fix: clear full-main CodeQL findings

plugins/context-guard/hooks/stop-context-guard.py

@@ -106,7 +106,7 @@ def _thresholds(model_id: str):
         if isinstance(loaded, dict) and isinstance(loaded.get("models"), list):
             table = loaded
     except (OSError, json.JSONDecodeError, ValueError):
-        pass
+        table = FALLBACK_THRESHOLDS
 
     mid = (model_id or "").lower()
     chosen = table.get("default") or FALLBACK_THRESHOLDS["default"]
@@ -122,7 +122,8 @@ def _thresholds(model_id: str):
         if 0 < warn < hard:
             return warn, hard
     except (KeyError, TypeError, ValueError):
-        pass
+        d = FALLBACK_THRESHOLDS["default"]
+        return d["warn"], d["hard"]
     d = FALLBACK_THRESHOLDS["default"]
     return d["warn"], d["hard"]
 
@@ -262,7 +263,7 @@ def _subagent_summary(session_id: str):
 
     Non-fatal: any read/parse problem returns zeros.
     """
-    path = os.path.join("/tmp", f"zetetic-subagents-{session_id}.json")
+    path = os.path.join(STATE_DIR, f"zetetic-subagents-{session_id}.json")
     try:
         with open(path, "r", encoding="utf-8") as fh:
             totals = (json.load(fh) or {}).get("totals") or {}
@@ -380,10 +381,11 @@ def _save_level(session_id: str, level: str) -> None:
         with open(path, "w", encoding="utf-8") as fh:
             json.dump({"level": level}, fh)
     except OSError:
-        pass
+        return
 
 
 def main():
+    data = {}
     try:
         data = json.load(sys.stdin)
     except (json.JSONDecodeError, ValueError):
@@ -402,6 +404,7 @@ def main():
         _exit()
 
     warn, hard = _thresholds(model_id)
+    level = "none"
     if ctx >= hard:
         level = "hard"
     elif ctx >= warn:

plugins/context-guard/hooks/subagent-tracker.py

@@ -61,7 +61,7 @@ def _load_state(session_id):
         if isinstance(data, dict) and isinstance(data.get("agents"), dict):
             return data
     except (OSError, json.JSONDecodeError, ValueError):
-        pass
+        return {"session_id": session_id, "agents": {}}
     return {"session_id": session_id, "agents": {}}
 
 
@@ -144,7 +144,7 @@ def main():
         with open(_state_path(session_id), "w", encoding="utf-8") as fh:
             json.dump(state, fh)
     except OSError:
-        pass
+        return
     sys.exit(0)
 
 

plugins/statusline/assets/statusline-transcript.py

@@ -219,6 +219,8 @@ def main():
             json.dump(result, fh)
         os.replace(tmp, CACHE_PATH)
     except OSError:
+        # Cache persistence is opportunistic; stdout remains the authoritative
+        # result for the caller when the cache directory is unavailable.
         pass
     json.dump(result, sys.stdout)
     sys.stdout.write("\n")

tests/test_context_guard_hooks.py

@@ -94,12 +94,7 @@ def test_usage_line_and_reverse_tail_reader(tmp_path, monkeypatch):
 
 
 def test_subagent_summary_line_and_git_fail_open(tmp_path, monkeypatch):
-    real_join = guard.os.path.join
-    monkeypatch.setattr(
-        guard.os.path,
-        "join",
-        lambda root, leaf: str(tmp_path / leaf) if root == "/tmp" else real_join(root, leaf),
-    )
+    monkeypatch.setattr(guard, "STATE_DIR", str(tmp_path))
     assert guard._subagent_summary("none") == (0, 0, 0.0)
     state = tmp_path / "zetetic-subagents-s1.json"
     state.write_text(json.dumps({"totals": {