@windyroad/risk-scorer 0.18.8 → 0.18.9-preview.1049

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.18.8"
+  "version": "0.18.9"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.18.8",
+  "version": "0.18.9",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/hooks/codex-agent-completion.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
@@ -67,6 +67,37 @@ function claimTarget(input, target) {
   return { claim, done };
 }
 
+function pipelineAssessment(output) {
+  const roots = [...output.matchAll(/^RISK_CWD:[ \t]*(.+)$/gm)];
+  if (roots.length !== 1) return null;
+
+  const declaredRoot = roots[0][1].trim();
+  if (!isAbsolute(declaredRoot)) return null;
+
+  let root;
+  try {
+    root = realpathSync(declaredRoot);
+  } catch {
+    return null;
+  }
+  const git = spawnSync("git", ["-C", root, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  if (git.status !== 0) return null;
+
+  let gitRoot;
+  try {
+    gitRoot = realpathSync(git.stdout.trim());
+  } catch {
+    return null;
+  }
+  if (gitRoot !== root) return null;
+
+  let sanitized = output.split(/\r?\n/).filter((line) => !line.startsWith("RISK_CWD:")).join("\n");
+  for (const privatePath of new Set([declaredRoot, root])) {
+    sanitized = sanitized.split(privatePath).join("<assessed-root>");
+  }
+  return { root, output: sanitized };
+}
+
 function markTarget(input, target, output) {
   if (typeof target !== "string" || typeof output !== "string" || !output) return;
 
@@ -77,14 +108,24 @@ function markTarget(input, target, output) {
   const claim = claimTarget(input, target);
   if (!claim) return;
 
+  const assessment = role === "wr-risk-scorer:pipeline" ? pipelineAssessment(output) : null;
+  if (role === "wr-risk-scorer:pipeline" && !assessment) {
+    rmSync(claim.claim, { force: true });
+    process.exitCode = 1;
+    return;
+  }
+
+  const cwd = assessment?.root || input.cwd || process.cwd();
+
   const synthetic = {
     ...input,
+    cwd,
     tool_name: "Agent",
     tool_input: { subagent_type: role, prompt: "" },
-    tool_response: { content: [{ type: "text", text: output }] },
+    tool_response: { content: [{ type: "text", text: assessment?.output || output }] },
   };
   const result = spawnSync(join(hookDir, "risk-score-mark.sh"), {
-    cwd: input.cwd || process.cwd(),
+    cwd,
     env: process.env,
     input: JSON.stringify(synthetic),
     encoding: "utf8",

package/hooks/git-push-gate.sh

@@ -20,6 +20,13 @@ TOOL_NAME=$(_get_tool_name)
 COMMAND=$(_get_command)
 SESSION_ID=$(_get_session_id)
 
+if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*(git push|npm run (push:watch|release:watch)|npx changeset|npm run changeset|gh pr merge)(\s|$)'; then
+    if ! _enter_hook_cwd; then
+        risk_gate_deny "Pipeline action blocked: the command checkout could not be validated. Run the command from an absolute Git working directory and rescore that checkout."
+        exit 0
+    fi
+fi
+
 # Block git push to master/main/publish/changeset-release/*, or bare git push.
 # Allow explicit pushes to other branches (feature branches etc).
 if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*git push(\s|$)'; then
@@ -45,7 +52,7 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run push:watch(\s|$)'; then
             MARK_TIME=$(_mtime "${RDIR}/reducing-push")
             AGE=$(( NOW - MARK_TIME ))
             TTL_SECONDS="${RISK_TTL:-3600}"
-            if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
+            if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ] && _checkout_matches "${RDIR}/checkout-id"; then
                 STORED_HASH=$(cat "${RDIR}/state-hash")
                 CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
                 if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then
@@ -109,8 +116,11 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run release:watch(\s|$)'; the
         # Per JTBD-201, this MUST short-circuit BEFORE the CI-status check
         # so the hotfix path is unaffected by red CI on master.
         if [ -f "${RDIR}/incident-release" ]; then
+            if _checkout_matches "${RDIR}/checkout-id"; then
+                rm -f "${RDIR}/incident-release"
+                exit 0
+            fi
             rm -f "${RDIR}/incident-release"
-            exit 0
         fi
         # Risk-reducing bypass for release — session-scoped, drift-
         # revalidated (P192). Same lifecycle as reducing-push above.
@@ -119,7 +129,7 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run release:watch(\s|$)'; the
             MARK_TIME=$(_mtime "${RDIR}/reducing-release")
             AGE=$(( NOW - MARK_TIME ))
             TTL_SECONDS="${RISK_TTL:-3600}"
-            if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
+            if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ] && _checkout_matches "${RDIR}/checkout-id"; then
                 STORED_HASH=$(cat "${RDIR}/state-hash")
                 CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
                 if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then

package/hooks/lib/gate-helpers.sh

@@ -13,6 +13,21 @@ _mtime() { stat -c%Y "$1" 2>/dev/null || /usr/bin/stat -f%m "$1" 2>/dev/null ||
 # Portable hash: tries md5sum, falls back to md5 -r, then shasum
 _hashcmd() { md5sum 2>/dev/null || md5 -r 2>/dev/null || shasum 2>/dev/null; }
 
+# Opaque identity for the physical Git checkout. Device + inode distinguishes
+# separate clones with identical trees without persisting their local paths.
+_checkout_id() {
+    local root
+    root=$(git rev-parse --show-toplevel 2>/dev/null) || return 1
+    python3 -c 'import hashlib, os, sys; s=os.stat(os.path.realpath(sys.argv[1])); print(hashlib.sha256(f"{s.st_dev}:{s.st_ino}".encode()).hexdigest())' "$root" 2>/dev/null
+}
+
+_checkout_matches() {
+    local stored_file="$1" current
+    [ -s "$stored_file" ] || return 1
+    current=$(_checkout_id) || return 1
+    [ -n "$current" ] && [ "$(cat "$stored_file")" = "$current" ]
+}
+
 # ---------------------------------------------------------------------------
 # Substance-aware drift hash + atomic verdict-write (ADR-009 amendment
 # 2026-06-06, P353 + P303 close).
@@ -189,6 +204,45 @@ except:
 " 2>/dev/null || echo ""
 }
 
+_get_cwd() {
+    echo "$_HOOK_INPUT" | python3 -c "
+import json, re, shlex, sys
+try:
+    data = json.load(sys.stdin)
+    tool = data.get('tool_input', {})
+    command_cwd = ''
+    try:
+        tokens = shlex.split(tool.get('command', ''))
+        while tokens and re.fullmatch(r'[A-Za-z_][A-Za-z0-9_]*=.*', tokens[0]):
+            tokens.pop(0)
+        if len(tokens) >= 3 and tokens[0] == 'cd' and tokens[2] == '&&':
+            command_cwd = tokens[1]
+    except ValueError:
+        pass
+    print(tool.get('cwd') or tool.get('workdir') or command_cwd or data.get('cwd') or '')
+except:
+    print('')
+" 2>/dev/null || echo ""
+}
+
+_enter_hook_cwd() {
+    local declared real root
+    declared=$(_get_cwd)
+    if [ -z "$declared" ]; then
+        # Legacy Claude payloads omit cwd. The caller's process root remains a
+        # safe fallback because checkout-id matching still denies a marker
+        # minted by any other physical checkout.
+        return 0
+    fi
+    case "$declared" in /*) ;; *) return 1 ;; esac
+    real=$(python3 -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$declared" 2>/dev/null) || return 1
+    [ -d "$real" ] || return 1
+    root=$(git -C "$real" rev-parse --show-toplevel 2>/dev/null) || return 1
+    root=$(python3 -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' "$root" 2>/dev/null) || return 1
+    [ -d "$root" ] || return 1
+    cd "$root"
+}
+
 _get_file_path() {
     echo "$_HOOK_INPUT" | python3 -c "
 import sys, json

package/hooks/lib/risk-gate.sh

@@ -30,6 +30,7 @@ check_risk_gate() {
   local SCORE_FILE="${RDIR}/${ACTION}"
   local BORN_FILE="${RDIR}/${ACTION}-born"
   local HASH_FILE="${RDIR}/state-hash"
+  local CHECKOUT_FILE="${RDIR}/checkout-id"
   local TTL_SECONDS="${RISK_TTL:-3600}"
 
   RISK_GATE_CATEGORY=""
@@ -46,6 +47,14 @@ check_risk_gate() {
     return 1
   fi
 
+  # Scores and bypasses belong to the physical checkout that was assessed.
+  # Fail closed for legacy markers that predate this binding.
+  if ! _checkout_matches "$CHECKOUT_FILE"; then
+    RISK_GATE_CATEGORY="drift"
+    RISK_GATE_REASON="Risk assessment checkout binding is missing or does not match the current Git checkout. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to rescore this checkout."
+    return 1
+  fi
+
   # 2. TTL — Band C hard expiry first
   local NOW=$(date +%s)
   local SCORE_TIME=$(_mtime "$SCORE_FILE")

package/hooks/risk-hash-refresh.sh

@@ -12,6 +12,7 @@ COMMAND=$(_get_command)
 
 # Only act on commands that change git state
 echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*git (add|commit|stash|reset|checkout|restore)' || exit 0
+_enter_hook_cwd || exit 0
 
 SESSION_ID=$(_get_session_id)
 [ -n "$SESSION_ID" ] || exit 0
@@ -19,6 +20,7 @@ SESSION_ID=$(_get_session_id)
 RDIR=$(_risk_dir "$SESSION_ID")
 HASH_FILE="${RDIR}/state-hash"
 [ -f "$HASH_FILE" ] || exit 0  # No hash file yet — scorer hasn't run
+_checkout_matches "${RDIR}/checkout-id" || exit 0
 
 CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
 if [ -n "$CURRENT_HASH" ]; then

package/hooks/risk-score-commit-gate.sh

@@ -15,6 +15,10 @@ TOOL_NAME=$(_get_tool_name)
 
 COMMAND=$(_get_command)
 echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*git commit' || exit 0
+if ! _enter_hook_cwd; then
+    risk_gate_deny "Commit blocked: the command checkout could not be validated. Run the command from an absolute Git working directory and rescore that checkout."
+    exit 0
+fi
 
 # P170 / RFC-002 / ADR-031 T11: commit-message-embedded RISK_BYPASS
 # marker recognition. The adopter auto-migrate routine (T7,
@@ -92,7 +96,7 @@ if [ -f "${RDIR}/reducing-commit" ]; then
     MARK_TIME=$(_mtime "${RDIR}/reducing-commit")
     AGE=$(( NOW - MARK_TIME ))
     TTL_SECONDS="${RISK_TTL:-3600}"
-    if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
+    if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ] && _checkout_matches "${RDIR}/checkout-id"; then
         STORED_HASH=$(cat "${RDIR}/state-hash")
         CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
         if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then

package/hooks/risk-score-mark.sh

@@ -39,19 +39,23 @@ RDIR=$(_risk_dir "$SESSION_ID")
 if echo "$SUBAGENT" | grep -qE 'risk-scorer.pipeline'; then
   # Parse RISK_SCORES: commit=N push=N release=N
   SCORES_LINE=$(echo "$AGENT_OUTPUT" | grep -E '^RISK_SCORES:' | tail -1) || true
-  if [ -n "$SCORES_LINE" ]; then
-    COMMIT=$(echo "$SCORES_LINE" | grep -oE 'commit=[0-9]+' | cut -d= -f2) || true
-    PUSH=$(echo "$SCORES_LINE" | grep -oE 'push=[0-9]+' | cut -d= -f2) || true
-    RELEASE=$(echo "$SCORES_LINE" | grep -oE 'release=[0-9]+' | cut -d= -f2) || true
+  [ -n "$SCORES_LINE" ] || exit 1
+  COMMIT=$(echo "$SCORES_LINE" | grep -oE 'commit=[0-9]+' | cut -d= -f2) || true
+  PUSH=$(echo "$SCORES_LINE" | grep -oE 'push=[0-9]+' | cut -d= -f2) || true
+  RELEASE=$(echo "$SCORES_LINE" | grep -oE 'release=[0-9]+' | cut -d= -f2) || true
+  [ -n "$COMMIT" ] && [ -n "$PUSH" ] && [ -n "$RELEASE" ] || exit 1
 
-    # Birth markers (<action>-born) capture the scorer-run timestamp. Band B
-    # of the three-band TTL policy (P090) uses them to enforce a 2×TTL
-    # hard-cap on sliding-window extension, so an unchanged-but-idle tree
-    # cannot ride a single score indefinitely.
-    [ -n "$COMMIT" ] && { printf '%s' "$COMMIT" > "${RDIR}/commit"; touch "${RDIR}/commit-born"; }
-    [ -n "$PUSH" ] && { printf '%s' "$PUSH" > "${RDIR}/push"; touch "${RDIR}/push-born"; }
-    [ -n "$RELEASE" ] && { printf '%s' "$RELEASE" > "${RDIR}/release"; touch "${RDIR}/release-born"; }
-  fi
+  CHECKOUT_ID=$(_checkout_id) || exit 1
+  [ -n "$CHECKOUT_ID" ] || exit 1
+  rm -f "${RDIR}/checkout-id"
+
+  # Birth markers (<action>-born) capture the scorer-run timestamp. Band B
+  # of the three-band TTL policy (P090) uses them to enforce a 2×TTL
+  # hard-cap on sliding-window extension, so an unchanged-but-idle tree
+  # cannot ride a single score indefinitely.
+  printf '%s' "$COMMIT" > "${RDIR}/commit"; touch "${RDIR}/commit-born"
+  printf '%s' "$PUSH" > "${RDIR}/push"; touch "${RDIR}/push-born"
+  printf '%s' "$RELEASE" > "${RDIR}/release"; touch "${RDIR}/release-born"
 
   # Parse RISK_BYPASS: reducing|incident
   BYPASS_LINE=$(echo "$AGENT_OUTPUT" | grep -E '^RISK_BYPASS:' | tail -1) || true
@@ -162,6 +166,10 @@ print(json.dumps({
       done <<< "$HINT_BLOCK"
     fi
   } 2>/dev/null || true
+
+  # Publish the physical-checkout binding last. If any required marker write
+  # above fails, legacy scores remain unusable in a different checkout.
+  printf '%s' "$CHECKOUT_ID" > "${RDIR}/checkout-id"
 fi
 
 # ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.18.8",
+  "version": "0.18.9-preview.1049",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",

package/scripts/codex-agents.mjs

@@ -33,6 +33,16 @@ On PASS, append \`EXTERNAL_COMMS_RISK_KEY: <64 lowercase hex characters>\` after
 the verdict. On FAIL, do not emit a key. This is generated Codex-only behavior;
 the completion hook independently validates the key shape before writing a marker.`;
 
+const pipelineCodexInstructions = `
+
+## Codex assessed-checkout binding
+
+The request must contain exactly one \`RISK_CWD: <absolute Git root>\` line.
+Repeat that exact line once after the structured risk output so the completion
+bridge can bind marker generation to the checkout that was assessed. Do not
+repeat the path elsewhere. If the request omits the line or provides more than
+one, do not emit \`RISK_SCORES\`; report that the assessed checkout is unbound.`;
+
 export const riskAgentSpecs = [
   ["pipeline", "Scores pipeline actions for cumulative residual risk."],
   ["plan", "Reviews implementation plans and projected release risk."],
@@ -73,7 +83,9 @@ function renderPayload(spec) {
   const description = frontmatterValue(frontmatter, "description") || spec.fallbackDescription;
   const instructions = spec.mode === "external-comms"
     ? `${body.trimEnd()}${externalCommsCodexInstructions}`
-    : body;
+    : spec.mode === "pipeline"
+      ? `${body.trimEnd()}${pipelineCodexInstructions}`
+      : body;
   return [
     "# Do not edit by hand; update the Claude agent markdown and regenerate.",
     `name = ${JSON.stringify(spec.name)}`,

package/skills/assess-release/SKILL.md

@@ -32,6 +32,9 @@ Read `$ARGUMENTS` for an explicit release scope (e.g., "release v1.3.0", "commit
 Run the following to establish the assessment scope:
 
 ```bash
+# Exact checkout whose state the completion marker must bind to.
+git rev-parse --show-toplevel
+
 # Unpushed commits
 git log origin/$(git rev-parse --abbrev-ref HEAD)..HEAD --oneline 2>/dev/null || git log HEAD --oneline -10
 
@@ -62,6 +65,7 @@ Do not ask if there is an obvious unpushed commit queue.
 ### 4. Construct the assessment prompt
 
 Build a self-contained prompt for the pipeline subagent that includes:
+- A single `RISK_CWD: <absolute Git root>` line from Step 2
 - The git log summary (unpushed commits with subjects)
 - The staged diff summary (file names and line counts)
 - The changeset list (if any)

package/skills/pipeline/SKILL.md

@@ -18,7 +18,7 @@ This SKILL is an **invokable wrapper** around the `wr-risk-scorer:pipeline` agen
 ## Contract
 
 - **Input** (`$ARGUMENTS`): a self-contained scoring prompt with pipeline state context. Caller assembles UNCOMMITTED / UNPUSHED / UNRELEASED sections per `packages/risk-scorer/agents/pipeline.md` § Pipeline State.
-- **Output**: the agent's verbatim report, including the structured `RISK_SCORES: commit=N push=N release=N` block, optional `RISK_BYPASS:` line, optional `RISK_REMEDIATIONS:` block, optional `RISK_REGISTER_HINT:` block, and optional `CATALOG_HIT_RATE:` line.
+- **Output**: the agent's verbatim report, including the structured `RISK_SCORES: commit=N push=N release=N` block, required `RISK_CWD:` line supplied by the caller, optional `RISK_BYPASS:` line, optional `RISK_REMEDIATIONS:` block, optional `RISK_REGISTER_HINT:` block, and optional `CATALOG_HIT_RATE:` line.
 - **Side effects**: the `PostToolUse:Agent` hook (`risk-score-mark.sh`) reads the agent's output downstream of this wrapper and writes the bypass marker files to `${TMPDIR}/claude-risk-${SESSION_ID}/`. The wrapper itself writes no files.
 
 ## Steps
@@ -27,6 +27,16 @@ This SKILL is an **invokable wrapper** around the `wr-risk-scorer:pipeline` agen
 
 Invoke the pipeline subagent via the Agent tool with the caller's `$ARGUMENTS` verbatim. Dispatch it **synchronously** (`run_in_background: false`) — the `PostToolUse:Agent` mark hook that writes the risk-gate marker fires reliably only for a synchronous agent; a background-launched scorer's mark hook does not fire in time, so no marker persists and the commit/push gate re-blocks despite a within-appetite score (P402):
 
+On Codex, when the Agent tool is exposed as `spawn_agent`, pass
+`agent_type: wr-risk-scorer:pipeline` with `fork_turns: "none"`. Codex rejects an
+explicit agent type on a full-history fork; omitting the type on retry also
+prevents the completion bridge from binding the returned verdict. `$ARGUMENTS`
+is already self-contained, so no forked conversation context is required.
+After the Codex agent reports completion, close that completed agent exactly
+once so the compatibility hook receives the structured result. When Codex
+exposes completed-agent close as `interrupt_agent`, invoke it once on the
+completed target; do not relaunch or inspect a transcript.
+
 ```
 subagent_type: wr-risk-scorer:pipeline
 run_in_background: false
@@ -35,6 +45,6 @@ prompt: $ARGUMENTS
 
 ### 2. Return the agent report verbatim
 
-Return the agent's response to the caller without alteration. Do NOT strip, paraphrase, or post-process the structured output blocks (`RISK_SCORES:`, `RISK_BYPASS:`, `RISK_REMEDIATIONS:`, `RISK_REGISTER_HINT:`, `CATALOG_HIT_RATE:`). The PostToolUse hook depends on the exact byte sequence to parse.
+Return the agent's response to the caller without alteration. Do NOT strip, paraphrase, or post-process the structured output blocks (`RISK_SCORES:`, `RISK_CWD:`, `RISK_BYPASS:`, `RISK_REMEDIATIONS:`, `RISK_REGISTER_HINT:`, `CATALOG_HIT_RATE:`). The PostToolUse hook depends on the exact byte sequence to parse.
 
 $ARGUMENTS