coderifts 8.0.1 → 8.2.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 8.2.0 - 2026-09-05
+
+### Changed
+- `@coderifts/agent-guard` range raised to `^17.0.0` (MIN_GUARD_MAJOR 17). Guard 17 blocks a raw shell carrying a mutation by default (a host-declared mutating_shell now reaches the UNGUARDED_MUTATION decision instead of slipping through). The CLI range must match so `npm i -g coderifts` installs the guard whose default the docs describe. No CLI behaviour change beyond the installed guard major.
+
+
+## 8.1.0 - 2026-09-05
+
+### Changed
+- `@coderifts/agent-guard` range raised to `^16.0.0` (MIN_GUARD_MAJOR 16). Guard 16 makes `UNGUARDED_MUTATION` fail-closed the default; the CLI range must match so `npm i -g coderifts` installs the guard whose default the docs describe, not the 15.x advisory-default it shipped alongside before. No CLI behaviour change beyond the installed guard major.
+
+
 ## 8.0.1 - 2026-09-02
 
 ### Changed

package/README.md

@@ -412,21 +412,31 @@ Do not copy one file onto another host.
 
 ### `coderifts status [repo]`
 
-**Read-only** cross-layer enforcement report (Runtime / Merge / Deploy, plus
-Content). Calls `GET /api/v1/enforcement-status` and prints the statuses the
-endpoint measured — no GitHub writes, no branch-protection changes. Pair with
-`coderifts enforce` (that command **acts**; this one only **shows**).
-
-Requires a cloud API key. Distinct from `coderifts hook status` (local
-pre-push hook install state). Exit **0** on a successful read, **1** on
-missing/invalid repo, missing key, or API error.
+Prints three lines derived from **this process's actual config**, not a static
+string: Runtime / Merge / Deploy = `PREVENTS` or `REPORTS`.
+
+| Line | PREVENTS when | REPORTS when |
+|------|----------------|--------------|
+| Runtime | host wrap fail-closed (`CODERIFTS_ADVISORY` unset) | `CODERIFTS_ADVISORY=1\|true` |
+| Merge | `MERGEGATE_ENFORCE=true` (exact string; `1` is not enough) | otherwise (the App default) |
+| Deploy | deploy-gate fail-closed | `CODERIFTS_DEPLOY_ADVISORY=1\|true` or `CODERIFTS_ADVISORY=1\|true` |
+
+`REPORTS` is `REPORTS` — this does not claim a wrap or required check is
+installed on a repository. With `[repo]` / `--repo owner/repo`, also calls
+`GET /api/v1/enforcement-status` and prints the statuses the endpoint measured
+(API key required for that half). No GitHub writes. Pair with `coderifts
+enforce` (that command **acts**; this one only **shows**). Distinct from
+`coderifts hook status`. Exit **0** on the local three-liner or a successful
+cloud read, **1** on invalid repo, missing key (when a repo is given), or API
+error.
 
 | Flag | Description | Default |
 |------|-------------|---------|
-| `[repo]` / `--repo <owner/repo>` | Repository | none (required) |
-| `--json` | Machine-readable JSON (raw API body) | `false` |
+| `[repo]` / `--repo <owner/repo>` | Repository (cloud report) | none (local posture only) |
+| `--json` | Machine-readable JSON (local posture, or raw API body when a repo is given) | `false` |
 
 ```bash
+coderifts status
 coderifts status owner/repo
 coderifts status --repo owner/repo --json
 ```

package/bin/coderifts.js

@@ -15,9 +15,11 @@ program
   .command('diff <old-spec> <new-spec>')
   .description('Compare two OpenAPI specs and report breaking changes')
   .option('-f, --format <format>', 'Output format: terminal (default), json, markdown', 'terminal')
-  .option('--ci', 'CI mode — exit with code 1 if breaking changes exceed threshold')
+  .option('--ci', 'CI mode — exit 1 when risk exceeds --threshold (add --fail-on-breaking to also fail on any break)')
   .option('--threshold <number>', 'Risk score threshold for CI mode (0-100)', '50')
+  .option('--fail-on-breaking', 'CI mode: exit 1 on ANY breaking change, even under --threshold. Opt-in: the local analyser has a known false positive on additive request-body changes.')
   .option('--cloud', 'Use the CodeRifts cloud API instead of local analysis')
+  .option('--gate', 'Quote the server authorize verdict + receipt (the gate). Not a local recompute. Requires an API key.')
   .option('-c, --config <path>', 'Path to .coderifts.yml config file')
   .option('--no-normalize', 'Skip spec normalization (raw diff mode)')
   .action(async (oldSpec, newSpec, options) => {
@@ -36,7 +38,8 @@ program
   .option('--artifact <artifact_id>', 'Immutable artifact identity being deployed (content digest or commit SHA)')
   .option('--receipt <file>', 'Path to the signed chain_receipt token + decision envelope JSON')
   .option('--fingerprint <fp>', 'Optional intended fingerprint the receipt must match')
-  .option('--keys <file-or-url>', 'Ed25519 key registry (file or URL). Default: https://app.coderifts.com/.well-known/coderifts-keys.json')
+  .option('--keys <file-or-url>', 'Ed25519 key registry (file or URL). Default: the vendored offline snapshot (keys/coderifts-keys.json)')
+  .option('--refresh-keys', 'Opt in to LIVE key discovery for this run (fetches the well-known registry). Default verification is offline.')
   .option('--pinned-key <file>', 'Air-gapped PEM public key (skips registry fetch)')
   .option('--json', 'Output the binding result as JSON')
   .option('--enforce', 'Accepted silently (exit is fail-closed by default). Still attests ENFORCING for inescapable_deploy.')
@@ -222,7 +225,7 @@ program
 // GET /api/v1/enforcement-status — no GitHub writes. Distinct from `coderifts hook status`.
 program
   .command('status [repo]')
-  .description('Show cross-layer enforcement status (Runtime / Merge / Deploy) for a repo — read-only')
+  .description('Show Runtime / Merge / Deploy = PREVENTS or REPORTS from local config; with a repo, also the cloud enforcement-status report — read-only')
   .option('--repo <owner/repo>', 'Repository (owner/repo); also accepted as a positional argument')
   .option('--json', 'Machine-readable JSON (raw API body)')
   .action(async (repoPositional, options) => {

package/dist/.build-source-sha

@@ -0,0 +1,5 @@
+{
+  "$comment": "GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.",
+  "sha256": "d9d48f2b01fa76855978dbbaa67d81be419b7632e1cc80eb5b999d5efcf9c090",
+  "file_count": 42
+}