all` adds LangGraph and OpenAI instructions. (`coderifts init agent` is a different command — it writes a `.coderifts.yml` template.) |
+| **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent). Copilot shares Claude's `.claude/settings.json` — VS Code reads it by default. |
 | **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. `require-verified-monitoring` is commented (honest default: **false**) |
 
 **Next manual step:** add `CODERIFTS_API_KEY` to the repository secrets. The
@@ -168,8 +169,11 @@ gate reason + `renderDecisionWhy` when a body exists) and
 unsigned file still prints the unsigned-receipt truth loudly.
 
 **`--enforce` / `CODERIFTS_DEPLOY_ENFORCE=true`:** accepted silently (no-op
-for exit — default is already fail-closed). Still attests ENFORCING for the
-`inescapable_deploy` claim.
+for exit — default is already fail-closed). This is a **host claim** that the
+step is ENFORCING. It does **not** set `inescapable_deploy`. That field is
+true only from queried pipeline protection (`coderifts enforce --check`).
+`CODERIFTS_DEPLOY_NO_BYPASS` is recorded as a host claim and does not clear
+`bypass_possible`.
 
 **Infra vs policy:** missing `--env` / `--artifact`, malformed receipt JSON, or
 an unreachable `--keys` registry prints distinct `INFRA` wording plus
@@ -344,6 +348,37 @@ weakened by `CODERIFTS_ADVISORY`.
 CODERIFTS_ADVISORY=1 coderifts claude-hook
 ```
 
+### GitHub Copilot / VS Code agent mode
+
+Measured (VS Code **1.110**, Agent hooks Preview, 2026-08-24): VS Code **reads
+`.claude/settings.json` by default**. `coderifts hook install --claude`
+therefore arms Copilot agent mode — there is no separate `--copilot` hook
+installer. VS Code Agent hooks **are deny-capable**: PreToolUse honours
+`permissionDecision` allow|deny|ask and **exit 2**.
+
+**Property names (CLI 4.8.0):** VS Code passes camelCase (`toolName` /
+`toolInput` / `filePath` / `targetFile`). The hook accepts those alongside
+Claude's snake_case (`tool_name` / `tool_input` / `file_path`). Flattened
+payloads (path on the root object) are accepted. Garbage input is still
+fail-closed.
+
+**Matcher limitation (host behaviour, not a CLI bug):** VS Code **parses** hook
+matchers (`Write|Edit|MultiEdit`) but **does not apply them**. The hook fires
+on every tool call. Non-governed tools (Read, Bash, …) and non-contract paths
+exit **0** silently with **no network** and **no API key required** — cheap
+and fail-open for anything that is not a Write/Edit/MultiEdit of the spec. It
+is noisy (every tool call invokes the process) and safe (irrelevant tools are
+not blocked). A spec-path write without a key is still fail-closed.
+
+**Honest boundary:** hooks gate the **agent**, not the human. Inline
+completions (ghost text) are not tool calls and are not governed. A developer
+typing in the editor is not a PreToolUse event.
+
+**MCP:** `coderifts init --agents` (and `--hosts=copilot`) writes
+`.vscode/mcp.json` with root key **`servers`** — a third shape. Claude Code and
+Cursor use `mcpServers`; Copilot cloud Settings paste also uses `mcpServers`.
+Do not copy one file onto another host.
+
 ### `coderifts status [repo]`
 
 **Read-only** cross-layer enforcement report (Runtime / Merge / Deploy, plus
@@ -382,13 +417,44 @@ failed, **1** on missing repo/key, API error, or any apply failure.
 |------|-------------|---------|
 | `[repo]` / `--repo <owner/repo>` | Repository | none (required) |
 | `--apply` | Run underlying setup commands | dry-run |
+| `--check` | Query GitHub + local workflows (read-only evidence) | `false` |
+| `--env <name>` | With `--check`: GitHub Environment to query | none |
+| `--branch <name>` | With `--check`: branch (default: repo default) | default branch |
 | `--json` | Machine-readable JSON result | `false` |
 
 ```bash
 coderifts enforce owner/repo
 coderifts enforce --repo owner/repo --apply
+coderifts enforce --check --repo owner/repo --env production --json
 ```
 
+### `coderifts enforce --check`
+
+Provider-native pipeline-protection evidence. This is **not** a host claim:
+`--enforce` and `CODERIFTS_DEPLOY_NO_BYPASS` do **not** set
+`inescapable_deploy`. The field is true only when every layer below is
+`VERIFIED`.
+
+| Layer | VERIFIED when |
+|-------|----------------|
+| `required_check` | Default-branch protection requires `CodeRifts / contract-gate` |
+| `enforce_admins` | `enforce_admins.enabled` is **true** (admins cannot bypass). `false` = NOT_VERIFIED (admin bypass open) |
+| `strict_status_checks` | `required_status_checks.strict` is true |
+| `environment_protection` | `--env` names a GitHub Environment with protection rules or a deployment branch policy |
+| `workflow_contract_gate` | a local `.github/workflows` file references `coderifts/contract-gate@v0` |
+| `workflow_deploy_gate` | a local workflow runs `coderifts deploy-gate` |
+
+Statuses: `VERIFIED` / `NOT_VERIFIED` / `UNVERIFIABLE(reason)`. Auth:
+`GITHUB_TOKEN` (never printed). **No token** → API layers `UNVERIFIABLE` with
+the instruction to set `GITHUB_TOKEN` (repo + `administration:read`). The
+CodeRifts GitHub App **cannot** query branch protection (permissions are
+contents / pull requests / checks — not `administration:read`).
+
+`--json` is the quotable evidence document (`spec`:
+`provider-enforcement-evidence.v1`): each layer's status, the API endpoint
+consulted, `queried_at`. Exit **0** when a report was produced (evidence, not
+a gate). GitLab/Bitbucket: no adapter — `UNVERIFIABLE`, never stubbed.
+
 ### Agent host files (`coderifts agent-setup`)
 
 Writes the six CodeRifts agent-host rule files **plus** the Claude Code

package/bin/coderifts.js

@@ -92,7 +92,7 @@ program
   .command('init [template]')
   .description('Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)')
   .option('--agents', 'Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)')
-  .option('--hosts <list>', 'With --agents: claude, cursor, or all (default: all)', 'all')
+  .option('--hosts <list>', 'With --agents: claude, cursor, copilot, or all (default: all)', 'all')
   .option('--no-hook', 'With --agents: skip host hook install')
   .option('--no-workflow', 'With --agents: skip writing .github/workflows/coderifts.yml')
   .option('--dry-run', 'With --agents: print the plan without writing')
@@ -184,9 +184,13 @@ program
 // No new GitHub writes with the CodeRifts API key (user's gh for merge; local fs for hook).
 program
   .command('enforce [repo]')
-  .description('Close enforcement gaps by chaining setup-required-check / hook / deploy guidance (dry-run default; use --apply to mutate)')
+  .description('Close enforcement gaps (dry-run default), or --check to query provider-native pipeline protection evidence')
   .option('--repo <owner/repo>', 'Repository (owner/repo); also accepted as a positional argument')
   .option('--apply', 'Actually run underlying setup commands (default: dry-run only)')
+  .option('--check', 'Query GitHub + local workflows; report VERIFIED / NOT_VERIFIED / UNVERIFIABLE (read-only)')
+  .option('--env <name>', 'With --check: GitHub Environment name to query for protection rules')
+  .option('--branch <name>', 'With --check: branch to query (default: repository default branch)')
+  .option('--provider <name>', 'With --check: provider adapter (github only; others UNVERIFIABLE, never stubbed)', 'github')
   .option('--json', 'Machine-readable JSON result')
   .action(async (repoPositional, options) => {
     const { runEnforce } = require('../src/commands/enforce');
@@ -194,6 +198,7 @@ program
       ...options,
       repo: options.repo || repoPositional || null,
       apply: !!options.apply,
+      check: !!options.check,
     });
     if (result && typeof result.exitCode === 'number') {
       process.exitCode = result.exitCode;