@windyroad/risk-scorer 0.19.12 → 0.19.13-preview.1285

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.19.12"
+  "version": "0.19.13"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.19.12",
+  "version": "0.19.13",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/hooks/external-comms-gate.sh

@@ -159,6 +159,7 @@ EOF
 # ---------- Surface detection ----------
 SURFACE=""
 DRAFT=""
+BODY_FILE_ERROR=0
 
 case "$TOOL_NAME" in
     Bash)
@@ -169,6 +170,15 @@ try:
 except Exception:
     print('')
 " 2>/dev/null || echo "")
+        TOOL_CWD=$(printf '%s' "$INPUT" | python3 -c "
+import sys, json
+try:
+    event = json.load(sys.stdin)
+    tool = event.get('tool_input', {})
+    print(tool.get('cwd') or tool.get('workdir') or event.get('cwd') or '')
+except Exception:
+    print('')
+" 2>/dev/null || echo "")
 
         # Surface match — most-specific first.
         if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*gh issue create(\s|$)'; then
@@ -230,13 +240,78 @@ except Exception:
         #   Then --body / --field for the gh + npm + security-advisories surfaces.
         #   Then -m / --message for git commit (single-line literal forms).
         #
-        # When absent (npm publish, --body-file, editor flow already filtered),
-        # DRAFT="" is acceptable: the agent will be invoked with command
-        # context and read whatever body source the call uses.
-        DRAFT=$(printf '%s' "$COMMAND" | python3 -c "
-import sys, re
+        # When absent (npm publish, editor flow already filtered), DRAFT=""
+        # is acceptable. A named body file must be readable before review.
+        if ! DRAFT=$(printf '%s' "$COMMAND" | python3 -c "
+import sys, re, os, shlex
 cmd = sys.stdin.read()
 surface = sys.argv[1]
+tool_cwd = sys.argv[2]
+if surface.startswith('gh-'):
+    try:
+        lexer = shlex.shlex(cmd, posix=True, punctuation_chars=';&|')
+        lexer.whitespace_split = True
+        lexer.commenters = ''
+        args = list(lexer)
+    except ValueError:
+        if '--body-file' in cmd or ' -F' in cmd or ' -b' in cmd:
+            raise SystemExit(2)
+        args = []
+    try:
+        base = os.path.abspath(tool_cwd) if os.path.isabs(tool_cwd) else ''
+        if len(args) >= 4 and args[0] == 'cd' and args[2] == '&&':
+            if os.path.isabs(args[1]):
+                base = os.path.abspath(args[1])
+            elif base:
+                base = os.path.abspath(os.path.join(base, args[1]))
+            args = args[3:]
+        # Skip known option values so a quoted title/body beginning with -F
+        # cannot be mistaken for a second body source.
+        valued = {'--title', '-t', '--template', '-T', '--repo', '-R',
+                  '--assignee', '-a', '--label', '-l', '--reviewer', '-r',
+                  '--milestone', '-m', '--project', '-p', '--base', '-B', '--head', '-H'}
+        sources = []
+        i = 3
+        while i < len(args):
+            arg = args[i]
+            if arg and all(ch in ';&|' for ch in arg):
+                raise ValueError('ambiguous command')
+            if arg in ('--body-file', '-F', '--body', '-b'):
+                sources.append(('file' if arg in ('--body-file', '-F') else 'body',
+                                args[i + 1] if i + 1 < len(args) else '', arg))
+                i += 2
+            elif arg.startswith('--body-file=') or arg.startswith('--body='):
+                sources.append(('file' if arg.startswith('--body-file=') else 'body',
+                                arg.split('=', 1)[1], arg.split('=', 1)[0]))
+                i += 1
+            elif arg.startswith('-F') or arg.startswith('-b'):
+                sources.append(('file' if arg.startswith('-F') else 'body',
+                                arg[3:] if arg[2:3] == '=' else arg[2:], arg[:2]))
+                i += 1
+            elif arg in valued:
+                i += 2
+            else:
+                i += 1
+        files = [value for kind, value, _ in sources if kind == 'file']
+        short_bodies = [value for kind, value, flag in sources if kind == 'body' and flag == '-b']
+        if files or short_bodies:
+            if args[:2] not in (['gh', 'issue'], ['gh', 'pr']):
+                raise ValueError('ambiguous command')
+            if files:
+                if len(files) != 1 or len(sources) != 1 or not files[0] or files[0] == '-':
+                    raise ValueError('ambiguous body file')
+                if not os.path.isabs(files[0]) and not base:
+                    raise ValueError('unknown command checkout')
+                path = files[0] if os.path.isabs(files[0]) else os.path.join(base, files[0])
+                with open(path, encoding='utf-8') as body_file:
+                    print(body_file.read(), end='')
+            else:
+                if len(sources) != 1 or not short_bodies[0]:
+                    raise ValueError('ambiguous body')
+                print(short_bodies[0], end='')
+            raise SystemExit
+    except (OSError, UnicodeError, ValueError):
+        raise SystemExit(2)
 # P364: bash double-quote unescape. The double-quoted body capture groups
 # carry RAW shell-escaped command text — an orchestrator must backslash-escape
 # backticks (and \$, \", \\) inside \"...\" to survive bash parsing, e.g.
@@ -310,7 +385,9 @@ for pat, flags, unescape in patterns:
             body = unescape_dq(body)
         print(body)
         break
-" "$SURFACE" 2>/dev/null || echo "")
+" "$SURFACE" "$TOOL_CWD" 2>/dev/null); then
+            BODY_FILE_ERROR=1
+        fi
         ;;
 
     Write|Edit)
@@ -362,6 +439,11 @@ print(json.dumps({
 " "$reason"
 }
 
+if [ "$BODY_FILE_ERROR" -eq 1 ]; then
+    deny_with_reason "BLOCKED (external-comms gate): body-file could not be read unambiguously from the command checkout. Use one readable UTF-8 --body-file path and review its exact contents before retrying."
+    exit 0
+fi
+
 permit_with_advisory() {
     local msg="$1"
     python3 -c "

package/hooks/lib/risk-gate.sh

@@ -39,7 +39,7 @@ check_risk_gate() {
   # 1. Score file must exist (fail-closed)
   if [ ! -f "$SCORE_FILE" ]; then
     RISK_GATE_CATEGORY="missing"
-    RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to wr-risk-scorer:pipeline to assess cumulative pipeline risk. On Codex, wait for the reviewer and confirm that exact target is completed; then invoke \`interrupt_agent\` exactly once on the completed target before retrying. If it is still running, keep waiting. The compatibility hook persists the completed structured verdict; no transcript parsing or nested codex exec is required. On Claude Code, dispatch the reviewer synchronously (\`run_in_background: false\`) before retrying."
+    RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to wr-risk-scorer:pipeline to assess cumulative pipeline risk. On Codex, spawn a fresh typed reviewer for each new assessment; followup_task cannot refresh a completed review marker. Wait for the reviewer and confirm that exact target is completed; then invoke \`interrupt_agent\` exactly once on the completed target before retrying. If it is still running, keep waiting. The compatibility hook persists the completed structured verdict; no transcript parsing or nested codex exec is required. On Claude Code, dispatch the reviewer synchronously (\`run_in_background: false\`) before retrying."
     return 1
   fi
 
@@ -163,7 +163,7 @@ print(('yes' if score > N else 'no') + ' ' + str(N))
   if [ "$DENIED" = "yes" ]; then
     RISK_GATE_CATEGORY="threshold"
     RISK_GATE_SCORE="$SCORE"
-    RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 exceeds the project appetite of ${APPETITE}/25 (RISK-POLICY.md). Reduce risk or halt — there is no proceed-anyway path (P377/RFC-029). To proceed within appetite: (1) split the ${ACTION}, (2) add risk-reducing measures and re-score, or (3) if this is incident response, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context — it scores the change against the live realised-risk baseline (ADR-042 Rule 1b) and clears it via the risk-reducing path if it is net-risk-reducing."
+    RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 exceeds the project appetite of ${APPETITE}/25 (RISK-POLICY.md). Reduce risk or halt — there is no proceed-anyway path (P377/RFC-029). After remediation on Codex, spawn a fresh typed wr-risk-scorer:pipeline reviewer for this checkout; followup_task does not refresh the recorded score. To proceed within appetite: (1) split the ${ACTION}, (2) add risk-reducing measures and re-score, or (3) if this is incident response, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context — it scores the change against the live realised-risk baseline (ADR-042 Rule 1b) and clears it via the risk-reducing path if it is net-risk-reducing."
     return 1
   fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.19.12",
+  "version": "0.19.13-preview.1285",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",

package/skills/pipeline/SKILL.md

@@ -34,7 +34,10 @@ prevents the completion bridge from binding the returned verdict. `$ARGUMENTS`
 is already self-contained, so no forked conversation context is required.
 After the Codex agent reports completion, invoke `interrupt_agent` exactly once
 on that completed target so the compatibility hook receives the structured
-result. Do not relaunch or inspect a transcript.
+result. After remediation changes the assessed risk, spawn a **new** typed
+reviewer with the updated state. `followup_task` on a completed reviewer does
+not create a new marker generation, so its later score cannot replace the
+recorded score. Do not relaunch the same target or inspect a transcript.
 
 ```
 subagent_type: wr-risk-scorer:pipeline