@windyroad/risk-scorer 0.1.3-preview.13 → 0.1.4-preview.26

package/README.md

@@ -0,0 +1,76 @@
+# @windyroad/risk-scorer
+
+**Pipeline risk scoring, commit/push gates, and secret leak detection for Claude Code.** Scores every change for risk and blocks high-risk commits and pushes before they happen.
+
+Part of [Windy Road Agent Plugins](../../README.md).
+
+## What It Does
+
+The risk-scorer plugin brings ISO 31000-aligned risk management to your AI coding workflow. It:
+
+1. **Scores risk** on every edit, assessing cumulative pipeline risk as changes build up
+2. **Gates commits** -- blocks `git commit` when cumulative risk exceeds your policy threshold
+3. **Gates pushes** -- blocks `git push` for high-risk changesets (use `npm run push:watch` instead)
+4. **Detects secrets** -- scans edits for API keys, tokens, passwords, and other credentials before they're written
+5. **Reviews plans** -- scores implementation plans for risk before you start building
+
+All thresholds are configurable through your project's `RISK-POLICY.md`.
+
+## Install
+
+```bash
+npx @windyroad/risk-scorer
+```
+
+Restart Claude Code after installing.
+
+## Usage
+
+The plugin works automatically once installed. On first run in a project without a risk policy, it blocks edits and directs you to generate one:
+
+```
+/wr-risk-scorer:update-policy
+```
+
+This creates a `RISK-POLICY.md` tailored to your project, defining impact levels, likelihood scales, risk appetite, and the risk matrix -- all aligned to ISO 31000.
+
+## How It Works
+
+| Hook | Trigger | What it does |
+|------|---------|-------------|
+| `risk-score.sh` | Every prompt | Injects risk scoring context |
+| `secret-leak-gate.sh` | Edit or Write | Blocks writes containing secrets |
+| `wip-risk-gate.sh` | Edit or Write | Blocks edits if WIP risk hasn't been assessed |
+| `risk-policy-enforce-edit.sh` | Edit or Write | Blocks edits if no `RISK-POLICY.md` exists |
+| `git-push-gate.sh` | Bash (git push) | Blocks direct `git push`; requires `npm run push:watch` |
+| `risk-score-commit-gate.sh` | Bash (git commit) | Blocks commits when risk exceeds threshold |
+| `risk-score-plan-enforce.sh` | ExitPlanMode | Ensures plans are risk-scored before execution |
+| `plan-risk-guidance.sh` | EnterPlanMode | Injects risk guidance into plan mode |
+| `wip-risk-mark.sh` | After edit | Records WIP risk assessment |
+| `risk-score-mark.sh` | Agent completes | Marks risk review as done |
+| `risk-hash-refresh.sh` | After Bash | Refreshes content hashes |
+| `risk-score-reset.sh` | Session end | Cleans up risk markers |
+| `risk-policy-reset-marker.sh` | Session end | Cleans up policy markers |
+
+## Agents
+
+The plugin includes five specialised agents:
+
+| Agent | Purpose |
+|-------|---------|
+| `wr-risk-scorer:agent` | Routes to the appropriate mode-specific agent |
+| `wr-risk-scorer:wip` | Assesses cumulative risk after each edit |
+| `wr-risk-scorer:pipeline` | Scores pipeline actions (commit, push, release) |
+| `wr-risk-scorer:plan` | Reviews implementation plans for risk |
+| `wr-risk-scorer:policy` | Validates `RISK-POLICY.md` for ISO 31000 compliance |
+
+## Updating and Uninstalling
+
+```bash
+npx @windyroad/risk-scorer --update
+npx @windyroad/risk-scorer --uninstall
+```
+
+## Licence
+
+[MIT](../../LICENSE)

package/hooks/risk-policy-enforce-edit.sh

@@ -35,7 +35,7 @@ cat <<'EOF'
   "hookSpecificOutput": {
     "hookEventName": "PreToolUse",
     "permissionDecision": "deny",
-    "permissionDecisionReason": "BLOCKED: Cannot edit RISK-POLICY.md directly. Run the /risk-policy skill first -- it enforces ISO 31000 compliance (reads the risk-scorer contract, discovers project context, checks for incidents, validates with you, and smoke-tests the result). Use the Skill tool with skill: \"risk-policy\"."
+    "permissionDecisionReason": "BLOCKED: Cannot edit RISK-POLICY.md directly. Run /wr-risk-scorer:update-policy first -- it enforces ISO 31000 compliance (reads the risk-scorer contract, discovers project context, checks for incidents, validates with you, and smoke-tests the result). Use the Skill tool with skill: \"wr-risk-scorer:update-policy\"."
   }
 }
 EOF

package/hooks/test/risk-score-mark.bats

@@ -0,0 +1,39 @@
+#!/usr/bin/env bats
+
+# Tests for risk-score-mark.sh subagent pattern matching
+
+setup() {
+  SCRIPT_DIR="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)"
+}
+
+@test "pattern matches colon-style: wr-risk-scorer:pipeline" {
+  echo "wr-risk-scorer:pipeline" | grep -qE 'risk-scorer.pipeline'
+}
+
+@test "pattern matches colon-style: wr-risk-scorer:plan" {
+  echo "wr-risk-scorer:plan" | grep -qE 'risk-scorer.plan'
+}
+
+@test "pattern matches colon-style: wr-risk-scorer:wip" {
+  echo "wr-risk-scorer:wip" | grep -qE 'risk-scorer.wip'
+}
+
+@test "pattern matches colon-style: wr-risk-scorer:policy" {
+  echo "wr-risk-scorer:policy" | grep -qE 'risk-scorer.policy'
+}
+
+@test "case guard matches wr-risk-scorer:pipeline" {
+  SUBAGENT="wr-risk-scorer:pipeline"
+  case "$SUBAGENT" in
+    *risk-scorer*) true ;;
+    *) false ;;
+  esac
+}
+
+@test "case guard does NOT match unrelated agent" {
+  SUBAGENT="wr-architect:agent"
+  case "$SUBAGENT" in
+    *risk-scorer*) false ;;
+    *) true ;;
+  esac
+}

package/hooks/wip-risk-mark.sh

@@ -17,16 +17,8 @@ SESSION_ID=$(_get_session_id)
 
 MARKER="$(_risk_dir "$SESSION_ID")/wip-reviewed"
 
-case "$TOOL_NAME" in
-  Edit|Write)
-    FILE_PATH=$(_get_file_path)
-    [ -n "$FILE_PATH" ] || exit 0
-
-    if ! _is_doc_file "$FILE_PATH"; then
-        rm -f "$MARKER"
-    fi
-    ;;
-  # Agent case handled by risk-score-mark.sh
-esac
+# WIP marker persists after assessment — allows multiple edits.
+# Cleared on session end by risk-score-reset.sh (Stop hook).
+# Agent case (marker creation) handled by risk-score-mark.sh.
 
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.1.3-preview.13",
+  "version": "0.1.4-preview.26",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"

package/skills/{wr:risk-policy → update-policy}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr:risk-policy
+name: wr-risk-scorer:update-policy
 description: Create or update the project's RISK-POLICY.md per ISO 31000 and the risk-scorer agent. Examines the project to derive business-specific impact levels.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Agent
 ---