coderifts 4.6.0 → 4.8.0

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.6.0",
+      version: "4.8.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -74363,7 +74363,7 @@ var require_claude_hook = __commonJS({
       "Parse-gap DEFAULT (exit 2): unparseable stdin / missing file_path \u2014 refusing (fail-closed);",
       "  set CODERIFTS_ADVISORY=1 to soften. JSONL hook_blocked cause stdin_unparseable|missing_file_path.",
       "",
-      "Still exit 0 (nothing to govern): non-spec path, identical content.",
+      "Still exit 0 (nothing to govern): non-spec path, identical content, non-governed tool.",
       "",
       "CONTINUE_WITH_MONITORING: allow only if the host asserts a sink",
       "  (CODERIFTS_MONITORING_SINK_WIRED=1|true or git config coderifts.monitoringSinkWired).",
@@ -74504,6 +74504,42 @@ var require_claude_hook = __commonJS({
       if (fromGit) return fromGit;
       return DEFAULT_SPEC_PATH;
     }
+    var GOVERNED_TOOLS = /* @__PURE__ */ new Set(["write", "edit", "multiedit", "multi_edit"]);
+    function isGovernedTool(name) {
+      return GOVERNED_TOOLS.has(String(name || "").toLowerCase());
+    }
+    function pickToolField(obj, ...keys) {
+      if (!obj || typeof obj !== "object" || Array.isArray(obj)) return void 0;
+      for (const k of keys) {
+        if (!Object.prototype.hasOwnProperty.call(obj, k)) continue;
+        const v = obj[k];
+        if (v === void 0 || v === null) continue;
+        return v;
+      }
+      return void 0;
+    }
+    function filePathFromInput(toolInput) {
+      const v = pickToolField(toolInput, "file_path", "filePath", "path", "target_file", "targetFile");
+      return typeof v === "string" && v !== "" ? v : void 0;
+    }
+    function contentFromInput(toolInput) {
+      const v = pickToolField(toolInput, "content", "contents");
+      return typeof v === "string" ? v : void 0;
+    }
+    function coerceToolInput(value) {
+      if (value && typeof value === "object" && !Array.isArray(value)) return value;
+      if (typeof value === "string") {
+        const t = value.trim();
+        if (!t) return null;
+        try {
+          const parsed = JSON.parse(t);
+          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+        } catch {
+          return null;
+        }
+      }
+      return null;
+    }
     function parseStdinJson(raw) {
       if (raw == null || String(raw).trim() === "") {
         return { ok: false, reason: "empty stdin" };
@@ -74517,9 +74553,9 @@ var require_claude_hook = __commonJS({
       if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
         return { ok: false, reason: "stdin JSON is not an object" };
       }
-      const toolName = obj.tool_name || obj.toolName || obj.name || null;
-      let toolInput = obj.tool_input || obj.toolInput || obj.input || null;
-      if (toolInput == null && obj.file_path) toolInput = obj;
+      const toolName = pickToolField(obj, "tool_name", "toolName", "name");
+      let toolInput = coerceToolInput(pickToolField(obj, "tool_input", "toolInput", "input"));
+      if (toolInput == null && filePathFromInput(obj)) toolInput = obj;
       if (!toolName || typeof toolName !== "string") {
         return { ok: false, reason: "missing tool_name" };
       }
@@ -74543,16 +74579,17 @@ var require_claude_hook = __commonJS({
       return false;
     }
     function deriveAfterContent(toolName, toolInput, diskBefore) {
-      const name = String(toolName || "");
-      if (name === "Write" || name === "write") {
-        if (typeof toolInput.content !== "string") {
+      const name = String(toolName || "").toLowerCase();
+      if (name === "write") {
+        const content = contentFromInput(toolInput);
+        if (typeof content !== "string") {
           return { ok: false, reason: "Write tool_input.content missing or not a string" };
         }
-        return { ok: true, after: toolInput.content };
+        return { ok: true, after: content };
       }
-      if (name === "Edit" || name === "edit") {
-        const oldS = toolInput.old_string != null ? toolInput.old_string : toolInput.oldString;
-        const newS = toolInput.new_string != null ? toolInput.new_string : toolInput.newString;
+      if (name === "edit") {
+        const oldS = pickToolField(toolInput, "old_string", "oldString");
+        const newS = pickToolField(toolInput, "new_string", "newString");
         if (typeof oldS !== "string" || typeof newS !== "string") {
           return { ok: false, reason: "Edit tool_input.old_string/new_string missing" };
         }
@@ -74561,16 +74598,16 @@ var require_claude_hook = __commonJS({
         }
         return { ok: true, after: diskBefore.replace(oldS, newS) };
       }
-      if (name === "MultiEdit" || name === "multi_edit" || name === "multiEdit") {
-        const edits = toolInput.edits || toolInput.Edits;
+      if (name === "multiedit" || name === "multi_edit") {
+        const edits = pickToolField(toolInput, "edits", "Edits");
         if (!Array.isArray(edits) || edits.length === 0) {
           return { ok: false, reason: "MultiEdit tool_input.edits missing or empty" };
         }
         let cur = diskBefore;
         for (let i = 0; i < edits.length; i++) {
           const e = edits[i] || {};
-          const oldS = e.old_string != null ? e.old_string : e.oldString;
-          const newS = e.new_string != null ? e.new_string : e.newString;
+          const oldS = pickToolField(e, "old_string", "oldString");
+          const newS = pickToolField(e, "new_string", "newString");
           if (typeof oldS !== "string" || typeof newS !== "string") {
             return { ok: false, reason: `MultiEdit edits[${i}] missing old_string/new_string` };
           }
@@ -74581,7 +74618,7 @@ var require_claude_hook = __commonJS({
         }
         return { ok: true, after: cur };
       }
-      return { ok: false, reason: `unsupported tool_name for content derive: ${name}` };
+      return { ok: false, reason: `unsupported tool_name for content derive: ${toolName}` };
     }
     function isV2DecisionBody(d, dr) {
       if (dr && typeof dr === "object") return true;
@@ -74742,18 +74779,6 @@ var require_claude_hook = __commonJS({
         }
         return r;
       };
-      const apiKey = resolveApiKey({ ...deps, cwd, env });
-      if (!apiKey) {
-        logEv({ type: "preflight_unavailable", cause: "missing_api_key" });
-        return emitTerminal(failClosedOrAdvisory({
-          advisory,
-          strict,
-          site: "missing_api_key",
-          why: "no API key",
-          softMsg: "CodeRifts claude-hook: no API key (coderifts login / CODERIFTS_API_KEY / git config coderifts.apiKey) \u2014 allowing",
-          errLog
-        }));
-      }
       const PARSE_GAP_STDERR = "unparseable input \u2014 refusing (fail-closed); set CODERIFTS_ADVISORY=1 to soften";
       const raw = typeof options.stdin === "string" ? options.stdin : readStdin();
       const parsed = parseStdinJson(raw);
@@ -74767,7 +74792,11 @@ var require_claude_hook = __commonJS({
       }
       const { toolName, toolInput } = parsed;
       tool = toolName;
-      const filePath = toolInput.file_path || toolInput.filePath || toolInput.path;
+      if (!isGovernedTool(toolName)) {
+        logEv({ type: "detection_skip", signals: ["not_governed_tool"], tool });
+        return emitTerminal({ exitCode: 0, reason: "not_governed_tool" });
+      }
+      const filePath = filePathFromInput(toolInput);
       if (!filePath || typeof filePath !== "string") {
         if (advisory && !strict) {
           errLog("CodeRifts claude-hook: tool_input.file_path missing \u2014 allowing (CODERIFTS_ADVISORY)");
@@ -74782,6 +74811,18 @@ var require_claude_hook = __commonJS({
         logEv({ type: "detection_skip", signals: ["not_spec_path"], tool, path: filePath });
         return emitTerminal({ exitCode: 0, reason: "not_spec_path" });
       }
+      const apiKey = resolveApiKey({ ...deps, cwd, env });
+      if (!apiKey) {
+        logEv({ type: "preflight_unavailable", cause: "missing_api_key" });
+        return emitTerminal(failClosedOrAdvisory({
+          advisory,
+          strict,
+          site: "missing_api_key",
+          why: "no API key",
+          softMsg: "CodeRifts claude-hook: no API key (coderifts login / CODERIFTS_API_KEY / git config coderifts.apiKey) \u2014 allowing",
+          errLog
+        }));
+      }
       const absPath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
       let diskBefore = "";
       if (exists(absPath)) {
@@ -74941,6 +74982,11 @@ var require_claude_hook = __commonJS({
     module2.exports = {
       runClaudeHook,
       parseStdinJson,
+      pickToolField,
+      filePathFromInput,
+      contentFromInput,
+      isGovernedTool,
+      coerceToolInput,
       isSpecPath,
       deriveAfterContent,
       mapDecisionSeverity,
@@ -142589,6 +142635,13 @@ var require_key_store = __commonJS({
     function findByPrefix(prefix) {
       return keyRecords.find((r) => r.keyPrefix === prefix) || null;
     }
+    function findAllByPrefix(prefix) {
+      if (!prefix || typeof prefix !== "string") return [];
+      return keyRecords.filter((r) => r.keyPrefix === prefix);
+    }
+    function isFullKeyToken(token) {
+      return typeof token === "string" && token.length > 12;
+    }
     function findRecordByKey(key) {
       if (!key || typeof key !== "string") return null;
       const prefix = getKeyPrefix(key);
@@ -142672,14 +142725,38 @@ var require_key_store = __commonJS({
     function _setGenerateKeyStringForTest(fn) {
       _generateKeyStringForTest = typeof fn === "function" ? fn : null;
     }
-    function deleteByPrefix(prefix, ownerEmail) {
-      const idx = keyRecords.findIndex((r) => r.keyPrefix === prefix);
+    function deleteRecord(record, ownerEmail) {
+      const idx = keyRecords.indexOf(record);
       if (idx === -1) return false;
       if (ownerEmail && keyRecords[idx].owner !== ownerEmail) return false;
       keyRecords.splice(idx, 1);
       saveKeys();
       return true;
     }
+    function revokeKey({ token, ownerEmail } = {}) {
+      const raw = typeof token === "string" ? token : "";
+      if (!raw) return { ok: false, code: "not_found", count: 0 };
+      if (isFullKeyToken(raw)) {
+        const rec = findRecordByKey(raw);
+        if (!rec) return { ok: false, code: "not_found", count: 0 };
+        if (!deleteRecord(rec, ownerEmail || null)) {
+          return { ok: false, code: "unauthorized", count: 1, prefix: rec.keyPrefix };
+        }
+        return { ok: true, code: "deleted", count: 1, prefix: rec.keyPrefix };
+      }
+      const matches = findAllByPrefix(raw);
+      if (matches.length === 0) return { ok: false, code: "not_found", count: 0 };
+      if (matches.length > 1) {
+        return { ok: false, code: "ambiguous", count: matches.length, prefix: raw };
+      }
+      if (!deleteRecord(matches[0], ownerEmail || null)) {
+        return { ok: false, code: "unauthorized", count: 1, prefix: raw };
+      }
+      return { ok: true, code: "deleted", count: 1, prefix: raw };
+    }
+    function deleteByPrefix(prefix, ownerEmail) {
+      return revokeKey({ token: prefix, ownerEmail }).ok === true;
+    }
     module2.exports = {
       createKey,
       hasKey,
@@ -142689,7 +142766,9 @@ var require_key_store = __commonJS({
       listKeysByOwner,
       deleteByPrefix,
       findByPrefix,
+      findAllByPrefix,
       findRecordByKey,
+      revokeKey,
       FREE_TIER_REQUESTS_PER_MONTH,
       FREE_TIER_REQUESTS_PER_MINUTE,
       PREFIX_REGENERATE_ATTEMPTS,
@@ -198815,9 +198894,10 @@ var require_remediation_taxonomy = __commonJS({
           break;
         }
         case "COVERAGE_GAP": {
-          target = "analysis";
+          const detail = str(pattern && pattern.description) || str(pattern && pattern.error);
+          target = str(pattern && pattern.affected_path) || "analysis";
           target_ref = {};
-          instruction = "Do not treat this as a schema edit: restore analyzable artifacts / wait for coverage; re-preflight when analysis is complete.";
+          instruction = detail ? `fix the spec: ${detail}` : "Do not treat this as a schema edit: restore analyzable artifacts / wait for coverage; re-preflight when analysis is complete.";
           break;
         }
         default: {
@@ -198872,6 +198952,21 @@ var require_remediation_taxonomy = __commonJS({
       if (patterns.length > 0) {
         return patterns.map((pattern) => remediationFromDetection({ pattern, ir: null }));
       }
+      const degradedReasons = Array.isArray(verdict.degraded_reasons) ? verdict.degraded_reasons : [];
+      if (degradedReasons.length > 0) {
+        return degradedReasons.map((r) => {
+          const msg = r && (r.message || r.code) ? String(r.message || r.code) : "analysis incomplete";
+          return remediationFromDetection({
+            pattern: {
+              name: "COVERAGE_GAP",
+              degraded: true,
+              description: msg,
+              affected_path: r && r.code || "analysis"
+            },
+            ir: null
+          });
+        });
+      }
       if (verdict.coverage_gap === true || verdict.degraded === true) {
         return [remediationFromDetection({ pattern: { name: "COVERAGE_GAP", degraded: true }, ir: null })];
       }
@@ -206628,8 +206723,19 @@ var require_remediation_transaction = __commonJS({
       if (artifactIds.length > 0) scope.artifact_ids = artifactIds;
       return scope;
     }
+    function isDegradedContext(coreVerdict, context = {}) {
+      if (context.analysis_complete === false) return true;
+      if (Array.isArray(context.degraded_reasons) && context.degraded_reasons.length > 0) return true;
+      if (coreVerdict && coreVerdict.degraded === true) return true;
+      if (Array.isArray(coreVerdict && coreVerdict.degraded_reasons) && coreVerdict.degraded_reasons.length > 0) {
+        return true;
+      }
+      return false;
+    }
     function buildRemediationTransaction({ decision, fingerprint, coreVerdict, context = {} }) {
-      if (decision !== "BLOCK") return null;
+      const degraded = isDegradedContext(coreVerdict, context);
+      const emit = decision === "BLOCK" || decision === "REQUIRE_APPROVAL" || degraded;
+      if (!emit) return null;
       if (typeof fingerprint !== "string" || !fingerprint) return null;
       const verdictForTaxonomy = {
         ...coreVerdict && typeof coreVerdict === "object" ? coreVerdict : {}
@@ -206639,6 +206745,13 @@ var require_remediation_transaction = __commonJS({
           verdictForTaxonomy.detected_patterns = context.detectedPatterns;
         }
       }
+      if (degraded) {
+        verdictForTaxonomy.degraded = true;
+        const reasons = Array.isArray(context.degraded_reasons) && context.degraded_reasons.length ? context.degraded_reasons : verdictForTaxonomy.degraded_reasons;
+        if (Array.isArray(reasons) && reasons.length) {
+          verdictForTaxonomy.degraded_reasons = reasons;
+        }
+      }
       const required_changes = buildRemediations(verdictForTaxonomy);
       const profile = resolveFingerprintProfile(context);
       return {
@@ -206673,6 +206786,7 @@ var require_remediation_transaction = __commonJS({
       resolveFingerprintProfile,
       deriveRecheckScope,
       blockRequiredActionCore,
+      isDegradedContext,
       PROFILE_CRBUNDLE_V1,
       PROFILE_VERDICT_FP_V1,
       RESUBMISSION_UNCHANGED,
@@ -206848,7 +206962,7 @@ var require_decision_result = __commonJS({
       pattern_sources: null,
       // Control core for retrieval; null = not supplied (must never render as type none for BLOCK)
       required_action_core: null,
-      // ID850 v1 — BLOCK-only remediation transaction (null / omit on non-BLOCK)
+      // ID850 v1 — remediation transaction (null / omit on ALLOW/WARN with complete analysis)
       remediation_transaction: null,
       // ID637 v5 slice 4 — change-set completeness commitment (honest; not a proof on generic path).
       // SERVER-authored mode; body_hash covered. Never boolean completeness:true.
@@ -207461,18 +207575,31 @@ var require_deploy_gate2 = __commonJS({
       return isEnvFlag(e, "CODERIFTS_DEPLOY_ADVISORY") || isEnvFlag(e, "CODERIFTS_ADVISORY");
     }
     function observeCDEnforcement(options = {}) {
+      const evidence = options.providerEvidence;
+      const hostClaimNoBypass = String(process.env.CODERIFTS_DEPLOY_NO_BYPASS || "").toLowerCase() === "true";
+      if (evidence && evidence.inescapable_deploy === true) {
+        return {
+          enforcement: "ENFORCING",
+          bypass_possible: false,
+          step_is_required: true,
+          required_step_name: "CodeRifts / deploy-gate",
+          attestation_source: "provider_query",
+          host_claim_no_bypass: hostClaimNoBypass
+        };
+      }
       const envVal = String(process.env.CODERIFTS_DEPLOY_ENFORCE || "").toLowerCase();
       let enforcement;
       if (enforceSignal(options)) enforcement = "ENFORCING";
       else if (envVal === "unknown") enforcement = "UNKNOWN";
       else enforcement = "ADVISORY";
-      const bypass_possible = String(process.env.CODERIFTS_DEPLOY_NO_BYPASS || "").toLowerCase() !== "true";
       return {
         enforcement,
-        bypass_possible,
+        bypass_possible: true,
+        // host NO_BYPASS is a claim, not queried evidence
         step_is_required: enforcement === "ENFORCING",
         required_step_name: "CodeRifts / deploy-gate",
-        attestation_source: "cli_flag"
+        attestation_source: "cli_flag",
+        host_claim_no_bypass: hostClaimNoBypass
       };
     }
     function deployReportResiduals(state, enforcement_inescapable, enforcement, change_set_rebound) {
@@ -207795,7 +207922,7 @@ var require_deploy_gate2 = __commonJS({
       if (bind.report_residuals.length) lines.push(`  Residuals:          ${bind.report_residuals.join(", ")}`);
       if (bind.must_re_preflight) lines.push(chalk.yellow("  Action: re-preflight this { environment, artifact } \u2014 the receipt does not authorize it."));
       lines.push("");
-      lines.push(enforce ? chalk.dim("  Attested ENFORCING (inescapable_deploy claim). Exit is fail-closed by default.") : chalk.dim("  Fail-closed default \u2014 a failing gate exits non-zero. " + SOFTEN_HINT + "."));
+      lines.push(enforce ? chalk.dim("  Attested ENFORCING via --enforce (host claim). inescapable_deploy requires queried pipeline protection (`coderifts enforce --check`). Exit is fail-closed by default.") : chalk.dim("  Fail-closed default \u2014 a failing gate exits non-zero. " + SOFTEN_HINT + "."));
       lines.push("");
       return lines.join("\n");
     }
@@ -209791,6 +209918,7 @@ var require_mcp_repo_config = __commonJS({
         id: "claude",
         relPath: ".mcp.json",
         label: "Claude Code",
+        rootKey: "mcpServers",
         // Measured: type+url required. url-without-type is a config error.
         entry: Object.freeze({
           type: "http",
@@ -209805,6 +209933,7 @@ var require_mcp_repo_config = __commonJS({
         id: "cursor",
         relPath: ".cursor/mcp.json",
         label: "Cursor",
+        rootKey: "mcpServers",
         // Measured: url only — Cursor docs do not use type for remote HTTP.
         entry: Object.freeze({
           url: MCP_URL,
@@ -209813,8 +209942,24 @@ var require_mcp_repo_config = __commonJS({
           })
         }),
         shapeNote: "mcpServers.coderifts url (no type \u2014 Cursor remote form)"
+      }),
+      copilot: Object.freeze({
+        id: "copilot",
+        relPath: ".vscode/mcp.json",
+        label: "GitHub Copilot / VS Code",
+        // Measured: THIRD variant — root key is `servers`, not mcpServers.
+        rootKey: "servers",
+        entry: Object.freeze({
+          type: "http",
+          url: MCP_URL,
+          headers: Object.freeze({
+            Authorization: "Bearer ${env:CODERIFTS_API_KEY}"
+          })
+        }),
+        shapeNote: "servers.coderifts type=http url (root key servers, not mcpServers)"
       })
     });
+    var MCP_HOST_IDS = Object.freeze(Object.keys(MCP_HOSTS));
     function deepEqual(a, b) {
       if (a === b) return true;
       try {
@@ -209823,25 +209968,26 @@ var require_mcp_repo_config = __commonJS({
         return false;
       }
     }
-    function planMcpMerge(existing, entry) {
+    function planMcpMerge(existing, entry, rootKey = "mcpServers") {
+      const key = rootKey || "mcpServers";
       const hadFile = existing != null;
       const base = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
-      const servers = base.mcpServers && typeof base.mcpServers === "object" && !Array.isArray(base.mcpServers) ? base.mcpServers : {};
-      const current = Object.prototype.hasOwnProperty.call(servers, SERVER_NAME) ? servers[SERVER_NAME] : void 0;
+      const group = base[key] && typeof base[key] === "object" && !Array.isArray(base[key]) ? base[key] : {};
+      const current = Object.prototype.hasOwnProperty.call(group, SERVER_NAME) ? group[SERVER_NAME] : void 0;
       if (deepEqual(current, entry)) {
         return { action: "skip", next: null, reason: "already present, identical" };
       }
       const next = {
         ...base,
-        mcpServers: {
-          ...servers,
+        [key]: {
+          ...group,
           [SERVER_NAME]: entry
         }
       };
       if (!hadFile) {
         return { action: "create", next, reason: "created" };
       }
-      const reason = current === void 0 ? "added mcpServers.coderifts; preserved other servers" : "updated mcpServers.coderifts; preserved other servers";
+      const reason = current === void 0 ? `added ${key}.coderifts; preserved other servers` : `updated ${key}.coderifts; preserved other servers`;
       return { action: "merge", next, reason };
     }
     function serializeMcp(doc) {
@@ -209910,7 +210056,7 @@ var require_mcp_repo_config = __commonJS({
           existing = {};
         }
       }
-      const plan = planMcpMerge(existing, host.entry);
+      const plan = planMcpMerge(existing, host.entry, host.rootKey);
       if (plan.action === "skip") {
         return { action: "skip", relPath: host.relPath, reason: plan.reason, exitCode: 0 };
       }
@@ -209947,7 +210093,7 @@ var require_mcp_repo_config = __commonJS({
       if (!exists(fp)) return false;
       try {
         const doc = JSON.parse(readFile(fp));
-        return planMcpMerge(doc, host.entry).action === "skip";
+        return planMcpMerge(doc, host.entry, host.rootKey).action === "skip";
       } catch {
         return false;
       }
@@ -209956,6 +210102,7 @@ var require_mcp_repo_config = __commonJS({
       MCP_URL,
       SERVER_NAME,
       MCP_HOSTS,
+      MCP_HOST_IDS,
       planMcpMerge,
       serializeMcp,
       writeHostMcpConfig,
@@ -210071,6 +210218,7 @@ var require_init_agents = __commonJS({
     var { installClaudeHook, installCursorHook } = require_hook();
     var {
       MCP_HOSTS,
+      MCP_HOST_IDS,
       writeHostMcpConfig,
       mcpConfigPresent
     } = require_mcp_repo_config();
@@ -210082,15 +210230,15 @@ var require_init_agents = __commonJS({
       workflowPresent
     } = require_contract_gate_workflow();
     if (process.env.NO_COLOR) chalk.level = 0;
-    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,all] [--no-hook] [--no-workflow] [--dry-run] [--check] [--out <dir>]
+    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--dry-run] [--check] [--out <dir>]
 
   Wire this repository for governed agent work in ONE command:
-    1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json)
+    1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json / .vscode/mcp.json)
     2. generated agent rule files (reuses agent-setup)
-    3. host hook (Claude Code today; Cursor when hook install --cursor is present)
+    3. host hook (Claude Code / VS Code Copilot via .claude/settings.json; Cursor via .cursor/hooks.json)
     4. .github/workflows/coderifts.yml (coderifts/contract-gate@v0)
 
-  --hosts <list>   claude, cursor, or all (default: all)
+  --hosts <list>   claude, cursor, copilot, or all (default: all)
   --no-hook        Skip host hook install
   --no-workflow    Skip writing the CI workflow
   --dry-run        Print the plan without writing
@@ -210101,7 +210249,8 @@ var require_init_agents = __commonJS({
     var SHARED_RULE = "AGENTS.md";
     var HOST_RULES = Object.freeze({
       claude: Object.freeze(["CLAUDE.md"]),
-      cursor: Object.freeze([".cursor/rules/coderifts.mdc"])
+      cursor: Object.freeze([".cursor/rules/coderifts.mdc"]),
+      copilot: Object.freeze([".github/copilot-instructions.md"])
     });
     var EXTRA_RULES_ON_ALL = Object.freeze([
       ".github/copilot-instructions.md",
@@ -210121,27 +210270,28 @@ var require_init_agents = __commonJS({
       "    \xB7 write Gemini MCP config (Gemini uses httpUrl at extension level, not a repo file)"
     ]);
     function parseHosts(raw) {
+      const allHosts = [...MCP_HOST_IDS];
       if (raw == null || raw === true || String(raw).trim() === "") {
-        return { hosts: ["claude", "cursor"], allRules: true };
+        return { hosts: allHosts, allRules: true };
       }
       const parts = String(raw).split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
       if (parts.length === 0) {
-        return { hosts: ["claude", "cursor"], allRules: true, error: `init --agents: --hosts requires a value
+        return { hosts: allHosts, allRules: true, error: `init --agents: --hosts requires a value
 ${USAGE}` };
       }
-      const allowed = /* @__PURE__ */ new Set(["claude", "cursor", "all"]);
+      const allowed = /* @__PURE__ */ new Set([...MCP_HOST_IDS, "all"]);
       for (const p of parts) {
         if (!allowed.has(p)) {
           return {
             hosts: [],
             allRules: false,
-            error: `init --agents: unknown host "${p}" (use claude, cursor, all)
+            error: `init --agents: unknown host "${p}" (use claude, cursor, copilot, all)
 ${USAGE}`
           };
         }
       }
       if (parts.includes("all")) {
-        return { hosts: ["claude", "cursor"], allRules: true };
+        return { hosts: allHosts, allRules: true };
       }
       const hosts = [];
       for (const p of parts) {
@@ -210173,7 +210323,25 @@ ${USAGE}`
       return hostId === "cursor" ? ".cursor/hooks.json" : ".claude/settings.json";
     }
     function hookNoteForHost(hostId) {
-      return hostId === "cursor" ? "preToolUse \u2192 coderifts cursor-hook" : "PreToolUse \u2192 coderifts claude-hook";
+      if (hostId === "cursor") return "preToolUse \u2192 coderifts cursor-hook";
+      if (hostId === "copilot") {
+        return "PreToolUse \u2192 coderifts claude-hook (VS Code reads .claude/settings.json by default)";
+      }
+      return "PreToolUse \u2192 coderifts claude-hook";
+    }
+    function hookInstallerForHost(hostId) {
+      return hostId === "cursor" ? installCursorHook : installClaudeHook;
+    }
+    function uniqueHookHosts(hosts) {
+      const seen = /* @__PURE__ */ new Set();
+      const out = [];
+      for (const h of hosts) {
+        const rel = hookRelForHost(h);
+        if (seen.has(rel)) continue;
+        seen.add(rel);
+        out.push(h);
+      }
+      return out;
     }
     function wantHook(options) {
       if (options.noHook === true) return false;
@@ -210220,9 +210388,9 @@ ${USAGE}`
       const hooksMissing = [];
       const hooksWanted = wantHook(options);
       if (hooksWanted) {
-        for (const h of hosts) {
+        for (const h of uniqueHookHosts(hosts)) {
           const rel = hookRelForHost(h);
-          const installer = h === "cursor" ? installCursorHook : installClaudeHook;
+          const installer = hookInstallerForHost(h);
           const r = installer({ cwd: outDir, silent: true, dryRun: true });
           if (r && r.code === "NOOP") hooksPresent.push(rel);
           else hooksMissing.push(rel);
@@ -210353,7 +210521,7 @@ ${USAGE}`
         items.push({ section: "rules", action: "skip", relPath: rel, note: "exists; installer does not overwrite" });
       }
       if (!wantHook(options)) {
-        for (const h of hosts) {
+        for (const h of uniqueHookHosts(hosts)) {
           items.push({
             section: "hooks",
             action: "skip",
@@ -210362,8 +210530,8 @@ ${USAGE}`
           });
         }
       } else {
-        for (const h of hosts) {
-          const installer = h === "cursor" ? installCursorHook : installClaudeHook;
+        for (const h of uniqueHookHosts(hosts)) {
+          const installer = hookInstallerForHost(h);
           const r = installer({
             cwd: outDir,
             silent: true,
@@ -236999,6 +237167,538 @@ var require_status = __commonJS({
   }
 });
 
+// src/provider/github-enforcement.js
+var require_github_enforcement = __commonJS({
+  "src/provider/github-enforcement.js"(exports2, module2) {
+    "use strict";
+    var fs = require("fs");
+    var path = require("path");
+    var {
+      CHECK_NAME,
+      extractRequiredContexts
+    } = require_setup_required_check();
+    var { GATE_ACTION } = require_contract_gate_workflow();
+    var EVIDENCE_SPEC = "provider-enforcement-evidence.v1";
+    var APP_INSTALLATION = Object.freeze({
+      can_query_protection: false,
+      permissions: Object.freeze([
+        "contents:read",
+        "pull_requests:read+write",
+        "checks:read+write"
+      ]),
+      missing_scope: "administration:read",
+      reason: "GET /repos/{owner}/{repo}/branches/{branch}/protection requires administration:read (or repo admin). The CodeRifts GitHub App permission set is contents:read, pull_requests:read+write, checks:read+write \u2014 administration:read is not granted."
+    });
+    var NO_TOKEN_INSTRUCTION = "NO token \u2014 set GITHUB_TOKEN (repo + administration:read; Environments: Read if querying --env). The CodeRifts GitHub App installation cannot query branch protection (permissions: contents:read, pull_requests:read+write, checks:read+write \u2014 missing administration:read).";
+    var LAYER_IDS = Object.freeze([
+      "required_check",
+      "enforce_admins",
+      "strict_status_checks",
+      "environment_protection",
+      "workflow_contract_gate",
+      "workflow_deploy_gate"
+    ]);
+    var STATUS = Object.freeze({
+      VERIFIED: "VERIFIED",
+      NOT_VERIFIED: "NOT_VERIFIED",
+      UNVERIFIABLE: "UNVERIFIABLE"
+    });
+    function resolveGitHubAuth(env = process.env) {
+      const user = String(env && (env.GITHUB_TOKEN || env.GH_TOKEN) || "").trim();
+      if (user) {
+        return { ok: true, source: "github_token", token: user };
+      }
+      const app = String(env && (env.GITHUB_APP_TOKEN || env.CODERIFTS_GITHUB_APP_TOKEN) || "").trim();
+      if (app) {
+        return { ok: true, source: "github_app_installation", token: app };
+      }
+      return { ok: false, source: "none", token: null, reason: NO_TOKEN_INSTRUCTION };
+    }
+    function redactSecrets(text) {
+      return String(text || "").replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(/ghp_[A-Za-z0-9_]+/g, "ghp_[redacted]").replace(/github_pat_[A-Za-z0-9_]+/g, "github_pat_[redacted]");
+    }
+    function createGitHubHttpClient(opts = {}) {
+      const token = opts.token;
+      const fetchFn = opts.fetchImpl || (typeof fetch === "function" ? fetch.bind(globalThis) : null);
+      const apiBase = (opts.apiBase || "https://api.github.com").replace(/\/$/, "");
+      return {
+        name: "github",
+        async get(apiPath) {
+          const endpoint = `${apiBase}/${String(apiPath).replace(/^\//, "")}`;
+          if (!fetchFn) {
+            return {
+              status: 0,
+              body: null,
+              endpoint,
+              error: "fetch is not available in this runtime"
+            };
+          }
+          const res = await fetchFn(endpoint, {
+            method: "GET",
+            headers: {
+              Authorization: `Bearer ${token}`,
+              Accept: "application/vnd.github+json",
+              "X-GitHub-Api-Version": "2022-11-28",
+              "User-Agent": "coderifts-cli"
+            }
+          });
+          const text = await res.text();
+          let body = null;
+          try {
+            body = text ? JSON.parse(text) : null;
+          } catch {
+            body = null;
+          }
+          return { status: res.status, body, endpoint };
+        }
+      };
+    }
+    function enforceAdminsEnabled(protection) {
+      if (!protection || typeof protection !== "object") return false;
+      const ea = protection.enforce_admins;
+      if (ea === true) return true;
+      if (ea && typeof ea === "object" && ea.enabled === true) return true;
+      return false;
+    }
+    function strictEnabled(protection) {
+      if (!protection || typeof protection !== "object") return false;
+      const rsc = protection.required_status_checks;
+      return !!(rsc && typeof rsc === "object" && rsc.strict === true);
+    }
+    function environmentProtected(body) {
+      if (!body || typeof body !== "object") return false;
+      const rules = Array.isArray(body.protection_rules) ? body.protection_rules : [];
+      if (rules.length > 0) return true;
+      const policy = body.deployment_branch_policy;
+      if (policy && typeof policy === "object") {
+        return policy.protected_branches === true || policy.custom_branch_policies === true;
+      }
+      return false;
+    }
+    function layer(id, status, extra = {}) {
+      return { id, status, ...extra };
+    }
+    function evaluateLayers({
+      protectionRead,
+      environmentRead,
+      environmentName,
+      local,
+      auth
+    } = {}) {
+      const layers = [];
+      const localFiles = local || { contractGateFiles: [], deployGateFiles: [] };
+      const noAuth = !auth || auth.source === "none" || !auth.ok;
+      const prot = protectionRead || null;
+      if (noAuth && !prot) {
+        const why = auth && auth.reason || NO_TOKEN_INSTRUCTION;
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, {
+            reason: why,
+            endpoint: null,
+            missing_scope: APP_INSTALLATION.missing_scope
+          }));
+        }
+      } else if (!prot) {
+        const why = "branch protection was not queried";
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, { reason: why, endpoint: null }));
+        }
+      } else if (prot.status === 403) {
+        const why = "GitHub HTTP 403 \u2014 missing scope administration:read (branch protection). Grant Administration: Read on the token, or use a repo-admin token.";
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, {
+            reason: why,
+            endpoint,
+            missing_scope: "administration:read",
+            http_status: 403
+          }));
+        }
+      } else if (prot.status === 404) {
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        layers.push(layer("required_check", STATUS.NOT_VERIFIED, {
+          reason: `classic branch protection is absent \u2014 required check "${CHECK_NAME}" is not required`,
+          endpoint,
+          http_status: 404
+        }));
+        layers.push(layer("enforce_admins", STATUS.NOT_VERIFIED, {
+          reason: "classic branch protection is absent \u2014 administrators are unrestricted",
+          endpoint,
+          http_status: 404
+        }));
+        layers.push(layer("strict_status_checks", STATUS.NOT_VERIFIED, {
+          reason: "classic branch protection is absent \u2014 required_status_checks.strict is not set",
+          endpoint,
+          http_status: 404
+        }));
+      } else if (prot.status >= 400 || prot.status === 0) {
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        const why = `GitHub HTTP ${prot.status || 0} reading branch protection \u2014 cannot verify`;
+        for (const id of ["required_check", "enforce_admins", "strict_status_checks"]) {
+          layers.push(layer(id, STATUS.UNVERIFIABLE, {
+            reason: redactSecrets(why),
+            endpoint,
+            http_status: prot.status
+          }));
+        }
+      } else {
+        const protection = prot.body && typeof prot.body === "object" ? prot.body : {};
+        const endpoint = prot.endpoint ? `GET ${prot.endpoint}` : null;
+        const contexts = extractRequiredContexts(protection);
+        const hasCheck = contexts.includes(CHECK_NAME);
+        layers.push(layer("required_check", hasCheck ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: hasCheck ? `required_status_checks includes "${CHECK_NAME}"` : `required_status_checks does not include "${CHECK_NAME}" (have: ${contexts.join(", ") || "none"})`,
+          endpoint,
+          required_contexts: contexts
+        }));
+        const admins = enforceAdminsEnabled(protection);
+        layers.push(layer("enforce_admins", admins ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: admins ? "enforce_admins.enabled is true \u2014 administrators cannot bypass required checks" : "enforce_admins.enabled is false \u2014 repository administrators can bypass required checks",
+          endpoint,
+          enforce_admins: admins
+        }));
+        const strict = strictEnabled(protection);
+        layers.push(layer("strict_status_checks", strict ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: strict ? "required_status_checks.strict is true" : "required_status_checks.strict is not true \u2014 a branch need not be up to date before merge",
+          endpoint,
+          strict
+        }));
+      }
+      if (!environmentName) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: "no --env supplied; pass --env <GitHub Environment name> to query environment protection rules",
+          endpoint: null
+        }));
+      } else if (noAuth && !environmentRead) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: auth && auth.reason || NO_TOKEN_INSTRUCTION,
+          endpoint: null,
+          missing_scope: "actions:read / Environments: Read"
+        }));
+      } else if (!environmentRead) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: "environment was not queried",
+          endpoint: null
+        }));
+      } else if (environmentRead.status === 403) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: "GitHub HTTP 403 \u2014 missing scope to read environments (Actions/Environments: Read, or repo admin).",
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          missing_scope: "environments:read",
+          http_status: 403
+        }));
+      } else if (environmentRead.status === 404) {
+        layers.push(layer("environment_protection", STATUS.NOT_VERIFIED, {
+          reason: `GitHub Environment "${environmentName}" does not exist (or has no protection)`,
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          http_status: 404
+        }));
+      } else if (environmentRead.status >= 400 || environmentRead.status === 0) {
+        layers.push(layer("environment_protection", STATUS.UNVERIFIABLE, {
+          reason: `GitHub HTTP ${environmentRead.status || 0} reading environment "${environmentName}"`,
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          http_status: environmentRead.status
+        }));
+      } else {
+        const ok = environmentProtected(environmentRead.body);
+        layers.push(layer("environment_protection", ok ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+          reason: ok ? `GitHub Environment "${environmentName}" has protection rules or a deployment branch policy` : `GitHub Environment "${environmentName}" exists but has no protection_rules and no deployment_branch_policy`,
+          endpoint: environmentRead.endpoint ? `GET ${environmentRead.endpoint}` : null,
+          environment: environmentName
+        }));
+      }
+      const cg = localFiles.contractGateFiles || [];
+      layers.push(layer("workflow_contract_gate", cg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+        reason: cg.length ? `workflow references ${GATE_ACTION} (${cg.join(", ")})` : `no .github/workflows file references ${GATE_ACTION}`,
+        endpoint: "local:.github/workflows",
+        files: cg
+      }));
+      const dg = localFiles.deployGateFiles || [];
+      layers.push(layer("workflow_deploy_gate", dg.length ? STATUS.VERIFIED : STATUS.NOT_VERIFIED, {
+        reason: dg.length ? `workflow runs coderifts deploy-gate (${dg.join(", ")})` : "no .github/workflows file runs coderifts deploy-gate",
+        endpoint: "local:.github/workflows",
+        files: dg
+      }));
+      const byId = Object.fromEntries(layers.map((l) => [l.id, l]));
+      const inescapable = LAYER_IDS.every((id) => byId[id] && byId[id].status === STATUS.VERIFIED);
+      return {
+        layers,
+        inescapable_deploy: inescapable,
+        claim: {
+          inescapable_deploy: inescapable,
+          basis: inescapable ? "all six layers VERIFIED from queried provider evidence + local workflow files" : "inescapable_deploy stays false until every layer is VERIFIED"
+        }
+      };
+    }
+    function scanLocalWorkflows(cwd, deps = {}) {
+      const exists = deps.exists || fs.existsSync.bind(fs);
+      const readdir = deps.readdir || ((p) => fs.readdirSync(p));
+      const readFile = deps.readFile || ((p) => fs.readFileSync(p, "utf8"));
+      const dir = path.join(cwd, ".github", "workflows");
+      const contractGateFiles = [];
+      const deployGateFiles = [];
+      if (!exists(dir)) return { contractGateFiles, deployGateFiles };
+      let names = [];
+      try {
+        names = readdir(dir);
+      } catch {
+        return { contractGateFiles, deployGateFiles };
+      }
+      for (const name of names) {
+        if (!/\.ya?ml$/i.test(name)) continue;
+        const rel = `.github/workflows/${name}`;
+        let body = "";
+        try {
+          body = String(readFile(path.join(dir, name)));
+        } catch {
+          continue;
+        }
+        if (body.includes(GATE_ACTION)) contractGateFiles.push(rel);
+        if (/\bcoderifts\s+deploy-gate\b/.test(body)) deployGateFiles.push(rel);
+      }
+      return { contractGateFiles, deployGateFiles };
+    }
+    async function queryGitHubEnforcement({
+      owner,
+      repo,
+      branch,
+      environmentName,
+      client
+    } = {}) {
+      const protectionPath = branch ? `repos/${owner}/${repo}/branches/${encodeURIComponent(branch)}/protection` : null;
+      const envPath = environmentName ? `repos/${owner}/${repo}/environments/${encodeURIComponent(environmentName)}` : null;
+      let resolvedBranch = branch || null;
+      let repoRead = null;
+      if (!resolvedBranch && client) {
+        repoRead = await client.get(`repos/${owner}/${repo}`);
+        if (repoRead && repoRead.status === 200 && repoRead.body && repoRead.body.default_branch) {
+          resolvedBranch = String(repoRead.body.default_branch);
+        }
+      }
+      const protPath = resolvedBranch ? `repos/${owner}/${repo}/branches/${encodeURIComponent(resolvedBranch)}/protection` : protectionPath;
+      const protectionRead = client && protPath ? await client.get(protPath) : null;
+      const environmentRead = client && envPath ? await client.get(envPath) : null;
+      return {
+        branch: resolvedBranch,
+        repoRead,
+        protectionRead,
+        environmentRead
+      };
+    }
+    module2.exports = {
+      EVIDENCE_SPEC,
+      APP_INSTALLATION,
+      NO_TOKEN_INSTRUCTION,
+      LAYER_IDS,
+      STATUS,
+      CHECK_NAME,
+      GATE_ACTION,
+      resolveGitHubAuth,
+      redactSecrets,
+      createGitHubHttpClient,
+      evaluateLayers,
+      scanLocalWorkflows,
+      queryGitHubEnforcement,
+      enforceAdminsEnabled,
+      strictEnabled,
+      environmentProtected
+    };
+  }
+});
+
+// src/commands/enforce-check.js
+var require_enforce_check = __commonJS({
+  "src/commands/enforce-check.js"(exports2, module2) {
+    "use strict";
+    var chalk = require_source();
+    var {
+      EVIDENCE_SPEC,
+      APP_INSTALLATION,
+      NO_TOKEN_INSTRUCTION,
+      resolveGitHubAuth,
+      createGitHubHttpClient,
+      evaluateLayers,
+      scanLocalWorkflows,
+      queryGitHubEnforcement
+    } = require_github_enforcement();
+    var { isValidRepo } = require_status();
+    var { resolveOwnerRepo } = require_setup_required_check();
+    if (process.env.NO_COLOR) chalk.level = 0;
+    var USAGE = [
+      "Usage: coderifts enforce --check --repo owner/repo [--env <github-environment>] [--branch <name>] [--json]",
+      "",
+      "Query the provider (GitHub) and local workflow files. Report, per layer:",
+      "  VERIFIED / NOT_VERIFIED / UNVERIFIABLE(reason).",
+      "inescapable_deploy is true only when every layer is VERIFIED.",
+      "",
+      "Auth: GITHUB_TOKEN (or GH_TOKEN). Never prints token values.",
+      "The CodeRifts GitHub App installation cannot query branch protection",
+      "(missing administration:read)."
+    ].join("\n");
+    function statusColor(status) {
+      if (status === "VERIFIED") return chalk.green(status);
+      if (status === "NOT_VERIFIED") return chalk.yellow(status);
+      return chalk.red(status);
+    }
+    function renderHuman(report) {
+      const lines = [];
+      lines.push(chalk.bold("CodeRifts enforce --check"));
+      lines.push(`  repo:    ${report.repo}`);
+      lines.push(`  branch:  ${report.branch || "(unknown)"}`);
+      if (report.environment) lines.push(`  env:     ${report.environment}`);
+      lines.push(`  queried: ${report.queried_at}`);
+      lines.push(`  auth:    ${report.auth.source} (value not printed)`);
+      lines.push(chalk.dim(`  App installation: cannot query protection (${report.auth.app_installation.missing_scope})`));
+      lines.push("");
+      lines.push(chalk.bold("  Layer                              Status"));
+      for (const l of report.layers) {
+        const id = String(l.id).padEnd(34, " ");
+        lines.push(`  ${id}${statusColor(l.status)}`);
+        if (l.status !== "VERIFIED" && l.reason) {
+          lines.push(chalk.dim(`    WHY    ${l.reason}`));
+        }
+        if (l.endpoint) lines.push(chalk.dim(`    via    ${l.endpoint}`));
+      }
+      lines.push("");
+      const claim = report.claim && report.claim.inescapable_deploy === true;
+      lines.push(`  inescapable_deploy: ${claim ? chalk.green("true") : chalk.yellow("false")}`);
+      lines.push(chalk.dim(`  ${report.claim.basis}`));
+      lines.push("");
+      lines.push(chalk.dim("  This is queried evidence, not a host claim."));
+      lines.push(chalk.dim("  --enforce / CODERIFTS_DEPLOY_NO_BYPASS are host claims and do not set this field."));
+      if (!claim) {
+        lines.push("");
+        lines.push(chalk.bold("  ACTION"));
+        const missing = report.layers.filter((l) => l.status !== "VERIFIED");
+        for (const l of missing) {
+          if (l.id === "required_check") {
+            lines.push(chalk.dim('    require "CodeRifts / contract-gate" on default-branch protection'));
+            lines.push(chalk.dim("    (coderifts setup-required-check --apply)"));
+          } else if (l.id === "enforce_admins") {
+            lines.push(chalk.dim("    set enforce_admins: true so administrators cannot bypass"));
+            lines.push(chalk.dim("    (coderifts setup-required-check --enforce-admins --apply)"));
+          } else if (l.id === "strict_status_checks") {
+            lines.push(chalk.dim("    set required_status_checks.strict: true"));
+          } else if (l.id === "environment_protection") {
+            lines.push(chalk.dim("    add a GitHub Environment with protection rules, pass --env <name>"));
+          } else if (l.id === "workflow_contract_gate") {
+            lines.push(chalk.dim("    add .github/workflows/coderifts.yml using coderifts/contract-gate@v0"));
+            lines.push(chalk.dim("    (coderifts init --agents)"));
+          } else if (l.id === "workflow_deploy_gate") {
+            lines.push(chalk.dim("    add a CD step: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>"));
+          }
+        }
+      }
+      return lines.join("\n");
+    }
+    async function runEnforceCheck(options = {}, deps = {}) {
+      const log = deps.log || console.log.bind(console);
+      const errLog = deps.errLog || console.error.bind(console);
+      const cwd = deps.cwd || options.cwd || process.cwd();
+      const now = deps.now || (() => (/* @__PURE__ */ new Date()).toISOString());
+      const env = deps.env || process.env;
+      const repoArg = options.repo;
+      let ownerRepo = null;
+      if (repoArg && isValidRepo(String(repoArg).trim())) {
+        const [owner, repo] = String(repoArg).trim().split("/");
+        ownerRepo = { owner, repo };
+      } else if (!repoArg) {
+        try {
+          ownerRepo = resolveOwnerRepo(cwd, deps.gitImpl);
+        } catch {
+          ownerRepo = null;
+        }
+      }
+      if (!ownerRepo) {
+        errLog(chalk.red("Error: missing repo (pass --repo owner/repo)"));
+        errLog(USAGE);
+        return { exitCode: 1, error: "missing_repo" };
+      }
+      const providerName = String(options.provider || "github").toLowerCase();
+      const queriedAt = now();
+      const environmentName = options.env ? String(options.env).trim() : null;
+      const local = (deps.scanLocalWorkflows || scanLocalWorkflows)(cwd, deps.fs || {});
+      const authPublic = {
+        source: "none",
+        app_installation: { ...APP_INSTALLATION }
+      };
+      if (providerName !== "github") {
+        const reason = `no ${providerName} adapter \u2014 GitHub is the only implemented provider; refusing to stub results`;
+        const evaluated2 = evaluateLayers({
+          protectionRead: null,
+          environmentRead: null,
+          environmentName,
+          local,
+          auth: { ok: false, source: "none", reason }
+        });
+        const report2 = {
+          command: "enforce --check",
+          spec: EVIDENCE_SPEC,
+          queried_at: queriedAt,
+          repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
+          branch: options.branch || null,
+          environment: environmentName,
+          provider: providerName,
+          auth: { ...authPublic, reason },
+          ...evaluated2
+        };
+        if (options.json) log(JSON.stringify(report2, null, 2));
+        else log(renderHuman(report2));
+        return { exitCode: 0, report: report2 };
+      }
+      const auth = (deps.resolveAuth || resolveGitHubAuth)(env);
+      authPublic.source = auth.source;
+      if (auth.reason) authPublic.reason = auth.reason;
+      let branch = options.branch ? String(options.branch).trim() : null;
+      let protectionRead = null;
+      let environmentRead = null;
+      if (auth.ok) {
+        const client = deps.githubClient || createGitHubHttpClient({
+          token: auth.token,
+          fetchImpl: deps.fetchImpl
+        });
+        const queried = await queryGitHubEnforcement({
+          owner: ownerRepo.owner,
+          repo: ownerRepo.repo,
+          branch,
+          environmentName,
+          client
+        });
+        branch = queried.branch || branch;
+        protectionRead = queried.protectionRead;
+        environmentRead = queried.environmentRead;
+      }
+      const evaluated = evaluateLayers({
+        protectionRead,
+        environmentRead,
+        environmentName,
+        local,
+        auth
+      });
+      const report = {
+        command: "enforce --check",
+        spec: EVIDENCE_SPEC,
+        queried_at: queriedAt,
+        repo: `${ownerRepo.owner}/${ownerRepo.repo}`,
+        branch,
+        environment: environmentName,
+        provider: "github",
+        auth: authPublic,
+        ...evaluated
+      };
+      if (options.json) log(JSON.stringify(report, null, 2));
+      else log(renderHuman(report));
+      return { exitCode: 0, report };
+    }
+    module2.exports = {
+      runEnforceCheck,
+      renderHuman,
+      USAGE,
+      NO_TOKEN_INSTRUCTION
+    };
+  }
+});
+
 // src/commands/enforce.js
 var require_enforce = __commonJS({
   "src/commands/enforce.js"(exports2, module2) {
@@ -237021,14 +237721,19 @@ var require_enforce = __commonJS({
     var USAGE = [
       "Usage: coderifts enforce --repo owner/repo [--apply]",
       "   or: coderifts enforce owner/repo [--apply]",
+      "   or: coderifts enforce --check --repo owner/repo [--env <name>] [--json]",
       "",
       "Cross-layer orchestrator: reads enforcement-status, then closes gaps by calling existing",
       "setup commands (setup-required-check, hook install, deploy-gate guidance).",
       "",
+      "--check: query GitHub + local workflows and report VERIFIED / NOT_VERIFIED /",
+      "UNVERIFIABLE per layer. inescapable_deploy is true only when every layer is VERIFIED.",
+      "Does not use the CodeRifts API key. Auth: GITHUB_TOKEN. Read-only.",
+      "",
       "DRY-RUN BY DEFAULT \u2014 without --apply, prints what WOULD run and mutates NOTHING.",
       "With --apply, threads apply into each underlying command (their own safety still applies).",
       "",
-      "Requires a cloud API key for the status read (coderifts login / CODERIFTS_API_KEY).",
+      "Requires a cloud API key for the (non --check) status read (coderifts login / CODERIFTS_API_KEY).",
       "Merge apply uses your local `gh` credentials, not the CodeRifts API key."
     ].join("\n");
     var AGENT_GUARD_GUIDANCE = [
@@ -237039,8 +237744,10 @@ var require_enforce = __commonJS({
     ].join("\n");
     var DEPLOY_GUIDANCE = [
       "Deploy is declared-only on the server (never server-observed ENFORCING).",
-      "Add a CD step that runs: coderifts deploy-gate --env <env> --artifact <id> --receipt <file> --enforce",
-      "  (fail-closed by default; --enforce attests ENFORCING for inescapable_deploy. CODERIFTS_DEPLOY_ADVISORY=1 to soften.)",
+      "Add a CD step that runs: coderifts deploy-gate --env <env> --artifact <id> --receipt <file>",
+      "  (fail-closed by default. --enforce is a host claim, not inescapable_deploy.",
+      "   Prove pipeline protection with: coderifts enforce --check --repo owner/repo --env <env>.",
+      "   CODERIFTS_DEPLOY_ADVISORY=1 to soften the exit.)",
       "Also set policy.require_source_binding: true in .coderifts.yml for the deploy declaration leg."
     ].join("\n");
     var CONTENT_GUIDANCE = [
@@ -237067,6 +237774,15 @@ var require_enforce = __commonJS({
       }
     }
     async function runEnforce(options = {}, deps = {}) {
+      if (options.check === true) {
+        if (options.apply === true) {
+          const errLog2 = deps.errLog || console.error.bind(console);
+          errLog2(chalk.red("Error: --check is read-only evidence and cannot be combined with --apply"));
+          return { exitCode: 1, error: "check_apply_conflict", outcomes: [] };
+        }
+        const { runEnforceCheck } = require_enforce_check();
+        return runEnforceCheck(options, deps);
+      }
       const apply = options.apply === true;
       const getKey = deps.getApiKey || getApiKey;
       const fetchStatus = deps.cloudGetEnforcementStatus || cloudGetEnforcementStatus;
@@ -238206,7 +238922,7 @@ var require_outcome = __commonJS({
 var require_cursor_hook = __commonJS({
   "src/commands/cursor-hook.js"(exports2, module2) {
     "use strict";
-    var { runClaudeHook } = require_claude_hook();
+    var { runClaudeHook, pickToolField, filePathFromInput, contentFromInput, coerceToolInput } = require_claude_hook();
     var USAGE = `Usage: coderifts cursor-hook
 
 Cursor preToolUse adapter. Reads Cursor's hook JSON on stdin, emits
@@ -238233,15 +238949,15 @@ Unparseable stdin denies (fail-closed).
       if (!obj || typeof obj !== "object" || Array.isArray(obj)) {
         return { ok: false, reason: "stdin JSON is not an object" };
       }
-      const toolName = typeof obj.tool_name === "string" ? obj.tool_name : null;
-      if (!toolName) return { ok: false, reason: "missing tool_name" };
-      const toolInput = obj.tool_input && typeof obj.tool_input === "object" && !Array.isArray(obj.tool_input) ? obj.tool_input : null;
+      const toolName = pickToolField(obj, "tool_name", "toolName", "name");
+      if (typeof toolName !== "string" || !toolName) return { ok: false, reason: "missing tool_name" };
+      const toolInput = coerceToolInput(pickToolField(obj, "tool_input", "toolInput", "input")) || (filePathFromInput(obj) ? obj : null);
       if (!toolInput) return { ok: false, reason: "missing tool_input" };
       return { ok: true, payload: obj, toolName, toolInput };
     }
     function toClaudeShape(toolName, toolInput) {
-      const filePath = toolInput.file_path || toolInput.path || toolInput.target_file || null;
-      const content = toolInput.content !== void 0 ? toolInput.content : toolInput.contents !== void 0 ? toolInput.contents : void 0;
+      const filePath = filePathFromInput(toolInput) || null;
+      const content = contentFromInput(toolInput);
       const out = { ...toolInput };
       if (filePath) out.file_path = filePath;
       if (content !== void 0) out.content = content;
@@ -240003,7 +240719,7 @@ program.command("registry-gate [dir]").description("Admit a directory of OpenAPI
   process.exitCode = code;
   process.exit(code);
 });
-program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
+program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
   const {
     runInitAgents,
     agentFlagsRequireAgents,
@@ -240058,12 +240774,13 @@ program.command("status [repo]").description("Show cross-layer enforcement statu
     process.exitCode = result.exitCode;
   }
 });
-program.command("enforce [repo]").description("Close enforcement gaps by chaining setup-required-check / hook / deploy guidance (dry-run default; use --apply to mutate)").option("--repo <owner/repo>", "Repository (owner/repo); also accepted as a positional argument").option("--apply", "Actually run underlying setup commands (default: dry-run only)").option("--json", "Machine-readable JSON result").action(async (repoPositional, options) => {
+program.command("enforce [repo]").description("Close enforcement gaps (dry-run default), or --check to query provider-native pipeline protection evidence").option("--repo <owner/repo>", "Repository (owner/repo); also accepted as a positional argument").option("--apply", "Actually run underlying setup commands (default: dry-run only)").option("--check", "Query GitHub + local workflows; report VERIFIED / NOT_VERIFIED / UNVERIFIABLE (read-only)").option("--env <name>", "With --check: GitHub Environment name to query for protection rules").option("--branch <name>", "With --check: branch to query (default: repository default branch)").option("--provider <name>", "With --check: provider adapter (github only; others UNVERIFIABLE, never stubbed)", "github").option("--json", "Machine-readable JSON result").action(async (repoPositional, options) => {
   const { runEnforce } = require_enforce();
   const result = await runEnforce({
     ...options,
     repo: options.repo || repoPositional || null,
-    apply: !!options.apply
+    apply: !!options.apply,
+    check: !!options.check
   });
   if (result && typeof result.exitCode === "number") {
     process.exitCode = result.exitCode;