coderifts 4.9.0 → 4.10.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 4.10.0
+
+### Added
+- **`coderifts init --agents --strict`** writes the STRICT contract-gate
+  workflow: `require-verified-monitoring: 'true'` (plus attestation /
+  keyring inputs). The default template is unchanged (monitoring stays
+  commented / false).
+
 ## 4.9.0
 
 ### Fixed

package/README.md

@@ -75,6 +75,7 @@ coderifts init --agents --hosts=cursor   # Cursor only
 coderifts init --agents --hosts=copilot  # GitHub Copilot / VS Code only
 coderifts init --agents --no-hook        # skip host hook install
 coderifts init --agents --no-workflow    # skip .github/workflows/coderifts.yml
+coderifts init --agents --strict         # STRICT: require-verified-monitoring: true
 coderifts init --agents --check          # which of the four pieces are present
 ```
 
@@ -83,7 +84,7 @@ coderifts init --agents --check          # which of the four pieces are present
 | **MCP config** | `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor), `.vscode/mcp.json` (Copilot / VS Code) | Three shapes, never normalised into one: Claude `mcpServers` + `type: "http"` + `url`; Cursor `mcpServers` + `url` only (no `type`); Copilot **`servers`** (not `mcpServers`) + `type: "http"` + `url`. Never `httpUrl` (that is Gemini, extension-level — this command does not write it). |
 | **Agent rules** | generated host files via `agent-setup`'s writer | `AGENTS.md` is always written. Claude also gets `CLAUDE.md`; Cursor also gets `.cursor/rules/coderifts.mdc`; Copilot also gets `.github/copilot-instructions.md`. `--hosts=all` adds LangGraph and OpenAI instructions. (`coderifts init agent` is a different command — it writes a `.coderifts.yml` template.) |
 | **Host hook** | `.claude/settings.json`, `.cursor/hooks.json` | Reuses `hook install --claude` / `--cursor` (JSON-merge, backup, idempotent). Copilot shares Claude's `.claude/settings.json` — VS Code reads it by default. |
-| **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. `require-verified-monitoring` is commented (honest default: **false**) |
+| **CI workflow** | `.github/workflows/coderifts.yml` | `coderifts/contract-gate@v0`. Default: `require-verified-monitoring` commented (honest default: **false**). `--strict`: the same file with `require-verified-monitoring: 'true'` |
 
 **Next manual step:** add `CODERIFTS_API_KEY` to the repository secrets. The
 CLI never writes a key anywhere.

package/bin/coderifts.js

@@ -95,6 +95,7 @@ program
   .option('--hosts <list>', 'With --agents: claude, cursor, copilot, or all (default: all)', 'all')
   .option('--no-hook', 'With --agents: skip host hook install')
   .option('--no-workflow', 'With --agents: skip writing .github/workflows/coderifts.yml')
+  .option('--strict', 'With --agents: STRICT workflow (require-verified-monitoring: true)')
   .option('--dry-run', 'With --agents: print the plan without writing')
   .option('--check', 'With --agents: report which of the four pieces are present (no write)')
   .option('--out <dir>', 'With --agents: target directory (default: cwd)')
@@ -118,6 +119,7 @@ program
         dryRun: !!options.dryRun,
         check: !!options.check,
         out: options.out,
+        strict: !!options.strict,
       });
       if (result && typeof result.exitCode === 'number') {
         process.exitCode = result.exitCode;

package/dist/cli.js

@@ -3028,7 +3028,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "coderifts",
-      version: "4.9.0",
+      version: "4.10.0",
       description: "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
       author: "CodeRifts <hello@coderifts.com>",
       license: "MIT",
@@ -210222,6 +210222,46 @@ jobs:
           # monitoring-attestation: \${{ vars.CODERIFTS_MONITORING_ATTESTATION }}
           # monitoring-keyring: \${{ github.workspace }}/.coderifts/monitoring-keys.json
 `;
+    var STRICT_WORKFLOW_BODY = `# Written by \`coderifts init --agents --strict\`. Re-run is a no-op when this file already exists.
+#
+# STRICT template: require-verified-monitoring is ON.
+# This workflow POSTS the Check Run named exactly:
+#   CodeRifts / contract-gate
+# It does NOT enable branch protection and it does NOT make that check required.
+# Turn the check on in repo settings to enforce (${ENFORCEMENT_DOC}).
+#
+# Copied from the gate repo example (examples/contract-gate.yml) \u2014 action at @v0.
+name: CodeRifts Contract Gate
+
+# Run on EVERY pull request. Do NOT add paths: filters \u2014 a required check that
+# never runs leaves the PR mergeable (see ENFORCEMENT.md, "fail-closed on absence").
+on:
+  pull_request:
+
+permissions:
+  checks: write
+  contents: read
+
+jobs:
+  contract-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # REQUIRED: the gate derives the change set from git diff base...head.
+          fetch-depth: 0
+
+      - uses: ${GATE_ACTION}
+        with:
+          api-key: \${{ secrets.CODERIFTS_API_KEY }}
+          # api-url: https://app.coderifts.com   # override only for self-hosted
+          require-verified-monitoring: 'true'
+          monitoring-attestation: \${{ vars.CODERIFTS_MONITORING_ATTESTATION }}
+          monitoring-keyring: \${{ github.workspace }}/.coderifts/monitoring-keys.json
+`;
+    function workflowBody(strict) {
+      return strict ? STRICT_WORKFLOW_BODY : WORKFLOW_BODY;
+    }
     function writeContractGateWorkflow(opts = {}) {
       const outDir = opts.outDir;
       const dest = path.join(outDir, WORKFLOW_REL);
@@ -210232,6 +210272,7 @@ jobs:
         fs.writeFileSync(p, c, "utf8");
       });
       const dryRun = !!opts.dryRun;
+      const body = workflowBody(!!opts.strict);
       if (exists(dest)) {
         let onDisk = "";
         try {
@@ -210239,13 +210280,13 @@ jobs:
         } catch {
           onDisk = "";
         }
-        const reason = onDisk === WORKFLOW_BODY ? "already present, identical" : "exists; installer does not clobber workflows";
+        const reason = onDisk === body ? "already present, identical" : "exists; installer does not clobber workflows";
         return { action: "skip", relPath: WORKFLOW_REL, reason, exitCode: 0 };
       }
       if (dryRun) {
         return { action: "create", relPath: WORKFLOW_REL, reason: "created", exitCode: 0, dryRun: true };
       }
-      writeFile(dest, WORKFLOW_BODY);
+      writeFile(dest, body);
       return { action: "create", relPath: WORKFLOW_REL, reason: "created", exitCode: 0 };
     }
     function workflowPresent(outDir, deps = {}) {
@@ -210262,6 +210303,7 @@ jobs:
     module2.exports = {
       WORKFLOW_REL,
       WORKFLOW_BODY,
+      STRICT_WORKFLOW_BODY,
       GATE_ACTION,
       ENFORCEMENT_DOC,
       writeContractGateWorkflow,
@@ -210293,7 +210335,7 @@ var require_init_agents = __commonJS({
       workflowPresent
     } = require_contract_gate_workflow();
     if (process.env.NO_COLOR) chalk.level = 0;
-    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--dry-run] [--check] [--out <dir>]
+    var USAGE = `Usage: coderifts init --agents [--hosts=claude,cursor,copilot,all] [--no-hook] [--no-workflow] [--strict] [--dry-run] [--check] [--out <dir>]
 
   Wire this repository for governed agent work in ONE command:
     1. repo-level MCP config (per host: .mcp.json / .cursor/mcp.json / .vscode/mcp.json)
@@ -210304,6 +210346,7 @@ var require_init_agents = __commonJS({
   --hosts <list>   claude, cursor, copilot, or all (default: all)
   --no-hook        Skip host hook install
   --no-workflow    Skip writing the CI workflow
+  --strict         STRICT workflow: require-verified-monitoring: true (default template stays false)
   --dry-run        Print the plan without writing
   --check          Report which of the four pieces are present (no write)
   --out <dir>      Target directory (default: cwd)
@@ -210363,9 +210406,9 @@ ${USAGE}`
       return { hosts, allRules: false };
     }
     function agentFlagsRequireAgents(options = {}) {
-      return !!(options.check || options.dryRun || options.out || options.hosts != null && String(options.hosts) !== "all" || options.hook === false || options.workflow === false || options.noHook === true || options.noWorkflow === true);
+      return !!(options.check || options.dryRun || options.out || options.hosts != null && String(options.hosts) !== "all" || options.hook === false || options.workflow === false || options.noHook === true || options.noWorkflow === true || options.strict === true);
     }
-    var AGENT_FLAGS_REQUIRE_AGENTS = "Error: --check/--dry-run/--out/--hosts/--no-hook/--no-workflow require --agents";
+    var AGENT_FLAGS_REQUIRE_AGENTS = "Error: --check/--dry-run/--out/--hosts/--no-hook/--no-workflow/--strict require --agents";
     var AGENTS_NO_TEMPLATE = "Error: init --agents does not take a template. Did you mean `coderifts init --agents` (not `coderifts init agent`)?";
     function rulePathsForHosts(hosts, allRules) {
       const out = [SHARED_RULE];
@@ -210628,12 +210671,12 @@ ${USAGE}`
       if (!wantWorkflow(options)) {
         items.push({ section: "workflow", action: "skip", relPath: WORKFLOW_REL, note: "--no-workflow" });
       } else {
-        const r = writeContractGateWorkflow({ outDir, dryRun, ...fsDeps });
+        const r = writeContractGateWorkflow({ outDir, dryRun, strict: !!options.strict, ...fsDeps });
         items.push({
           section: "workflow",
           action: r.action,
           relPath: r.relPath,
-          note: r.action === "create" ? `${GATE_ACTION}` : r.reason
+          note: r.action === "create" ? options.strict ? `${GATE_ACTION} (STRICT require-verified-monitoring)` : GATE_ACTION : r.reason
         });
       }
       const created = items.filter((i) => i.action === "create").length;
@@ -241087,7 +241130,7 @@ program.command("registry-gate [dir]").description("Admit a directory of OpenAPI
   process.exitCode = code;
   process.exit(code);
 });
-program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
+program.command("init [template]").description("Generate a .coderifts.yml from a policy template, or wire governed agent work (--agents)").option("--agents", "Wire this repo for governed agent work (MCP config, rule files, host hook, CI gate)").option("--hosts <list>", "With --agents: claude, cursor, copilot, or all (default: all)", "all").option("--no-hook", "With --agents: skip host hook install").option("--no-workflow", "With --agents: skip writing .github/workflows/coderifts.yml").option("--strict", "With --agents: STRICT workflow (require-verified-monitoring: true)").option("--dry-run", "With --agents: print the plan without writing").option("--check", "With --agents: report which of the four pieces are present (no write)").option("--out <dir>", "With --agents: target directory (default: cwd)").action(async (template, options) => {
   const {
     runInitAgents,
     agentFlagsRequireAgents,
@@ -241106,7 +241149,8 @@ program.command("init [template]").description("Generate a .coderifts.yml from a
       workflow: options.workflow,
       dryRun: !!options.dryRun,
       check: !!options.check,
-      out: options.out
+      out: options.out,
+      strict: !!options.strict
     });
     if (result && typeof result.exitCode === "number") {
       process.exitCode = result.exitCode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "4.9.0",
+  "version": "4.10.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",