@hegemonart/get-design-done 1.55.0 → 1.56.0

package/scripts/lib/risk/calibration.cjs

@@ -0,0 +1,385 @@
+'use strict';
+/**
+ * scripts/lib/risk/calibration.cjs — Phase 56 (CAL-01) per-agent risk
+ * calibration + the bandit reward bridge.
+ *
+ * The risk scorer (scripts/lib/risk/compute-risk.cjs) is a STATIC table-driven
+ * model — it cannot learn that a particular writer agent chronically under- or
+ * over-scores its own actions. This module is the feedback layer: it records
+ * per-agent outcomes in a rolling-50 window, derives three calibration
+ * statistics, flags drift, and feeds a reward signal into the Phase 23.5
+ * Thompson-sampling bandit (scripts/lib/bandit-router.cjs) so the adaptive
+ * router can react to a mis-calibrated agent over time.
+ *
+ * Persistence:
+ *   .design/telemetry/calibration.json
+ *     {
+ *       schema_version: '56.0',
+ *       generated_at:   ISO,
+ *       agents: {
+ *         "<agent>": {
+ *           window: [ { risk, accepted, user_undo, post_apply_correct }, … ≤50 ],
+ *           mean_risk_emitted:      number,  // mean(window.risk)
+ *           override_rate:          number,  // P(rejected OR undone)
+ *           post_apply_correctness: number   // P(correct | applied)
+ *         }, …
+ *       }
+ *     }
+ *   Atomic .tmp + rename (mirrors instinct-store.save / ds-arms.save). The
+ *   `.design/` tree is gitignored + worktree-local (R5).
+ *
+ * Purity contract:
+ *   - detectDrift + riskReward are PURE (no I/O, no Date.now / Math.random;
+ *     the DRIFT thresholds are frozen). Deterministic for the suite.
+ *   - updateCalibration reads/writes the FS, but only via the injected
+ *     `{root}` (or `file`) so tests run hermetically under a tmpdir. The only
+ *     non-determinism is `generated_at` (an ISO stamp), which callers can pin
+ *     via opts.now.
+ *   - recordRiskOutcome calls bandit-router.update BEST-EFFORT — it never
+ *     throws (a telemetry write must never break a hook / agent turn).
+ *
+ * Zero new dependency. CommonJS to match the scripts/lib/ siblings.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SCHEMA_VERSION = '56.0';
+const DEFAULT_CALIBRATION_PATH = '.design/telemetry/calibration.json';
+
+/** Rolling window length (CAL-01): keep the last 50 outcomes per agent. */
+const WINDOW_SIZE = 50;
+
+/**
+ * Drift thresholds (frozen). detectDrift compares the rolling stats against
+ * these bands:
+ *   under_scoring — the agent emits LOW risk yet the user overrides OFTEN:
+ *                   the scores are too tame (false sense of safety).
+ *   over_scoring  — the agent emits HIGH risk yet applied actions are almost
+ *                   always correct AND the user rarely overrides: the scores
+ *                   are too alarmist (friction without payoff).
+ */
+const DRIFT = Object.freeze({
+  under_scoring: Object.freeze({ mean_risk_max: 0.35, override_rate_min: 0.30 }),
+  over_scoring: Object.freeze({
+    mean_risk_min: 0.65,
+    correctness_min: 0.90,
+    override_rate_max: 0.10,
+  }),
+});
+
+/**
+ * Clamp to [0, 1]. Non-finite -> 0 (matches compute-risk.clamp01 semantics).
+ * @param {number} n
+ * @returns {number}
+ */
+function clamp01(n) {
+  if (typeof n !== 'number' || Number.isNaN(n)) return 0;
+  if (n < 0) return 0;
+  if (n > 1) return 1;
+  return n;
+}
+
+/**
+ * Resolve the on-disk calibration file, honouring an absolute override.
+ * Accepts `{ file }` (explicit path) or `{ root }` / `{ baseDir }` (a project
+ * root under which DEFAULT_CALIBRATION_PATH is resolved).
+ * @param {{file?:string, root?:string, baseDir?:string}} [opts]
+ * @returns {{file:string, dir:string}}
+ */
+function paths(opts = {}) {
+  let file;
+  if (opts.file) {
+    file = path.isAbsolute(opts.file)
+      ? opts.file
+      : path.resolve(opts.root ?? opts.baseDir ?? process.cwd(), opts.file);
+  } else {
+    file = path.resolve(opts.root ?? opts.baseDir ?? process.cwd(), DEFAULT_CALIBRATION_PATH);
+  }
+  return { file, dir: path.dirname(file) };
+}
+
+/**
+ * Load the calibration store, or a fresh envelope when absent/corrupt.
+ * @param {{file?:string, root?:string, baseDir?:string}} [opts]
+ * @returns {{schema_version:string, generated_at?:string, agents:object}}
+ */
+function load(opts = {}) {
+  const { file } = paths(opts);
+  if (!fs.existsSync(file)) {
+    return { schema_version: SCHEMA_VERSION, agents: {} };
+  }
+  try {
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!data || typeof data !== 'object' || typeof data.agents !== 'object' || data.agents === null) {
+      return { schema_version: SCHEMA_VERSION, agents: {} };
+    }
+    return data;
+  } catch {
+    return { schema_version: SCHEMA_VERSION, agents: {} };
+  }
+}
+
+/**
+ * Persist the calibration store atomically (.tmp + rename).
+ * @param {object} store
+ * @param {{file?:string, root?:string, baseDir?:string, now?:string|Date}} [opts]
+ * @returns {string} absolute path written
+ */
+function save(store, opts = {}) {
+  const { file, dir } = paths(opts);
+  fs.mkdirSync(dir, { recursive: true });
+  store.schema_version = SCHEMA_VERSION;
+  store.generated_at =
+    opts.now instanceof Date
+      ? opts.now.toISOString()
+      : typeof opts.now === 'string'
+        ? opts.now
+        : new Date().toISOString();
+  const tmp = file + '.tmp';
+  fs.writeFileSync(tmp, JSON.stringify(store, null, 2) + '\n');
+  fs.renameSync(tmp, file);
+  return file;
+}
+
+/**
+ * Coerce a raw outcome into the canonical window record. Unknown / missing
+ * fields degrade safely:
+ *   risk               -> clamp01(number), default 0
+ *   accepted           -> boolean (default true — an action that produced an
+ *                         outcome without an explicit reject is treated as
+ *                         applied)
+ *   user_undo          -> boolean (default false)
+ *   post_apply_correct -> boolean | null (null = "not yet known"; only counts
+ *                         toward post_apply_correctness once resolved)
+ * @param {object} record
+ * @returns {{risk:number, accepted:boolean, user_undo:boolean, post_apply_correct:(boolean|null)}}
+ */
+function normalizeRecord(record) {
+  const r = record && typeof record === 'object' ? record : {};
+  return {
+    risk: clamp01(typeof r.risk === 'number' ? r.risk : 0),
+    accepted: r.accepted === undefined ? true : Boolean(r.accepted),
+    user_undo: Boolean(r.user_undo),
+    post_apply_correct:
+      r.post_apply_correct === undefined || r.post_apply_correct === null
+        ? null
+        : Boolean(r.post_apply_correct),
+  };
+}
+
+/**
+ * Recompute the three rolling statistics over a window of normalized records.
+ *
+ *   mean_risk_emitted      = mean(risk)                           (0 when empty)
+ *   override_rate          = P(!accepted OR user_undo)            (0 when empty)
+ *   post_apply_correctness = P(post_apply_correct | applied)      (1 when no
+ *       resolved applied records — an agent with no known-bad applied actions
+ *       reads as fully correct; this is the conservative direction for the
+ *       over_scoring drift gate, which additionally requires high mean risk +
+ *       low override, so an empty window never spuriously trips it)
+ *
+ * @param {Array} window  normalized records
+ * @returns {{mean_risk_emitted:number, override_rate:number, post_apply_correctness:number}}
+ */
+function computeStats(window) {
+  const w = Array.isArray(window) ? window : [];
+  const n = w.length;
+  if (n === 0) {
+    return { mean_risk_emitted: 0, override_rate: 0, post_apply_correctness: 1 };
+  }
+  let riskSum = 0;
+  let overrides = 0;
+  let appliedResolved = 0;
+  let appliedCorrect = 0;
+  for (const rec of w) {
+    riskSum += rec.risk;
+    const overridden = !rec.accepted || rec.user_undo;
+    if (overridden) overrides += 1;
+    // "applied" = accepted AND not undone. Only resolved (non-null) correctness
+    // signals count toward the correctness rate.
+    const applied = rec.accepted && !rec.user_undo;
+    if (applied && rec.post_apply_correct !== null) {
+      appliedResolved += 1;
+      if (rec.post_apply_correct === true) appliedCorrect += 1;
+    }
+  }
+  return {
+    mean_risk_emitted: riskSum / n,
+    override_rate: overrides / n,
+    post_apply_correctness: appliedResolved === 0 ? 1 : appliedCorrect / appliedResolved,
+  };
+}
+
+/**
+ * Record one risk outcome for `agent`, append to its rolling-50 window, drop
+ * the oldest beyond 50, recompute the three statistics, and persist atomically.
+ *
+ * @param {string} agent   the writer agent the assessment scored (e.g. 'design-fixer')
+ * @param {{risk?:number, accepted?:boolean, user_undo?:boolean, post_apply_correct?:boolean}} record
+ * @param {{file?:string, root?:string, baseDir?:string, now?:string|Date}} [opts]
+ * @returns {{agent:string, stats:{mean_risk_emitted:number, override_rate:number, post_apply_correctness:number}, windowSize:number, path:string}}
+ */
+function updateCalibration(agent, record, opts = {}) {
+  if (typeof agent !== 'string' || agent.length === 0) {
+    throw new TypeError('updateCalibration: agent (non-empty string) required');
+  }
+  const store = load(opts);
+  if (!store.agents || typeof store.agents !== 'object') store.agents = {};
+
+  const prev = store.agents[agent];
+  const prevWindow =
+    prev && Array.isArray(prev.window) ? prev.window.map(normalizeRecord) : [];
+
+  prevWindow.push(normalizeRecord(record));
+  // Keep only the last WINDOW_SIZE entries (rolling window).
+  const window =
+    prevWindow.length > WINDOW_SIZE ? prevWindow.slice(prevWindow.length - WINDOW_SIZE) : prevWindow;
+
+  const stats = computeStats(window);
+  store.agents[agent] = {
+    window,
+    mean_risk_emitted: stats.mean_risk_emitted,
+    override_rate: stats.override_rate,
+    post_apply_correctness: stats.post_apply_correctness,
+  };
+
+  const written = save(store, opts);
+  return { agent, stats, windowSize: window.length, path: written };
+}
+
+/**
+ * Classify calibration drift from an agent's rolling stats. PURE.
+ *
+ *   under_scoring: mean_risk_emitted < 0.35  &&  override_rate > 0.30
+ *   over_scoring:  mean_risk_emitted > 0.65  &&  post_apply_correctness > 0.90
+ *                  &&  override_rate < 0.10
+ *   else:          'none'
+ *
+ * under_scoring is checked first; the two bands are mutually exclusive by
+ * construction (mean-risk bands do not overlap) but the explicit order makes
+ * the contract unambiguous.
+ *
+ * @param {{mean_risk_emitted?:number, override_rate?:number, post_apply_correctness?:number}} stats
+ * @param {object} [cfg]  defaults to the frozen DRIFT thresholds
+ * @returns {'under_scoring'|'over_scoring'|'none'}
+ */
+function detectDrift(stats, cfg = DRIFT) {
+  const s = stats && typeof stats === 'object' ? stats : {};
+  const mean = typeof s.mean_risk_emitted === 'number' ? s.mean_risk_emitted : 0;
+  const override = typeof s.override_rate === 'number' ? s.override_rate : 0;
+  const correct = typeof s.post_apply_correctness === 'number' ? s.post_apply_correctness : 0;
+
+  const under = cfg && cfg.under_scoring ? cfg.under_scoring : DRIFT.under_scoring;
+  const over = cfg && cfg.over_scoring ? cfg.over_scoring : DRIFT.over_scoring;
+
+  if (mean < under.mean_risk_max && override > under.override_rate_min) {
+    return 'under_scoring';
+  }
+  if (
+    mean > over.mean_risk_min &&
+    correct > over.correctness_min &&
+    override < over.override_rate_max
+  ) {
+    return 'over_scoring';
+  }
+  return 'none';
+}
+
+/**
+ * Map a single risk outcome to a bandit reward in [0, 1]. PURE.
+ *
+ * Contract (mirrors the Phase 23.5 lexicographic shape — correctness first):
+ *   - rejected (accepted === false) OR undone (user_undo === true) -> 0
+ *     (the user vetoed the action; no credit regardless of risk).
+ *   - otherwise -> clamp01(1 - 0.5 * risk)
+ *     (an accepted, not-undone action earns a reward that decays linearly with
+ *     the risk it carried: a confident low-risk accept ≈ 1.0; a high-risk
+ *     accept still earns partial credit ≈ 0.5 because the user did keep it).
+ *
+ * Examples (the calibration suite pins these):
+ *   {accepted:true,  risk:0.2}                 -> 0.9
+ *   {accepted:false, risk:0.2}                 -> 0
+ *   {accepted:true,  risk:0.9}                 -> 0.55
+ *   {accepted:true,  risk:0.0, user_undo:true} -> 0
+ *
+ * @param {{accepted?:boolean, risk?:number, user_undo?:boolean}} input
+ * @returns {number} reward in [0, 1]
+ */
+function riskReward(input) {
+  const i = input && typeof input === 'object' ? input : {};
+  // An explicit reject, or any user_undo, zeroes the reward.
+  if (i.accepted === false) return 0;
+  if (i.user_undo === true) return 0;
+  const risk = clamp01(typeof i.risk === 'number' ? i.risk : 0);
+  return clamp01(1 - 0.5 * risk);
+}
+
+/**
+ * Thin best-effort bridge: compute the risk reward for an outcome and feed it
+ * into the Thompson-sampling bandit (scripts/lib/bandit-router.cjs update()).
+ *
+ * NEVER throws — a telemetry/learning write must not break the hook or agent
+ * turn that triggered it. On any failure (bandit module absent, bad input,
+ * FS error) it returns `{ recorded:false, reason }` and swallows the error.
+ *
+ * The bandit's update() needs `(agent, bin, tier, reward)`. The caller supplies
+ * the routing context it used (bin = touches-size bin, tier = model tier). When
+ * a context field is missing we DO NOT guess — we skip the bandit write and
+ * report it, because writing to the wrong arm would corrupt the posterior.
+ *
+ * @param {{
+ *   agent: string,
+ *   bin?: string,
+ *   tier?: string,
+ *   accepted?: boolean,
+ *   risk?: number,
+ *   user_undo?: boolean,
+ *   bandit?: object,            // injectable for tests (defaults to require'd module)
+ *   root?: string, baseDir?: string, posteriorPath?: string,
+ * }} input
+ * @returns {{recorded:boolean, reward:number, reason?:string}}
+ */
+function recordRiskOutcome(input) {
+  const reward = riskReward(input || {});
+  try {
+    const i = input && typeof input === 'object' ? input : {};
+    if (typeof i.agent !== 'string' || i.agent.length === 0) {
+      return { recorded: false, reward, reason: 'agent required for bandit update' };
+    }
+    if (typeof i.bin !== 'string' || i.bin.length === 0 || typeof i.tier !== 'string' || i.tier.length === 0) {
+      // Without a routing context we cannot address an arm — skip cleanly.
+      return { recorded: false, reward, reason: 'bin+tier required for bandit update' };
+    }
+    // Lazy require so a missing/breaking bandit module degrades to best-effort.
+    const bandit = i.bandit || require('../bandit-router.cjs');
+    bandit.update({
+      agent: i.agent,
+      bin: i.bin,
+      tier: i.tier,
+      reward,
+      baseDir: i.baseDir ?? i.root,
+      posteriorPath: i.posteriorPath,
+    });
+    return { recorded: true, reward };
+  } catch (err) {
+    return { recorded: false, reward, reason: err && err.message ? err.message : String(err) };
+  }
+}
+
+module.exports = {
+  updateCalibration,
+  detectDrift,
+  riskReward,
+  recordRiskOutcome,
+  // Exposed for tests + sibling reuse.
+  computeStats,
+  normalizeRecord,
+  load,
+  save,
+  clamp01,
+  DRIFT,
+  WINDOW_SIZE,
+  SCHEMA_VERSION,
+  DEFAULT_CALIBRATION_PATH,
+};

package/scripts/lib/risk/compute-risk.cjs

@@ -0,0 +1,229 @@
+'use strict';
+/**
+ * scripts/lib/risk/compute-risk.cjs — PURE, deterministic action-risk scorer
+ * for the Phase 56 risk gate.
+ *
+ * NO I/O. NO Date.now / Math.random. Given the same (tool_name, input,
+ * thresholds) it always returns the same result. Frozen static tables live in
+ * ./tables.cjs; config overrides are merged by the HOOK (which reads
+ * .design/config.json and passes the merged thresholds/tables in) — this
+ * module stays side-effect-free so the routing matrix is unit-testable.
+ *
+ * Contract:
+ *   computeRisk(tool_name, input, thresholds = THRESHOLDS, tables = defaults)
+ *     -> { score:0..1, reasons:string[], suggested_action, breakdown }
+ *
+ *   score = clamp01( base * fileMult + fileAdd + sum(inputAdds) )
+ *   suggested_action in 'allow' | 'review' | 'require_confirmation' | 'block'
+ *
+ * loadRiskConfig(cwd) is provided (mirrors blast-radius.loadConfig) so the hook
+ * can read `.design/config.json#risk.{thresholds, base_tool_extra,
+ * file_sensitivity_extra, input_pattern_extra}` and EXTEND the defaults
+ * (extend-only — protected-paths discipline). computeRisk itself never calls it.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const TABLES = require('./tables.cjs');
+const { BASE_TOOL_RISK, FILE_SENSITIVITY, INPUT_PATTERN_RISK, THRESHOLDS } = TABLES;
+
+function clamp01(n) {
+  if (typeof n !== 'number' || Number.isNaN(n)) return 0;
+  if (n < 0) return 0;
+  if (n > 1) return 1;
+  return n;
+}
+
+function normPath(p) {
+  return String(p == null ? '' : p).replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+/**
+ * pathsFor(tool, input) — the file paths a tool action touches.
+ *   Edit/Write/NotebookEdit -> file_path / notebook_path
+ *   MultiEdit               -> the shared file_path (edits[] all target it)
+ *   Bash                    -> best-effort path-ish tokens extracted from the command
+ */
+function pathsFor(tool, input) {
+  const out = [];
+  if (!input || typeof input !== 'object') return out;
+  if (typeof input.file_path === 'string') out.push(normPath(input.file_path));
+  if (typeof input.notebook_path === 'string') out.push(normPath(input.notebook_path));
+  if (typeof input.path === 'string') out.push(normPath(input.path));
+  if (tool === 'Bash' && typeof input.command === 'string') {
+    for (const t of extractBashPaths(input.command)) out.push(normPath(t));
+  }
+  // de-dup, drop empties
+  return Array.from(new Set(out.filter(Boolean)));
+}
+
+// Small, linear extractor: pull whitespace-delimited tokens that look like
+// file paths (contain a slash or a dot-extension, no shell metachars). Linear
+// scan — no backtracking-prone regex.
+function extractBashPaths(command) {
+  const tokens = String(command).split(/\s+/);
+  const paths = [];
+  for (const raw of tokens) {
+    const t = raw.replace(/^['"]|['"]$/g, '');
+    if (!t || t.startsWith('-')) continue;
+    if (/[|;&$`(){}<>*?!]/.test(t)) continue; // skip shell-operator/glob tokens
+    if (t.includes('/') || /\.[A-Za-z0-9]{1,8}$/.test(t)) paths.push(t);
+  }
+  return paths;
+}
+
+/**
+ * pickMaxFileSensitivity(paths, table) — the single highest-WEIGHT matching
+ * entry across all touched paths. "Weight" = mult + add so a clearly higher-mult
+ * entry wins over a low de-risking one even when both match (e.g. a file under
+ * both `tests/` and `hooks/` resolves to the hook entry). Returns
+ * { mult:1, add:0, label:null } when nothing matches.
+ */
+function pickMaxFileSensitivity(paths, table) {
+  let best = null;
+  let bestWeight = -Infinity;
+  for (const entry of table) {
+    for (const p of paths) {
+      if (entry.test.test(p)) {
+        const w = (typeof entry.mult === 'number' ? entry.mult : 1) + (typeof entry.add === 'number' ? entry.add : 0);
+        if (w > bestWeight) {
+          bestWeight = w;
+          best = entry;
+        }
+        break; // this entry already matched; move to the next entry
+      }
+    }
+  }
+  if (!best) return { mult: 1, add: 0, label: null };
+  return { mult: typeof best.mult === 'number' ? best.mult : 1, add: typeof best.add === 'number' ? best.add : 0, label: best.label };
+}
+
+function actionFor(score, thresholds) {
+  const t = thresholds || THRESHOLDS;
+  if (score >= t.block) return 'block';
+  if (score >= t.require_confirmation) return 'require_confirmation';
+  if (score >= t.review) return 'review';
+  return 'allow';
+}
+
+/**
+ * computeRisk — the pure scorer.
+ * @param {string} tool_name
+ * @param {object} input            tool_input (Edit/Write/MultiEdit/Bash/...)
+ * @param {object} [thresholds]     defaults to TABLES.THRESHOLDS
+ * @param {object} [tables]         { BASE_TOOL_RISK, FILE_SENSITIVITY, INPUT_PATTERN_RISK } — defaults to the frozen tables
+ * @returns {{score:number, reasons:string[], suggested_action:string, breakdown:object}}
+ */
+function computeRisk(tool_name, input, thresholds = THRESHOLDS, tables) {
+  const baseTbl = (tables && tables.BASE_TOOL_RISK) || BASE_TOOL_RISK;
+  const fileTbl = (tables && tables.FILE_SENSITIVITY) || FILE_SENSITIVITY;
+  const inputTbl = (tables && tables.INPUT_PATTERN_RISK) || INPUT_PATTERN_RISK;
+
+  const reasons = [];
+
+  // 1. Base tool risk.
+  const base = typeof baseTbl[tool_name] === 'number' ? baseTbl[tool_name] : baseTbl.__default;
+  reasons.push(`base:${tool_name}=${round(base)}`);
+
+  // 2. File sensitivity (highest-weight match across touched paths).
+  const paths = pathsFor(tool_name, input);
+  const fs_ = pickMaxFileSensitivity(paths, fileTbl);
+  if (fs_.label) {
+    reasons.push(`file:${fs_.label}(x${fs_.mult}+${fs_.add})`);
+  }
+
+  // 3. Input-pattern addends (fixed table order).
+  const inputAdds = [];
+  let inputAddSum = 0;
+  for (const entry of inputTbl) {
+    let hit;
+    try {
+      hit = entry.when(tool_name, input);
+    } catch {
+      hit = false;
+    }
+    if (!hit) continue;
+    const add = typeof entry.add === 'function' ? entry.add(hit, tool_name, input) : entry.add;
+    const a = typeof add === 'number' && Number.isFinite(add) ? add : 0;
+    if (a === 0) continue;
+    inputAdds.push({ label: entry.label, add: a });
+    inputAddSum += a;
+    reasons.push(`input:${entry.label}=+${round(a)}`);
+  }
+
+  // 4. Combine + clamp.
+  const rawScore = base * fs_.mult + fs_.add + inputAddSum;
+  const score = clamp01(rawScore);
+
+  const suggested_action = actionFor(score, thresholds);
+
+  return {
+    score,
+    reasons,
+    suggested_action,
+    breakdown: {
+      base,
+      tool: tool_name,
+      paths,
+      file: { mult: fs_.mult, add: fs_.add, label: fs_.label },
+      inputAdds,
+      inputAddSum: round3(inputAddSum),
+      raw: round3(rawScore),
+      thresholds,
+    },
+  };
+}
+
+function round(n) {
+  return Math.round(n * 100) / 100;
+}
+function round3(n) {
+  return Math.round(n * 1000) / 1000;
+}
+
+// ── Config loader (used by the HOOK, not by computeRisk) ────────────────────
+// Mirrors blast-radius.loadConfig. Reads .design/config.json#risk and returns
+// merged thresholds + EXTEND-only table extras. Defaults are returned when the
+// file/keys are absent or malformed. This is the ONLY function here that does
+// I/O; computeRisk stays pure.
+function loadRiskConfig(cwd) {
+  const configPath = path.join(cwd || process.cwd(), '.design', 'config.json');
+  let cfg = {};
+  try { cfg = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch { cfg = {}; }
+  const risk = (cfg && typeof cfg === 'object' && cfg.risk) || {};
+  const t = (risk && typeof risk.thresholds === 'object' && risk.thresholds) || {};
+  return {
+    thresholds: {
+      review: numOrInRange(t.review, THRESHOLDS.review),
+      require_confirmation: numOrInRange(t.require_confirmation, THRESHOLDS.require_confirmation),
+      block: numOrInRange(t.block, THRESHOLDS.block),
+    },
+    // Extend-only table extras (the hook merges these onto the frozen defaults).
+    base_tool_extra: (risk && typeof risk.base_tool_extra === 'object' && risk.base_tool_extra) || {},
+    file_sensitivity_extra: Array.isArray(risk.file_sensitivity_extra) ? risk.file_sensitivity_extra : [],
+    input_pattern_extra: Array.isArray(risk.input_pattern_extra) ? risk.input_pattern_extra : [],
+  };
+}
+
+function numOrInRange(v, fallback) {
+  if (typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= 1) return v;
+  return fallback;
+}
+
+module.exports = {
+  computeRisk,
+  // helpers exported for the hook + tests
+  pathsFor,
+  pickMaxFileSensitivity,
+  actionFor,
+  clamp01,
+  loadRiskConfig,
+  _extractBashPaths: extractBashPaths,
+  // re-export the tables so consumers (B/C/D) can `require('./compute-risk')`
+  // and get THRESHOLDS without a second import.
+  THRESHOLDS,
+  BASE_TOOL_RISK,
+  FILE_SENSITIVITY,
+  INPUT_PATTERN_RISK,
+};