@windyroad/risk-scorer 0.18.16 → 0.18.17

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.18.16"
+  "version": "0.18.17"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.18.16",
+  "version": "0.18.17",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/hooks/codex-agent-completion.mjs

@@ -182,7 +182,22 @@ function freshReceipt(path) {
   return Date.now() - statSync(path).mtimeMs < ttl;
 }
 
+function reapExpiredReceipts() {
+  if (!existsSync(pendingDir())) return;
+  const receipt = /^[0-9a-f]{64}-[0-9a-f]{32}-[0-9a-f]{64}(?:\.claim|\.done)?$/;
+  for (const name of readdirSync(pendingDir())) {
+    if (!receipt.test(name)) continue;
+    const path = join(pendingDir(), name);
+    try {
+      if (!freshReceipt(path)) rmSync(path, { force: true });
+    } catch {
+      // A concurrent consumer may have renamed or removed it.
+    }
+  }
+}
+
 function persistPendingPipeline(input) {
+  reapExpiredReceipts();
   diagnoseSubagentStop(input, "received", "pipeline-receipt-attempt");
   if (input.agent_type !== "wr-risk-scorer:pipeline") {
     diagnoseSubagentStop(input, "rejected", "unexpected-agent-type");
@@ -302,6 +317,7 @@ function markSubagentStop(input) {
 
 function consumePending(input) {
   if (!/^[A-Za-z0-9-]+$/.test(input.session_id || "")) return;
+  reapExpiredReceipts();
   let root;
   try {
     root = realpathSync(process.cwd());

package/hooks/lib/risk-gate.sh

@@ -49,9 +49,18 @@ check_risk_gate() {
 
   # Scores and bypasses belong to the physical checkout that was assessed.
   # Fail closed for legacy markers that predate this binding.
+  if [ ! -s "$CHECKOUT_FILE" ]; then
+    RISK_GATE_CATEGORY="drift"
+    RISK_GATE_REASON="Risk assessment checkout binding is missing. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to rescore this checkout."
+    return 1
+  fi
   if ! _checkout_matches "$CHECKOUT_FILE"; then
     RISK_GATE_CATEGORY="drift"
-    RISK_GATE_REASON="Risk assessment checkout binding is missing or does not match the current Git checkout. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to rescore this checkout."
+    if [ -n "${CODEX_THREAD_ID:-}" ]; then
+      RISK_GATE_REASON="Risk assessment checkout binding does not match the checkout visible to this hook. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && ...\`; the valid score was preserved, so do not rescore unless that checkout changed."
+    else
+      RISK_GATE_REASON="Risk assessment checkout binding is missing or does not match the current Git checkout. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to rescore this checkout."
+    fi
     return 1
   fi
 

package/hooks/risk-scorer-dispatch.sh

@@ -29,10 +29,11 @@ case "$EVENT" in
       NUDGE_OUTPUT=""
     fi
     if [ -n "${CODEX_THREAD_ID:-}" ]; then
-      AGENT_OUTPUT="$AGENT_OUTPUT" NUDGE_OUTPUT="$NUDGE_OUTPUT" python3 -c '
+      CODEX_CWD_OUTPUT='{"systemMessage":"Codex checkout safety: for git commit, npm run push:watch, npm run release:watch, and changeset commands, put an explicit leading `cd /absolute/git/root &&` inside the command. A tool workdir alone may be hidden from checkout-binding hooks."}'
+      AGENT_OUTPUT="$AGENT_OUTPUT" NUDGE_OUTPUT="$NUDGE_OUTPUT" CODEX_CWD_OUTPUT="$CODEX_CWD_OUTPUT" python3 -c '
 import json, os
 messages = []
-for name in ("AGENT_OUTPUT", "NUDGE_OUTPUT"):
+for name in ("AGENT_OUTPUT", "NUDGE_OUTPUT", "CODEX_CWD_OUTPUT"):
     try:
         message = json.loads(os.environ[name]).get("systemMessage", "")
     except (json.JSONDecodeError, AttributeError):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.18.16",
+  "version": "0.18.17",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",

package/scripts/codex-agents.mjs

@@ -37,11 +37,19 @@ const pipelineCodexInstructions = `
 
 ## Codex assessed-checkout binding
 
+You are the endpoint pipeline scorer. Score the supplied state directly. Do
+not invoke the \`wr-risk-scorer:pipeline\` skill and do not spawn or delegate to
+another pipeline scorer; that wrapper exists for callers, not for this agent.
+
 The request must contain exactly one \`RISK_CWD: <absolute Git root>\` line.
 Repeat that exact line once after the structured risk output so the completion
 bridge can bind marker generation to the checkout that was assessed. Do not
 repeat the path elsewhere. If the request omits the line or provides more than
-one, do not emit \`RISK_SCORES\`; report that the assessed checkout is unbound.`;
+one, do not emit \`RISK_SCORES\`; report that the assessed checkout is unbound.
+
+The returned \`RISK_CWD\` is also the caller's command root. Subsequent governed
+commands must put \`cd <RISK_CWD> &&\` inside the command itself; a Codex tool
+\`workdir\` alone may be hidden from checkout-binding hooks.`;
 
 export const riskAgentSpecs = [
   ["pipeline", "Scores pipeline actions for cumulative residual risk."],