@hegemonart/get-design-done 1.55.0 → 1.57.0

package/scripts/lib/risk/consumers.cjs

@@ -0,0 +1,211 @@
+'use strict';
+/**
+ * scripts/lib/risk/consumers.cjs — Phase 56 importer/consumer resolver for the
+ * fact-forcing gate (hooks/gdd-fact-force.js).
+ *
+ * Wraps the Phase 52 typed DesignContext graph query (design-context-query.cjs
+ * `load` + `consumersOf`) with a BEST-EFFORT file→node mapping and a
+ * SOFTEN-IF-ABSENT contract: when `.design/context-graph.json` is missing,
+ * unbuilt, or malformed, this returns `{ available:false, importers:[] }` and
+ * NEVER throws — so the gate degrades to a warning on greenfield projects
+ * rather than over-blocking (CONTEXT.md R3 / D3).
+ *
+ * Why a wrapper and not a direct consumersOf call: the graph indexes NODES
+ * (ids like `component:Button`, `token:color/primary/500`), not file paths. A
+ * writer action mutates a FILE (`src/components/Button.tsx`). We map the file
+ * to its node id by lowercased basename/slug match against the node set, then
+ * ask the Phase 52 query for that node's consumers, and finally surface the
+ * consumer NAMES so the gate can check whether their files were Read.
+ *
+ * Dependency-free. The only I/O is the graph file read (delegated to the
+ * Phase 52 `load`), and it is fully guarded.
+ *
+ * Public API:
+ *   consumersOfFile(filePath, { root?, graph? })
+ *     -> { available:boolean, importers:string[], targets:string[], nodeId?:string }
+ *
+ *   `available`  — true only when a graph loaded AND the file mapped to a node.
+ *   `importers`  — consumer node names/slugs (lowercased), best-effort file
+ *                  identifiers the gate matches against state.reads.
+ *   `targets`    — the consumer node ids (raw, for diagnostics).
+ *   `nodeId`     — the resolved node id for `filePath`, when one matched.
+ */
+
+const path = require('path');
+
+// Phase 52 query — sibling under scripts/lib/. Resolved by package-root walk-up
+// (Phase 53/54 lesson) so the require survives regardless of this module's
+// install location. Loaded lazily + guarded so an absent sibling SOFTENS.
+let _query = null;
+let _queryResolved = false;
+
+/**
+ * Walk up from a start dir to the package root (the dir whose package.json
+ * `name` is this package), returning that root or null. Used to resolve the
+ * Phase 52 sibling robustly even when cwd differs from the install dir.
+ */
+function findPackageRoot(startDir) {
+  let dir = startDir;
+  for (let i = 0; i < 12; i++) {
+    try {
+      const pkg = require(path.join(dir, 'package.json'));
+      if (pkg && pkg.name === '@hegemonart/get-design-done') return dir;
+    } catch { /* not this level */ }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+function getQuery() {
+  if (_queryResolved) return _query;
+  _queryResolved = true;
+  // 1. Adjacent sibling (this file lives in scripts/lib/risk/, query in scripts/lib/).
+  const candidates = [path.join(__dirname, '..', 'design-context-query.cjs')];
+  // 2. Package-root walk-up fallback (robust to relocated installs).
+  const root = findPackageRoot(__dirname);
+  if (root) candidates.push(path.join(root, 'scripts', 'lib', 'design-context-query.cjs'));
+  for (const c of candidates) {
+    try {
+      _query = require(c);
+      if (_query && typeof _query.consumersOf === 'function' && typeof _query.load === 'function') {
+        return _query;
+      }
+    } catch { /* try next candidate */ }
+  }
+  _query = null;
+  return _query;
+}
+
+/**
+ * Lowercase + tokenize a file basename or a node id/name into comparable slug
+ * tokens. Splits on path separators, hyphens, underscores, dots, and colons
+ * (node ids are `<type>:<name>` with `/`-segmented names). Drops the file
+ * extension and short no-signal tokens.
+ */
+function slugTokens(s) {
+  if (!s) return [];
+  const lc = String(s).toLowerCase();
+  // Drop a trailing file extension (`.tsx`, `.css.ts` -> keep `css`+`ts` out).
+  const noExt = lc.replace(/\.[a-z0-9]+$/i, '');
+  return noExt
+    .split(/[\\/\-_.:]+/)
+    .map((t) => t.trim())
+    .filter((t) => t.length > 1);
+}
+
+/** The most specific basename slug for a file (its basename, sans extension). */
+function fileSlug(filePath) {
+  const base = path.basename(String(filePath || ''));
+  return base.replace(/\.[a-z0-9.]+$/i, '').toLowerCase();
+}
+
+/**
+ * Best-effort: map a file path to a graph node id by matching the file's
+ * basename slug against each node's id/name tokens. Prefers an exact basename
+ * == node-name(slug) match; falls back to any shared token. Returns the matched
+ * node id, or null when nothing matches.
+ */
+function fileToNodeId(filePath, graph) {
+  const nodes = Array.isArray(graph && graph.nodes) ? graph.nodes : [];
+  if (!nodes.length) return null;
+  const fSlug = fileSlug(filePath);
+  const fTokens = new Set(slugTokens(path.basename(String(filePath || ''))));
+  if (!fSlug && fTokens.size === 0) return null;
+
+  let exact = null;
+  let partial = null;
+  for (const n of nodes) {
+    if (!n || typeof n.id !== 'string') continue;
+    const nameTokens = slugTokens(n.name != null ? n.name : '');
+    const idTokens = slugTokens(n.id);
+    // The node's "leaf" identifier: last segment of name, else last of id.
+    const nameLeaf = nameTokens.length ? nameTokens[nameTokens.length - 1] : '';
+    const idLeaf = idTokens.length ? idTokens[idTokens.length - 1] : '';
+    if (fSlug && (fSlug === nameLeaf || fSlug === idLeaf)) {
+      exact = n.id;
+      break;
+    }
+    if (!partial) {
+      for (const t of fTokens) {
+        if (nameTokens.includes(t) || idTokens.includes(t)) { partial = n.id; break; }
+      }
+    }
+  }
+  return exact || partial;
+}
+
+/**
+ * Resolve the consumer/importer identifiers for a file via the Phase 52 graph.
+ *
+ * @param {string} filePath               the file being mutated
+ * @param {{root?:string, graph?:object}} [opts]
+ *        root  — project root holding `.design/context-graph.json`
+ *        graph — pre-loaded graph object (test injection; bypasses disk read)
+ * @returns {{available:boolean, importers:string[], targets:string[], nodeId?:string}}
+ */
+function consumersOfFile(filePath, opts = {}) {
+  const SOFT = { available: false, importers: [], targets: [] };
+  try {
+    const q = getQuery();
+    if (!q) return SOFT;
+
+    // Obtain the graph: injected (tests) or loaded from disk (guarded).
+    let graph = opts && opts.graph;
+    if (!graph) {
+      const root = (opts && opts.root) || process.cwd();
+      const graphPath = path.join(root, '.design', 'context-graph.json');
+      try {
+        graph = q.load(graphPath);
+      } catch {
+        // Absent / unbuilt / malformed -> SOFTEN to a warning, never throw.
+        return SOFT;
+      }
+    }
+    if (!graph || !Array.isArray(graph.nodes)) return SOFT;
+
+    const nodeId = fileToNodeId(filePath, graph);
+    if (!nodeId) {
+      // Graph exists but this file maps to no node — treat as "no known
+      // consumers" but mark available so the gate doesn't soften purely on a
+      // mapping miss (an unmapped file genuinely has no importer prerequisite).
+      return { available: true, importers: [], targets: [], nodeId: undefined };
+    }
+
+    const consumerNodes = q.consumersOf(graph, nodeId) || [];
+    const targets = consumerNodes
+      .map((n) => (n && typeof n.id === 'string' ? n.id : null))
+      .filter(Boolean);
+    // Importer identifiers the gate matches against state.reads: the consumer
+    // node's leaf name (lowercased), which is the strongest signal for the
+    // consumer's source-file basename.
+    const importers = [];
+    for (const n of consumerNodes) {
+      if (!n) continue;
+      const nameTokens = slugTokens(n.name != null ? n.name : '');
+      const idTokens = slugTokens(n.id);
+      const leaf = nameTokens.length ? nameTokens[nameTokens.length - 1]
+        : (idTokens.length ? idTokens[idTokens.length - 1] : null);
+      if (leaf) importers.push(leaf);
+    }
+    return {
+      available: true,
+      importers: Array.from(new Set(importers)),
+      targets,
+      nodeId,
+    };
+  } catch {
+    // Any unexpected failure SOFTENS — the gate must never hard-fail on graph I/O.
+    return SOFT;
+  }
+}
+
+module.exports = {
+  consumersOfFile,
+  // exported for tests / reuse
+  fileToNodeId,
+  fileSlug,
+  slugTokens,
+  findPackageRoot,
+};

package/scripts/lib/risk/override.cjs

@@ -0,0 +1,87 @@
+'use strict';
+/**
+ * scripts/lib/risk/override.cjs — PURE helpers for the `/gdd:override` skill
+ * (Phase 56). Mirrors the unlock-decision precedent (Phase 40): override is the
+ * deliberately heavyweight escape hatch from a risk-blocked action or a
+ * fact-force gate, and every use is audited.
+ *
+ * NO I/O, NO Date.now / Math.random. The SKILL.md (and C's fact-force hook) do
+ * the actual atomic file write; these functions only shape the data so the
+ * routing/override matrix stays unit-testable in isolation.
+ *
+ * Two modes, one per exported builder:
+ *
+ *   1. overrideDecisionEntry(findingId, { approver, reason })
+ *        -> { text, status, tag } for `mcp__gdd_state__add_decision`.
+ *      The audit invariant: a recorded approver is mandatory. The `override`
+ *      tag is embedded in `text` (the Decision shape is { id, text, status } —
+ *      it has no dedicated tags field), so the entry is greppable and the
+ *      D-XX it becomes carries the override marker in STATE.md <decisions>.
+ *
+ *   2. setFactForceChecked(state, path)
+ *        -> a NEW session-state object with checked[path] = true.
+ *      The fact-force gate (hooks/gdd-fact-force.js) reads this map at
+ *      `<cwd>/.design/locks/factforce-<session_id>.json`; once a path is
+ *      checked it stops blocking the first mutation of that path.
+ *
+ * Dependency-free.
+ */
+
+const OVERRIDE_TAG = 'override';
+
+/**
+ * Build the audited decision entry for a risk-blocked finding override.
+ * @param {string} findingId  e.g. "G-12" or a risk finding id
+ * @param {object} opts
+ * @param {string} opts.approver  REQUIRED non-empty approver name (audit invariant)
+ * @param {string} [opts.reason]  optional rationale, recorded verbatim
+ * @returns {{ text:string, status:'locked', tag:'override' }}
+ * @throws {Error} when approver is missing/empty (override is never silent)
+ */
+function overrideDecisionEntry(findingId, opts = {}) {
+  const id = typeof findingId === 'string' ? findingId.trim() : '';
+  const approver = typeof opts.approver === 'string' ? opts.approver.trim() : '';
+  const reason = typeof opts.reason === 'string' ? opts.reason.trim() : '';
+  if (!id) throw new Error('override: a finding id is required');
+  if (!approver) throw new Error('override: --approver is required (audit invariant)');
+  // The tag prefix keeps the entry greppable; reason is recorded when present.
+  const base = `[${OVERRIDE_TAG}] ${id} risk-blocked action approved by ${approver}`;
+  const text = reason ? `${base}. Reason: ${reason}` : base;
+  return { text, status: 'locked', tag: OVERRIDE_TAG };
+}
+
+/**
+ * Mark a path as fact-force-checked in a session-state object. Pure: returns a
+ * new object, never mutates the input. A non-object/absent state seeds a fresh
+ * one ({ reads:{}, checked:{} }) so the first override on a greenfield session
+ * still produces a valid file for the hook to read.
+ * @param {object} state  the parsed factforce session state (or null/undefined)
+ * @param {string} p      the path to unblock
+ * @returns {{ reads:object, checked:object }}
+ */
+function setFactForceChecked(state, p) {
+  const key = typeof p === 'string' ? p.replace(/\\/g, '/').replace(/^\.\//, '') : '';
+  if (!key) throw new Error('override: a path is required for factforce mode');
+  const src = state && typeof state === 'object' ? state : {};
+  const reads = src.reads && typeof src.reads === 'object' ? { ...src.reads } : {};
+  const checked = src.checked && typeof src.checked === 'object' ? { ...src.checked } : {};
+  checked[key] = true;
+  return { ...src, reads, checked };
+}
+
+/**
+ * isFactForceChecked(state, path) — read-side predicate the gate uses to decide
+ * whether a path was overridden. Pure.
+ */
+function isFactForceChecked(state, p) {
+  const key = typeof p === 'string' ? p.replace(/\\/g, '/').replace(/^\.\//, '') : '';
+  if (!key || !state || typeof state !== 'object' || !state.checked) return false;
+  return state.checked[key] === true;
+}
+
+module.exports = {
+  overrideDecisionEntry,
+  setFactForceChecked,
+  isFactForceChecked,
+  OVERRIDE_TAG,
+};

package/scripts/lib/risk/route.cjs

@@ -0,0 +1,59 @@
+'use strict';
+/**
+ * scripts/lib/risk/route.cjs — pure confidence×risk router for the Phase 56
+ * gate (the risk sibling of scripts/lib/confidence-route.cjs from Phase 49).
+ *
+ * Decides what a writer agent (design-fixer Step 2.5) should DO with an action,
+ * given (a) the agent's CONFIDENCE in the change [0..1] and (b) the risk
+ * scorer's suggested_action ('allow'|'review'|'require_confirmation'|'block').
+ *
+ * Canonical rule (mirrors the Phase 56 shared contract):
+ *   1. action === 'block'                       -> 'override'   (always; block short-circuits)
+ *   2. confidence < 0.5                          -> 'skip'       (low-confidence floor; non-block)
+ *   3. confidence >= 0.8 && action in {allow,review}        -> 'auto'
+ *   4. confidence >= 0.8 && action === 'require_confirmation'-> 'confirm'
+ *   5. else (0.5 <= confidence < 0.8, non-block) -> 'confirm'
+ *
+ * Note the ordering: BLOCK is checked before the low-confidence floor, so a
+ * block with low confidence still routes to 'override' (you cannot silently
+ * skip a blocked action — it must be explicitly overridden). A non-block action
+ * with confidence < 0.5 is skipped.
+ *
+ * Returns: 'auto' | 'confirm' | 'skip' | 'override'. Dependency-free, no I/O.
+ */
+
+const AUTO_FLOOR = 0.8;     // at/above this, low-risk actions auto-apply
+const SKIP_FLOOR = 0.5;     // below this, non-block actions are skipped
+
+const AUTO_OK_ACTIONS = new Set(['allow', 'review']);
+
+/**
+ * @param {number} confidence  agent confidence in the change, 0.0-1.0
+ * @param {string} action      risk suggested_action: allow|review|require_confirmation|block
+ * @returns {'auto'|'confirm'|'skip'|'override'}
+ */
+function route(confidence, action) {
+  const a = typeof action === 'string' ? action.trim().toLowerCase() : '';
+  // A missing/non-numeric confidence is treated as the lowest tier (0).
+  const c = typeof confidence === 'number' && Number.isFinite(confidence) ? confidence : 0;
+
+  // 1. Block short-circuits everything: it must be explicitly overridden,
+  //    regardless of confidence.
+  if (a === 'block') return 'override';
+
+  // 2. Low-confidence floor (non-block): not worth surfacing — skip.
+  if (c < SKIP_FLOOR) return 'skip';
+
+  // 3-4. High confidence: auto-apply low-risk, confirm if confirmation asked.
+  if (c >= AUTO_FLOOR) {
+    if (AUTO_OK_ACTIONS.has(a)) return 'auto';
+    if (a === 'require_confirmation') return 'confirm';
+    // Any other (unknown) non-block action at high confidence: be conservative.
+    return 'confirm';
+  }
+
+  // 5. Mid confidence [0.5, 0.8), non-block: surface for confirmation.
+  return 'confirm';
+}
+
+module.exports = { route, AUTO_FLOOR, SKIP_FLOOR, AUTO_OK_ACTIONS };

package/scripts/lib/risk/tables.cjs

@@ -0,0 +1,221 @@
+'use strict';
+/**
+ * scripts/lib/risk/tables.cjs — frozen, dependency-free static tables for the
+ * Phase 56 risk scorer. PURE DATA + linear-only regexes (CodeQL js/redos safe:
+ * no nested quantifiers, no `(a+)+`, no `(.*)*`; the secret-shaped pattern is
+ * anchored on fixed prefixes with bounded character classes).
+ *
+ * Consumed by scripts/lib/risk/compute-risk.cjs. Tables are
+ * `Object.freeze`-d so a downstream consumer cannot mutate the shared defaults;
+ * config overrides EXTEND (never shrink) these via the loadConfig pattern in
+ * compute-risk.cjs (protected-paths discipline — D7).
+ *
+ * Exports:
+ *   BASE_TOOL_RISK    — { [toolName]: number, __default: number }
+ *   FILE_SENSITIVITY  — ordered [{ test:RegExp, mult, add, label }]
+ *   INPUT_PATTERN_RISK— ordered [{ when:(tool,input)=>bool|hit, add:number|fn, label }]
+ *   THRESHOLDS        — { review, require_confirmation, block }
+ *   SECRET_SHAPED_RE  — the (linear) secret detector, exported for reuse/tests
+ *   _SEVERITY_ADD     — dangerous-bash severity -> addend map
+ */
+
+const dangerous = require('../dangerous-patterns.cjs');
+const blast = require('../blast-radius.cjs');
+
+// ── Base per-tool risk ─────────────────────────────────────────────────────
+// Bash is the riskiest (arbitrary shell), then bulk edits, then single edits,
+// then whole-file writes; read-only tools are ~zero. __default covers unknown
+// tools conservatively.
+const BASE_TOOL_RISK = Object.freeze({
+  Bash: 0.55,
+  MultiEdit: 0.40,
+  Edit: 0.35,
+  NotebookEdit: 0.35,
+  Write: 0.30,
+  Read: 0.02,
+  Glob: 0,
+  Grep: 0,
+  __default: 0.20,
+});
+
+// ── Secret-shaped content detector ─────────────────────────────────────────
+// Linear: each alternative is a fixed prefix + a bounded/anchored class. No
+// alternative can backtrack into another (distinct literal prefixes).
+//   AWS access key id | PEM private-key header | OpenAI sk- | GitHub ghp_ | Slack xox?-
+const SECRET_SHAPED_RE =
+  /AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----|sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|xox[baprs]-/;
+
+// ── File-sensitivity table (mirrors reference/protected-paths.default.json) ──
+// ORDERED, highest-weight first. compute-risk.cjs picks the single
+// highest-weight matching entry (pickMaxFileSensitivity). `test` matches a
+// forward-slash-normalized path. All regexes linear.
+//
+// mult multiplies the base tool risk; add is a flat addend. De-risking entries
+// (tests/fixtures, docs) use mult<1 + add 0 to pull benign edits below review.
+const FILE_SENSITIVITY = Object.freeze([
+  // State + config: the audit/control spine.
+  { test: /(^|\/)STATE\.md$/i, mult: 1.6, add: 0.25, label: 'planning-state' },
+  { test: /(^|\/)config\.json$/i, mult: 1.6, add: 0.25, label: 'config' },
+  // Schemas + lockfiles + generated styling contracts.
+  { test: /\.schema\.json$/i, mult: 1.5, add: 0.25, label: 'schema' },
+  { test: /(^|\/)package-lock\.json$/i, mult: 1.5, add: 0.20, label: 'lockfile' },
+  { test: /(^|\/)package\.json$/i, mult: 1.5, add: 0.20, label: 'package-manifest' },
+  { test: /\.css\.ts$/i, mult: 1.5, add: 0.20, label: 'css-in-ts' },
+  // Hooks + CI: execution surface.
+  { test: /(^|\/)hooks\//i, mult: 1.5, add: 0.20, label: 'hook' },
+  { test: /(^|\/)\.github\/workflows\//i, mult: 1.5, add: 0.20, label: 'ci-workflow' },
+  // Design-token / theme sources.
+  { test: /(^|\/)(tokens|theme)(\/|[.-])/i, mult: 1.4, add: 0.18, label: 'design-tokens' },
+  // Build/runtime config files.
+  { test: /(^|\/)(tsconfig[^/]*\.json|\.npmrc|Dockerfile|\.gitleaks(\.toml)?)$/i, mult: 1.3, add: 0.15, label: 'build-config' },
+  // Plugin authoring surface (skills/commands/agents).
+  { test: /(^|\/)(skills|commands|agents)\//i, mult: 1.3, add: 0.12, label: 'authoring-surface' },
+  // De-risking: tests + fixtures are low-stakes.
+  { test: /(^|\/)(tests?|fixtures?|__tests__|__fixtures__)\//i, mult: 0.6, add: 0, label: 'test-or-fixture' },
+  // De-risking: docs / markdown.
+  { test: /(^|\/)docs?\/|\.mdx?$/i, mult: 0.5, add: 0, label: 'docs' },
+]);
+
+// ── Severity -> addend for destructive bash (via dangerous-patterns.cjs) ────
+const _SEVERITY_ADD = Object.freeze({ critical: 0.6, high: 0.4, medium: 0.2 });
+
+// ── Helpers shared by INPUT_PATTERN_RISK predicates ─────────────────────────
+function textOf(input) {
+  if (!input || typeof input !== 'object') return '';
+  const parts = [];
+  if (typeof input.content === 'string') parts.push(input.content);
+  if (typeof input.new_string === 'string') parts.push(input.new_string);
+  if (typeof input.new_str === 'string') parts.push(input.new_str);
+  if (Array.isArray(input.edits)) {
+    for (const e of input.edits) {
+      if (e && typeof e.new_string === 'string') parts.push(e.new_string);
+    }
+  }
+  if (typeof input.command === 'string') parts.push(input.command);
+  return parts.join('\n');
+}
+
+// Approximate the changed-line count for a Write/Edit/MultiEdit input by
+// counting newlines in the new text. Reuses blast-radius.estimate for the
+// capped addend math so the large-diff curve matches the blast-radius primitive.
+function changedLineCount(tool, input) {
+  if (!input || typeof input !== 'object') return 0;
+  let lines = 0;
+  if (typeof input.content === 'string') lines += countLines(input.content);
+  if (typeof input.new_string === 'string') lines += countLines(input.new_string);
+  if (Array.isArray(input.edits)) {
+    for (const e of input.edits) {
+      if (e && typeof e.new_string === 'string') lines += countLines(e.new_string);
+    }
+  }
+  return lines;
+}
+
+function countLines(s) {
+  if (typeof s !== 'string' || s.length === 0) return 0;
+  // A non-empty string is at least one line; each newline adds one.
+  let n = 1;
+  for (let i = 0; i < s.length; i++) if (s.charCodeAt(i) === 10) n++;
+  return n;
+}
+
+// File-path-ish fields, normalized to forward slashes (for schema/migration sniff).
+function pathHintsOf(input) {
+  if (!input || typeof input !== 'object') return '';
+  const parts = [];
+  for (const k of ['file_path', 'notebook_path', 'path']) {
+    if (typeof input[k] === 'string') parts.push(input[k]);
+  }
+  return parts.join('\n').replace(/\\/g, '/');
+}
+
+// Linear regexes only.
+const SCHEMA_MIGRATION_RE = /(^|\/)migrations?\/|\.schema\.json$|\bALTER\s+TABLE\b|\bCREATE\s+TABLE\b|\bDROP\s+TABLE\b/i;
+const DEP_MUTATION_RE = /\b(npm|pnpm|yarn|bun)\s+(install|add|i|remove|rm|uninstall|up|update|upgrade)\b|\b(pip|pip3)\s+install\b|\bcargo\s+(add|install)\b/;
+// Broad glob: a pattern argument touching the repo root with ** or a bare /* .
+const BROAD_GLOB_RE = /(\*\*|(^|\s)\.?\/?\*(\s|$)|--include=\*|\s-r\b.*\*)/;
+
+// ── Input-pattern risk table ────────────────────────────────────────────────
+// ORDERED. Each `when(tool, input)` returns a truthy value (bool or a "hit"
+// object) when it applies; `add` is either a flat number or a function of the
+// hit/(tool,input) returning the addend. compute-risk.cjs accumulates every
+// applicable entry in this fixed order.
+const INPUT_PATTERN_RISK = Object.freeze([
+  {
+    label: 'dangerous-bash',
+    when: (tool, input) => {
+      if (tool !== 'Bash' || !input || typeof input.command !== 'string') return false;
+      const hit = dangerous.match(input.command);
+      return hit.matched ? hit : false;
+    },
+    add: (hit) => _SEVERITY_ADD[hit && hit.severity] || 0.2,
+  },
+  {
+    label: 'large-diff',
+    when: (tool, input) => {
+      const lines = changedLineCount(tool, input);
+      return lines > 0 ? lines : false;
+    },
+    // Cap at +0.30; curve = lines / 1500 (matches the shared contract).
+    add: (lines) => {
+      // Route through blast-radius.estimate so the line accounting stays in
+      // lockstep with the blast-radius primitive (pure: explicit DEFAULTS-like
+      // config, no disk read).
+      const est = blast.estimate({ diffStats: { insertions: lines, deletions: 0 }, config: { max_files_per_task: 0, max_lines_per_task: 0, max_mcp_calls_per_task: 0 } });
+      return Math.min(0.30, est.lines / 1500);
+    },
+  },
+  {
+    label: 'schema-migration',
+    when: (tool, input) => SCHEMA_MIGRATION_RE.test(pathHintsOf(input)) || SCHEMA_MIGRATION_RE.test(textOf(input)),
+    add: 0.25,
+  },
+  {
+    label: 'secret-shaped',
+    when: (tool, input) => SECRET_SHAPED_RE.test(textOf(input)),
+    add: 0.5,
+  },
+  {
+    label: 'broad-glob',
+    when: (tool, input) => {
+      if (tool === 'Bash' && input && typeof input.command === 'string') return BROAD_GLOB_RE.test(input.command);
+      if ((tool === 'Glob' || tool === 'Grep') && input && typeof input.pattern === 'string') return BROAD_GLOB_RE.test(input.pattern);
+      return false;
+    },
+    add: 0.15,
+  },
+  {
+    label: 'dependency-mutation',
+    when: (tool, input) => {
+      if (tool === 'Bash' && input && typeof input.command === 'string' && DEP_MUTATION_RE.test(input.command)) return true;
+      // Editing a manifest/lockfile is also a dependency mutation surface.
+      const hints = pathHintsOf(input);
+      return /(^|\/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|Cargo\.toml|requirements\.txt)$/i.test(hints);
+    },
+    add: 0.15,
+  },
+]);
+
+// ── Thresholds ──────────────────────────────────────────────────────────────
+// score < review            -> allow
+// review <= score < require_confirmation -> review
+// require_confirmation <= score < block  -> require_confirmation
+// score >= block            -> block
+const THRESHOLDS = Object.freeze({
+  review: 0.30,
+  require_confirmation: 0.60,
+  block: 0.85,
+});
+
+module.exports = {
+  BASE_TOOL_RISK,
+  FILE_SENSITIVITY,
+  INPUT_PATTERN_RISK,
+  THRESHOLDS,
+  SECRET_SHAPED_RE,
+  _SEVERITY_ADD,
+  // internal helpers exported for compute-risk.cjs + unit visibility
+  _textOf: textOf,
+  _changedLineCount: changedLineCount,
+  _pathHintsOf: pathHintsOf,
+};