@trac3er/oh-my-god 2.0.4 → 2.0.7

package/build/lib/runtime/proof_chain.py

@@ -0,0 +1,228 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from typing import Any
+
+
+def _load_json(path: Path) -> dict[str, Any]:
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+def _read_jsonl(path: Path) -> list[dict[str, Any]]:
+    if not path.exists():
+        return []
+    rows: list[dict[str, Any]] = []
+    for line in path.read_text(encoding="utf-8").splitlines():
+        if not line.strip():
+            continue
+        try:
+            payload = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if isinstance(payload, dict):
+            rows.append(payload)
+    return rows
+
+
+def _latest_evidence_pack(output_root: Path) -> tuple[str, dict[str, Any]]:
+    evidence_dir = output_root / ".omg" / "evidence"
+    if not evidence_dir.exists():
+        return "", {}
+    evidence_files = sorted(path for path in evidence_dir.glob("*.json") if path.is_file())
+    evidence_payloads: list[tuple[Path, dict[str, Any]]] = []
+    for path in evidence_files:
+        try:
+            payload = _load_json(path)
+        except Exception:
+            continue
+        if payload.get("schema") == "EvidencePack":
+            evidence_payloads.append((path, payload))
+    if not evidence_payloads:
+        return "", {}
+    path, payload = evidence_payloads[-1]
+    return str(path.relative_to(output_root)), payload
+
+
+def assemble_proof_chain(project_dir: str, *, evidence_path: str | None = None) -> dict[str, Any]:
+    output_root = Path(project_dir)
+
+    trace_rows = _read_jsonl(output_root / ".omg" / "tracebank" / "events.jsonl")
+    trace_by_id = {
+        str(item.get("trace_id", "")): item
+        for item in trace_rows
+        if isinstance(item, dict) and item.get("trace_id")
+    }
+
+    eval_path = output_root / ".omg" / "evals" / "latest.json"
+    eval_payload: dict[str, Any] = _load_json(eval_path) if eval_path.exists() else {}
+
+    if evidence_path:
+        selected_path = str(evidence_path)
+        evidence_payload = _load_json(output_root / selected_path)
+    else:
+        selected_path, evidence_payload = _latest_evidence_pack(output_root)
+
+    trace_id = ""
+    trace_ids = evidence_payload.get("trace_ids", [])
+    if isinstance(trace_ids, list) and trace_ids:
+        trace_id = str(trace_ids[0])
+    if not trace_id:
+        trace_id = str(eval_payload.get("trace_id", ""))
+
+    trace_payload = trace_by_id.get(trace_id, {})
+    lineage = eval_payload.get("lineage") or evidence_payload.get("lineage") or {}
+    eval_id = str(eval_payload.get("eval_id", ""))
+    if not eval_id and trace_id:
+        eval_id = f"eval-{hashlib.sha256(trace_id.encode('utf-8')).hexdigest()[:12]}"
+
+    chain = {
+        "schema": "ProofChain",
+        "trace_id": trace_id,
+        "eval_id": eval_id,
+        "eval_trace_id": str(eval_payload.get("trace_id", "")),
+        "lineage": lineage,
+        "lineage_trace_id": str((lineage or {}).get("trace_id", "")) if isinstance(lineage, dict) else "",
+        "evidence_path": selected_path,
+        "security_scans": evidence_payload.get("security_scans", []),
+        "timestamp": evidence_payload.get("timestamp") or trace_payload.get("timestamp") or eval_payload.get("timestamp") or eval_payload.get("evaluated_at") or "unknown",
+        "executor": evidence_payload.get("executor") or trace_payload.get("executor") or eval_payload.get("executor") or {"user": "unknown", "pid": "unknown"},
+        "environment": evidence_payload.get("environment") or trace_payload.get("environment") or eval_payload.get("environment") or {"hostname": "unknown", "platform": "unknown"},
+        "ci_job_url": evidence_payload.get("ci_job_url") or "",
+        "external_inputs": evidence_payload.get("external_inputs", []),
+        "artifacts": {
+            "trace": trace_payload.get("path", ".omg/tracebank/events.jsonl"),
+            "eval": ".omg/evals/latest.json" if eval_payload else "",
+            "lineage": str((lineage or {}).get("path", "")) if isinstance(lineage, dict) else "",
+            "evidence": selected_path,
+        },
+    }
+    validation = validate_proof_chain(chain)
+    chain["status"] = validation["status"]
+    chain["blockers"] = validation["blockers"]
+    return chain
+
+
+def validate_proof_chain(chain: dict[str, Any]) -> dict[str, Any]:
+    blockers: list[str] = []
+
+    required_fields = (
+        "trace_id",
+        "eval_id",
+        "lineage",
+        "evidence_path",
+        "timestamp",
+        "executor",
+        "environment",
+    )
+    for field in required_fields:
+        value = chain.get(field)
+        if value in ("", None, [], {}):
+            blockers.append(f"proof_chain_missing_{field}")
+
+    trace_id = str(chain.get("trace_id", ""))
+    eval_trace_id = str(chain.get("eval_trace_id", ""))
+    if trace_id and eval_trace_id and trace_id != eval_trace_id:
+        blockers.append("proof_chain_trace_eval_mismatch")
+
+    evidence_path = str(chain.get("evidence_path", ""))
+    if evidence_path and not evidence_path.startswith(".omg/evidence/"):
+        blockers.append("proof_chain_evidence_path_outside_runtime_evidence")
+
+    security_scans = chain.get("security_scans", [])
+    if isinstance(security_scans, list):
+        linked_scan = any(isinstance(scan, dict) and str(scan.get("path", "")).startswith(".omg/evidence/") for scan in security_scans)
+        if not linked_scan:
+            blockers.append("proof_chain_missing_security_check_link")
+    else:
+        blockers.append("proof_chain_missing_security_check_link")
+
+    lineage = chain.get("lineage", {})
+    if isinstance(lineage, dict):
+        lineage_trace_id = str(lineage.get("trace_id", "") or chain.get("lineage_trace_id", ""))
+        if trace_id and lineage_trace_id and trace_id != lineage_trace_id:
+            blockers.append("proof_chain_lineage_trace_mismatch")
+    else:
+        blockers.append("proof_chain_invalid_lineage")
+
+    return {
+        "schema": "ProofChainValidationResult",
+        "status": "ok" if not blockers else "error",
+        "blockers": blockers,
+    }
+
+
+def build_proof_gate_input(project_dir: str, *, evidence_path: str | None = None) -> dict[str, Any]:
+    output_root = Path(project_dir)
+    chain = assemble_proof_chain(project_dir, evidence_path=evidence_path)
+
+    eval_path = output_root / ".omg" / "evals" / "latest.json"
+    eval_output = _load_json(eval_path) if eval_path.exists() else {}
+
+    if evidence_path:
+        selected_path = str(evidence_path)
+        evidence_payload = _load_json(output_root / selected_path)
+    else:
+        selected_path, evidence_payload = _latest_evidence_pack(output_root)
+
+    security_evidence = _resolve_security_evidence(output_root=output_root, evidence_payload=evidence_payload)
+    browser_evidence = _resolve_browser_evidence(output_root=output_root, evidence_payload=evidence_payload)
+
+    return {
+        "claims": evidence_payload.get("claims", []),
+        "proof_chain": chain,
+        "eval_output": eval_output,
+        "security_evidence": security_evidence,
+        "browser_evidence": browser_evidence,
+        "evidence_path": selected_path,
+    }
+
+
+def _resolve_security_evidence(*, output_root: Path, evidence_payload: dict[str, Any]) -> dict[str, Any]:
+    scans = evidence_payload.get("security_scans", [])
+    if not isinstance(scans, list):
+        return {}
+    for item in scans:
+        if not isinstance(item, dict):
+            continue
+        path = str(item.get("path", "")).strip()
+        if not path:
+            continue
+        evidence_path = output_root / path
+        if evidence_path.exists():
+            payload = _load_json(evidence_path)
+            if isinstance(payload, dict):
+                return payload
+    return {}
+
+
+def _resolve_browser_evidence(*, output_root: Path, evidence_payload: dict[str, Any]) -> dict[str, Any]:
+    candidates: list[str] = []
+    browser_evidence = evidence_payload.get("browser_evidence")
+    if isinstance(browser_evidence, dict):
+        direct_path = str(browser_evidence.get("path", "")).strip()
+        if direct_path:
+            candidates.append(direct_path)
+        if browser_evidence.get("schema") == "BrowserEvidence":
+            return browser_evidence
+    browser_trace = evidence_payload.get("browser_trace")
+    if isinstance(browser_trace, dict):
+        path = str(browser_trace.get("evidence_path", "")).strip()
+        if path:
+            candidates.append(path)
+
+    candidates.extend(
+        [
+            ".omg/evidence/browser-evidence.json",
+            ".omg/evidence/browser-proof.json",
+        ]
+    )
+    for rel in candidates:
+        path = output_root / rel
+        if not path.exists():
+            continue
+        payload = _load_json(path)
+        if isinstance(payload, dict):
+            return payload
+    return {}

package/build/lib/runtime/proof_gate.py

@@ -0,0 +1,163 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+def evaluate_proof_gate(input: dict[str, Any]) -> dict[str, Any]:
+    claims = _as_claims(input.get("claims"))
+    proof_chain = _as_dict(input.get("proof_chain"))
+    eval_output = _as_dict(input.get("eval_output"))
+    security_evidence = _as_dict(input.get("security_evidence"))
+    browser_evidence = _as_dict(input.get("browser_evidence"))
+
+    blockers: list[str] = []
+    if not claims:
+        blockers.append("proof_gate_missing_claims")
+
+    proof_status = str(proof_chain.get("status", "error"))
+    proof_blockers = proof_chain.get("blockers", [])
+    if proof_status == "error":
+        blockers.append("proof_gate_proof_chain_error")
+    if isinstance(proof_blockers, list) and proof_blockers:
+        blockers.extend(f"proof_gate_proof_chain: {item}" for item in proof_blockers)
+    elif proof_blockers not in ({}, None, []):
+        blockers.append("proof_gate_proof_chain_blockers_invalid")
+
+    trace_id = str(proof_chain.get("trace_id", "")).strip()
+    blockers.extend(_validate_claim_artifacts(claims))
+    blockers.extend(_validate_trace_linkage(claims=claims, trace_id=trace_id, eval_output=eval_output, browser_evidence=browser_evidence))
+    blockers.extend(_validate_security_and_browser_artifacts(claims=claims, security_evidence=security_evidence, browser_evidence=browser_evidence))
+
+    unique_blockers = list(dict.fromkeys(item for item in blockers if str(item).strip()))
+    evidence_summary = {
+        "claim_count": len(claims),
+        "proof_chain_status": proof_status,
+        "proof_chain_blocker_count": len(proof_blockers) if isinstance(proof_blockers, list) else 0,
+        "required_artifacts": ["junit", "coverage", "sarif", "browser_trace"],
+        "trace_id": trace_id,
+        "eval_trace_id": str(eval_output.get("trace_id", "")).strip(),
+        "has_security_evidence": bool(security_evidence),
+        "has_browser_evidence": bool(browser_evidence),
+    }
+    return {
+        "schema": "ProofGateResult",
+        "verdict": "pass" if not unique_blockers else "fail",
+        "blockers": unique_blockers,
+        "evidence_summary": evidence_summary,
+    }
+
+
+def _as_claims(value: Any) -> list[dict[str, Any]]:
+    if not isinstance(value, list):
+        return []
+    claims: list[dict[str, Any]] = []
+    for item in value:
+        if not isinstance(item, dict):
+            continue
+        claims.append(item)
+    return claims
+
+
+def _as_dict(value: Any) -> dict[str, Any]:
+    if isinstance(value, dict):
+        return value
+    return {}
+
+
+def _collect_artifacts(claim: dict[str, Any]) -> list[str]:
+    evidence = _as_dict(claim.get("evidence"))
+    raw_artifacts = evidence.get("artifacts", claim.get("artifacts", []))
+    if not isinstance(raw_artifacts, list):
+        return []
+    artifacts: list[str] = []
+    for item in raw_artifacts:
+        if isinstance(item, str):
+            value = item.strip().lower()
+            if value:
+                artifacts.append(value)
+        elif isinstance(item, dict):
+            for key in ("kind", "schema", "type", "path", "id"):
+                value = str(item.get(key, "")).strip().lower()
+                if value:
+                    artifacts.append(value)
+    return artifacts
+
+
+def _collect_trace_ids(claim: dict[str, Any]) -> set[str]:
+    evidence = _as_dict(claim.get("evidence"))
+    raw_trace_ids = evidence.get("trace_ids", claim.get("trace_ids", []))
+    if not isinstance(raw_trace_ids, list):
+        return set()
+    return {str(item).strip() for item in raw_trace_ids if str(item).strip()}
+
+
+def _validate_claim_artifacts(claims: list[dict[str, Any]]) -> list[str]:
+    all_artifacts: list[str] = []
+    for claim in claims:
+        all_artifacts.extend(_collect_artifacts(claim))
+
+    blockers: list[str] = []
+    required_tokens = {
+        "junit": ("junit", "junit.xml", "surefire"),
+        "coverage": ("coverage", "lcov", "coverage.xml"),
+        "sarif": ("sarif", ".sarif"),
+        "browser_trace": ("trace.zip", "browser_trace", "playwright", "browser-evidence"),
+    }
+    for key, tokens in required_tokens.items():
+        if not any(any(token in artifact for token in tokens) for artifact in all_artifacts):
+            blockers.append(f"proof_gate_missing_artifact_{key}")
+    return blockers
+
+
+def _validate_trace_linkage(
+    *,
+    claims: list[dict[str, Any]],
+    trace_id: str,
+    eval_output: dict[str, Any],
+    browser_evidence: dict[str, Any],
+) -> list[str]:
+    blockers: list[str] = []
+    claim_trace_ids: set[str] = set()
+    for claim in claims:
+        claim_trace_ids.update(_collect_trace_ids(claim))
+
+    if not claim_trace_ids:
+        blockers.append("proof_gate_missing_tracebank_ids")
+    if trace_id and claim_trace_ids and trace_id not in claim_trace_ids:
+        blockers.append("proof_gate_trace_id_not_linked_in_claims")
+
+    eval_trace_id = str(eval_output.get("trace_id", "")).strip()
+    if trace_id and eval_trace_id and trace_id != eval_trace_id:
+        blockers.append("proof_gate_eval_trace_mismatch")
+
+    browser_metadata = _as_dict(browser_evidence.get("metadata"))
+    browser_trace_id = str(browser_metadata.get("trace_id", browser_evidence.get("trace_id", ""))).strip()
+    if browser_trace_id and trace_id and browser_trace_id != trace_id:
+        blockers.append("proof_gate_browser_trace_mismatch")
+    return blockers
+
+
+def _validate_security_and_browser_artifacts(
+    *,
+    claims: list[dict[str, Any]],
+    security_evidence: dict[str, Any],
+    browser_evidence: dict[str, Any],
+) -> list[str]:
+    blockers: list[str] = []
+    all_artifacts: list[str] = []
+    for claim in claims:
+        all_artifacts.extend(_collect_artifacts(claim))
+
+    if security_evidence:
+        evidence = _as_dict(security_evidence.get("evidence"))
+        sarif_path = str(evidence.get("sarif_path", "")).strip().lower()
+        if sarif_path and not any("sarif" in artifact for artifact in all_artifacts):
+            blockers.append("proof_gate_sarif_not_linked_by_claims")
+
+    if browser_evidence:
+        artifacts = _as_dict(browser_evidence.get("artifacts"))
+        trace_path = str(artifacts.get("trace", "")).strip().lower()
+        if trace_path and not any("trace" in artifact or "playwright" in artifact for artifact in all_artifacts):
+            blockers.append("proof_gate_browser_trace_not_linked_by_claims")
+
+    return blockers

package/build/lib/runtime/providers/codex_provider.py

@@ -0,0 +1,102 @@
+"""Codex CLI provider — implements CLIProvider for the ``codex`` binary."""
+
+from __future__ import annotations
+
+import logging
+import os
+import shlex
+import shutil
+import subprocess
+import uuid
+from typing import Any
+
+from runtime.cli_provider import CLIProvider, register_provider
+from runtime.mcp_config_writers import write_codex_mcp_config
+from runtime.tmux_session_manager import TmuxSessionManager
+
+_logger = logging.getLogger(__name__)
+
+
+class CodexProvider(CLIProvider):
+    """CLIProvider implementation for the Codex CLI (``codex``)."""
+
+    # -- identity -----------------------------------------------------------
+
+    def get_name(self) -> str:  # noqa: D401
+        """Return the canonical provider name."""
+        return "codex"
+
+    # -- detection ----------------------------------------------------------
+
+    def detect(self) -> bool:
+        """Return ``True`` when the ``codex`` binary is available on PATH."""
+        return shutil.which("codex") is not None
+
+    # -- authentication -----------------------------------------------------
+
+    def check_auth(self) -> tuple[bool | None, str]:
+        """Check Codex authentication status via ``codex auth status``."""
+        try:
+            result = self.run_tool(["codex", "auth", "status"], timeout=30)
+            if result.returncode == 0:
+                return True, result.stdout.strip()
+            return False, result.stderr.strip() or result.stdout.strip()
+        except Exception as exc:
+            return None, f"codex auth check failed: {exc}"
+
+    # -- invocation ---------------------------------------------------------
+
+    def invoke(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny]
+        """Invoke ``codex exec --json`` via subprocess."""
+        try:
+            result = self.run_tool(
+                ["codex", "exec", "--json", prompt],
+                timeout=timeout,
+            )
+            return {
+                "model": "codex-cli",
+                "output": result.stdout,
+                "exit_code": result.returncode,
+            }
+        except subprocess.TimeoutExpired:
+            return {"error": "codex-cli timeout", "fallback": "claude"}
+        except FileNotFoundError:
+            return {"error": "codex-cli not found", "fallback": "claude"}
+        except Exception as exc:
+            return {"error": str(exc), "fallback": "claude"}
+
+    def invoke_tmux(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny]
+        """Invoke ``codex exec --json`` via a persistent tmux session.
+
+        Falls back to :meth:`invoke` on failure.
+        """
+        try:
+            mgr = TmuxSessionManager()
+            session_name = mgr.make_session_name("codex", unique_id=str(uuid.uuid4())[:8])
+            session = mgr.get_or_create_session(session_name)
+            output = mgr.send_command(session, f"codex exec --json {shlex.quote(prompt)}", timeout=timeout)
+            mgr.kill_session(session)
+            return {"model": "codex-cli", "output": output, "exit_code": 0}
+        except Exception as exc:
+            _logger.warning("tmux codex invocation failed, falling back to subprocess: %s", exc)
+            return self.invoke(prompt, project_dir, timeout=timeout)
+
+    # -- command helpers ----------------------------------------------------
+
+    def get_non_interactive_cmd(self, prompt: str) -> list[str]:
+        """Return the non-interactive command for codex."""
+        return ["codex", "exec", "--json", prompt]
+
+    # -- configuration ------------------------------------------------------
+
+    def get_config_path(self) -> str:
+        """Return the Codex configuration file path."""
+        return os.path.expanduser("~/.codex/config.toml")
+
+    def write_mcp_config(self, server_url: str, server_name: str = "memory-server") -> None:
+        """Write an MCP server entry to ``~/.codex/config.toml``."""
+        write_codex_mcp_config(server_url, server_name, config_path=self.get_config_path())
+
+
+# -- auto-register on import -----------------------------------------------
+register_provider(CodexProvider())

package/build/lib/runtime/providers/gemini_provider.py

@@ -0,0 +1,109 @@
+"""Gemini CLI provider — implements CLIProvider for the ``gemini`` binary."""
+
+from __future__ import annotations
+
+import logging
+import os
+import shlex
+import shutil
+import subprocess
+import uuid
+from typing import Any
+
+from runtime.cli_provider import CLIProvider, register_provider
+from runtime.mcp_config_writers import write_gemini_mcp_config
+from runtime.tmux_session_manager import TmuxSessionManager
+
+_logger = logging.getLogger(__name__)
+
+
+class GeminiProvider(CLIProvider):
+    """CLIProvider implementation for the Gemini CLI (``gemini``)."""
+
+    # -- identity -----------------------------------------------------------
+
+    def get_name(self) -> str:  # noqa: D401
+        """Return the canonical provider name."""
+        return "gemini"
+
+    # -- detection ----------------------------------------------------------
+
+    def detect(self) -> bool:
+        """Return ``True`` when the ``gemini`` binary is available on PATH."""
+        return shutil.which("gemini") is not None
+
+    # -- authentication -----------------------------------------------------
+
+    def check_auth(self) -> tuple[bool | None, str]:
+        """Check Gemini authentication status via ``gemini auth status``."""
+        try:
+            result = self.run_tool(["gemini", "auth", "status"], timeout=30)
+            if result.returncode == 0:
+                return True, result.stdout.strip()
+            return False, result.stderr.strip() or result.stdout.strip()
+        except Exception as exc:
+            return None, f"gemini auth check failed: {exc}"
+
+    # -- invocation ---------------------------------------------------------
+
+    def invoke(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny]
+        """Invoke ``gemini -p`` via subprocess.
+
+        Gemini CLI has no ``--json`` flag — output is plain text stdout.
+        """
+        try:
+            result = self.run_tool(
+                ["gemini", "-p", prompt],
+                timeout=timeout,
+            )
+            return {
+                "model": "gemini-cli",
+                "output": result.stdout,
+                "exit_code": result.returncode,
+            }
+        except subprocess.TimeoutExpired:
+            return {"error": "gemini-cli timeout", "fallback": "claude"}
+        except FileNotFoundError:
+            return {"error": "gemini-cli not found", "fallback": "claude"}
+        except Exception as exc:
+            return {"error": str(exc), "fallback": "claude"}
+
+    def invoke_tmux(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny]
+        """Invoke ``gemini -p`` via a persistent tmux session.
+
+        Falls back to :meth:`invoke` on failure.
+        """
+        try:
+            mgr = TmuxSessionManager()
+            session_name = mgr.make_session_name("gemini", unique_id=str(uuid.uuid4())[:8])
+            session = mgr.get_or_create_session(session_name)
+            output = mgr.send_command(session, f"gemini -p {shlex.quote(prompt)}", timeout=timeout)
+            mgr.kill_session(session)
+            return {"model": "gemini-cli", "output": output, "exit_code": 0}
+        except Exception as exc:
+            _logger.warning("tmux gemini invocation failed, falling back to subprocess: %s", exc)
+            return self.invoke(prompt, project_dir, timeout=timeout)
+
+    # -- command helpers ----------------------------------------------------
+
+    def get_non_interactive_cmd(self, prompt: str) -> list[str]:
+        """Return the non-interactive command for gemini."""
+        return ["gemini", "-p", prompt]
+
+    # -- configuration ------------------------------------------------------
+
+    def get_config_path(self) -> str:
+        """Return the Gemini configuration file path."""
+        return os.path.expanduser("~/.gemini/settings.json")
+
+    def write_mcp_config(self, server_url: str, server_name: str = "memory-server") -> None:
+        """Write an MCP server entry to ``~/.gemini/settings.json``.
+
+        Uses JSON format with ``mcpServers`` key and ``httpUrl`` field,
+        merging into any existing configuration.
+        """
+        write_gemini_mcp_config(server_url, server_name, config_path=self.get_config_path())
+
+
+# -- auto-register on import -----------------------------------------------
+register_provider(GeminiProvider())