@jaguilar87/gaia-ops 4.4.0 → 4.7.2

package/hooks/modules/tools/bash_validator.py

@@ -5,7 +5,8 @@ Primary security gate for all Bash tool invocations. With Bash(*) in the
 settings.json allow list, ALL commands reach this hook -- it is the sole
 enforcement layer for dangerous command detection.
 
-Simplified three-category pipeline:
+Pipeline (ordered by priority):
+0. Indirect execution detection -- bash -c, eval, python -c etc. (T2 approval)
 1. blocked_commands FIRST -- permanently denied patterns (exit 2)
 2. Claude footer stripping -- transparent cleanup via updatedInput
 3. Commit message validation -- conventional commits format
@@ -30,6 +31,7 @@ from ..security.mutative_verbs import (
 from ..security.approval_grants import (
     check_approval_grant,
     confirm_grant,
+    find_pending_for_command,
     generate_nonce,
     last_check_found_expired,
     write_pending_approval,
@@ -63,10 +65,40 @@ class BashValidationResult:
             self.suggestions = []
 
 
-# Patterns for Claude Code attribution footers (forbidden)
+# Patterns for AI tool attribution footers (auto-stripped from commits).
+# Covers Claude Code, GitHub Copilot, Aider, Windsurf, and any future
+# tool using the Co-authored-by git trailer convention.
 FORBIDDEN_FOOTER_PATTERNS = [
     r"Generated with\s+Claude Code",
-    r"Co-Authored-By:\s+Claude",
+    r"Generated with\s+\[?Claude Code\]?",
+    r"Co-Authored-By:\s+Claude\b",
+    r"Co-authored-by:\s+GitHub Copilot\b",
+    r"Co-authored-by:\s+aider\b",
+    r"Co-authored-by:\s+Windsurf\b",
+    r"Co-authored-by:\s+Cursor\b",
+    r"Co-authored-by:\s+Codex\b",
+    r"Co-authored-by:\s+Gemini\b",
+]
+
+# ---------------------------------------------------------------------------
+# Indirect execution wrappers — commands that execute arbitrary strings.
+# These bypass regex-based command blocking because the real command is
+# hidden inside a string argument.  Classified as T2 (requires approval)
+# so the user sees what will actually run.
+# ---------------------------------------------------------------------------
+INDIRECT_EXEC_PATTERNS = [
+    re.compile(r"^bash\s+-c\s+", re.IGNORECASE),
+    re.compile(r"^sh\s+-c\s+", re.IGNORECASE),
+    re.compile(r"^zsh\s+-c\s+", re.IGNORECASE),
+    re.compile(r"^dash\s+-c\s+", re.IGNORECASE),
+    re.compile(r"^\s*eval\s+", re.IGNORECASE),
+    re.compile(r"^python3?\s+-c\s+", re.IGNORECASE),
+    re.compile(r"^node\s+-e\s+", re.IGNORECASE),
+    re.compile(r"^perl\s+-e\s+", re.IGNORECASE),
+    re.compile(r"^ruby\s+-e\s+", re.IGNORECASE),
+    # Process substitution and heredoc piped to shell
+    re.compile(r"^bash\s+<\(", re.IGNORECASE),
+    re.compile(r"^sh\s+<\(", re.IGNORECASE),
 ]
 
 class BashValidator:
@@ -76,6 +108,91 @@ class BashValidator:
         """Initialize validator."""
         self.shell_parser = get_shell_parser()
 
+    def _detect_indirect_execution(self, command: str) -> Optional[BashValidationResult]:
+        """Detect indirect execution wrappers that can bypass regex blocking.
+
+        Commands like 'bash -c "az group delete"' hide the real command inside
+        a string.  We classify these as T2 (mutative) so they require user
+        approval via the nonce workflow, giving the human a chance to inspect
+        what will actually run.
+
+        Returns BashValidationResult if indirect execution detected, else None.
+        """
+        for pattern in INDIRECT_EXEC_PATTERNS:
+            if pattern.search(command):
+                # Also check if the inner payload contains a blocked command.
+                # Extract the string argument after the wrapper.
+                inner = self._extract_inner_command(command)
+                if inner:
+                    blocked = is_blocked_command(inner)
+                    if blocked.is_blocked:
+                        return BashValidationResult(
+                            allowed=False,
+                            tier=SecurityTier.T3_BLOCKED,
+                            reason=(
+                                f"Indirect execution of blocked command detected: "
+                                f"{blocked.category} (via wrapper)"
+                            ),
+                            suggestions=[
+                                blocked.suggestion or "Run the command directly instead of via a shell wrapper.",
+                            ],
+                        )
+
+                # Not blocked but still indirect — route through approval
+                logger.info("Indirect execution detected: %s", command[:80])
+                result = detect_mutative_command(command)
+                if result.is_mutative:
+                    return None  # Already mutative, will be caught by mutative_verbs
+
+                # For interpreters with inline code analysis (python3 -c),
+                # mutative_verbs.py has dedicated pattern scanning that
+                # distinguishes safe code (json.dumps, sys.version) from
+                # dangerous code (os.system, subprocess.run). If it classified
+                # the inline code as safe, trust that analysis and allow it
+                # through without forcing an "ask" dialog.
+                from ..security.mutative_verbs import _INLINE_CODE_CLIS
+                base_cmd = command.strip().split()[0].rsplit("/", 1)[-1].lower()
+                if base_cmd in _INLINE_CODE_CLIS:
+                    logger.info(
+                        "Inline code classified as safe by pattern scanner: %s",
+                        command[:80],
+                    )
+                    return None  # Safe inline code, proceed to normal validation
+
+                # Shell wrappers (bash -c, eval, etc.) hide the real command
+                # in a string — no dedicated scanner exists. Force "ask" so
+                # the user can inspect what will actually run.
+                hook_block = build_hook_permission_response(
+                    "ask",
+                    (
+                        "Indirect execution detected. The command uses a shell "
+                        "wrapper (bash -c, eval, etc.) that can bypass "
+                        "security checks. Please confirm you want to run this."
+                    ),
+                )
+                return BashValidationResult(
+                    allowed=False,
+                    tier=SecurityTier.T2_DRY_RUN,
+                    reason="Indirect execution wrapper detected — requires confirmation",
+                    block_response=hook_block,
+                )
+        return None
+
+    def _extract_inner_command(self, command: str) -> Optional[str]:
+        """Extract the inner command from an indirect execution wrapper.
+
+        E.g., 'bash -c "az group delete --name foo"' → 'az group delete --name foo'
+        """
+        # Match: shell -c "..." or shell -c '...'
+        match = re.search(r"""-[ce]\s+(['"])(.*?)\1""", command, re.DOTALL)
+        if match:
+            return match.group(2).strip()
+        # Match: shell -c ... (unquoted, take rest of line)
+        match = re.search(r"-[ce]\s+(\S+.*)", command)
+        if match:
+            return match.group(1).strip()
+        return None
+
     def _has_operators(self, command: str) -> bool:
         """Quick check if command has operators (before parsing)."""
         # Fast check for common operators outside quotes
@@ -84,12 +201,19 @@ class BashValidator:
             return False
         return True
 
-    def validate(self, command: str) -> BashValidationResult:
+    def validate(
+        self,
+        command: str,
+        is_subagent: bool = False,
+        session_id: str = "",
+    ) -> BashValidationResult:
         """
         Validate a Bash command.
 
         Args:
             command: Command string to validate
+            is_subagent: True when running in subagent context
+            session_id: Session ID for approval scoping
 
         Returns:
             BashValidationResult with validation details
@@ -103,6 +227,32 @@ class BashValidator:
 
         command = command.strip()
 
+        # ================================================================
+        # EARLY NORMALIZATION: Strip AI attribution footers before any
+        # other processing.  This ensures the same normalized command
+        # string is used for blocked-command checks, compound parsing,
+        # mutative verb detection, pending approval writes, AND pending
+        # approval lookups.  Without this, write_pending_approval() and
+        # find_pending_for_command() could see different strings on the
+        # first attempt vs. retry, causing nonce mismatch loops.
+        # ================================================================
+        command_was_modified = False
+        if self._detect_claude_footers(command):
+            command = self._strip_claude_footers(command)
+            command_was_modified = True
+            logger.info("Auto-stripped Claude Code footer from commit command")
+
+        # ================================================================
+        # PRIORITY 0: Indirect execution detection.
+        # Commands like "bash -c '...'" or "eval '...'" can hide blocked
+        # commands inside string arguments, bypassing regex patterns.
+        # Detected wrappers are routed to approval or blocked if the inner
+        # payload matches a blocked command.
+        # ================================================================
+        indirect_result = self._detect_indirect_execution(command)
+        if indirect_result is not None:
+            return indirect_result
+
         # ================================================================
         # PRIORITY 1: Blocked commands check on FULL command (exit 2).
         # This MUST run before any other validator to ensure permanently
@@ -120,6 +270,7 @@ class BashValidator:
             )
 
         # Parse compound commands once (reused for blocked-command check and validation dispatch).
+        # Runs AFTER footer stripping so components also use the normalized command.
         has_operators = self._has_operators(command)
         parsed_components = None
         if has_operators:
@@ -136,14 +287,6 @@ class BashValidator:
                         suggestions=[comp_blocked.suggestion] if comp_blocked.suggestion else [],
                     )
 
-        # Auto-strip forbidden footers from git commits (instead of blocking).
-        # Uses updatedInput to transparently clean the command before execution.
-        command_was_modified = False
-        if self._detect_claude_footers(command):
-            command = self._strip_claude_footers(command)
-            command_was_modified = True
-            logger.info("Auto-stripped Claude Code footer from commit command")
-
         # Validate git commit messages (on the potentially cleaned command)
         if "git commit" in command and "-m" in command:
             commit_validation = self._validate_commit_message(command)
@@ -167,11 +310,17 @@ class BashValidator:
 
         # Dispatch to single or compound validation using already-parsed components
         if not has_operators:
-            result = self._validate_single_command(command)
+            result = self._validate_single_command(
+                command, is_subagent=is_subagent, session_id=session_id,
+            )
         elif parsed_components is not None and len(parsed_components) > 1:
-            result = self._validate_compound_command(parsed_components)
+            result = self._validate_compound_command(
+                parsed_components, is_subagent=is_subagent, session_id=session_id,
+            )
         else:
-            result = self._validate_single_command(command)
+            result = self._validate_single_command(
+                command, is_subagent=is_subagent, session_id=session_id,
+            )
 
         # Attach cleaned command for hook to emit via updatedInput.
         # Set regardless of result.allowed so the ask path can include it too.
@@ -191,99 +340,156 @@ class BashValidator:
 
         return result
 
-    def _validate_single_command(self, command: str) -> BashValidationResult:
+    def _validate_single_command(
+        self,
+        command: str,
+        is_subagent: bool = False,
+        session_id: str = "",
+    ) -> BashValidationResult:
         """Validate a single command (no operators).
 
         Simplified pipeline:
+        0. Indirect execution detection (for compound command components)
         1. Mutative verb detection -> block with nonce or allow with grant
         2. GitOps policy validation (for kubectl/helm/flux)
         3. Everything else -> SAFE by elimination
 
+        Args:
+            command: The command to validate.
+            is_subagent: True when running in subagent context (generates
+                approval_id + deny). False for orchestrator (returns ask).
+            session_id: Session ID for pending approval scoping.
+
         Note: is_blocked_command() is NOT called here because validate()
         already checks the full command AND each compound component against
         the deny list before dispatching to this method.
         """
 
+        # Indirect execution check for compound command components.
+        # When validate() splits "cd /tmp && python3 -c '...'" into parts,
+        # the python3 -c component needs the same indirect execution gate
+        # that the full command gets in validate().
+        indirect_result = self._detect_indirect_execution(command)
+        if indirect_result is not None:
+            return indirect_result
+
         # Mutative verb detection
         result = detect_mutative_command(command)
         if result.is_mutative:
             # Check for an active approval grant before blocking.
-            grant = check_approval_grant(command)
+            grant = check_approval_grant(command, session_id=session_id)
             if grant is not None:
-                if not grant.confirmed:
-                    # First execution after nonce activation: return "ask"
-                    # to trigger Claude Code's native permission dialog
-                    # (double-barrier security).
-                    #
-                    # DO NOT call confirm_grant() here. The native dialog
-                    # has not been answered yet. If the user declines, the
-                    # grant must stay unconfirmed. Confirmation happens on
-                    # the NEXT hook invocation: if we see the same command
-                    # with an unconfirmed grant again, the native dialog
-                    # must have succeeded (the command executed and the
-                    # agent is retrying or a new matching command arrived).
+                if grant.confirmed:
+                    # Already confirmed and consumed -- should not reach
+                    # here (single-use). But if it does, allow through.
                     logger.info(
-                        "T3 command requires native confirmation: %s (scope='%s')",
+                        "T3 command allowed via confirmed grant: %s (scope='%s')",
                         command[:80], grant.approved_scope,
                     )
-                    hook_ask = build_hook_permission_response(
-                        "ask",
-                        "T3 operation approved. Confirm execution.",
+                    return BashValidationResult(
+                        allowed=True,
+                        tier=SecurityTier.T3_BLOCKED,
+                        reason="Grant confirmed",
+                    )
+                else:
+                    # Grant exists, not yet confirmed -- GAIA approved,
+                    # let it through. PostToolUse will confirm and consume
+                    # the grant after successful execution.
+                    logger.info(
+                        "T3 command passthrough via active grant: %s (scope='%s')",
+                        command[:80], grant.approved_scope,
                     )
                     return BashValidationResult(
-                        allowed=False,
+                        allowed=True,
                         tier=SecurityTier.T3_BLOCKED,
-                        reason="T3 approved by user, confirming execution via native dialog",
-                        block_response=hook_ask,
+                        reason="Grant active, pending confirmation",
                     )
-                logger.info(
-                    "T3 command allowed via approval grant: %s (scope='%s')",
-                    command[:80], grant.approved_scope,
-                )
-                return BashValidationResult(
-                    allowed=True,
-                    tier=SecurityTier.T3_BLOCKED,
-                    reason=f"Command allowed via approval grant (tier T3)",
-                )
             else:
-                # If a matching grant was found but expired, prepend a clear
-                # expiry message so the agent knows the previous approval lapsed.
-                expired_prefix = ""
-                if last_check_found_expired():
-                    expired_prefix = (
-                        "[EXPIRED] Approval grant has expired (TTL exceeded). "
-                        "Retry the command to generate a fresh nonce and "
-                        "restart the approval workflow.\n\n"
+                if is_subagent:
+                    # Subagent context: check for an existing pending
+                    # approval first (retry scenario). If found, reuse
+                    # the same nonce to prevent infinite approval_id
+                    # generation loops while the user reviews.
+                    existing_nonce = find_pending_for_command(
+                        session_id or "", command,
                     )
-
-                # Generate a cryptographic nonce and write a pending approval.
-                nonce = generate_nonce()
-                pending_file = write_pending_approval(
-                    nonce=nonce,
-                    command=command,
-                    danger_verb=result.verb,
-                    danger_category=result.category,
-                )
-                if pending_file is None:
-                    hook_block = build_hook_permission_response(
-                        "deny",
-                        build_pending_approval_unavailable_message(),
+                    if existing_nonce:
+                        approval_id = existing_nonce
+                        logger.info(
+                            "Reusing pending approval_id=%s for retry: %s",
+                            approval_id, command[:80],
+                        )
+                        reason = (
+                            f"[T3_BLOCKED] This command requires user approval.\n"
+                            f"Do NOT retry this command. Report REVIEW with this approval_id in your json:contract.\n"
+                            f"Command: {command}\n"
+                            f"Verb: '{result.verb}' ({result.category})\n"
+                            f"approval_id: {approval_id}"
+                        )
+                        hook_deny = build_hook_permission_response("deny", reason)
+                        return BashValidationResult(
+                            allowed=False,
+                            tier=SecurityTier.T3_BLOCKED,
+                            reason=f"T3 {result.category.lower()} command: {result.reason}",
+                            block_response=hook_deny,
+                        )
+                    # No existing pending -- generate a new nonce.
+                    # The ElicitationResult hook will activate the
+                    # grant when the user approves via AskUserQuestion.
+                    approval_id = generate_nonce()
+                    pending_path = write_pending_approval(
+                        nonce=approval_id,
+                        command=command,
+                        danger_verb=result.verb,
+                        danger_category=result.category,
+                        session_id=session_id or None,
+                    )
+                    if pending_path is None:
+                        # Persistence failure — fall back to ask
+                        logger.warning(
+                            "Failed to persist pending approval for subagent; "
+                            "falling back to ask: %s",
+                            command[:80],
+                        )
+                        reason = build_pending_approval_unavailable_message()
+                        hook_ask = build_hook_permission_response("ask", reason)
+                        return BashValidationResult(
+                            allowed=False,
+                            tier=SecurityTier.T3_BLOCKED,
+                            reason="Pending approval persistence failed",
+                            block_response=hook_ask,
+                        )
+                    reason = (
+                        f"[T3_BLOCKED] This command requires user approval.\n"
+                        f"Do NOT retry this command. Report REVIEW with this approval_id in your json:contract.\n"
+                        f"Command: {command}\n"
+                        f"Verb: '{result.verb}' ({result.category})\n"
+                        f"approval_id: {approval_id}"
                     )
+                    hook_deny = build_hook_permission_response("deny", reason)
                     return BashValidationResult(
                         allowed=False,
                         tier=SecurityTier.T3_BLOCKED,
-                        reason="Failed to persist pending approval for T3 command",
-                        block_response=hook_block,
+                        reason=f"T3 {result.category.lower()} command: {result.reason}",
+                        block_response=hook_deny,
+                    )
+                else:
+                    # Orchestrator context: route through native 'ask' dialog.
+                    # The user sees the native permission prompt and approves
+                    # directly. No approval_id is generated.
+                    reason = (
+                        f"[T3_APPROVAL_REQUIRED] {result.category} operation detected.\n"
+                        f"Command: {command}\n"
+                        f"Verb: '{result.verb}' ({result.category})\n"
+                        f"Reason: {result.reason}"
+                    )
+                    hook_ask = build_hook_permission_response("ask", reason)
+                    return BashValidationResult(
+                        allowed=False,
+                        tier=SecurityTier.T3_BLOCKED,
+                        reason=f"Dangerous {result.category.lower()} command: {result.reason}",
+                        block_response=hook_ask,
                     )
-
-                t3_block = build_t3_block_response(command, result, nonce=nonce)
-                hook_block = build_hook_permission_response("deny", expired_prefix + t3_block["message"])
-                return BashValidationResult(
-                    allowed=False,
-                    tier=SecurityTier.T3_BLOCKED,
-                    reason=f"Dangerous {result.category.lower()} command: {result.reason}",
-                    block_response=hook_block,
-                )
 
         # Check GitOps policy for kubectl/helm/flux commands
         if any(keyword in command for keyword in ("kubectl", "helm", "flux")):
@@ -303,13 +509,20 @@ class BashValidator:
             reason="Safe by elimination (not blocked, not mutative)",
         )
 
-    def _validate_compound_command(self, components: List[str]) -> BashValidationResult:
+    def _validate_compound_command(
+        self,
+        components: List[str],
+        is_subagent: bool = False,
+        session_id: str = "",
+    ) -> BashValidationResult:
         """Validate a compound command (multiple components)."""
         logger.info(f"Compound command detected with {len(components)} components")
 
         component_results: List[BashValidationResult] = []
         for i, component in enumerate(components, 1):
-            result = self._validate_single_command(component)
+            result = self._validate_single_command(
+                component, is_subagent=is_subagent, session_id=session_id,
+            )
 
             if not result.allowed:
                 return BashValidationResult(
@@ -352,6 +565,8 @@ class BashValidator:
 
         Removes full lines matching forbidden footer patterns.
         Works on raw command string regardless of quoting/HEREDOC format.
+        Preserves trailing quote/paren characters that close the commit
+        message (e.g., the closing " in -m "...footer").
 
         Args:
             command: Raw command string
@@ -359,11 +574,15 @@ class BashValidator:
         Returns:
             Command with footer lines removed
         """
-        # Remove full lines that contain forbidden patterns
+        # Remove full lines that contain AI attribution patterns.
+        # Each pattern matches the newline + footer content, then uses a
+        # lookahead to stop before any trailing quote/paren/bracket
+        # sequence that closes the command structure.  The captured group
+        # is replaced with empty string, leaving the closing chars intact.
         footer_line_patterns = [
-            r'\n\s*Co-Authored-By:\s+Claude[^\n]*',
-            r'\n\s*Generated with\s+\[?Claude Code\]?[^\n]*',
-            r'\n\s*🤖\s*Generated with[^\n]*',
+            r'\n\s*Co-[Aa]uthored-[Bb]y:\s+(?:Claude|GitHub Copilot|aider|Windsurf|Cursor|Codex|Gemini)[^\n]*?(?=["\')\]]*(?:\n|$))',
+            r'\n\s*Generated with\s+\[?Claude Code\]?[^\n]*?(?=["\')\]]*(?:\n|$))',
+            r'\n\s*🤖\s*Generated with[^\n]*?(?=["\')\]]*(?:\n|$))',
         ]
         for pattern in footer_line_patterns:
             command = re.sub(pattern, '', command, flags=re.IGNORECASE)
@@ -469,24 +688,21 @@ class BashValidator:
 
         return None
 
-def validate_bash_command(command: str) -> BashValidationResult:
+def validate_bash_command(
+    command: str,
+    is_subagent: bool = False,
+    session_id: str = "",
+) -> BashValidationResult:
     """
     Validate a Bash command (convenience function).
 
     Args:
         command: Command to validate
+        is_subagent: True when running in subagent context
+        session_id: Session ID for approval scoping
 
     Returns:
         BashValidationResult
     """
     validator = BashValidator()
-    return validator.validate(command)
-
-
-def create_permission_allow_response(reason: str) -> str:
-    """
-    Create JSON response to auto-approve a command.
-
-    This response tells Claude Code to skip the permission check.
-    """
-    return json.dumps(build_hook_permission_response("allow", reason))
+    return validator.validate(command, is_subagent=is_subagent, session_id=session_id)

package/hooks/modules/tools/shell_parser.py

@@ -15,7 +15,6 @@ Features:
 Dependencies: Python stdlib only (shlex, re)
 """
 
-import re
 from typing import List, Optional
 from dataclasses import dataclass
 

package/hooks/modules/tools/task_validator.py

@@ -4,7 +4,7 @@ Task tool validator.
 Validates Task tool invocations:
 - Agent existence verification
 - Context provisioning enforcement
-- T3 operation detection for Bash-time nonce approval
+- T3 operation detection for user approval workflow
 """
 
 import logging
@@ -18,19 +18,10 @@ from ..security.mutative_verbs import (
     MutativeResult,
     CLI_FAMILY_LOOKUP,
     COMMAND_ALIASES,
-    CATEGORY_MUTATIVE,
 )
 
 logger = logging.getLogger(__name__)
 
-# ============================================================================
-# ROUTER INTEGRATION - REMOVED
-# ============================================================================
-# Router suggestion removed for simplicity. Orchestrator should choose correct
-# agent based on improved descriptions in CLAUDE.md. If wrong agent selected,
-# error message shows available agents and orchestrator self-corrects.
-
-
 # Available agents for Task invocation — both bare and plugin-namespaced forms
 _BASE_AGENTS = [
     "terraform-architect",
@@ -217,8 +208,8 @@ class TaskValidator:
         prompt = parameters.get("prompt", "")
         description = parameters.get("description", "")
 
-        # Phase 2: additionalContext means prompt is never mutated, so T3 detection
-        # runs directly against the original user prompt -- no workaround needed.
+        # additionalContext means prompt is never mutated, so T3 detection
+        # runs directly against the original user prompt.
         user_task_for_t3_check = prompt
 
         logger.info(f"Task tool validation for agent: {agent_name}")
@@ -229,7 +220,7 @@ class TaskValidator:
             error_msg += f"Available agents:\n"
             for agent in sorted(self.available_agents):
                 error_msg += f"  - {agent}\n"
-            error_msg += "\nRefer to agent descriptions in the project-dispatch skill.\n"
+            error_msg += "\nRefer to the Surface Routing Recommendation for agent selection.\n"
             error_msg += f"\nCorrect usage: Task(subagent_type=\"<agent-name>\", ...)"
 
             return TaskValidationResult(
@@ -239,14 +230,11 @@ class TaskValidator:
                 agent_name=agent_name,
             )
 
-        # Check context provisioning (for project agents)
-        has_context = self._check_context_provisioning(prompt, agent_name)
-
-        if not has_context and agent_name not in META_AGENTS:
-            logger.warning(
-                f"Task invocation for {agent_name} without apparent context provisioning. "
-                f"Orchestrator should call context_provider.py first (Phase 2)."
-            )
+        # Context is injected via additionalContext by the adapter, not by
+        # mutating the prompt.  The validator cannot check additionalContext
+        # (it only sees parameters), so we determine context status by agent type.
+        # Meta-agents never receive context by design.
+        has_context = agent_name not in META_AGENTS
 
         # Check for T3 operations (use original user task to avoid false positives from context)
         is_t3 = self._is_t3_operation(user_task_for_t3_check, description)
@@ -273,14 +261,6 @@ class TaskValidator:
             is_t3_operation=is_t3,
         )
 
-    def _check_context_provisioning(self, prompt: str, agent_name: str) -> bool:
-        """Check if context was properly provisioned."""
-        return (
-            "# Project Context" in prompt or
-            "contract" in prompt.lower() or
-            "context_provider.py" in prompt.lower()
-        )
-
     def _is_t3_operation(self, prompt: str, description: str) -> bool:
         """Check if this is a T3 (destructive) operation using the verb detector."""
         combined = f"{description} {prompt}"