@windyroad/risk-scorer 0.1.4 → 0.1.5-preview.48

package/hooks/git-push-gate.sh

@@ -72,12 +72,19 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run push:watch(\s|$)'; then
     exit 0
 fi
 
+# Block `changeset version` — versioning is done by the release pipeline,
+# not locally. Creating changesets (`npx changeset`) is fine.
+if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*(npx changeset|npm run changeset)\s+version(\s|$)'; then
+    risk_gate_deny "Do not run \`changeset version\` locally. The release pipeline handles versioning automatically. To release: (1) push your changes with \`npm run push:watch\`, (2) the pipeline creates a release PR via changesets, (3) merge the release PR to publish. If you need to create a changeset, use \`npx changeset\` (without \`version\`)."
+    exit 0
+fi
+
 # Gate changeset creation on release risk score (fail-closed).
 # Changesets feed directly into releases, so gate on the release score.
 if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*(npx changeset|npm run changeset)(\s|$)'; then
     if [ -n "$SESSION_ID" ]; then
         if ! check_risk_gate "$SESSION_ID" "release"; then
-            risk_gate_deny "Changeset blocked: ${RISK_GATE_REASON}"
+            risk_gate_deny "Changeset blocked: ${RISK_GATE_REASON}. To create a changeset, the release risk score must be within appetite. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to assess."
             exit 0
         fi
     fi
@@ -101,7 +108,7 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run release:watch(\s|$)'; the
             exit 0
         fi
         if ! check_risk_gate "$SESSION_ID" "release"; then
-            risk_gate_deny "Release blocked: ${RISK_GATE_REASON}. To proceed: (1) split the release, (2) add risk-reducing measures, or (3) for a LIVE INCIDENT, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context for an incident bypass."
+            risk_gate_deny "Release blocked: ${RISK_GATE_REASON}"
             exit 0
         fi
     fi

package/hooks/lib/risk-gate.sh

@@ -43,7 +43,7 @@ check_risk_gate() {
     local CURRENT_HASH
     CURRENT_HASH=$("$_RISK_GATE_DIR/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
     if [ "$STORED_HASH" != "$CURRENT_HASH" ]; then
-      RISK_GATE_REASON="Pipeline state drift: git diff changed between scoring and ${ACTION}. The hash is computed at prompt submit time. If you staged files (git add) after the prompt, re-submit: stage all files first, then submit a new prompt, then commit in that response."
+      RISK_GATE_REASON="Pipeline state drift: working tree changed since the last ${ACTION} risk assessment. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to rescore against the current state."
       return 1
     fi
   fi
@@ -63,7 +63,7 @@ print('yes' if score >= 5 else 'no')
 " 2>/dev/null || echo "no")
 
   if [ "$DENIED" = "yes" ]; then
-    RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 (Medium or above). Reduce changes or address outstanding risk first, then re-run the risk-scorer agent."
+    RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 (Medium or above). To proceed: (1) split the ${ACTION}, (2) add risk-reducing measures, or (3) for a LIVE INCIDENT, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context for an incident bypass."
     return 1
   fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.1.4",
+  "version": "0.1.5-preview.48",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"