riskrails 3.1.0 → 3.2.2

package/hooks/guard/dialog.py

@@ -7,11 +7,16 @@ tests/test_dialog_contract.py feeds both the same fixtures, so they cannot
 drift. Nothing here imports state.py: hooks run under `python3 -I -S`, stdlib
 only.
 
-Off is today: with .ai/policies/dialog.json missing or not `enabled: true`,
-no AI_UNATTENDED, the runtime's verified dialog tool, the main session and a
-session id all required, effective_switch() is False and no caller writes or
-decides anything (R36.1, R36.2). Readers fail open: a missing or unreadable
-file reads as "nothing open, nothing picked".
+The switch has three states (switch_state). Off is today: with
+.ai/policies/dialog.json missing or not `enabled: true`, AI_UNATTENDED set or
+the runtime's verified dialog tool missing, no caller writes or decides
+anything (R36.1, R36.2). Closed: the project's switch is on but the call
+cannot be bound to a session that can answer a dialog (a subagent, no session
+id, a session id that is not the hook environment's own); the dialog and the
+ledger treat it like off, the git consent rule refuses (terminal route). On:
+the main session with a session id. effective_switch() is True only for on.
+Readers fail open: a missing or unreadable file reads as "nothing open,
+nothing picked".
 """
 import contextlib
 import json
@@ -28,6 +33,10 @@ LOCK_STALE_S = 2.0
 LINE_MAX = 4096                             # one write; O_APPEND keeps a line whole up to this
 
 DIALOG_TOOL = {"claude": "AskUserQuestion", "codex": "request_user_input"}
+# The runtime's own session variable; the same mapping as state.py's. A hook's
+# environment carries it for Claude only (spike 2026-10-31: no CODEX_* variable
+# reaches a Codex hook), so it is compared only when present and non-empty.
+SESSION_ENV = {"claude": "CLAUDE_CODE_SESSION_ID", "codex": "CODEX_THREAD_ID"}
 LEDGER_TYPES = {"offer", "pick", "use", "void", "decline", "settle"}
 STOP_BLOCK = "stop_block"                   # the Stop loop breaker's count; no reader of consent reads it
 LABEL_FORBIDDEN = (";", "&", "|", "\n", "\r", "`", "$(", "<", ">")
@@ -63,13 +72,39 @@ def canonical(obj):
 
 
 # -- the switch ---------------------------------------------------------------
+JSON_DEPTH_MAX = 64                       # one nesting cap for both switches, not the stack's
+
+
+def json_loads_capped(text):
+    """json.loads(text), except that a text nested deeper than JSON_DEPTH_MAX is
+    malformed (ValueError). The parser's own limit moves with the stack depth, so
+    the hook and state.py could disagree; this scan does not recurse."""
+    depth, in_str, esc = 0, False, False
+    for ch in text:
+        if in_str:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_str = False
+        elif ch == '"':
+            in_str = True
+        elif ch in "[{":
+            depth += 1
+            if depth > JSON_DEPTH_MAX:
+                raise ValueError("JSON nested deeper than %d" % JSON_DEPTH_MAX)
+        elif ch in "]}":
+            depth -= 1
+    return json.loads(text)
+
 
 def dialog_policy(root):
     """.ai/policies/dialog.json when it says enabled: true, else None."""
     try:
         with open(os.path.join(root, ".ai", "policies", "dialog.json"), encoding="utf-8") as fh:
-            data = json.load(fh)
-    except (OSError, ValueError, TypeError):
+            data = json_loads_capped(fh.read())
+    except (OSError, ValueError, TypeError, RecursionError):
         return None
     if not isinstance(data, dict) or data.get("enabled") is not True:
         return None
@@ -79,7 +114,29 @@ def dialog_policy(root):
         value = value if isinstance(value, int) and not isinstance(value, bool) else default
         return min(high, max(low, value))
     return {"window_seconds": bounded("window_seconds", *WINDOW),
-            "stop_blocks_max": bounded("stop_blocks_max", STOP_BLOCKS_MAX, 0, STOP_BLOCKS_MAX)}
+            "stop_blocks_max": bounded("stop_blocks_max", STOP_BLOCKS_MAX, 0, STOP_BLOCKS_MAX),
+            "background_sessions": data.get("background_sessions") is True}
+
+
+def ai_unattended():
+    """AI_UNATTENDED is set when it is non-empty and not 0, false or no (case
+    and blanks ignored): one rule in every reader (risk 0587)."""
+    return os.environ.get("AI_UNATTENDED", "").strip().lower() not in ("", "0", "false", "no")
+
+
+def unattended(policy):
+    """True when the run is declared unattended: AI_UNATTENDED always; the
+    runtime's own marker (CLAUDE_CODE_SESSION_ATTENDED=0: a background job,
+    `claude -p`, the SDK) unless the project opts in with background_sessions:
+    true, for background jobs of the CLI a human is still chatting in. The
+    opt-in never covers an SDK entrypoint (CLAUDE_CODE_ENTRYPOINT sdk-*:
+    `claude -p`, an SDK host — nobody there answers the dialog; risk ffae).
+    state.py's dialog_on() keeps the same rule."""
+    if ai_unattended():
+        return True
+    background = policy.get("background_sessions") and \
+        not os.environ.get("CLAUDE_CODE_ENTRYPOINT", "").startswith("sdk-")
+    return os.environ.get("CLAUDE_CODE_SESSION_ATTENDED") == "0" and not background
 
 
 def runtime_home(runtime):
@@ -94,8 +151,8 @@ def dialog_tool(runtime):
     Only an installer from 7b on writes dialog.tool, always under riskrails/."""
     try:
         with open(os.path.join(runtime_home(runtime), "riskrails", "profile.json"), encoding="utf-8") as fh:
-            tool = (json.load(fh).get("dialog") or {}).get("tool")
-    except (OSError, ValueError, AttributeError):
+            tool = (json_loads_capped(fh.read()).get("dialog") or {}).get("tool")
+    except (OSError, ValueError, AttributeError, RecursionError):
         return None
     return tool if runtime in DIALOG_TOOL and tool == DIALOG_TOOL[runtime] else None
 
@@ -111,18 +168,28 @@ def payload_runtime(payload, hook_file):
     return "codex" if "%s.codex%s" % (os.sep, os.sep) in os.path.abspath(hook_file) else "claude"
 
 
+def switch_state(root, runtime, payload):
+    """"off", "closed" or "on". Off is today's route: no root, the project's
+    switch not on, AI_UNATTENDED or the runtime's unattended marker set, or no
+    verified dialog tool. Closed: the switch is on but this call cannot be bound
+    to a session that can answer a dialog: a payload that is not an object, a
+    subagent (agent_id), no session id, or a session id other than the one the
+    hook's own environment carries. On: otherwise."""
+    policy = dialog_policy(root) if root else None
+    if policy is None or unattended(policy):
+        return "off"
+    if dialog_tool(runtime) is None:
+        return "off"
+    if not isinstance(payload, dict) or payload.get("agent_id") or not payload.get("session_id"):
+        return "closed"
+    own = os.environ.get(SESSION_ENV.get(runtime, ""))
+    return "closed" if own and own != payload.get("session_id") else "on"
+
+
 def effective_switch(root, runtime, payload):
-    """On only when the project says so, nobody declared the run unattended,
-    the runtime's dialog tool is the verified one, this is the main session
-    (no agent_id: a subagent cannot answer a dialog) and the payload has a
-    session id to bind a pick to. Every other combination is today's route."""
-    if not root or dialog_policy(root) is None:
-        return False
-    if os.environ.get("AI_UNATTENDED") or os.environ.get("CLAUDE_CODE_SESSION_ATTENDED") == "0":
-        return False
-    if dialog_tool(runtime) is None or not isinstance(payload, dict):
-        return False
-    return not payload.get("agent_id") and bool(payload.get("session_id"))
+    """True only when switch_state() is "on"; "off" and "closed" are both no
+    dialog, no decision and no ledger write for every caller."""
+    return switch_state(root, runtime, payload) == "on"
 
 
 # -- labels -------------------------------------------------------------------
@@ -180,7 +247,7 @@ def read_decisions(root):
     try:
         with open(os.path.join(root, ".ai", "state", "decision.json"), encoding="utf-8") as fh:
             data = json.load(fh)
-    except (OSError, ValueError, TypeError):
+    except (OSError, ValueError, TypeError, RecursionError):
         return []
     opened = data.get("open") if isinstance(data, dict) else None
     return [d for d in opened if isinstance(d, dict) and d.get("id")] if isinstance(opened, list) else []
@@ -198,6 +265,18 @@ def decision_parts(decision):
     return [(options, bool(decision.get("multi_select")))]
 
 
+QUESTION_MAX = 1200  # state.py's
+
+
+def part_question(question, i, n):
+    """state.py's part_question: part i of n of a split decision is
+    "<question> (i of n)", the question cut so the whole fits QUESTION_MAX."""
+    if n < 2:
+        return question
+    suffix = " (%d of %d)" % (i, n)
+    return (question or "")[:QUESTION_MAX - len(suffix)] + suffix
+
+
 def offered(decisions, runtime):
     """What a dialog call for these decisions carries, question by question:
     (decision, options, the question as sent) — state.py's dialog_payload."""
@@ -205,7 +284,8 @@ def offered(decisions, runtime):
     for decision in decisions:
         parts = decision_parts(decision)
         for i, (options, multi) in enumerate(parts, 1):
-            item = {"question": decision.get("question"), "header": decision.get("header"),
+            item = {"question": part_question(decision.get("question"), i, len(parts)),
+                    "header": decision.get("header"),
                     "options": [{"label": o.get("label"), "description": o.get("description") or (
                         "the session runs exactly this, once" if o.get("kind") == "command" else "nothing runs")}
                                 for o in options]}
@@ -248,14 +328,14 @@ def adapt_response(runtime, payload):
 
     Claude: answers keyed by question text, a multi-select's labels joined
     with ", "; two questions with one text cannot be told apart, so both read
-    as unanswerable. Codex: tool_response is a JSON string,
+    as unanswerable (a split decision's parts are numbered "(i of n)" to differ). Codex: tool_response is a JSON string,
     answers[<id>].answers is a list; "None of the above" and "user_note: …"
     are items like any other, and match no label."""
     questions = response_questions(runtime, payload)
     if runtime == "codex":
         try:
             answers = json.loads(payload.get("tool_response") or "").get("answers")
-        except (ValueError, TypeError, AttributeError):
+        except (ValueError, TypeError, AttributeError, RecursionError):
             answers = None
         out = []
         for q in questions:
@@ -332,7 +412,7 @@ def write_line(root, data):
         os.close(fd)
 
 
-def read_ledger(root, path=None, types=LEDGER_TYPES):
+def read_ledger(root, path=None, types=LEDGER_TYPES):  # pylint: disable=dangerous-default-value  # read-only: `types` is only tested with `in`, never mutated
     """Every well-formed line of the given types, in order; a torn or foreign
     line is skipped, so a damaged ledger shows fewer picks, never more."""
     entries = []
@@ -341,7 +421,7 @@ def read_ledger(root, path=None, types=LEDGER_TYPES):
             for raw in fh:
                 try:
                     entry = json.loads(raw)
-                except ValueError:
+                except (ValueError, RecursionError):
                     continue
                 if isinstance(entry, dict) and entry.get("v") == 1 and entry.get("type") in types:
                     entries.append(entry)

package/hooks/guard/git.py

@@ -32,6 +32,10 @@ WHY_CONSENT = ("\n\nWith the dialog on, a commit or push runs only when the huma
                "send the dialog it prints, then run the picked command verbatim, once. See\n"
                ".ai/policies/safety.md.")
 
+WHY_CONSENT_CLOSED = ("\n\nWith the dialog on, a commit or push runs only when the human picked it in the\n"
+                      "dialog, and only a session that can answer the dialog can have a pick. See\n"
+                      ".ai/policies/safety.md.")
+
 SPACE = "[[:space:]]"
 CHEAP_RE = ("(^|[|;&[:space:]])(git|gh|argocd|helm|kubectl|terraform|dep|deployer|cap|flyctl|fly|"
             "vercel|netlify|npm)([[:space:]]|$)|/npm([[:space:]]|$)")
@@ -257,14 +261,19 @@ class GitGuard:
         raw = values[0] if len(values) == 1 and isinstance(values[0], dict) else None
         hook_file = os.path.join(os.fsdecode(b_bytes(self.ctx.hook_dir)), "ai-guard.py")
         try:
-            on = raw is not None and dialog.effective_switch(root, dialog.payload_runtime(raw, hook_file), raw)
+            state = dialog.switch_state(root, dialog.payload_runtime(raw, hook_file), raw)
         except Exception:                   # pylint: disable=broad-exception-caught
-            on = False
-        if not on:
+            state = "closed"
+        if state == "off":
             return
         command = b_bytes(cmd).decode("utf-8", "replace").strip()
         if not dialog.needs_consent(command):
             return
+        if state == "closed":
+            raise Deny(text_to_b("CONSENT_REQUIRED — this session cannot answer the dialog (a subagent, a "
+                                 "call with no session id, a session id other than the hook's own, or an "
+                                 "unreadable call). "
+                                 "The human runs this command in their own terminal.") + WHY_CONSENT_CLOSED)
         spent = getattr(self.ctx, "consent", None)
         if spent and spent.get("label") == command:
             return

package/hooks/guard/paths.py

@@ -154,15 +154,100 @@ LONG_TRIGGER_RE = ("(^|[^A-Za-z0-9_])approve([^A-Za-z0-9_]|$)|--by(=|[[:space:]]
 FETCHERS = "(^|[|;&[:space:]])(scp|tar|zip|unzip|curl|wget)([[:space:]]+[^;&|[:space:]]+)*[[:space:]]+"
 # An interpreter one-liner is not parsed, its text is scanned: one that names a
 # secret, or one that names a control file and looks like a write, is refused (H3).
-INTERP_RE = "(^|[|;&[:space:]])(python3?|perl|ruby|node|php)([[:space:]]+-[^[:space:]]+)*[[:space:]]+-(c|e)([[:space:]]|$)"
+INTERP_RE = ("(^|[|;&[:space:]])(python3?|perl|ruby|node|php)([[:space:]]+-[^[:space:]]+)*[[:space:]]+-(c|e)([[:space:]]|$)|"
+             "(^|[|;&[:space:]])php([[:space:]]+-[^[:space:]]+)*[[:space:]]+-r([[:space:]]|$)")
 CONTROL_TEXT_RE = "\\.ai/state/|\\.ai/reports/"
-INPLACE_RE = ("(^|[|;&[:space:]])(perl|ruby)([[:space:]]+-([CEIMmr][[:space:]]*[^[:space:]]+|[^[:space:]]+))*"
-              "[[:space:]]+-[acdfghlnpsStTuUvwWXy]*i")
+# perl or ruby with -i, behind any blank, separator, ( ` { or quote, so every wrapper and
+# position is caught; Guard.inplace_edit carves out the segments of a text tool (grep, echo,
+# git log ...) that merely name it. An -e/-E/-ne code argument may be one quoted word.
+INPLACE_RE = ("(^|[|;&(`{'\"[:space:]])"
+              "(perl|ruby)([[:space:]]+-([CEIMmr][[:space:]]*[^[:space:]]+|[a-zA-Z]*[eE][[:space:]]+('[^']*'|\"[^\"]*\")|"
+              "[^[:space:]]+))*[[:space:]]+-[acdfghlnpsStTuUvwWXy]*i")
+_TEXT_TOOLS = {"grep", "egrep", "fgrep", "rg", "ag", "ack", "echo", "printf"}
+_GIT_TEXT = {"log", "grep", "commit", "show", "diff", "tag", "notes"}
+_STD_WRITE = re.compile(r"(writeSync|writevSync)\([ \t]*(1|2|process\.std(out|err)\.fd)[ \t]*,|"
+                        r"v?fprintf\([ \t]*STD(OUT|ERR)[ \t]*,")
+
+
+_SHELL_SINKS = {"sh", "bash", "zsh", "dash", "ksh", "ssh", "source", ".", "eval"}
+_XARGS_ARG = {"-I", "-n", "-P", "-L", "-s", "-E", "-d", "-a"}
+_GIT_RUNS = ("GIT_", "PAGER", "EDITOR", "VISUAL", "SSH_COMMAND")
+_GIT_CFG = re.compile(r"[A-Za-z0-9_.-]+=[A-Za-z0-9_./:-]*$")
+
+
+def _tool_word(w):
+    """The bare word, /bin/<w> or /usr/bin/<w>; any other path is a program of its own."""
+    if w.startswith("/bin/"):
+        return w[5:]
+    if w.startswith("/usr/bin/"):
+        return w[9:]
+    return w
+
+
+def shell_sink(seg):
+    """A segment that runs its input or its arguments as shell text."""
+    words = seg.split()
+    if not words:
+        return False
+    w = _tool_word(words[0])
+    if w in _SHELL_SINKS:
+        return True
+    return w == "xargs" and any(_tool_word(x) in _SHELL_SINKS for x in words[1:])
+
+
+def _plain_text_tool(words, i, git_runs):
+    if i >= len(words):
+        return False
+    w = _tool_word(words[i])
+    if w in _TEXT_TOOLS:
+        return True
+    if w != "git" or git_runs:
+        return False
+    if any(x.startswith(("-O", "--open-files-in-pager", "--config-env")) for x in words[i + 1:]):
+        return False
+    k = i + 1
+    while k < len(words):
+        x = words[k]
+        if x in ("-C", "-c"):
+            if x == "-c" and (k + 1 >= len(words) or not _GIT_CFG.match(words[k + 1])):
+                return False
+            k += 2
+        elif x.startswith("-"):
+            k += 1
+        else:
+            return x in _GIT_TEXT
+    return False
+
+
+def text_tool_segment(seg, git_runs=False):
+    """A segment whose command word is a text tool: a program named in it is an argument.
+    xargs and find -exec are looked through; git_runs is set when the line may hand git a
+    command to run (a stripped GIT_PAGER=... assignment)."""
+    words = seg.split()
+    if not words:
+        return False
+    w = _tool_word(words[0])
+    if w == "xargs":
+        i = 1
+        while i < len(words) and words[i].startswith("-"):
+            i += 2 if words[i] in _XARGS_ARG else 1
+        return _plain_text_tool(words, i, git_runs)
+    if w == "find":
+        found = False
+        for k, x in enumerate(words):
+            if x in ("-exec", "-execdir", "-ok", "-okdir"):
+                if not _plain_text_tool(words, k + 1, git_runs):
+                    return False
+                found = True
+        return found
+    return _plain_text_tool(words, 0, git_runs)
+
+
 EVAL_WORD_RE = "(^|[|;&[:space:]])eval([[:space:]]|$)"
 SECRET_TEXT_RE = "\\.env|secrets?/|credentials?|id_rsa|\\.pem|\\.aws"
 WRITE_CALL_RE = (
     "(^|[^A-Za-z0-9_])(write|writelines|write_text|write_bytes|write_file|writeFile|writeFileSync|appendFile|"
-    "appendFileSync|createWriteStream|binwrite|syswrite|fwrite|fputs|file_put_contents|dump|unlink|unlinkSync|"
+    "appendFileSync|createWriteStream|binwrite|syswrite|fwrite|fputs|fprintf|vfprintf|writeSync|writevSync|file_put_contents|dump|unlink|unlinkSync|"
     "remove|removedirs|rename|renames|renameSync|rmdir|rmdirSync|rm|rmSync|rmtree|mkdir|mkdirSync|makedirs|"
     "mkdtemp|truncate|truncateSync|ftruncate|symlink|symlinkSync|symlink_to|hardlink_to|link|linkSync|link_to|"
     "touch|chmod|chown|utime|utimes|copyFile|copyFileSync|cp|cpSync|move|delete|system|exec|execSync|execFile|"
@@ -1182,7 +1267,8 @@ class PathGuard:                            # pylint: disable=too-many-instance-
         p = self.p
         if p.tool not in ("Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"):
             return
-        unattended = bool(env_b("AI_UNATTENDED"))
+        # AI_UNATTENDED is set when non-empty and not 0, false or no: one rule (risk 0587)
+        unattended = env_b("AI_UNATTENDED").strip().lower() not in ("", "0", "false", "no")
         if p.tool == "Bash" and not unattended:
             self.confirm_delete(p.bash_command())
         root = find_ai_root(p.cwd, self.ctx.pwd)
@@ -1227,6 +1313,22 @@ class PathGuard:                            # pylint: disable=too-many-instance-
         command = b_bytes(cmd).decode("utf-8", "replace").strip()
         return True, bool(pick and pick.get("label") == command)
 
+    def inplace_edit(self, cmd):
+        """perl or ruby -i as a command: INPLACE_RE on the line less the segments of a text tool."""
+        m = self.m
+        if not m.ere_match(INPLACE_RE, cmd):
+            return False
+        if "<<" in cmd:                     # a heredoc body is read by whoever reads it
+            return True
+        segs = shell_segments(cmd).split("\n")
+        if "|" in cmd and any(shell_sink(sg) for sg in segs):
+            return True                     # a text tool's output may run as shell text
+        git_runs = any(t in cmd for t in _GIT_RUNS)
+        if git_runs and any(_tool_word(sg.split(None, 1)[0]) == "git" for sg in segs if sg.strip()):
+            return True                     # the assignment that runs a command is not in the segment
+        keep = [sg for sg in segs if not text_tool_segment(sg, git_runs)]
+        return m.ere_match(INPLACE_RE, "\n".join(keep))
+
     def interpreter_text(self, cmd):
         """The text of an interpreter one-liner or an eval, scanned whole (H3)."""
         m = self.m
@@ -1235,10 +1337,10 @@ class PathGuard:                            # pylint: disable=too-many-instance-
         if (is_eval or is_interp) and m.ere_match(SECRET_TEXT_RE, cmd):
             raise Deny("Refusing an interpreter one-liner that references a sensitive path." + WHY_SENSITIVE)
         if m.ere_match(CONTROL_TEXT_RE, cmd):
-            if is_eval or m.ere_match(INPLACE_RE, cmd):
+            if is_eval or self.inplace_edit(cmd):
                 raise Deny("Refusing an interpreter one-liner that writes the task's own control files." + WHY_APPROVE)
             if is_interp:
-                scan = cmd.replace("stdout.write", " ").replace("stderr.write", " ")
+                scan = _STD_WRITE.sub(" ", cmd.replace("stdout.write", " ").replace("stderr.write", " "))
                 pscan = cmd.replace("copy.copy(", " ")
                 if (m.ere_match(WRITE_CALL_RE, scan) or m.ere_match(WRITE_WORD_RE, cmd)
                         or (m.ere_match("Path", cmd)

package/hooks/project-scaffold.py

@@ -204,7 +204,8 @@ class Scaffold:
         if os.path.exists(os.path.join(d, ".gitkeep")):
             return
         os.makedirs(d, exist_ok=True)
-        open(os.path.join(d, ".gitkeep"), "wb").close()
+        with open(os.path.join(d, ".gitkeep"), "wb"):
+            pass
         self.created.append(rel + "/.gitkeep")
 
     def append_once(self, path, marker, template, label):