riskrails 3.0.1 → 3.2.1

package/hooks/context-guard.py

@@ -126,7 +126,7 @@ def user_settings():
         with open(os.path.join(config_dir(), "settings.json"), encoding="utf-8") as fh:
             settings = json.load(fh)
         return settings if isinstance(settings, dict) else {}
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return {}
 
 
@@ -157,7 +157,7 @@ def profile_context():
         with open(os.path.join(home, "riskrails", "profile.json"), encoding="utf-8") as fh:
             context = json.load(fh).get("context")
         return context if isinstance(context, dict) else {}
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, RecursionError, AttributeError):
         return {}
 
 
@@ -253,7 +253,7 @@ def current_context(path):
             continue
         try:
             entry = json.loads(raw)
-        except ValueError:
+        except (ValueError, RecursionError):
             continue
         if entry.get("type") == "system" and entry.get("subtype") == "compact_boundary":
             return None             # the numbers before it describe the old context
@@ -301,7 +301,7 @@ def scan_session(path):
                 continue
             try:
                 entry = json.loads(raw)
-            except ValueError:
+            except (ValueError, RecursionError):
                 continue
             if entry.get("isSidechain"):
                 continue
@@ -395,7 +395,7 @@ def task_in_flight(root):
     try:
         with open(state, encoding="utf-8") as fh:
             return (json.load(fh) or {}).get("current_stage") != "done"
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return False
 
 
@@ -412,7 +412,7 @@ def write_session(root, updates):
         with open(path, encoding="utf-8") as fh:
             data = json.load(fh)
         data = data if isinstance(data, dict) else {}
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         data = {}
     data.update(updates)
     try:
@@ -431,7 +431,7 @@ def prompt_count(root):
     try:
         with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
             count = json.load(fh).get("prompt_count")
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, RecursionError, AttributeError):
         return 0
     return count if isinstance(count, int) and not isinstance(count, bool) else 0
 
@@ -471,7 +471,7 @@ def recorded_mtime(root):
     try:
         with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
             return json.load(fh).get("account_mtime")
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, RecursionError, AttributeError):
         return None
 
 
@@ -488,7 +488,7 @@ def detect_drift(root, cwd, session, open_it=True, mtime=None):
         raw = ""
     try:
         found = json.loads(raw)
-    except ValueError:
+    except (ValueError, RecursionError):
         return None
     if root and mtime is not None and isinstance(found, dict):
         write_session(root, {"account_mtime": mtime})
@@ -514,9 +514,12 @@ def drift_notice(root, found, session):
                     f"DIALOG_PENDING {decision} — call {tool} with exactly this JSON, then run the picked "
                     f"command verbatim or 'state.py decision settle --id {decision}': {payload}")
     command = found.get("command") or ""
+    ack = found.get("ack")
+    keep = f" — or, to keep {installed} and not be told again for this account: {ack}" if ack else ""
     return (f"RiskRails: this account is {account}; RiskRails is installed for {installed}.",
             f"RiskRails: the account's plan is {account} but RiskRails is installed for {installed}, so its "
-            f"budgets do not match. Tell the user; in their own terminal, outside the agent, they run: {command}")
+            f"budgets do not match. Tell the user; in their own terminal, outside the agent, they run: {command}"
+            f"{keep}")
 
 
 def handoff_block(root, reason):
@@ -552,7 +555,7 @@ def task_frame(root, reason):
         tail.append(f"## Pending questions ({count}) — answer with `state.py answer …` "
                     "or fill the file")
         tail.append(prose or ids)
-    tail.append("Resume with: /ai-task --resume")
+    tail.append("Resume with: /rr-build --resume")
     if len("\n".join([head] + tail)) > HANDOFF_INJECT_MAX_CHARS and len(tail) > 1:
         tail[1] = ids                     # the questions collapse to their ids
     return head[:HANDOFF_INJECT_MAX_CHARS], "\n".join(tail)
@@ -656,7 +659,7 @@ def prompt_warning(payload, session, transcript):
     try:
         with open(marker, encoding="utf-8") as fh:
             state = json.load(fh)
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         state = {}
 
     def save():

package/hooks/dialog-gate.py

@@ -37,7 +37,7 @@ def prompt_count(root):
     try:
         with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
             count = json.load(fh).get("prompt_count")
-    except (OSError, ValueError, AttributeError):
+    except (OSError, ValueError, AttributeError, RecursionError):
         return None
     return count if isinstance(count, int) and not isinstance(count, bool) else None
 

package/hooks/guard/common.py

@@ -165,6 +165,8 @@ _WS = " \t\n\r"
 def parse_stream(text):
     """(values, ok): every JSON value of a jq input stream, and False when a
     parse error ended it (the values before the error are kept)."""
+    if text.startswith("\ufeff"):                  # jq skips one leading UTF-8 BOM
+        text = text[1:]
     values, i, n = [], 0, len(text)
     while True:
         while i < n and text[i] in _WS:

package/hooks/guard/dialog.py

@@ -7,11 +7,16 @@ tests/test_dialog_contract.py feeds both the same fixtures, so they cannot
 drift. Nothing here imports state.py: hooks run under `python3 -I -S`, stdlib
 only.
 
-Off is today: with .ai/policies/dialog.json missing or not `enabled: true`,
-no AI_UNATTENDED, the runtime's verified dialog tool, the main session and a
-session id all required, effective_switch() is False and no caller writes or
-decides anything (R36.1, R36.2). Readers fail open: a missing or unreadable
-file reads as "nothing open, nothing picked".
+The switch has three states (switch_state). Off is today: with
+.ai/policies/dialog.json missing or not `enabled: true`, AI_UNATTENDED set or
+the runtime's verified dialog tool missing, no caller writes or decides
+anything (R36.1, R36.2). Closed: the project's switch is on but the call
+cannot be bound to a session that can answer a dialog (a subagent, no session
+id, a session id that is not the hook environment's own); the dialog and the
+ledger treat it like off, the git consent rule refuses (terminal route). On:
+the main session with a session id. effective_switch() is True only for on.
+Readers fail open: a missing or unreadable file reads as "nothing open,
+nothing picked".
 """
 import contextlib
 import json
@@ -28,6 +33,10 @@ LOCK_STALE_S = 2.0
 LINE_MAX = 4096                             # one write; O_APPEND keeps a line whole up to this
 
 DIALOG_TOOL = {"claude": "AskUserQuestion", "codex": "request_user_input"}
+# The runtime's own session variable; the same mapping as state.py's. A hook's
+# environment carries it for Claude only (spike 2026-10-31: no CODEX_* variable
+# reaches a Codex hook), so it is compared only when present and non-empty.
+SESSION_ENV = {"claude": "CLAUDE_CODE_SESSION_ID", "codex": "CODEX_THREAD_ID"}
 LEDGER_TYPES = {"offer", "pick", "use", "void", "decline", "settle"}
 STOP_BLOCK = "stop_block"                   # the Stop loop breaker's count; no reader of consent reads it
 LABEL_FORBIDDEN = (";", "&", "|", "\n", "\r", "`", "$(", "<", ">")
@@ -63,13 +72,39 @@ def canonical(obj):
 
 
 # -- the switch ---------------------------------------------------------------
+JSON_DEPTH_MAX = 64                       # one nesting cap for both switches, not the stack's
+
+
+def json_loads_capped(text):
+    """json.loads(text), except that a text nested deeper than JSON_DEPTH_MAX is
+    malformed (ValueError). The parser's own limit moves with the stack depth, so
+    the hook and state.py could disagree; this scan does not recurse."""
+    depth, in_str, esc = 0, False, False
+    for ch in text:
+        if in_str:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_str = False
+        elif ch == '"':
+            in_str = True
+        elif ch in "[{":
+            depth += 1
+            if depth > JSON_DEPTH_MAX:
+                raise ValueError("JSON nested deeper than %d" % JSON_DEPTH_MAX)
+        elif ch in "]}":
+            depth -= 1
+    return json.loads(text)
+
 
 def dialog_policy(root):
     """.ai/policies/dialog.json when it says enabled: true, else None."""
     try:
         with open(os.path.join(root, ".ai", "policies", "dialog.json"), encoding="utf-8") as fh:
-            data = json.load(fh)
-    except (OSError, ValueError, TypeError):
+            data = json_loads_capped(fh.read())
+    except (OSError, ValueError, TypeError, RecursionError):
         return None
     if not isinstance(data, dict) or data.get("enabled") is not True:
         return None
@@ -79,7 +114,29 @@ def dialog_policy(root):
         value = value if isinstance(value, int) and not isinstance(value, bool) else default
         return min(high, max(low, value))
     return {"window_seconds": bounded("window_seconds", *WINDOW),
-            "stop_blocks_max": bounded("stop_blocks_max", STOP_BLOCKS_MAX, 0, STOP_BLOCKS_MAX)}
+            "stop_blocks_max": bounded("stop_blocks_max", STOP_BLOCKS_MAX, 0, STOP_BLOCKS_MAX),
+            "background_sessions": data.get("background_sessions") is True}
+
+
+def ai_unattended():
+    """AI_UNATTENDED is set when it is non-empty and not 0, false or no (case
+    and blanks ignored): one rule in every reader (risk 0587)."""
+    return os.environ.get("AI_UNATTENDED", "").strip().lower() not in ("", "0", "false", "no")
+
+
+def unattended(policy):
+    """True when the run is declared unattended: AI_UNATTENDED always; the
+    runtime's own marker (CLAUDE_CODE_SESSION_ATTENDED=0: a background job,
+    `claude -p`, the SDK) unless the project opts in with background_sessions:
+    true, for background jobs of the CLI a human is still chatting in. The
+    opt-in never covers an SDK entrypoint (CLAUDE_CODE_ENTRYPOINT sdk-*:
+    `claude -p`, an SDK host — nobody there answers the dialog; risk ffae).
+    state.py's dialog_on() keeps the same rule."""
+    if ai_unattended():
+        return True
+    background = policy.get("background_sessions") and \
+        not os.environ.get("CLAUDE_CODE_ENTRYPOINT", "").startswith("sdk-")
+    return os.environ.get("CLAUDE_CODE_SESSION_ATTENDED") == "0" and not background
 
 
 def runtime_home(runtime):
@@ -94,8 +151,8 @@ def dialog_tool(runtime):
     Only an installer from 7b on writes dialog.tool, always under riskrails/."""
     try:
         with open(os.path.join(runtime_home(runtime), "riskrails", "profile.json"), encoding="utf-8") as fh:
-            tool = (json.load(fh).get("dialog") or {}).get("tool")
-    except (OSError, ValueError, AttributeError):
+            tool = (json_loads_capped(fh.read()).get("dialog") or {}).get("tool")
+    except (OSError, ValueError, AttributeError, RecursionError):
         return None
     return tool if runtime in DIALOG_TOOL and tool == DIALOG_TOOL[runtime] else None
 
@@ -111,18 +168,28 @@ def payload_runtime(payload, hook_file):
     return "codex" if "%s.codex%s" % (os.sep, os.sep) in os.path.abspath(hook_file) else "claude"
 
 
+def switch_state(root, runtime, payload):
+    """"off", "closed" or "on". Off is today's route: no root, the project's
+    switch not on, AI_UNATTENDED or the runtime's unattended marker set, or no
+    verified dialog tool. Closed: the switch is on but this call cannot be bound
+    to a session that can answer a dialog: a payload that is not an object, a
+    subagent (agent_id), no session id, or a session id other than the one the
+    hook's own environment carries. On: otherwise."""
+    policy = dialog_policy(root) if root else None
+    if policy is None or unattended(policy):
+        return "off"
+    if dialog_tool(runtime) is None:
+        return "off"
+    if not isinstance(payload, dict) or payload.get("agent_id") or not payload.get("session_id"):
+        return "closed"
+    own = os.environ.get(SESSION_ENV.get(runtime, ""))
+    return "closed" if own and own != payload.get("session_id") else "on"
+
+
 def effective_switch(root, runtime, payload):
-    """On only when the project says so, nobody declared the run unattended,
-    the runtime's dialog tool is the verified one, this is the main session
-    (no agent_id: a subagent cannot answer a dialog) and the payload has a
-    session id to bind a pick to. Every other combination is today's route."""
-    if not root or dialog_policy(root) is None:
-        return False
-    if os.environ.get("AI_UNATTENDED") or os.environ.get("CLAUDE_CODE_SESSION_ATTENDED") == "0":
-        return False
-    if dialog_tool(runtime) is None or not isinstance(payload, dict):
-        return False
-    return not payload.get("agent_id") and bool(payload.get("session_id"))
+    """True only when switch_state() is "on"; "off" and "closed" are both no
+    dialog, no decision and no ledger write for every caller."""
+    return switch_state(root, runtime, payload) == "on"
 
 
 # -- labels -------------------------------------------------------------------
@@ -180,7 +247,7 @@ def read_decisions(root):
     try:
         with open(os.path.join(root, ".ai", "state", "decision.json"), encoding="utf-8") as fh:
             data = json.load(fh)
-    except (OSError, ValueError, TypeError):
+    except (OSError, ValueError, TypeError, RecursionError):
         return []
     opened = data.get("open") if isinstance(data, dict) else None
     return [d for d in opened if isinstance(d, dict) and d.get("id")] if isinstance(opened, list) else []
@@ -198,6 +265,18 @@ def decision_parts(decision):
     return [(options, bool(decision.get("multi_select")))]
 
 
+QUESTION_MAX = 1200  # state.py's
+
+
+def part_question(question, i, n):
+    """state.py's part_question: part i of n of a split decision is
+    "<question> (i of n)", the question cut so the whole fits QUESTION_MAX."""
+    if n < 2:
+        return question
+    suffix = " (%d of %d)" % (i, n)
+    return (question or "")[:QUESTION_MAX - len(suffix)] + suffix
+
+
 def offered(decisions, runtime):
     """What a dialog call for these decisions carries, question by question:
     (decision, options, the question as sent) — state.py's dialog_payload."""
@@ -205,7 +284,8 @@ def offered(decisions, runtime):
     for decision in decisions:
         parts = decision_parts(decision)
         for i, (options, multi) in enumerate(parts, 1):
-            item = {"question": decision.get("question"), "header": decision.get("header"),
+            item = {"question": part_question(decision.get("question"), i, len(parts)),
+                    "header": decision.get("header"),
                     "options": [{"label": o.get("label"), "description": o.get("description") or (
                         "the session runs exactly this, once" if o.get("kind") == "command" else "nothing runs")}
                                 for o in options]}
@@ -248,14 +328,14 @@ def adapt_response(runtime, payload):
 
     Claude: answers keyed by question text, a multi-select's labels joined
     with ", "; two questions with one text cannot be told apart, so both read
-    as unanswerable. Codex: tool_response is a JSON string,
+    as unanswerable (a split decision's parts are numbered "(i of n)" to differ). Codex: tool_response is a JSON string,
     answers[<id>].answers is a list; "None of the above" and "user_note: …"
     are items like any other, and match no label."""
     questions = response_questions(runtime, payload)
     if runtime == "codex":
         try:
             answers = json.loads(payload.get("tool_response") or "").get("answers")
-        except (ValueError, TypeError, AttributeError):
+        except (ValueError, TypeError, AttributeError, RecursionError):
             answers = None
         out = []
         for q in questions:
@@ -332,7 +412,7 @@ def write_line(root, data):
         os.close(fd)
 
 
-def read_ledger(root, path=None, types=LEDGER_TYPES):
+def read_ledger(root, path=None, types=LEDGER_TYPES):  # pylint: disable=dangerous-default-value  # read-only: `types` is only tested with `in`, never mutated
     """Every well-formed line of the given types, in order; a torn or foreign
     line is skipped, so a damaged ledger shows fewer picks, never more."""
     entries = []
@@ -341,7 +421,7 @@ def read_ledger(root, path=None, types=LEDGER_TYPES):
             for raw in fh:
                 try:
                     entry = json.loads(raw)
-                except ValueError:
+                except (ValueError, RecursionError):
                     continue
                 if isinstance(entry, dict) and entry.get("v") == 1 and entry.get("type") in types:
                     entries.append(entry)

package/hooks/guard/git.py

@@ -32,6 +32,10 @@ WHY_CONSENT = ("\n\nWith the dialog on, a commit or push runs only when the huma
                "send the dialog it prints, then run the picked command verbatim, once. See\n"
                ".ai/policies/safety.md.")
 
+WHY_CONSENT_CLOSED = ("\n\nWith the dialog on, a commit or push runs only when the human picked it in the\n"
+                      "dialog, and only a session that can answer the dialog can have a pick. See\n"
+                      ".ai/policies/safety.md.")
+
 SPACE = "[[:space:]]"
 CHEAP_RE = ("(^|[|;&[:space:]])(git|gh|argocd|helm|kubectl|terraform|dep|deployer|cap|flyctl|fly|"
             "vercel|netlify|npm)([[:space:]]|$)|/npm([[:space:]]|$)")
@@ -257,14 +261,19 @@ class GitGuard:
         raw = values[0] if len(values) == 1 and isinstance(values[0], dict) else None
         hook_file = os.path.join(os.fsdecode(b_bytes(self.ctx.hook_dir)), "ai-guard.py")
         try:
-            on = raw is not None and dialog.effective_switch(root, dialog.payload_runtime(raw, hook_file), raw)
+            state = dialog.switch_state(root, dialog.payload_runtime(raw, hook_file), raw)
         except Exception:                   # pylint: disable=broad-exception-caught
-            on = False
-        if not on:
+            state = "closed"
+        if state == "off":
             return
         command = b_bytes(cmd).decode("utf-8", "replace").strip()
         if not dialog.needs_consent(command):
             return
+        if state == "closed":
+            raise Deny(text_to_b("CONSENT_REQUIRED — this session cannot answer the dialog (a subagent, a "
+                                 "call with no session id, a session id other than the hook's own, or an "
+                                 "unreadable call). "
+                                 "The human runs this command in their own terminal.") + WHY_CONSENT_CLOSED)
         spent = getattr(self.ctx, "consent", None)
         if spent and spent.get("label") == command:
             return