@windyroad/risk-scorer 0.19.14 → 0.19.15-preview.1293

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -310,5 +310,5 @@
310
310
  }
311
311
  },
312
312
  "name": "wr-risk-scorer",
313
- "version": "0.19.14"
313
+ "version": "0.19.15"
314
314
  }
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "wr-risk-scorer",
3
- "version": "0.19.14",
3
+ "version": "0.19.15",
4
4
  "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
5
5
  "author": {
6
6
  "name": "Windy Road Technology",
@@ -5,7 +5,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameS
5
5
  import { dirname, isAbsolute, join } from "node:path";
6
6
  import { spawnSync } from "node:child_process";
7
7
  import { fileURLToPath } from "node:url";
8
- import { CLOSE_TOOLS, SPAWN_TOOLS, WAIT_TOOLS, response } from "./lib/codex-completion-input.mjs";
8
+ import { CLOSE_TOOLS, SPAWN_TOOLS, WAIT_TOOLS, completionTarget, response } from "./lib/codex-completion-input.mjs";
9
9
 
10
10
  const hookDir = dirname(fileURLToPath(import.meta.url));
11
11
  const markedPipelineRoots = new Set();
@@ -258,6 +258,8 @@ function stateHash(root) {
258
258
 
259
259
  function markTarget(input, target, output) {
260
260
  if (typeof target !== "string" || typeof output !== "string" || !output) return;
261
+ target = completionTarget(target, riskDir(input.session_id), "codex-agent-");
262
+ if (!target) return;
261
263
 
262
264
  const state = statePath(input, target);
263
265
  if (!existsSync(state)) return;
@@ -1,3 +1,27 @@
1
+ import { readdirSync } from "node:fs";
2
+
3
+ // Resolve only this session's state files, including completed claims so an
4
+ // ambiguous short name cannot consume a different reviewer after delivery.
5
+ export function completionTarget(rawTarget, directory, prefix, rolePrefix = "") {
6
+ if (typeof rawTarget !== "string" || !rawTarget) return "";
7
+ const canonical = rawTarget.startsWith("/root/");
8
+ const target = canonical ? rawTarget.slice(6) : rawTarget;
9
+ let files;
10
+ try { files = readdirSync(directory); } catch { return ""; }
11
+ const targets = new Set();
12
+ for (const file of files) {
13
+ if (!file.startsWith(prefix)) continue;
14
+ const encoded = file.slice(prefix.length).replace(/\.(claim|done)$/, "");
15
+ const decoded = Buffer.from(encoded, "base64url").toString();
16
+ if (Buffer.from(decoded).toString("base64url") !== encoded || !decoded.startsWith(rolePrefix)) continue;
17
+ targets.add(decoded.slice(rolePrefix.length));
18
+ }
19
+ if (targets.has(target)) return target;
20
+ if (canonical) return "";
21
+ const matches = [...targets].filter((registered) => registered.endsWith("/" + target));
22
+ return matches.length === 1 ? matches[0] : "";
23
+ }
24
+
1
25
  export const SPAWN_TOOLS = new Set([
2
26
  "collaboration.spawn_agent",
3
27
  "collaborationspawn_agent",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@windyroad/risk-scorer",
3
- "version": "0.19.14",
3
+ "version": "0.19.15-preview.1293",
4
4
  "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
5
5
  "scripts": {
6
6
  "prepack": "node scripts/sync-codex-skills.mjs --pack",