@windyroad/risk-scorer 0.17.0 → 0.17.2-preview.975

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.17.0"
+  "version": "0.17.2"
 }

package/.codex-plugin/plugin.json

@@ -0,0 +1,43 @@
+{
+  "name": "wr-risk-scorer",
+  "version": "0.17.2",
+  "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
+  "author": {
+    "name": "Windy Road Technology",
+    "url": "https://windyroad.com.au"
+  },
+  "homepage": "https://github.com/windyroad/agent-plugins/tree/main/packages/risk-scorer",
+  "repository": "https://github.com/windyroad/agent-plugins",
+  "license": "MIT",
+  "keywords": [
+    "risk",
+    "pipeline",
+    "governance",
+    "secret-leak-detection",
+    "codex",
+    "claude-code"
+  ],
+  "skills": "./skills/",
+  "interface": {
+    "displayName": "Windy Road Risk Scorer",
+    "shortDescription": "Score pipeline risk and guard risky changes",
+    "longDescription": "Pipeline risk scoring, commit and push gates, release risk checks, and secret leak detection for AI coding workflows.",
+    "developerName": "Windy Road Technology",
+    "category": "Developer Tools",
+    "capabilities": [
+      "Interactive",
+      "Read",
+      "Write"
+    ],
+    "websiteURL": "https://windyroad.com.au",
+    "privacyPolicyURL": "https://windyroad.com.au/privacy",
+    "termsOfServiceURL": "https://windyroad.com.au/terms",
+    "defaultPrompt": [
+      "Assess release risk for the current changes",
+      "Review this outbound message for secret leaks",
+      "Update this project's risk policy"
+    ],
+    "brandColor": "#B45309",
+    "screenshots": []
+  }
+}

package/bin/install.mjs

@@ -21,6 +21,7 @@ Options:
   --update     Update this plugin and its skills
   --uninstall  Remove this plugin
   --scope      Installation scope: project (default) or user
+  --runtime    Runtime to install for: claude (default), codex, or both
   --dry-run    Show what would be done without executing
   --help, -h   Show this help
 `);
@@ -32,12 +33,12 @@ if (flags.dryRun) {
   console.log("[dry-run mode — no commands will be executed]\n");
 }
 
-utils.checkPrerequisites();
+utils.checkPrerequisites({ runtime: flags.runtime });
 
 if (flags.uninstall) {
-  utils.uninstallPackage(PLUGIN);
+  utils.uninstallPackage(PLUGIN, { runtime: flags.runtime });
 } else if (flags.update) {
-  utils.updatePackage(PLUGIN, { scope: flags.scope });
+  utils.updatePackage(PLUGIN, { scope: flags.scope, runtime: flags.runtime });
 } else {
-  utils.installPackage(PLUGIN, { deps: DEPS, scope: flags.scope });
+  utils.installPackage(PLUGIN, { deps: DEPS, scope: flags.scope, runtime: flags.runtime });
 }

package/hooks/hooks.json

@@ -4,23 +4,13 @@
       { "matcher": "startup", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-scaffold-nudge.sh" }] }
     ],
     "UserPromptSubmit": [
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-score.sh" }] },
-      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/staleness-check.sh" }] }
+      { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh user-prompt" }] }
     ],
     "PreToolUse": [
-      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/secret-leak-gate.sh" }, { "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/wip-risk-gate.sh" }] },
-      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/git-push-gate.sh" }] },
-      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-score-commit-gate.sh" }] },
-      { "matcher": "Bash|Edit|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/external-comms-gate.sh" }] },
-      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-policy-enforce-edit.sh" }] },
-      { "matcher": "ExitPlanMode", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-score-plan-enforce.sh" }] },
-      { "matcher": "EnterPlanMode", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/plan-risk-guidance.sh" }] }
+      { "matcher": "Bash|Edit|Write|ExitPlanMode|EnterPlanMode", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh pre-tool" }] }
     ],
     "PostToolUse": [
-      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/wip-risk-mark.sh" }] },
-      { "matcher": "Agent", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-score-mark.sh" }] },
-      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-hash-refresh.sh" }] },
-      { "matcher": "Agent|Bash|Skill", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-slide-marker.sh" }] }
+      { "matcher": "Agent|Bash|Skill", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh post-tool" }] }
     ]
   }
 }

package/hooks/risk-scorer-dispatch.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+# Fan out risk-scorer hooks from one registered hook per event.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+EVENT="${1:-}"
+INPUT="$(cat)"
+
+run_hook() {
+  local output
+  output="$(printf '%s' "$INPUT" | "$SCRIPT_DIR/$1")"
+  if [ -n "$output" ]; then
+    printf '%s\n' "$output"
+    exit 0
+  fi
+}
+
+tool_name() {
+  printf '%s' "$INPUT" | python3 -c 'import json,sys; print((json.load(sys.stdin).get("tool_name") or ""))' 2>/dev/null || true
+}
+
+case "$EVENT" in
+  user-prompt)
+    run_hook risk-score.sh
+    run_hook staleness-check.sh
+    ;;
+  pre-tool)
+    case "$(tool_name)" in
+      Edit|Write)
+        run_hook secret-leak-gate.sh
+        run_hook wip-risk-gate.sh
+        run_hook external-comms-gate.sh
+        run_hook risk-policy-enforce-edit.sh
+        ;;
+      Bash)
+        run_hook git-push-gate.sh
+        run_hook risk-score-commit-gate.sh
+        run_hook external-comms-gate.sh
+        ;;
+      ExitPlanMode)
+        run_hook risk-score-plan-enforce.sh
+        ;;
+      EnterPlanMode)
+        run_hook plan-risk-guidance.sh
+        ;;
+    esac
+    ;;
+  post-tool)
+    case "$(tool_name)" in
+      Agent)
+        run_hook risk-score-mark.sh
+        run_hook risk-slide-marker.sh
+        ;;
+      Bash)
+        run_hook risk-hash-refresh.sh
+        run_hook risk-slide-marker.sh
+        ;;
+      Skill)
+        run_hook risk-slide-marker.sh
+        ;;
+    esac
+    ;;
+  *)
+    exit 0
+    ;;
+esac

package/hooks/test/risk-scorer-hook-dispatch.bats

@@ -0,0 +1,45 @@
+#!/usr/bin/env bats
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  HOOKS="$REPO_ROOT/packages/risk-scorer/hooks"
+}
+
+@test "hooks.json registers four command hooks" {
+  run python3 - "$HOOKS/hooks.json" <<'PY'
+import json, sys
+data = json.load(open(sys.argv[1]))
+print(sum(len(entry["hooks"]) for entries in data["hooks"].values() for entry in entries))
+PY
+  [ "$status" -eq 0 ]
+  [ "$output" = "4" ]
+}
+
+@test "dispatcher is registered for prompt, pre-tool, and post-tool events" {
+  run grep -n "risk-scorer-dispatch.sh user-prompt" "$HOOKS/hooks.json"
+  [ "$status" -eq 0 ]
+  run grep -n "risk-scorer-dispatch.sh pre-tool" "$HOOKS/hooks.json"
+  [ "$status" -eq 0 ]
+  run grep -n "risk-scorer-dispatch.sh post-tool" "$HOOKS/hooks.json"
+  [ "$status" -eq 0 ]
+}
+
+@test "dispatcher routes Write through the secret leak gate" {
+  local fake_key input
+  fake_key="AKIA""ABCDEFGHIJKLMNOP"
+  input="$(python3 - "$fake_key" <<'PY'
+import json, sys
+print(json.dumps({
+    "tool_name": "Write",
+    "session_id": "dispatch-test",
+    "tool_input": {"file_path": "src/example.txt", "content": sys.argv[1]},
+}))
+PY
+)"
+
+  run bash "$HOOKS/risk-scorer-dispatch.sh" pre-tool <<<"$input"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"permissionDecision"* ]]
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"AWS access key"* ]]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.17.0",
+  "version": "0.17.2-preview.975",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"
@@ -24,6 +24,7 @@
     "hooks/",
     "skills/",
     ".claude-plugin/",
+    ".codex-plugin/",
     "lib/",
     "scripts/",
     "!skills/*/eval/",