@windyroad/risk-scorer 0.19.8-preview.1264 → 0.19.8

package/hooks/codex-agent-completion.mjs

@@ -25,6 +25,66 @@ function pendingDir() {
   return join(process.env.TMPDIR || "/tmp", "claude-risk-pending");
 }
 
+function transportDir() {
+  return join(process.env.TMPDIR || "/tmp", "codex-review-transport");
+}
+
+function normalizeTarget(target) {
+  if (typeof target !== "string") return "";
+  return target.startsWith("/root/") ? target.slice("/root/".length) : target;
+}
+
+function transportId(sessionId, role, target) {
+  return createHash("sha256").update(`${sessionId}\0${role}\0${target}`).digest("hex");
+}
+
+function transportRegistrationPath(sessionId, role, target) {
+  return join(transportDir(), `registration-${transportId(sessionId, role, target)}.json`);
+}
+
+function transportReceiptPath(sessionId, role, target, suffix = "") {
+  return join(transportDir(), `risk-receipt-${transportId(sessionId, role, target)}.json${suffix}`);
+}
+
+function directoryBinding(cwd) {
+  if (typeof cwd !== "string" || !cwd) return null;
+  let root;
+  try { root = realpathSync(cwd); } catch { return null; }
+  const stat = statSync(root);
+  return { root, physical: `${stat.dev}:${stat.ino}` };
+}
+
+function policyHash(root) {
+  if (!existsSync(join(root, "RISK-POLICY.md"))) return null;
+  const result = spawnSync("bash", ["-c", 'source "$1"; _substance_hash_path RISK-POLICY.md', "risk-policy",
+    join(hookDir, "lib", "gate-helpers.sh")], { cwd: root, encoding: "utf8" });
+  const hash = result.stdout?.trim();
+  return result.status === 0 && /^[a-f0-9]{64}$/.test(hash || "") ? hash : null;
+}
+
+function policyBinding(root) {
+  const path = join(root, "RISK-POLICY.md");
+  if (!existsSync(path)) return { kind: "absent" };
+  const hash = policyHash(root);
+  return hash ? { kind: "hash", value: hash } : null;
+}
+
+function policyMatches(root, binding) {
+  if (!binding || !["absent", "hash"].includes(binding.kind)) return false;
+  const exists = existsSync(join(root, "RISK-POLICY.md"));
+  if (binding.kind === "absent") return !exists;
+  const current = policyHash(root);
+  return Boolean(current && current === binding.value);
+}
+
+function expectedExternalKey(prompt) {
+  if (typeof prompt !== "string" || !prompt) return null;
+  const result = spawnSync("bash", ["-c", 'source "$1"; value="$(cat)"; derive_external_comms_key_from_prompt "$value"',
+    "external-key", join(hookDir, "lib", "external-comms-key.sh")], { input: prompt, encoding: "utf8" });
+  const key = result.stdout?.trim();
+  return result.status === 0 && /^[a-f0-9]{64}$/.test(key || "") ? key : null;
+}
+
 function fieldType(input, field) {
   if (!input || !Object.prototype.hasOwnProperty.call(input, field)) return "absent";
   if (input[field] === null) return "null";
@@ -62,6 +122,18 @@ function statePath(input, target, suffix = "") {
 }
 
 function clearTarget(input, target) {
+  const state = statePath(input, target);
+  if (existsSync(state)) {
+    try {
+      const previousRole = readFileSync(state, "utf8");
+      if (riskAgentRoles.has(previousRole)) {
+        rmSync(transportRegistrationPath(input.session_id, previousRole, normalizeTarget(target)), { force: true });
+        for (const suffix of ["", ".claim", ".done"]) {
+          rmSync(transportReceiptPath(input.session_id, previousRole, normalizeTarget(target), suffix), { force: true });
+        }
+      }
+    } catch { /* The local state is best-effort cleanup only. */ }
+  }
   for (const suffix of ["", ".claim", ".done"]) {
     rmSync(statePath(input, target, suffix), { force: true });
   }
@@ -73,6 +145,7 @@ function spawnTarget(input) {
 }
 
 function rememberSpawn(input) {
+  reapRegisteredTransport();
   const role = input.tool_input?.agent_type;
   const target = spawnTarget(input);
   if (typeof target !== "string" || !target) return;
@@ -80,6 +153,29 @@ function rememberSpawn(input) {
   clearTarget(input, target);
   if (!riskAgentRoles.has(role)) return;
   writeFileSync(statePath(input, target), role, "utf8");
+  const normalized = normalizeTarget(target);
+  const bound = directoryBinding(input.cwd || process.cwd());
+  if (!bound) return;
+  const prompt = input.tool_input?.message ?? input.tool_input?.prompt ?? "";
+  const policy = policyBinding(bound.root);
+  if (!policy) return;
+  const wipStateHash = role === "wr-risk-scorer:wip" ? stateHash(bound.root) : null;
+  const wipCheckoutId = role === "wr-risk-scorer:wip" ? checkoutId(bound.root) : null;
+  if (role === "wr-risk-scorer:wip" && (!wipStateHash || !wipCheckoutId)) return;
+  const registered = {
+    parentSession: input.session_id,
+    role,
+    target: normalized,
+    ...bound,
+    policy,
+    promptDigest: createHash("sha256").update(prompt).digest("hex"),
+    expectedKey: role === "wr-risk-scorer:external-comms" ? expectedExternalKey(prompt) : null,
+    wipStateHash,
+    wipCheckoutId,
+    createdAt: Date.now(),
+  };
+  mkdirSync(transportDir(), { recursive: true, mode: 0o700 });
+  writeFileSync(transportRegistrationPath(input.session_id, role, normalized), JSON.stringify(registered), { mode: 0o600 });
 }
 
 function claimTarget(input, target) {
@@ -159,92 +255,6 @@ function stateHash(root) {
   return createHash("md5").update(state.stdout).digest("hex");
 }
 
-function completionId(input, output) {
-  if (typeof input.session_id !== "string" || typeof input.agent_id !== "string") return null;
-  return createHash("sha256").update(`${input.session_id}\0${input.agent_id}\0${output}`).digest("hex");
-}
-
-function pendingPath(id, hash, completion, suffix = "") {
-  return join(pendingDir(), `${id}-${hash}-${completion}${suffix}`);
-}
-
-function freshReceipt(path) {
-  if (!existsSync(path)) return false;
-  const ttl = Number.parseInt(process.env.RISK_TTL || "3600", 10) * 1000;
-  return Date.now() - statSync(path).mtimeMs < ttl;
-}
-
-function reapExpiredReceipts() {
-  if (!existsSync(pendingDir())) return;
-  const receipt = /^[0-9a-f]{64}-[0-9a-f]{32}-[0-9a-f]{64}(?:\.claim|\.done)?$/;
-  for (const name of readdirSync(pendingDir())) {
-    if (!receipt.test(name)) continue;
-    const path = join(pendingDir(), name);
-    try {
-      if (!freshReceipt(path)) rmSync(path, { force: true });
-    } catch {
-      // A concurrent consumer may have renamed or removed it.
-    }
-  }
-}
-
-function persistPendingPipeline(input) {
-  reapExpiredReceipts();
-  diagnoseSubagentStop(input, "received", "pipeline-receipt-attempt");
-  if (input.agent_type !== "wr-risk-scorer:pipeline") {
-    diagnoseSubagentStop(input, "rejected", "unexpected-agent-type");
-    return;
-  }
-  let rejection;
-  const assessment = pipelineAssessment(input.last_assistant_message, (reason) => { rejection = reason; });
-  if (!assessment) {
-    diagnoseSubagentStop(input, "rejected", rejection || "invalid-assessment");
-    return;
-  }
-  const id = checkoutId(assessment.root);
-  const hash = stateHash(assessment.root);
-  const completion = completionId(input, assessment.output);
-  if (!hash) {
-    diagnoseSubagentStop(input, "rejected", "state-hash-failed");
-    return;
-  }
-  if (!completion) {
-    diagnoseSubagentStop(input, "rejected", "missing-completion-identity");
-    return;
-  }
-  if (!/^RISK_SCORES: commit=\d+ push=\d+ release=\d+$/m.test(assessment.output)) {
-    diagnoseSubagentStop(input, "rejected", "missing-risk-scores");
-    return;
-  }
-  mkdirSync(pendingDir(), { recursive: true });
-  const path = pendingPath(id, hash, completion);
-  for (const candidate of [path, `${path}.done`]) {
-    if (freshReceipt(candidate)) {
-      diagnoseSubagentStop(input, "duplicate", "fresh-receipt-exists");
-      return;
-    }
-    rmSync(candidate, { force: true });
-  }
-  try {
-    writeFileSync(path, JSON.stringify({
-      role: input.agent_type,
-      output: assessment.output,
-      checkoutId: id,
-      stateHash: hash,
-      completionId: completion,
-      createdAt: Date.now(),
-    }), { flag: "wx", mode: 0o600 });
-    diagnoseSubagentStop(input, "receipt-written", "checkout-bound-receipt");
-  } catch (error) {
-    if (error?.code === "EEXIST") {
-      diagnoseSubagentStop(input, "duplicate", "receipt-race");
-      return;
-    }
-    diagnoseSubagentStop(input, "rejected", "receipt-write-failed");
-    throw error;
-  }
-}
-
 function markTarget(input, target, output) {
   if (typeof target !== "string" || typeof output !== "string" || !output) return;
 
@@ -280,6 +290,7 @@ function markTarget(input, target, output) {
   if (result.status === 0) {
     renameSync(claim.claim, claim.done);
     rmSync(state, { force: true });
+    rmSync(transportRegistrationPath(input.session_id, role, normalizeTarget(target)), { force: true });
   } else {
     rmSync(claim.claim, { force: true });
     process.exitCode = 1;
@@ -298,90 +309,199 @@ function markWait(input) {
   }
 }
 
-function markSubagentStop(input) {
-  const state = typeof input.agent_id === "string" ? statePath(input, input.agent_id) : "";
-  if (state && existsSync(state)) {
-    markTarget(input, input.agent_id, input.last_assistant_message);
-    return;
+function genericTtl() {
+  const text = process.env.RISK_TTL || "3600";
+  if (!/^[0-9]+$/.test(text)) return null;
+  const value = Number(text) * 1000;
+  return Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+
+function reapRegisteredTransport() {
+  const ttl = genericTtl();
+  if (!ttl || !existsSync(transportDir())) return;
+  for (const name of readdirSync(transportDir())) {
+    const path = join(transportDir(), name);
+    try {
+      const statAge = Date.now() - statSync(path).mtimeMs;
+      if (/^(?:receipt|risk-receipt)-[a-f0-9]{64}\.json\.(?:claim|done)$/.test(name)) {
+        if (!Number.isFinite(statAge) || statAge < 0 || statAge >= ttl) rmSync(path, { force: true });
+        continue;
+      }
+      if (!/^(?:registration|risk-receipt)-[a-f0-9]{64}\.json$/.test(name)) continue;
+      const value = JSON.parse(readFileSync(path, "utf8"));
+      if (!riskAgentRoles.has(value.role)) continue;
+      const timestamp = name.startsWith("risk-receipt-") ? value.completedAt : value.createdAt;
+      const age = Date.now() - timestamp;
+      if (!Number.isFinite(age) || age < 0 || age >= ttl) rmSync(path, { force: true });
+    } catch { /* Another completion may own or remove this transport file. */ }
   }
-  persistPendingPipeline(input);
 }
 
-function consumePending(input) {
-  if (!/^[A-Za-z0-9-]+$/.test(input.session_id || "")) return;
-  reapExpiredReceipts();
-  let root;
-  try {
-    root = realpathSync(process.cwd());
-  } catch {
-    return;
+function registrationCandidates(input, role, target) {
+  reapRegisteredTransport();
+  if (!existsSync(transportDir())) return [];
+  const current = directoryBinding(input.cwd || process.cwd());
+  return readdirSync(transportDir())
+    .filter((name) => /^registration-[a-f0-9]{64}\.json$/.test(name))
+    .flatMap((name) => {
+      const path = join(transportDir(), name);
+      try {
+        const registered = JSON.parse(readFileSync(path, "utf8"));
+        if (registered.role !== role || registered.target !== target) return [];
+        if (role !== "wr-risk-scorer:pipeline" && (!current || registered.root !== current.root || registered.physical !== current.physical)) return [];
+        return [{ path, registered }];
+      } catch { return []; }
+    });
+}
+
+function singleLine(output, label) {
+  return [...output.matchAll(new RegExp(`^${label}:[ \\t]*(.+)$`, "gm"))];
+}
+
+function applicableAssessment(role, output, registered, reject = () => {}) {
+  if (typeof output !== "string" || !output) return reject("missing-output"), null;
+  if (role === "wr-risk-scorer:pipeline") {
+    let reason;
+    const assessment = pipelineAssessment(output, (value) => { reason = value; });
+    if (!assessment || !/^RISK_SCORES: commit=\d+ push=\d+ release=\d+$/m.test(assessment.output)) {
+      reject(reason || "missing-risk-scores");
+      return null;
+    }
+    const hash = stateHash(assessment.root);
+    if (!hash) return reject("state-hash-failed"), null;
+    const assessmentPolicy = policyBinding(assessment.root);
+    if (!assessmentPolicy) return reject("policy-hash-failed"), null;
+    return { output: assessment.output, assessmentRoot: assessment.root, assessmentPolicy,
+      checkoutId: checkoutId(assessment.root), stateHash: hash };
+  }
+  if (role === "wr-risk-scorer:external-comms") {
+    const verdicts = singleLine(output, "EXTERNAL_COMMS_RISK_VERDICT");
+    const keys = singleLine(output, "EXTERNAL_COMMS_RISK_KEY");
+    const key = keys.length === 1 ? keys[0][1].trim().replaceAll("`", "") : "";
+    if (verdicts.length !== 1 || verdicts[0][1].trim() !== "PASS") return reject("non-pass-verdict"), null;
+    if (!/^[a-f0-9]{64}$/.test(key)) return reject("invalid-external-comms-key"), null;
+    if (!registered.expectedKey) return reject("missing-external-comms-key-binding"), null;
+    if (registered.expectedKey !== key) return reject("external-comms-key-mismatch"), null;
+    return { output, root: registered.root, key };
+  }
+  if (role === "wr-risk-scorer:plan" || role === "wr-risk-scorer:policy") {
+    const verdicts = singleLine(output, "RISK_VERDICT");
+    if (verdicts.length !== 1 || verdicts[0][1].trim() !== "PASS") return reject("non-pass-verdict"), null;
+    return { output, root: registered.root };
+  }
+  if (role === "wr-risk-scorer:wip") {
+    const verdicts = singleLine(output, "RISK_VERDICT");
+    if (verdicts.length !== 1 || !/^(CONTINUE|COMMIT)$/.test(verdicts[0][1].trim())) return reject("non-authorizing-wip-verdict"), null;
+    const currentHash = stateHash(registered.root);
+    if (!currentHash || currentHash !== registered.wipStateHash || checkoutId(registered.root) !== registered.wipCheckoutId) return reject("wip-state-changed"), null;
+    return { output, root: registered.root, wipStateHash: currentHash, wipCheckoutId: registered.wipCheckoutId };
+  }
+  reject("unsupported-marker-role");
+  return null;
+}
+
+function registrationValid(input, registered) {
+  const ttl = genericTtl();
+  const age = Date.now() - registered.createdAt;
+  if (!ttl) return diagnoseSubagentStop(input, "rejected", "invalid-risk-ttl"), false;
+  if (!Number.isFinite(age) || age < 0 || age >= ttl) return diagnoseSubagentStop(input, "rejected", "stale-parent-registration"), false;
+  if (!registered.policy || !["absent", "hash"].includes(registered.policy.kind)) return diagnoseSubagentStop(input, "rejected", "invalid-policy-binding"), false;
+  if (!policyMatches(registered.root, registered.policy)) return diagnoseSubagentStop(input, "rejected", "policy-changed"), false;
+  return true;
+}
+
+function persistRegisteredPending(input) {
+  const role = input.agent_type;
+  const target = normalizeTarget(input.task_name || input.agent_name || input.agent_id);
+  if (!riskAgentRoles.has(role) || !target) return false;
+  const candidates = registrationCandidates(input, role, target);
+  if (candidates.length !== 1) {
+    diagnoseSubagentStop(input, "rejected", candidates.length ? "ambiguous-parent-registration" : "missing-parent-registration");
+    return false;
+  }
+  const { registered } = candidates[0];
+  if (!registrationValid(input, registered)) return true;
+  let rejection;
+  const assessment = applicableAssessment(role, input.last_assistant_message, registered, (reason) => { rejection = reason; });
+  if (!assessment) {
+    diagnoseSubagentStop(input, "rejected", rejection || "invalid-assessment");
+    return true;
+  }
+  const path = transportReceiptPath(registered.parentSession, role, target);
+  if (existsSync(path) || existsSync(`${path}.done`)) {
+    diagnoseSubagentStop(input, "duplicate", "fresh-parent-bound-receipt-exists");
+    return true;
   }
-  const git = spawnSync("git", ["-C", root, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
-  if (git.status !== 0 || realpathSync(git.stdout.trim()) !== root) return;
-
-  const id = checkoutId(root);
-  const hash = stateHash(root);
-  if (!hash) return;
-  const prefix = `${id}-${hash}-`;
-  const pendingPaths = existsSync(pendingDir())
-    ? readdirSync(pendingDir())
-      .filter((name) => name.startsWith(prefix) && !name.endsWith(".claim") && !name.endsWith(".done"))
-      .map((name) => join(pendingDir(), name))
-      .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs)
-    : [];
-  const path = pendingPaths[0];
-  if (!path) return;
-
-  const claim = `${path}.claim`;
   try {
-    writeFileSync(claim, "", { flag: "wx", mode: 0o600 });
+    writeFileSync(path, JSON.stringify({ ...registered, ...assessment, completedAt: Date.now() }), { flag: "wx", mode: 0o600 });
+    diagnoseSubagentStop(input, "receipt-written", "parent-bound-receipt");
   } catch (error) {
-    if (error?.code === "EEXIST") return;
-    throw error;
+    diagnoseSubagentStop(input, error?.code === "EEXIST" ? "duplicate" : "rejected", error?.code === "EEXIST" ? "receipt-race" : "receipt-write-failed");
   }
+  return true;
+}
 
-  try {
-    const pending = JSON.parse(readFileSync(path, "utf8"));
-    const ttl = Number.parseInt(process.env.RISK_TTL || "3600", 10) * 1000;
-    if (pending.role !== "wr-risk-scorer:pipeline" || pending.checkoutId !== id ||
-        pending.stateHash !== hash || typeof pending.output !== "string" ||
-        typeof pending.completionId !== "string" || !path.endsWith(`-${pending.completionId}`) ||
-        !Number.isFinite(pending.createdAt) || Date.now() - pending.createdAt < 0 ||
-        Date.now() - pending.createdAt >= ttl) return;
-
-    const synthetic = {
-      ...input,
-      cwd: root,
-      tool_name: "Agent",
-      tool_input: { subagent_type: pending.role, prompt: "" },
-      tool_response: { content: [{ type: "text", text: pending.output }] },
-    };
-    const result = spawnSync(join(hookDir, "risk-score-mark.sh"), {
-      cwd: root,
-      env: process.env,
-      input: JSON.stringify(synthetic),
-      encoding: "utf8",
-    });
-    if (result.status !== 0) {
-      process.exitCode = 1;
-      return;
-    }
-    const assessedAt = new Date(pending.createdAt);
-    const markers = ["commit", "push", "release", "commit-born", "push-born", "release-born"];
-    if (/^RISK_BYPASS:\s*reducing\s*$/m.test(pending.output)) {
-      markers.push("reducing-commit", "reducing-push", "reducing-release");
-    } else if (/^RISK_BYPASS:\s*incident\s*$/m.test(pending.output)) {
-      markers.push("incident-release");
-    }
-    for (const marker of markers) {
-      const markerPath = join(riskDir(input.session_id), marker);
-      if (existsSync(markerPath)) utimesSync(markerPath, assessedAt, assessedAt);
+function markerPaths(role, session, pending) {
+  const dir = riskDir(session);
+  if (role === "wr-risk-scorer:pipeline") return ["commit", "push", "release", "commit-born", "push-born", "release-born", "state-hash", "checkout-id"].map((name) => join(dir, name));
+  if (role === "wr-risk-scorer:plan") return [join(dir, "plan-reviewed"), join(dir, "state-hash")];
+  if (role === "wr-risk-scorer:wip") return [join(dir, "wip-reviewed")];
+  if (role === "wr-risk-scorer:policy") return [join(dir, "policy-reviewed")];
+  if (role === "wr-risk-scorer:external-comms") return [join(dir, `external-comms-risk-reviewed-${pending.key}`)];
+  return [];
+}
+
+function consumeRegisteredPending(input) {
+  reapRegisteredTransport();
+  if (!existsSync(transportDir())) return;
+  const current = directoryBinding(process.cwd());
+  for (const name of readdirSync(transportDir()).filter((entry) => /^risk-receipt-[a-f0-9]{64}\.json$/.test(entry))) {
+    const path = join(transportDir(), name);
+    let pending;
+    try { pending = JSON.parse(readFileSync(path, "utf8")); } catch { continue; }
+    if (pending.parentSession !== input.session_id || !riskAgentRoles.has(pending.role)) continue;
+    if (!registrationValid(input, pending)) continue;
+    if (pending.role === "wr-risk-scorer:pipeline") {
+      if (!current || checkoutId(current.root) !== pending.checkoutId || stateHash(current.root) !== pending.stateHash) continue;
+      if (current.root !== pending.assessmentRoot || !policyMatches(current.root, pending.assessmentPolicy)) continue;
+    } else {
+      if (!current || current.root !== pending.root || current.physical !== pending.physical) continue;
+      if (pending.role === "wr-risk-scorer:wip" &&
+          (checkoutId(current.root) !== pending.wipCheckoutId || stateHash(current.root) !== pending.wipStateHash)) continue;
     }
-    renameSync(path, `${path}.done`);
-    for (const stale of pendingPaths.slice(1)) rmSync(stale, { force: true });
-  } finally {
-    rmSync(claim, { force: true });
+    const claim = `${path}.claim`;
+    try { writeFileSync(claim, "", { flag: "wx", mode: 0o600 }); }
+    catch (error) { if (error?.code === "EEXIST") continue; throw error; }
+    try {
+      const markerRoot = pending.role === "wr-risk-scorer:pipeline" ? pending.assessmentRoot : pending.root;
+      const synthetic = { ...input, session_id: pending.parentSession, cwd: markerRoot, tool_name: "Agent",
+        tool_input: { subagent_type: pending.role, prompt: "" }, tool_response: { content: [{ type: "text", text: pending.output }] } };
+      const result = spawnSync(join(hookDir, "risk-score-mark.sh"), { cwd: markerRoot, env: process.env, input: JSON.stringify(synthetic), encoding: "utf8" });
+      if (result.status !== 0) {
+        diagnoseSubagentStop(input, "rejected", "marker-writer-failed");
+        continue;
+      }
+      const assessedAt = new Date(pending.completedAt);
+      for (const marker of markerPaths(pending.role, pending.parentSession, pending)) if (existsSync(marker)) utimesSync(marker, assessedAt, assessedAt);
+      renameSync(path, `${path}.done`);
+      rmSync(transportRegistrationPath(pending.parentSession, pending.role, pending.target), { force: true });
+      rmSync(statePath({ session_id: pending.parentSession }, pending.target), { force: true });
+    } finally { rmSync(claim, { force: true }); }
+  }
+}
+
+function markSubagentStop(input) {
+  const state = typeof input.agent_id === "string" ? statePath(input, input.agent_id) : "";
+  if (state && existsSync(state)) {
+    markTarget(input, input.agent_id, input.last_assistant_message);
+    return;
   }
+  persistRegisteredPending(input);
+}
+
+function consumePending(input) {
+  if (!/^[A-Za-z0-9-]+$/.test(input.session_id || "")) return;
+  consumeRegisteredPending(input);
 }
 
 let body = "";
@@ -398,27 +518,18 @@ try {
   process.exit(0);
 }
 
-if (process.argv.includes("--consume-pending")) {
-  consumePending(input);
-  process.exit(process.exitCode || 0);
-}
-
-if (!/^[A-Za-z0-9-]+$/.test(input.session_id || "")) {
-  if (process.argv.includes("--subagent-stop")) {
-    diagnoseSubagentStop(input, "rejected", "invalid-session-id");
+try {
+  if (process.argv.includes("--consume-pending")) {
+    consumePending(input);
+  } else if (!/^[A-Za-z0-9-]+$/.test(input.session_id || "")) {
+    if (process.argv.includes("--subagent-stop")) diagnoseSubagentStop(input, "rejected", "invalid-session-id");
+  } else {
+    if (SPAWN_TOOLS.has(input.tool_name)) rememberSpawn(input);
+    if (CLOSE_TOOLS.has(input.tool_name)) markClose(input);
+    if (WAIT_TOOLS.has(input.tool_name)) markWait(input);
+    if (input.hook_event_name === "SubagentStop") markSubagentStop(input);
   }
-  process.exit(0);
-}
-
-if (SPAWN_TOOLS.has(input.tool_name)) {
-  rememberSpawn(input);
-}
-if (CLOSE_TOOLS.has(input.tool_name)) {
-  markClose(input);
-}
-if (WAIT_TOOLS.has(input.tool_name)) {
-  markWait(input);
-}
-if (input.hook_event_name === "SubagentStop") {
-  markSubagentStop(input);
+} catch {
+  diagnoseSubagentStop(input, "rejected", "transport-error");
+  process.exitCode = 0;
 }

package/hooks/risk-pending-receipt.sh

@@ -9,6 +9,6 @@ _parse_input
 
 TOOL_NAME="$(_get_tool_name)"
 EVENT_NAME="$(printf '%s' "$_HOOK_INPUT" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("hook_event_name", ""))' 2>/dev/null || true)"
-[ "$TOOL_NAME" = "Bash" ] || [ "$EVENT_NAME" = "UserPromptSubmit" ] || exit 0
+[ "$EVENT_NAME" = "PreToolUse" ] || [ "$EVENT_NAME" = "UserPromptSubmit" ] || [ "$TOOL_NAME" = "Bash" ] || exit 0
 _enter_hook_cwd || exit 0
 printf '%s' "$_HOOK_INPUT" | node "$SCRIPT_DIR/codex-agent-completion.mjs" --consume-pending

package/hooks/risk-scorer-dispatch.sh

@@ -55,6 +55,8 @@ if messages:
     run_hook staleness-check.sh
     ;;
   pre-tool)
+    # Import an exact-parent background receipt before every guarded action.
+    "$SCRIPT_DIR/risk-pending-receipt.sh" <<<"$INPUT" || true
     case "$(tool_name)" in
       Edit|Write)
         run_hook secret-leak-gate.sh
@@ -63,10 +65,6 @@ if messages:
         run_hook risk-policy-enforce-edit.sh
         ;;
       Bash)
-        # Current Codex emits SubagentStop in the child conversation but does
-        # not expose native collaboration calls to the parent's PostToolUse.
-        # Import the exact checkout/hash-bound receipt before enforcing gates.
-        "$SCRIPT_DIR/risk-pending-receipt.sh" <<<"$INPUT" || true
         run_hook git-push-gate.sh
         run_hook risk-score-commit-gate.sh
         run_hook external-comms-gate.sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.19.8-preview.1264",
+  "version": "0.19.8",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",