@windyroad/risk-scorer 0.17.4 → 0.18.0

package/.agents/plugins/marketplace.json

@@ -1,5 +1,5 @@
 {
-  "name": "windyroad-local",
+  "name": "windyroad-risk-scorer-local",
   "interface": {
     "displayName": "Windy Road Risk Scorer"
   },

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.17.4"
+  "version": "0.18.0"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.17.4",
+  "version": "0.18.0",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/README.md

@@ -1,6 +1,6 @@
 # @windyroad/risk-scorer
 
-**Pipeline risk scoring, commit/push gates, and secret leak detection for Claude Code.** Scores every change for risk and blocks high-risk commits and pushes before they happen. *Maturity: Experimental (suite-bootstrap window; 2047 invocations / 30d).*
+**Pipeline risk scoring, commit/push gates, and secret leak detection for Claude Code and Codex.** Scores every change for risk and blocks high-risk commits and pushes before they happen. *Maturity: Experimental (suite-bootstrap window; 2047 invocations / 30d).*
 
 Part of [Windy Road Agent Plugins](../../README.md).
 
@@ -25,6 +25,16 @@ npx @windyroad/risk-scorer
 
 Restart Claude Code after installing.
 
+For Codex, install the plugin and its native custom agents together:
+
+```bash
+npx @windyroad/risk-scorer --runtime codex --scope project
+```
+
+Use `--scope user` to make the agents available across repositories. Restart
+Codex after installing. Marketplace/tag-only installs self-repair the user
+agent files at SessionStart and request one additional restart when needed.
+
 ## Usage
 
 The plugin works automatically once installed. On first run in a project without a risk policy, it blocks edits and directs you to generate one:
@@ -55,7 +65,8 @@ This creates a `RISK-POLICY.md` tailored to your project, defining impact levels
 
 ## Agents
 
-The plugin includes six specialised agents:
+Claude Code includes the routing agent plus six specialised agents. Codex
+installs the six mode-specific agents directly:
 
 | Agent | Purpose |
 |-------|---------|

package/bin/install.mjs

@@ -1,17 +1,33 @@
 #!/usr/bin/env node
 
-import { resolve, dirname } from "node:path";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const utils = await import(resolve(__dirname, "../lib/install-utils.mjs"));
+const agents = await import(resolve(__dirname, "../scripts/codex-agents.mjs"));
 
 const PLUGIN = "wr-risk-scorer";
+const CODEX_MARKETPLACE = "windyroad-risk-scorer-local";
 const DEPS = [];
 const PACKAGE_ROOT = resolve(__dirname, "..");
+const PACKAGE_VERSION = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8")).version;
+
+function codexMarketplaceRoot() {
+  const codexHome = process.env.CODEX_HOME || join(homedir(), ".codex");
+  return join(codexHome, ".tmp", "marketplaces", `wr-risk-scorer-${PACKAGE_VERSION}`);
+}
 
 const flags = utils.parseStandardArgs(process.argv);
 
+if (flags.runtime === "codex" || flags.runtime === "both") {
+  const bundled = "/Applications/ChatGPT.app/Contents/Resources/codex";
+  const binary = process.env.CODEX_BINARY || (existsSync(bundled) ? bundled : null);
+  if (binary?.includes("/")) process.env.PATH = `${dirname(binary)}:${process.env.PATH || ""}`;
+}
+
 if (flags.help) {
   console.log(`
 Usage: npx @windyroad/risk-scorer [options]
@@ -37,12 +53,30 @@ if (flags.dryRun) {
 utils.checkPrerequisites({ runtime: flags.runtime });
 
 function codexInstall() {
-  utils.run(`codex plugin marketplace add ${PACKAGE_ROOT}`, "Codex marketplace: windyroad-local");
-  utils.run(`codex plugin add ${PLUGIN}@windyroad-local`, PLUGIN);
+  const marketplaceRoot = codexMarketplaceRoot();
+  if (!flags.dryRun) {
+    rmSync(marketplaceRoot, { recursive: true, force: true });
+    mkdirSync(dirname(marketplaceRoot), { recursive: true });
+    cpSync(PACKAGE_ROOT, marketplaceRoot, { recursive: true });
+  }
+  if (!utils.run(`codex plugin marketplace add ${JSON.stringify(marketplaceRoot)}`, `Codex marketplace: ${CODEX_MARKETPLACE}`)) return false;
+  if (!utils.run(`codex plugin add ${PLUGIN}@${CODEX_MARKETPLACE}`, PLUGIN)) return false;
+  if (!flags.dryRun) agents.installRiskAgents(agents.agentDirForScope(flags.scope));
+  return true;
 }
 
 function codexUninstall() {
-  utils.run(`codex plugin remove ${PLUGIN}`, `Removing ${PLUGIN}`);
+  const removed = utils.run(`codex plugin remove ${PLUGIN}@${CODEX_MARKETPLACE}`, `Removing ${PLUGIN}`);
+  utils.run(`codex plugin marketplace remove ${CODEX_MARKETPLACE}`, `Removing ${CODEX_MARKETPLACE}`);
+  if (!flags.dryRun) {
+    const targets = new Set([
+      agents.agentDirForScope(flags.scope),
+      agents.agentDirForScope("user"),
+    ]);
+    for (const target of targets) agents.uninstallRiskAgents(target);
+    rmSync(codexMarketplaceRoot(), { recursive: true, force: true });
+  }
+  return removed;
 }
 
 if (flags.uninstall) {
@@ -50,22 +84,22 @@ if (flags.uninstall) {
     utils.uninstallPackage(PLUGIN, { runtime: "claude" });
   }
   if (flags.runtime === "codex" || flags.runtime === "both") {
-    codexUninstall();
+    if (!codexUninstall()) process.exit(1);
   }
 } else if (flags.update) {
   if (flags.runtime === "claude" || flags.runtime === "both") {
     utils.updatePackage(PLUGIN, { scope: flags.scope, runtime: "claude" });
   }
   if (flags.runtime === "codex" || flags.runtime === "both") {
-    codexInstall();
+    if (!codexInstall()) process.exit(1);
   }
 } else if (flags.runtime === "codex") {
   console.log(`\nInstalling @windyroad/risk-scorer (${flags.scope} scope)...\n`);
-  codexInstall();
+  if (!codexInstall()) process.exit(1);
   console.log("\nDone! Restart Codex to activate.\n");
 } else if (flags.runtime === "both") {
   utils.installPackage(PLUGIN, { deps: DEPS, scope: flags.scope, runtime: "claude" });
-  codexInstall();
+  if (!codexInstall()) process.exit(1);
   console.log("\nDone! Restart Claude Code and Codex to activate.\n");
 } else {
   utils.installPackage(PLUGIN, { deps: DEPS, scope: flags.scope, runtime: "claude" });

package/hooks/codex-agent-completion.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const hookDir = dirname(fileURLToPath(import.meta.url));
+const riskAgentRoles = new Set([
+  "wr-risk-scorer:pipeline",
+  "wr-risk-scorer:plan",
+  "wr-risk-scorer:wip",
+  "wr-risk-scorer:policy",
+  "wr-risk-scorer:external-comms",
+  "wr-risk-scorer:inbound-report",
+]);
+
+function response(input) {
+  if (typeof input.tool_response === "object" && input.tool_response) return input.tool_response;
+  try {
+    return JSON.parse(input.tool_response);
+  } catch {
+    return {};
+  }
+}
+
+function riskDir(sessionId) {
+  return join(process.env.TMPDIR || "/tmp", `claude-risk-${sessionId}`);
+}
+
+function statePath(input, target) {
+  return join(riskDir(input.session_id), `codex-agent-${Buffer.from(target).toString("base64url")}`);
+}
+
+function rememberSpawn(input) {
+  const role = input.tool_input?.agent_type;
+  const target = response(input).task_name;
+  if (!riskAgentRoles.has(role) || typeof target !== "string" || !target.startsWith("/")) return;
+  mkdirSync(riskDir(input.session_id), { recursive: true });
+  writeFileSync(statePath(input, target), role, "utf8");
+}
+
+function markCompletion(input) {
+  const target = input.tool_input?.target;
+  const output = response(input).previous_status?.completed;
+  if (typeof target !== "string" || typeof output !== "string" || !output) return;
+
+  const state = statePath(input, target);
+  if (!existsSync(state)) return;
+  const role = readFileSync(state, "utf8");
+  if (!riskAgentRoles.has(role)) return;
+
+  const synthetic = {
+    ...input,
+    tool_name: "Agent",
+    tool_input: { subagent_type: role, prompt: "" },
+    tool_response: { content: [{ type: "text", text: output }] },
+  };
+  const result = spawnSync(join(hookDir, "risk-score-mark.sh"), {
+    cwd: input.cwd || process.cwd(),
+    env: process.env,
+    input: JSON.stringify(synthetic),
+    encoding: "utf8",
+  });
+  if (result.status === 0) rmSync(state, { force: true });
+}
+
+let body = "";
+process.stdin.setEncoding("utf8");
+for await (const chunk of process.stdin) body += chunk;
+
+let input;
+try {
+  input = JSON.parse(body);
+} catch {
+  process.exit(0);
+}
+
+if (!/^[A-Za-z0-9-]+$/.test(input.session_id || "")) process.exit(0);
+
+if (input.tool_name === "collaborationspawn_agent") rememberSpawn(input);
+if (input.tool_name === "collaborationinterrupt_agent") markCompletion(input);

package/hooks/hooks.json

@@ -1,7 +1,10 @@
 {
   "hooks": {
     "SessionStart": [
-      { "matcher": "startup", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-scaffold-nudge.sh" }] }
+      { "matcher": "startup", "hooks": [
+        { "type": "command", "command": "node ${CLAUDE_PLUGIN_ROOT}/scripts/codex-agents.mjs --session-start" },
+        { "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-scaffold-nudge.sh" }
+     ] }
     ],
     "UserPromptSubmit": [
       { "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh user-prompt" }] }
@@ -10,7 +13,7 @@
       { "matcher": "Bash|Edit|Write|ExitPlanMode|EnterPlanMode", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh pre-tool" }] }
     ],
     "PostToolUse": [
-      { "matcher": "Agent|Bash|Edit|Skill|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh post-tool" }] }
+      { "matcher": "Agent|Bash|Edit|Skill|Write|collaborationspawn_agent|collaborationinterrupt_agent", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh post-tool" }] }
     ]
   }
 }

package/hooks/risk-scorer-dispatch.sh

@@ -52,6 +52,9 @@ case "$EVENT" in
         run_hook risk-score-mark.sh
         run_hook risk-slide-marker.sh
         ;;
+      collaborationspawn_agent|collaborationinterrupt_agent)
+        printf '%s' "$INPUT" | node "$SCRIPT_DIR/codex-agent-completion.mjs"
+        ;;
       Bash)
         run_hook risk-hash-refresh.sh
         run_hook risk-slide-marker.sh

package/hooks/risk-scorer-scaffold-nudge.sh

@@ -33,6 +33,17 @@
 
 set -euo pipefail
 
+cat >/dev/null
+IS_CODEX="${CODEX_THREAD_ID:+1}"
+
+emit_message() {
+  if [ "${IS_CODEX:-0}" = "1" ]; then
+    MESSAGE="$1" python3 -c 'import json,os; print(json.dumps({"systemMessage": os.environ["MESSAGE"]}))'
+  else
+    printf '%s\n' "$1"
+  fi
+}
+
 if [ "${WR_SUPPRESS_OVERSIGHT_NUDGE:-}" = "1" ]; then
   exit 0
 fi
@@ -55,13 +66,13 @@ REGISTER_DIR="$PROJECT_DIR/docs/risks"
 # — the hook never writes; the policy authoring is gated behind the user
 # invoking the on-demand skill.
 if [ ! -f "$POLICY_FILE" ]; then
-  echo "[wr-risk-scorer] No RISK-POLICY.md in this project — run /wr-risk-scorer:update-policy to author one so the risk-scorer gates score against your appetite instead of the default."
+  emit_message "[wr-risk-scorer] No RISK-POLICY.md in this project — run /wr-risk-scorer:update-policy to author one so the risk-scorer gates score against your appetite instead of the default."
   exit 0
 fi
 
 # Register directory missing — nudge to scaffold it.
 if [ ! -d "$REGISTER_DIR" ]; then
-  echo "[wr-risk-scorer] RISK-POLICY.md present but docs/risks/ is missing — run /wr-risk-scorer:bootstrap-catalog to scaffold the standing-risk register."
+  emit_message "[wr-risk-scorer] RISK-POLICY.md present but docs/risks/ is missing — run /wr-risk-scorer:bootstrap-catalog to scaffold the standing-risk register."
   exit 0
 fi
 
@@ -76,7 +87,7 @@ PENDING="${PENDING:-0}"
 [ "$PENDING" -gt 0 ] 2>/dev/null || exit 0
 
 if [ "$PENDING" -eq 1 ]; then
-  echo "[wr-risk-scorer] 1 standing-risk entry is pending review — curate it in docs/risks/ (enumerate controls + Impact×Likelihood scoring)."
+  emit_message "[wr-risk-scorer] 1 standing-risk entry is pending review — curate it in docs/risks/ (enumerate controls + Impact×Likelihood scoring)."
 else
-  echo "[wr-risk-scorer] $PENDING standing-risk entries are pending review — curate them in docs/risks/ (enumerate controls + Impact×Likelihood scoring)."
+  emit_message "[wr-risk-scorer] $PENDING standing-risk entries are pending review — curate them in docs/risks/ (enumerate controls + Impact×Likelihood scoring)."
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.17.4",
+  "version": "0.18.0",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",
@@ -33,6 +33,9 @@
     "lib/",
     "scripts/",
     "!skills/*/eval/",
-    "!agents/eval/"
+    "!agents/eval/",
+    "!agents/test/",
+    "!hooks/test/",
+    "!scripts/test/"
   ]
 }

package/scripts/codex-agents.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const ownerMarker = "# Generated by @windyroad/risk-scorer from ";
+
+const externalCommsCodexInstructions = `
+
+## Codex completion marker compatibility
+
+Codex encrypts custom-agent spawn prompts before PostToolUse hooks receive them.
+When the request contains a \`SURFACE:\` line and a \`<draft>...</draft>\` block,
+compute the canonical marker key with the same normalization documented above:
+
+1. For \`changeset-author\`, remove leading YAML frontmatter and its following blank line.
+2. Convert CRLF and CR line endings to LF.
+3. Remove trailing whitespace from every line, then from the complete draft.
+4. Compute lowercase SHA-256 over \`normalized draft + "\\n" + surface\`.
+
+Use a local shell or Python command to compute the digest; do not estimate it.
+On PASS, append \`EXTERNAL_COMMS_RISK_KEY: <64 lowercase hex characters>\` after
+the verdict. On FAIL, do not emit a key. This is generated Codex-only behavior;
+the completion hook independently validates the key shape before writing a marker.`;
+
+export const riskAgentSpecs = [
+  ["pipeline", "Scores pipeline actions for cumulative residual risk."],
+  ["plan", "Reviews implementation plans and projected release risk."],
+  ["wip", "Assesses cumulative work-in-progress pipeline risk."],
+  ["policy", "Validates RISK-POLICY.md drafts for ISO 31000 compliance."],
+  ["external-comms", "Reviews outbound prose for confidentiality and credibility risk."],
+  ["inbound-report", "Reviews inbound reports for request and fix risk."],
+].map(([mode, fallbackDescription]) => ({
+  mode,
+  name: `wr-risk-scorer:${mode}`,
+  filename: `wr-risk-scorer-${mode}.toml`,
+  source: join(packageRoot, "agents", `${mode}.md`),
+  sourceLabel: `agents/${mode}.md`,
+  fallbackDescription,
+}));
+
+function splitFrontmatter(markdown) {
+  if (!markdown.startsWith("---\n")) return { frontmatter: "", body: markdown };
+  const end = markdown.indexOf("\n---\n", 4);
+  if (end === -1) return { frontmatter: "", body: markdown };
+  return {
+    frontmatter: markdown.slice(4, end),
+    body: markdown.slice(end + 5),
+  };
+}
+
+function frontmatterValue(frontmatter, key) {
+  const line = frontmatter.split(/\r?\n/).find((item) => item.startsWith(`${key}:`));
+  return line ? line.slice(key.length + 1).trim() : "";
+}
+
+function tomlMultiline(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"""/g, '\\"\\"\\"').trimEnd();
+}
+
+function renderPayload(spec) {
+  const { frontmatter, body } = splitFrontmatter(readFileSync(spec.source, "utf8"));
+  const description = frontmatterValue(frontmatter, "description") || spec.fallbackDescription;
+  const instructions = spec.mode === "external-comms"
+    ? `${body.trimEnd()}${externalCommsCodexInstructions}`
+    : body;
+  return [
+    "# Do not edit by hand; update the Claude agent markdown and regenerate.",
+    `name = ${JSON.stringify(spec.name)}`,
+    `description = ${JSON.stringify(description)}`,
+    'sandbox_mode = "read-only"',
+    'developer_instructions = """',
+    tomlMultiline(instructions),
+    '"""',
+    "",
+  ].join("\n");
+}
+
+function payloadHash(payload) {
+  return createHash("sha256").update(payload).digest("hex");
+}
+
+export function renderRiskAgent(spec) {
+  const payload = renderPayload(spec);
+  return [
+    `${ownerMarker}${spec.sourceLabel}.`,
+    `# Generated content SHA-256: ${payloadHash(payload)}`,
+    payload,
+  ].join("\n");
+}
+
+function isUnmodifiedGenerated(content, spec) {
+  if (!content.startsWith(`${ownerMarker}${spec.sourceLabel}.\n`)) return false;
+  const lines = content.split("\n");
+  const hashMatch = lines[1]?.match(/^# Generated content SHA-256: ([0-9a-f]{64})$/);
+  if (hashMatch) return payloadHash(lines.slice(2).join("\n")) === hashMatch[1];
+
+  // Migrate the marker-only format generated by the unreleased pilot.
+  return content === [`${ownerMarker}${spec.sourceLabel}.`, renderPayload(spec)].join("\n");
+}
+
+export function installRiskAgents(targetDir, { quiet = false } = {}) {
+  mkdirSync(targetDir, { recursive: true });
+  let changed = 0;
+  let preserved = 0;
+  for (const spec of riskAgentSpecs) {
+    const target = join(targetDir, spec.filename);
+    const expected = renderRiskAgent(spec);
+    if (!existsSync(target)) {
+      writeFileSync(target, expected, "utf8");
+      changed += 1;
+      continue;
+    }
+    const current = readFileSync(target, "utf8");
+    if (current === expected) continue;
+    if (isUnmodifiedGenerated(current, spec)) {
+      writeFileSync(target, expected, "utf8");
+      changed += 1;
+    } else {
+      preserved += 1;
+    }
+  }
+  if (!quiet) console.log(`Codex risk agents: ${changed} updated, ${riskAgentSpecs.length - changed - preserved} current, ${preserved} preserved.`);
+  return changed;
+}
+
+export function checkRiskAgents(targetDir) {
+  return riskAgentSpecs.every((spec) => {
+    const target = join(targetDir, spec.filename);
+    return existsSync(target) && readFileSync(target, "utf8") === renderRiskAgent(spec);
+  });
+}
+
+export function uninstallRiskAgents(targetDir, { quiet = false } = {}) {
+  let removed = 0;
+  for (const spec of riskAgentSpecs) {
+    const target = join(targetDir, spec.filename);
+    if (!existsSync(target)) continue;
+    if (!isUnmodifiedGenerated(readFileSync(target, "utf8"), spec)) continue;
+    rmSync(target);
+    removed += 1;
+  }
+  if (!quiet) console.log(`Codex risk agents: ${removed} removed.`);
+  return removed;
+}
+
+export function agentDirForScope(scope, cwd = process.cwd(), env = process.env) {
+  if (scope === "user") {
+    return join(env.CODEX_HOME || join(homedir(), ".codex"), "agents");
+  }
+  return join(cwd, ".codex", "agents");
+}
+
+function argValue(name) {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : "";
+}
+
+async function main() {
+  const sessionStart = process.argv.includes("--session-start");
+  if (sessionStart && !process.env.CODEX_THREAD_ID) return;
+
+  let sessionStartInput = {};
+  if (sessionStart) {
+    let input = "";
+    process.stdin.setEncoding("utf8");
+    for await (const chunk of process.stdin) input += chunk;
+    try {
+      sessionStartInput = JSON.parse(input);
+    } catch {
+      sessionStartInput = {};
+    }
+  }
+
+  const targetArg = argValue("--target");
+  const scope = argValue("--scope") || (sessionStart ? "user" : "project");
+  const targetDir = targetArg || agentDirForScope(scope);
+  const quiet = sessionStart || process.argv.includes("--quiet");
+
+  if (process.argv.includes("--check")) {
+    if (!checkRiskAgents(targetDir)) process.exitCode = 1;
+    return;
+  }
+  if (process.argv.includes("--uninstall")) {
+    uninstallRiskAgents(targetDir, { quiet });
+    return;
+  }
+
+  const changed = installRiskAgents(targetDir, { quiet });
+  if (sessionStart && changed > 0) {
+    const message = "wr-risk-scorer: Codex agents installed; restart Codex to activate them.";
+    console.log(JSON.stringify({ systemMessage: message }));
+  }
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await main();
+}

package/scripts/sync-codex-skills.mjs

@@ -23,7 +23,7 @@ const restoreMode = process.argv.includes("--restore-pack");
 
 const preamble = `<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use \`request_user_input\` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or \`subagent_type\`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in \`default\` subagent and instruct it to read the plugin's sibling \`agents/*.md\` instructions in full before returning the same structured verdict block.
+> Codex runtime note: use \`request_user_input\` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or \`subagent_type\`, use a native Codex subagent workflow and spawn the matching installed \`wr-risk-scorer:<mode>\` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in \`default\` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 `;
 
@@ -33,10 +33,10 @@ const updatePolicyCodexAgentStep = `Run the Codex policy reviewer with this prom
 >
 > [paste the full draft policy content here]
 
-Use a native Codex subagent workflow. Prefer the installed plugin agent named \`wr-risk-scorer:policy\` when available. In this source repo, the generated project-local alias \`wr-risk-scorer-policy\` may also be available for dogfooding. If neither custom agent is available in the current Codex session, spawn the built-in \`default\` subagent and instruct it to read \`agents/policy.md\` from this plugin in full before performing the review.`;
+Use a native Codex subagent workflow with the installed custom agent named \`wr-risk-scorer:policy\`. If it is not visible in the current session, restart Codex; do not substitute a different agent identity because the policy marker hook consumes it.`;
 
 function transform(text) {
-  return preamble + text
+  const transformed = text
     .replaceAll("AskUserQuestion", "request_user_input")
     .replaceAll("`.claude/agents/risk-scorer-pipeline.md`", "`agents/pipeline.md`")
     .replace(
@@ -47,6 +47,11 @@ function transform(text) {
 > [paste the full draft policy content here]`,
       updatePolicyCodexAgentStep,
     );
+  if (!transformed.startsWith("---\n")) return preamble + transformed;
+  const frontmatterEnd = transformed.indexOf("\n---\n", 4);
+  if (frontmatterEnd === -1) return preamble + transformed;
+  const bodyStart = frontmatterEnd + 5;
+  return transformed.slice(0, bodyStart) + "\n" + preamble + transformed.slice(bodyStart);
 }
 
 function generatedFiles(sourceRoot, targetRoot) {

package/skills/assess-external-comms/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:assess-external-comms
 description: On-demand external-comms risk review. Reviews a draft of an outbound prose tool call (gh issue/pr body, security advisory, npm publish content, or .changeset/*.md body) for confidential-information leaks per RISK-POLICY.md. Delegates to wr-risk-scorer:external-comms and pre-satisfies the external-comms-gate marker for the current session.
 allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # External-Comms Risk Assessment Skill
 
 Run a confidential-information leak review on demand against any drafted outbound prose — outside a hook gate trigger. Pre-satisfies the `external-comms-gate.sh` marker for the current session so the gated tool call (gh issue/pr/api/npm publish/changeset write) proceeds without re-prompting.

package/skills/assess-inbound-report/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:assess-inbound-report
 description: On-demand inbound-report risk review. Reviews a third-party submission against this repo's intake (problem-report issue body, Q&A discussion, security-advisory body) for Request-risk (info-extraction / backdoor request / malicious-code injection) and Fix-risk (privilege escalation / removal of load-bearing safety check / adopter-attack-surface expansion) per RISK-POLICY.md. Delegates to wr-risk-scorer:inbound-report and emits the structured verdict consumed by ADR-062's assessment-pipeline branch routing.
 allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # Inbound-Report Risk Assessment Skill
 
 Run a Request-risk + Fix-risk review on demand against a single inbound report — outside the `/wr-itil:review-problems` Step 8.5 assessment-pipeline trigger. Maintainer-facing pre-flight surface per JTBD-005 + JTBD-202; the assessment-pipeline itself invokes the same `wr-risk-scorer:inbound-report` subagent in-loop per ADR-062 § Decision Outcome step 3.

package/skills/assess-release/SKILL.md

@@ -1,13 +1,14 @@
-<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
-
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
-
 ---
 name: wr-risk-scorer:assess-release
 description: On-demand release risk assessment. Scores commit, push, and release risk for the current unpushed changes. Delegates to wr-risk-scorer:pipeline and satisfies the commit gate for the current session.
 allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+
+
 # Release Risk Assessment Skill
 
 Run a pipeline risk assessment on demand — outside a hook gate trigger. Scores commit, push, and release risk layers for the current unpushed changes and satisfies the gate for the current session.