coderifts 4.7.0 → 4.9.0

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 4.9.0
+
+### Fixed
+- **P0 / ID621 — `enforce --check` no longer reports `inescapable_deploy: true`
+  for an unenforced configuration.** External audit 2026-08-24 reproduced two
+  holes on the published CLI: (a) the required check matched by **name only**
+  (`required_status_checks.checks[]` with no `app_id`), so any repository
+  writer could satisfy it with a same-named success status; (b) the two local
+  workflow checks were **text searches**, so `# uses: coderifts/contract-gate@v0`
+  in a comment counted as VERIFIED. Both now fail closed.
+
+### Changed
+- **`--json` spec `provider-enforcement-evidence.v2`.** The meaning of
+  `VERIFIED` changed. A layer whose evidence cannot be bound to an issuer
+  (CodeRifts GitHub App id, public `GET /apps/coderifts`) or to an **active**
+  workflow job is `NOT_VERIFIED` or `UNVERIFIABLE` — never `VERIFIED`.
+  `inescapable_deploy` is true only when every layer is VERIFIED under these
+  rules.
+- **Issuer binding:** `required_check` is VERIFIED only when `checks[]`
+  carries our App's numeric `app_id`. Legacy `contexts: string[]` is
+  `legacy_contexts_no_issuer_binding`. Name-only `checks[]` is
+  `no_issuer_binding`. A different `app_id` is `issuer_app_id_mismatch`.
+- **YAML AST, not grep:** workflow files are parsed with `js-yaml` (already a
+  CLI dependency — no new package). VERIFIED requires a job that is not
+  `if: false` and a step whose `uses:` is `coderifts/contract-gate` at a
+  pinned major, or a `run:` that actually invokes `coderifts deploy-gate`.
+  Comments, string literals in other keys, and commented-out steps fail.
+- **Environment correlation:** `environment_protection` is VERIFIED only when
+  `--env` names a protected GitHub Environment **and** an active deploy-gate
+  job sets that same `environment:` key (`environment_mismatch` otherwise).
+
+## 4.8.0
+
+### Fixed
+- **VS Code / Copilot PreToolUse camelCase (DRIFT 1).** VS Code Agent hooks
+  pass `toolName` / `toolInput` / `filePath` (and `targetFile`). The hook
+  already tolerated `toolName`/`toolInput` but missed several property
+  aliases, so flattened camelCase payloads and `targetFile` were refused as
+  unparseable (fail-closed, safe, unusable). Every Claude-shaped read site
+  now accepts snake_case and camelCase: `tool_name`/`toolName`,
+  `tool_input`/`toolInput`, `file_path`/`filePath`/`path`/`target_file`/`targetFile`,
+  `content`/`contents`. Snake_case behaviour is unchanged. Garbage is still
+  fail-closed.
+
+### Changed
+- **Matcher-inert hosts (DRIFT 2, documented, not a host fix).** VS Code
+  parses hook matchers but does not apply them — the hook fires on every
+  tool call. Non-Write/Edit/MultiEdit tools now exit **0** silently with no
+  network and **without requiring an API key** (parse → skip → key, so a
+  missing key cannot brick Read/Bash). Non-contract Write paths skip before
+  the key gate too. Garbage is still fail-closed (`stdin_unparseable`).
+  Spec-path Write/Edit/MultiEdit without a key is still fail-closed.
+
+### Added
+- **`copilot` MCP host (DRIFT 3).** `MCP_HOSTS` grows a third entry:
+  `.vscode/mcp.json`, root key **`servers`** (not `mcpServers`),
+  `type: "http"` + `url`. The writer special-cases the root key; Claude and
+  Cursor stay on `mcpServers`. `coderifts init --agents --hosts` accepts
+  `copilot` and includes it in `all`. Merge preserves other `servers` (and
+  any leftover keys). `--check` uses the same predicate.
+- README Copilot section: `hook install --claude` arms VS Code agent mode
+  (measured), matcher-inert behaviour, honest boundary (hooks gate the
+  agent, not the human; inline completions are not tool calls).
+
 ## 4.7.0
 
 ### Added

package/README.md

@@ -72,6 +72,7 @@ coderifts init --agents                  # all hosts, all four pieces
 coderifts init --agents --dry-run        # plan only — writes nothing
 coderifts init --agents --hosts=claude   # Claude Code only
 coderifts init --agents --hosts=cursor   # Cursor only
+coderifts init --agents --hosts=copilot  # GitHub Copilot / VS Code only
 coderifts init --agents --no-hook        # skip host hook install
 coderifts init --agents --no-workflow    # skip .github/workflows/coderifts.yml
 coderifts init --agents --check          # which of the four pieces are present
@@ -79,9 +80,9 @@ coderifts init --agents --check          # which of the four pieces are present
 
 | Piece | What it writes | Host-specific shape |
 |-------|----------------|---------------------|
-| **MCP config** | `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor) | Claude: `mcpServers.coderifts` with `type: "http"` + `url`. Cursor: `url` only (no `type`). Never `httpUrl` (that is Gemini, extension-level — this command does not write it). |
-| **Agent rules** | generated host files via `agent-setup`'s writer | `AGENTS.md` is always written. Claude also gets `CLAUDE.md`; Cursor also gets `.cursor/rules/coderifts.mdc`. `--hosts=all` adds Copilot, LangGraph, and OpenAI instructions. (`coderifts init agent` is a different command — it writes a `.coderifts.yml` template.) |
-| **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent) |
+| **MCP config** | `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor), `.vscode/mcp.json` (Copilot / VS Code) | Three shapes, never normalised into one: Claude `mcpServers` + `type: "http"` + `url`; Cursor `mcpServers` + `url` only (no `type`); Copilot **`servers`** (not `mcpServers`) + `type: "http"` + `url`. Never `httpUrl` (that is Gemini, extension-level — this command does not write it). |
+| **Agent rules** | generated host files via `agent-setup`'s writer | `AGENTS.md` is always written. Claude also gets `CLAUDE.md`; Cursor also gets `.cursor/rules/coderifts.mdc`; Copilot also gets `.github/copilot-instructions.md`. `--hosts=all` adds LangGraph and OpenAI instructions. (`coderifts init agent` is a different command — it writes a `.coderifts.yml` template.) |
+| **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent). Copilot shares Claude's `.claude/settings.json` — VS Code reads it by default. |
 | **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. `require-verified-monitoring` is commented (honest default: **false**) |
 
 **Next manual step:** add `CODERIFTS_API_KEY` to the repository secrets. The
@@ -347,6 +348,37 @@ weakened by `CODERIFTS_ADVISORY`.
 CODERIFTS_ADVISORY=1 coderifts claude-hook
 ```
 
+### GitHub Copilot / VS Code agent mode
+
+Measured (VS Code **1.110**, Agent hooks Preview, 2026-08-24): VS Code **reads
+`.claude/settings.json` by default**. `coderifts hook install --claude`
+therefore arms Copilot agent mode — there is no separate `--copilot` hook
+installer. VS Code Agent hooks **are deny-capable**: PreToolUse honours
+`permissionDecision` allow|deny|ask and **exit 2**.
+
+**Property names (CLI 4.8.0):** VS Code passes camelCase (`toolName` /
+`toolInput` / `filePath` / `targetFile`). The hook accepts those alongside
+Claude's snake_case (`tool_name` / `tool_input` / `file_path`). Flattened
+payloads (path on the root object) are accepted. Garbage input is still
+fail-closed.
+
+**Matcher limitation (host behaviour, not a CLI bug):** VS Code **parses** hook
+matchers (`Write|Edit|MultiEdit`) but **does not apply them**. The hook fires
+on every tool call. Non-governed tools (Read, Bash, …) and non-contract paths
+exit **0** silently with **no network** and **no API key required** — cheap
+and fail-open for anything that is not a Write/Edit/MultiEdit of the spec. It
+is noisy (every tool call invokes the process) and safe (irrelevant tools are
+not blocked). A spec-path write without a key is still fail-closed.
+
+**Honest boundary:** hooks gate the **agent**, not the human. Inline
+completions (ghost text) are not tool calls and are not governed. A developer
+typing in the editor is not a PreToolUse event.
+
+**MCP:** `coderifts init --agents` (and `--hosts=copilot`) writes
+`.vscode/mcp.json` with root key **`servers`** — a third shape. Claude Code and
+Cursor use `mcpServers`; Copilot cloud Settings paste also uses `mcpServers`.
+Do not copy one file onto another host.
+
 ### `coderifts status [repo]`
 
 **Read-only** cross-layer enforcement report (Runtime / Merge / Deploy, plus
@@ -405,12 +437,14 @@ Provider-native pipeline-protection evidence. This is **not** a host claim:
 
 | Layer | VERIFIED when |
 |-------|----------------|
-| `required_check` | Default-branch protection requires `CodeRifts / contract-gate` |
+| `required_check` | Default-branch protection `required_status_checks.checks[]` lists `CodeRifts / contract-gate` **bound to the CodeRifts GitHub App `app_id`** (public metadata: `GET https://api.github.com/apps/coderifts`). Name-only `checks[]` (`app_id` null) is `no_issuer_binding`. The legacy `contexts` array has no issuer field → `legacy_contexts_no_issuer_binding`. Both are **NOT_VERIFIED** (ID621). |
 | `enforce_admins` | `enforce_admins.enabled` is **true** (admins cannot bypass). `false` = NOT_VERIFIED (admin bypass open) |
 | `strict_status_checks` | `required_status_checks.strict` is true |
-| `environment_protection` | `--env` names a GitHub Environment with protection rules or a deployment branch policy |
-| `workflow_contract_gate` | a local `.github/workflows` file references `coderifts/contract-gate@v0` |
-| `workflow_deploy_gate` | a local workflow runs `coderifts deploy-gate` |
+| `environment_protection` | `--env` names a GitHub Environment with protection rules **and** an active deploy-gate job sets that same `environment:` (mismatch → `environment_mismatch`) |
+| `workflow_contract_gate` | an **active** job (not `if: false`) has a step whose `uses:` is `coderifts/contract-gate` at a pinned major. Comments, string literals, and commented-out steps are **NOT_VERIFIED** |
+| `workflow_deploy_gate` | an **active** job step **invokes** `coderifts deploy-gate` (not `echo` of the string; not a comment) |
+
+**Invariant:** any layer whose evidence cannot be bound to an issuer (our GitHub App id) or to an active job is `NOT_VERIFIED` or `UNVERIFIABLE` — never `VERIFIED`. `inescapable_deploy` remains true only when every layer is `VERIFIED` under that rule.
 
 Statuses: `VERIFIED` / `NOT_VERIFIED` / `UNVERIFIABLE(reason)`. Auth:
 `GITHUB_TOKEN` (never printed). **No token** → API layers `UNVERIFIABLE` with
@@ -419,9 +453,11 @@ CodeRifts GitHub App **cannot** query branch protection (permissions are
 contents / pull requests / checks — not `administration:read`).
 
 `--json` is the quotable evidence document (`spec`:
-`provider-enforcement-evidence.v1`): each layer's status, the API endpoint
-consulted, `queried_at`. Exit **0** when a report was produced (evidence, not
-a gate). GitLab/Bitbucket: no adapter — `UNVERIFIABLE`, never stubbed.
+`provider-enforcement-evidence.v2` — VERIFIED now requires issuer binding and
+an active YAML-AST job; v1 treated name-only checks and text search as
+VERIFIED): each layer's status, `reason_code`, the API endpoint consulted,
+`queried_at`. Exit **0** when a report was produced (evidence, not a gate).
+GitLab/Bitbucket: no adapter — `UNVERIFIABLE`, never stubbed.
 
 ### Agent host files (`coderifts agent-setup`)
 

package/bin/coderifts.js

@@ -92,7 +92,7 @@ program
   .command('init [template]')
   .description('Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)')
   .option('--agents', 'Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)')
-  .option('--hosts <list>', 'With --agents: claude, cursor, or all (default: all)', 'all')
+  .option('--hosts <list>', 'With --agents: claude, cursor, copilot, or all (default: all)', 'all')
   .option('--no-hook', 'With --agents: skip host hook install')
   .option('--no-workflow', 'With --agents: skip writing .github/workflows/coderifts.yml')
   .option('--dry-run', 'With --agents: print the plan without writing')