coderifts 8.6.2 → 8.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderifts",
-  "version": "8.6.2",
+  "version": "8.6.4",
   "description": "Detect breaking API changes from the command line. Works locally or with the CodeRifts cloud API.",
   "author": "CodeRifts <hello@coderifts.com>",
   "license": "MIT",
@@ -28,13 +28,12 @@
     "swagger",
     "devtools"
   ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/coderifts/app.git",
-    "directory": "packages/cli"
-  },
+  "repository": "https://coderifts.com",
   "homepage": "https://coderifts.com",
-  "bugs": "https://github.com/coderifts/app/issues",
+  "bugs": {
+    "url": "https://coderifts.com",
+    "email": "support@coderifts.com"
+  },
   "engines": {
     "node": ">=20.0.0"
   },
@@ -52,7 +51,7 @@
     "cli-table3": "^0.6.4",
     "commander": "^12.0.0",
     "inquirer": "^8.2.6",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "openapi-diff": "^0.24.1",
     "ora": "^5.4.1"
   },

package/scripts/build.js

@@ -11,6 +11,7 @@ const path = require('path');
 const fs = require('fs');
 const crypto = require('crypto');
 const esbuild = require('esbuild');
+const { sourceFingerprint } = require('./lib/source-fingerprint');
 
 const stub = path.join(__dirname, '..', 'src', 'logger-stub.js');
 const appLogger = path.resolve(__dirname, '..', '..', '..', 'src', 'logger.js');
@@ -52,33 +53,16 @@ esbuild.build({
   // CONTENT-ADDRESSED, not timestamps: mtimes move on checkout, rebase and copy without the bytes
   // changing, and a freshness check that cries wolf gets deleted.
   const root = path.join(__dirname, '..');
-  const files = [];
-  const walk = (dir) => {
-    if (!fs.existsSync(dir)) return;
-    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
-      const full = path.join(dir, e.name);
-      if (e.isDirectory()) walk(full);
-      else if (e.name.endsWith('.js')) files.push(full);
-    }
-  };
-  walk(path.join(root, 'src'));
-  walk(path.join(root, 'bin'));
-  const h = crypto.createHash('sha256');
-  for (const f of files.sort()) {
-    h.update(path.relative(root, f));
-    h.update('\0');
-    h.update(fs.readFileSync(f));
-    h.update('\0');
-  }
-  const sha256 = h.digest('hex');
+  const { sha256, file_count } = sourceFingerprint(root);
   fs.writeFileSync(path.join(root, 'dist', '.build-source-sha'), `${JSON.stringify({
-    $comment: 'GENERATED by scripts/build.js. sha256 over src/**.js + bin/**.js (path + bytes). '
-      + 'test/build-freshness.test.js recomputes it; a mismatch means dist/cli.js is stale.',
+    $comment: 'GENERATED by scripts/build.js. sha256 over src/** + bin/** (path + bytes), for '
+      + 'every extension esbuild bundles — .js AND .json. scripts/lib/source-fingerprint.js is '
+      + 'the single implementation; test/build-freshness.test.js recomputes it from there rather '
+      + 'than from a copy. A mismatch means dist/cli.js is stale.',
     sha256,
-    file_count: files.length,
+    file_count,
   }, null, 2)}\n`);
-  process.stdout.write(`build: source fingerprint ${sha256.slice(0, 12)}… over ${files.length} files\n`);
+  process.stdout.write(`build: source fingerprint ${sha256.slice(0, 12)}… over ${file_count} files\n`);
 }).catch((err) => {
   console.error(err);
   process.exit(1);

package/scripts/check-packed-install.js

@@ -85,7 +85,68 @@ try {
     fail('packed init --agents --atomic-v2 --dry-run did not mention atomic-v2 / WIRING_REQUIRED');
   }
 
-  process.stdout.write('packed install smoke: OK (atomic-v2 dry-run)\n');
+  // Packed `lock --check` must actually RUN two fixtures, not merely list the command.
+  // 8.6.3 threw CORE_UNAVAILABLE because mcp-lock-drift was a dynamic require outside the bundle.
+  const fixtures = path.join(tmp, 'lock-fixtures');
+  fs.mkdirSync(fixtures);
+  const lockedManifest = {
+    tools: [
+      { name: 'get_user', description: 'Get user', inputSchema: { type: 'object', properties: {} } },
+      { name: 'pay', description: 'Pay', inputSchema: { type: 'object', properties: {} } },
+    ],
+  };
+  const liveSame = JSON.parse(JSON.stringify(lockedManifest));
+  const liveDrift = {
+    tools: [
+      { name: 'get_user', description: 'Get user', inputSchema: { type: 'object', properties: {} } },
+    ],
+  };
+  const lockedPath = path.join(fixtures, 'locked.json');
+  const samePath = path.join(fixtures, 'live-same.json');
+  const driftPath = path.join(fixtures, 'live-drift.json');
+  fs.writeFileSync(lockedPath, `${JSON.stringify(lockedManifest)}\n`);
+  fs.writeFileSync(samePath, `${JSON.stringify(liveSame)}\n`);
+  fs.writeFileSync(driftPath, `${JSON.stringify(liveDrift)}\n`);
+
+  const lockOk = run(bin, [
+    'lock', '--check', '--json',
+    '--locked-manifest', lockedPath,
+    '--live-manifest', samePath,
+  ], { cwd: installDir, env: { ...process.env, NO_COLOR: '1' } });
+  if (lockOk.status !== 0) {
+    fail(`packed lock --check (identical fixtures) exited ${lockOk.status}:\n${lockOk.stderr}\n${lockOk.stdout}`);
+  }
+  if (/Cannot load mcp-lock-drift core/i.test(`${lockOk.stdout}\n${lockOk.stderr}`)) {
+    fail('packed lock --check still cannot load mcp-lock-drift core');
+  }
+  let okReport;
+  try { okReport = JSON.parse(lockOk.stdout); } catch (e) {
+    fail(`packed lock --check identical fixtures did not print JSON: ${e.message}\n${lockOk.stdout}`);
+  }
+  if (okReport.drift !== false) {
+    fail(`packed lock --check identical fixtures expected drift=false, got ${JSON.stringify(okReport)}`);
+  }
+
+  const lockDrift = run(bin, [
+    'lock', '--check', '--json',
+    '--locked-manifest', lockedPath,
+    '--live-manifest', driftPath,
+  ], { cwd: installDir, env: { ...process.env, NO_COLOR: '1' } });
+  if (lockDrift.status !== 3) {
+    fail(`packed lock --check (drift fixture) exited ${lockDrift.status}, expected 3:\n${lockDrift.stderr}\n${lockDrift.stdout}`);
+  }
+  if (/Cannot load mcp-lock-drift core/i.test(`${lockDrift.stdout}\n${lockDrift.stderr}`)) {
+    fail('packed lock --check drift fixture still cannot load mcp-lock-drift core');
+  }
+  let driftReport;
+  try { driftReport = JSON.parse(lockDrift.stdout); } catch (e) {
+    fail(`packed lock --check drift fixture did not print JSON: ${e.message}\n${lockDrift.stdout}`);
+  }
+  if (driftReport.drift !== true) {
+    fail(`packed lock --check drift fixture expected drift=true, got ${JSON.stringify(driftReport)}`);
+  }
+
+  process.stdout.write('packed install smoke: OK (atomic-v2 dry-run + lock --check two fixtures)\n');
 } finally {
   fs.rmSync(tmp, { recursive: true, force: true });
 }

package/scripts/lib/source-fingerprint.js

@@ -0,0 +1,56 @@
+'use strict';
+
+/*
+ * The source fingerprint dist/cli.js is stamped with, and the one test/build-freshness.test.js
+ * recomputes. ONE implementation, required by both.
+ *
+ * WHY IT LIVES HERE. The walk used to exist twice — once in scripts/build.js and once inside the
+ * test, whose comment said the copy was "kept in step by the assertions below". No assertion
+ * compared them, so "kept in step" was a hope. MEASURED 2026-09-12: it had already failed in one
+ * direction and was about to fail in the other. A freshness gate whose recomputation is a COPY of
+ * the thing it checks can drift from it silently, which is the one failure a freshness gate must
+ * not have.
+ *
+ * .json COUNTS. esbuild inlines src/generated/gate-pin.json into dist/cli.js, so it is shipped
+ * runtime rather than configuration beside it. With a .js-only walk the pin moved from v0.9.3 to
+ * v0.9.4 while the marker stayed green and dist kept naming v0.9.3 — the marker's own comment
+ * promises that a mismatch means dist is stale, and for a bundled JSON it did not deliver.
+ */
+
+const path = require('path');
+const fs = require('fs');
+const crypto = require('crypto');
+
+/** Extensions that end up INSIDE the bundle. Anything here changes the shipped runtime. */
+const BUNDLED_EXT = Object.freeze(['.js', '.json']);
+
+/**
+ * sha256 over src/** + bin/** (path + bytes), content-addressed — never mtime: mtimes move on
+ * checkout, rebase and copy with no byte change, and a freshness check that cries wolf gets
+ * deleted.
+ * @param {string} root package root
+ */
+function sourceFingerprint(root) {
+  const files = [];
+  const walk = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+      const full = path.join(dir, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (BUNDLED_EXT.some((x) => e.name.endsWith(x))) files.push(full);
+    }
+  };
+  walk(path.join(root, 'src'));
+  walk(path.join(root, 'bin'));
+  const h = crypto.createHash('sha256');
+  for (const f of files.sort()) {
+    h.update(path.relative(root, f));
+    h.update('\0');
+    h.update(fs.readFileSync(f));
+    h.update('\0');
+  }
+  return { sha256: h.digest('hex'), file_count: files.length };
+}
+
+module.exports = { sourceFingerprint, BUNDLED_EXT };