coderifts 8.0.0 → 8.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -36,17 +36,17 @@
   "homepage": "https://coderifts.com",
   "bugs": "https://github.com/coderifts/app/issues",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "scripts": {
     "build": "node scripts/copy-corpus.js && node scripts/build.js",
-    "prepublishOnly": "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build",
+    "prepublishOnly": "node scripts/assert-guard-major.js && node scripts/assert-changelog-version.js && bash ../../scripts/freeze-gate.sh && npm run build && bash ../../scripts/release-check.sh .",
     "assert-guard-major": "node scripts/assert-guard-major.js",
     "postinstall": "node scripts/postinstall.js",
     "test": "node --test test/*.test.js"
   },
   "dependencies": {
-    "@coderifts/agent-guard": "^15.0.0",
+    "@coderifts/agent-guard": "^16.0.0",
     "chalk": "^4.1.2",
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",
@@ -60,7 +60,7 @@
     "json-schema-ref-parser": "npm:@apidevtools/json-schema-ref-parser@^11.7.3",
     "form-data": "^4.0.6",
     "axios": ">=1.18.0",
-    "fast-uri": ">=3.1.5",
+    "fast-uri": ">=4.1.3",
     "brace-expansion": "5.0.9"
   },
   "devDependencies": {

package/scripts/assert-guard-major.js

@@ -73,13 +73,16 @@
  *   asVerifiedDeployReceiptView, DEPLOY_RECEIPT_VIEW_SPEC and matchGlob — no DeployGateReason
  *   exhaustive switch, no V2 config-conflict throw. The raise is installer-facing: the range
  *   is what `npm i -g coderifts` resolves.)
+ * 8.1.0: floor raised to 16 (published guard 16.0.0 is on npm; 16 makes UNGUARDED_MUTATION
+ *   fail-closed the default. The CLI range must match so `npm i -g coderifts` installs the guard
+ *   whose default the docs describe, not the 15.x advisory-default it shipped alongside before.)
  */
 
 const fs = require('fs');
 const path = require('path');
 
 /** Minimum acceptable major for @coderifts/agent-guard in THIS package (the CLI). */
-const MIN_GUARD_MAJOR = 15;
+const MIN_GUARD_MAJOR = 16;
 const DEP = '@coderifts/agent-guard';
 
 /**
@@ -109,7 +112,7 @@ const CHECKOUTS = [
     id: 'app-root',
     label: 'coderifts-app (root)',
     pkgPath: path.join(__dirname, '..', '..', '..', 'package.json'),
-    floor: 3,
+    floor: 14,
     /**
      * DELIBERATE, MEASURED, AND LOWER THAN THE CLI'S — recorded so it is a decision, not a default.
      *
@@ -159,8 +162,10 @@ const CHECKOUTS = [
      * So the floor is pinned at 3 to stop it drifting LOWER unnoticed. Raise this number in that
      * round and record the reason on the line below, in the style of the CLI history above.
      */
-    why: 'root pinned at 3 pending the gateDecision residual-PRECEDENCE reconciliation (see comment; '
-      + 're-measured against 11.0.0 — unchanged from 10.0.0).',
+    why: 'floor 14 = last measured merge-gate vintage (webhook-integration.js:344-345: '
+      + 'gateDecision call/return unchanged on 14; protection_inescapable is derived in-app '
+      + 'so a stale package cannot fail-open). Declared range is ^15 (installer). Floor is '
+      + 'not forced to 15: root code does not consume 15-only APIs on this path.',
   },
 ];
 

package/scripts/build.js

@@ -8,6 +8,8 @@
  */
 
 const path = require('path');
+const fs = require('fs');
+const crypto = require('crypto');
 const esbuild = require('esbuild');
 
 const stub = path.join(__dirname, '..', 'src', 'logger-stub.js');
@@ -35,6 +37,48 @@ esbuild.build({
       });
     },
   }],
+}).then(() => {
+  // ── 1353: build freshness ────────────────────────────────────────────────────────────────
+  //
+  // MEASURED 2026-09-04: dist/cli.js still printed the pre-1305 verdict a day after the source
+  // fix. `prepublishOnly` DOES run the build — the premise that it did not is wrong — so the
+  // PUBLISHED artifact was never at risk. The gap is LOCAL: dist/ is gitignored and the globally
+  // linked `coderifts` points straight at it, so a developer edits src, sees a green suite over
+  // src, and runs a stale binary. So does the reviewer.
+  //
+  // The build records a fingerprint of the sources it consumed; test/build-freshness.test.js
+  // recomputes it and fails when dist is behind — catching what a suite over src alone cannot.
+  //
+  // CONTENT-ADDRESSED, not timestamps: mtimes move on checkout, rebase and copy without the bytes
+  // changing, and a freshness check that cries wolf gets deleted.
+  const root = path.join(__dirname, '..');
+  const files = [];
+  const walk = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (e.name.endsWith('.js')) files.push(full);
+    }
+  };
+  walk(path.join(root, 'src'));
+  walk(path.join(root, 'bin'));
+  const h = crypto.createHash('sha256');
+  for (const f of files.sort()) {
+    h.update(path.relative(root, f));
+    h.update('\0');
+    h.update(fs.readFileSync(f));
+    h.update('\0');
+  }
+  const sha256 = h.digest('hex');
+  fs.writeFileSync(path.join(root, 'dist', '.build-source-sha'), `${JSON.stringify({
+    $comment: 'GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). '
+      + 'test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.',
+    sha256,
+    file_count: files.length,
+  }, null, 2)}\n`);
+  process.stdout.write(`build: source fingerprint ${sha256.slice(0, 12)}… over ${files.length} files\n`);
 }).catch((err) => {
   console.error(err);
   process.exit(1);