@windyroad/risk-scorer 0.19.1 → 0.19.2

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.19.1"
+  "version": "0.19.2"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/hooks/external-comms-gate.sh

@@ -138,6 +138,24 @@ _gh_api_has_body() {
     printf '%s' "$1" | grep -qE '(^|[[:space:]])(--field|--raw-field|--input|-f|-F)([[:space:]]|=)'
 }
 
+# P537: return success only when at least one matched command segment can
+# publish. Every publish segment must opt into a true dry run before the
+# external-comms review can be skipped; mixed commands therefore fail closed.
+_npm_publish_has_real_invocation() {
+    local segment
+    while IFS= read -r segment; do
+        if printf '%s' "$segment" | grep -qE '^\s*npm publish(\s|$)'; then
+            if ! printf '%s' "$segment" | grep -qE '(^|[[:space:]])--dry-run(=true)?($|[[:space:]])' \
+                || printf '%s' "$segment" | grep -qE '(^|[[:space:]])(--dry-run=false|--no-dry-run)($|[[:space:]])'; then
+                return 0
+            fi
+        fi
+    done <<EOF
+$(printf '%s' "$1" | tr ';&|' '\n\n\n')
+EOF
+    return 1
+}
+
 # ---------- Surface detection ----------
 SURFACE=""
 DRAFT=""
@@ -180,7 +198,11 @@ except Exception:
                 exit 0
             fi
         elif echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm publish(\s|$)'; then
-            SURFACE="npm-publish"
+            if _npm_publish_has_real_invocation "$COMMAND"; then
+                SURFACE="npm-publish"
+            else
+                exit 0
+            fi
         elif echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*git commit(\s|$)'; then
             # P082 Phase 1: gate `git commit -m / --message / HEREDOC` so commit
             # message bodies are reviewed by the voice-tone + risk evaluators
@@ -431,7 +453,7 @@ fi
 # (sha256(DRAFT + '\n' + SURFACE)). Single fire per gate cycle.
 VERDICT_PREFIX="${EXTERNAL_COMMS_VERDICT_PREFIX:-EXTERNAL_COMMS_${EXTERNAL_COMMS_EVALUATOR_ID^^}}"
 if [ -n "${CODEX_THREAD_ID:-}" ]; then
-    COMPLETION_GUIDANCE='On Codex, wait for the reviewer to finish, then close that completed agent once before retrying; the PostToolUse compatibility hook consumes the completed close response and persists its structured verdict, with no transcript parsing or nested codex exec.'
+    COMPLETION_GUIDANCE='On Codex, the calling agent waits for the reviewer to finish, then invokes `interrupt_agent` once on that completed target before retrying; the PostToolUse compatibility hook consumes the completed response and persists its structured verdict, with no transcript parsing or nested codex exec.'
 else
     COMPLETION_GUIDANCE='On Claude Code, dispatch the reviewer SYNCHRONOUSLY (run_in_background: false): a background-launched reviewer does not fire its PostToolUse mark hook, so the marker never persists and this gate re-blocks (P402).'
 fi

package/hooks/lib/risk-gate.sh

@@ -40,7 +40,7 @@ check_risk_gate() {
   if [ ! -f "$SCORE_FILE" ]; then
     RISK_GATE_CATEGORY="missing"
     if [ -n "${CODEX_THREAD_ID:-}" ]; then
-      RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to the native Codex agent wr-risk-scorer:pipeline to assess cumulative pipeline risk, wait for it to finish, then close that completed agent once before retrying. The PostToolUse compatibility hook consumes the completed close response and persists its structured verdict; no transcript parsing or nested codex exec is required."
+      RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to the native Codex agent wr-risk-scorer:pipeline to assess cumulative pipeline risk, wait for it to finish, then invoke interrupt_agent once on that completed target before retrying. The PostToolUse compatibility hook consumes the completed response and persists its structured verdict; no transcript parsing or nested codex exec is required."
     else
       RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to assess cumulative pipeline risk. Dispatch the scorer SYNCHRONOUSLY (run_in_background: false): a background-launched scorer does not fire its PostToolUse:Agent mark hook, so no marker persists and this gate re-blocks despite a within-appetite score (P402)."
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",

package/scripts/sync-codex-skills.mjs

@@ -24,7 +24,7 @@ const restoreMode = process.argv.includes("--restore-pack");
 
 const preamble = `<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use \`request_user_input\` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or \`subagent_type\`, use a native Codex subagent workflow and spawn the matching installed \`wr-risk-scorer:<mode>\` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested \`codex exec\`. Do not substitute the built-in \`default\` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use \`request_user_input\` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or \`subagent_type\`, use a native Codex subagent workflow and spawn the matching installed \`wr-risk-scorer:<mode>\` custom agent. Wait for it to finish, then invoke \`interrupt_agent\` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested \`codex exec\`. Do not substitute the built-in \`default\` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 `;
 

package/skills/assess-external-comms/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # External-Comms Risk Assessment Skill

package/skills/assess-inbound-report/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Inbound-Report Risk Assessment Skill

package/skills/assess-release/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Release Risk Assessment Skill

package/skills/assess-wip/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # WIP Risk Assessment Skill

package/skills/bootstrap-catalog/SKILL.md

@@ -7,7 +7,7 @@ maturity: proposed
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Risk Catalog Bootstrap

package/skills/create-risk/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Risk Register Entry Generator

package/skills/external-comms/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # External-Comms Leak Review Skill (Wrapper)

package/skills/pipeline/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Bash, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Pipeline Scoring Skill (Wrapper)
@@ -32,10 +32,9 @@ On Codex, when the Agent tool is exposed as `spawn_agent`, pass
 explicit agent type on a full-history fork; omitting the type on retry also
 prevents the completion bridge from binding the returned verdict. `$ARGUMENTS`
 is already self-contained, so no forked conversation context is required.
-After the Codex agent reports completion, close that completed agent exactly
-once so the compatibility hook receives the structured result. When Codex
-exposes completed-agent close as `interrupt_agent`, invoke it once on the
-completed target; do not relaunch or inspect a transcript.
+After the Codex agent reports completion, invoke `interrupt_agent` exactly once
+on that completed target so the compatibility hook receives the structured
+result. Do not relaunch or inspect a transcript.
 
 ```
 subagent_type: wr-risk-scorer:pipeline

package/skills/update-policy/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Risk Policy Generator

package/skills/wip/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Bash, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then invoke `interrupt_agent` once on that completed target so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # WIP Scoring Skill (Wrapper)