@trac3er/oh-my-god 2.1.0 → 2.1.4

package/runtime/mutation_gate.py

@@ -2,13 +2,25 @@ from __future__ import annotations
 
 import json
 import os
+import re
+import warnings
 from datetime import datetime, timezone
 from hashlib import sha256
 from pathlib import Path
 
+from runtime.release_run_coordinator import resolve_current_run_id
+from runtime.test_intent_lock import verify_lock
+
 
 _MUTATING_TOOLS = frozenset({"Write", "Edit", "MultiEdit"})
 _EXEMPTIONS = frozenset({"docs", "config", "generated", "test"})
+_MUTATION_BASH_PATTERNS = (
+    r"\b(git\s+(add|commit|push|rebase|cherry-pick|merge|tag))\b",
+    r"\b(rm|mv|cp|tee|touch|mkdir|rmdir|ln)\b",
+    r"\b(sed\s+-i|perl\s+-pi)\b",
+    r"\b(chmod|chown)\b",
+    r">\s*[^\s]",
+)
 
 
 def check_mutation_allowed(
@@ -18,11 +30,25 @@ def check_mutation_allowed(
     lock_id: str | None,
     *,
     exemption: str | None = None,
+    command: str | None = None,
+    run_id: str | None = None,
+    metadata: dict[str, object] | None = None,
 ) -> dict[str, str | None]:
     normalized_tool = str(tool or "").strip()
     normalized_file_path = str(file_path or "").strip()
     normalized_lock_id = str(lock_id or "").strip() or None
     normalized_exemption = str(exemption or "").strip().lower() or None
+    normalized_command = str(command or "").strip()
+    metadata_obj = metadata if isinstance(metadata, dict) else {}
+    explicit_exempt = bool(metadata_obj.get("exempt") is True)
+    strict_mode = os.environ.get("OMG_TDD_GATE_STRICT", "0").strip() == "1"
+
+    if explicit_exempt:
+        return {
+            "status": "exempt",
+            "reason": "metadata exemption allows mutation without lock",
+            "lock_id": normalized_lock_id,
+        }
 
     if normalized_exemption in _EXEMPTIONS:
         return {
@@ -31,36 +57,56 @@ def check_mutation_allowed(
             "lock_id": normalized_lock_id,
         }
 
-    if normalized_tool not in _MUTATING_TOOLS:
+    requires_lock = normalized_tool in _MUTATING_TOOLS
+    if normalized_tool == "Bash":
+        requires_lock = _is_mutation_capable_bash(normalized_command)
+
+    if not requires_lock:
         return {
             "status": "allowed",
             "reason": "tool is read-only for mutation gate",
             "lock_id": normalized_lock_id,
         }
 
-    if normalized_lock_id and _lock_exists(project_dir, normalized_lock_id):
+    resolved_run_id = str(run_id or "").strip() or resolve_current_run_id(project_dir=project_dir)
+    verification = verify_lock(project_dir, run_id=resolved_run_id, lock_id=normalized_lock_id)
+    if verification.get("status") == "ok":
         return {
             "status": "allowed",
             "reason": "active test intent lock found",
+            "lock_id": str(verification.get("lock_id") or normalized_lock_id or "") or None,
+        }
+
+    reason = str(verification.get("reason", "no_active_test_intent_lock"))
+    if strict_mode:
+        _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+        return {
+            "status": "blocked",
+            "reason": reason,
             "lock_id": normalized_lock_id,
         }
 
-    reason = (
-        "mutation denied: active test intent lock is required for mutation tools"
-        if not normalized_lock_id
-        else f"mutation denied: lock_id '{normalized_lock_id}' not found"
+    warnings.warn(
+        f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
+        RuntimeWarning,
+        stacklevel=2,
     )
-    _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
     return {
-        "status": "blocked",
+        "status": "allowed",
         "reason": reason,
         "lock_id": normalized_lock_id,
     }
 
 
-def _lock_exists(project_dir: str, lock_id: str) -> bool:
-    lock_path = Path(project_dir) / ".omg" / "state" / "test-intent-lock" / f"{lock_id}.json"
-    return lock_path.is_file()
+def _is_mutation_capable_bash(command: str) -> bool:
+    normalized_command = str(command or "").strip()
+    if not normalized_command:
+        return False
+    lowered = normalized_command.lower()
+    for pattern in _MUTATION_BASH_PATTERNS:
+        if re.search(pattern, lowered):
+            return True
+    return False
 
 
 def _write_block_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:

package/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.1.0",
+  "contract_version": "2.1.4",
   "count": 47,
   "contracts": [
     {
@@ -912,5 +912,5 @@
       "notes": "Writes long-form memory artifact for writing workflows."
     }
   ],
-  "generated_at": "2026-03-08T19:35:25.796113+00:00"
+  "generated_at": "2026-03-09T21:20:44.496932+00:00"
 }

package/runtime/omg_mcp_server.py

@@ -125,7 +125,7 @@ def _read_repo_text(rel_path: str) -> str:
 
 @mcp.tool()
 def omg_policy_evaluate(tool: str, input: dict[str, Any]) -> dict[str, Any]:
-    if tool in {"Write", "Edit", "MultiEdit"}:
+    if tool in {"Write", "Edit", "MultiEdit", "Bash"}:
         run_id_candidate = input.get("run_id") if isinstance(input, dict) else None
         run_id: str | None = None
         if isinstance(run_id_candidate, str) and run_id_candidate.strip():
@@ -138,9 +138,10 @@ def omg_policy_evaluate(tool: str, input: dict[str, Any]) -> dict[str, Any]:
         if not run_id:
             run_id = resolve_current_run_id()
 
-        tool_plan_result = tool_plan_gate_check(_service().project_dir, run_id, tool)
-        if tool_plan_result.get("status") == "blocked":
-            return tool_plan_result
+        if tool in {"Write", "Edit", "MultiEdit"}:
+            tool_plan_result = tool_plan_gate_check(_service().project_dir, run_id, tool)
+            if tool_plan_result.get("status") == "blocked":
+                return tool_plan_result
 
         lock_id: str | None = None
         if isinstance(metadata, dict):
@@ -158,6 +159,9 @@ def omg_policy_evaluate(tool: str, input: dict[str, Any]) -> dict[str, Any]:
                 "file_path": str(input.get("file_path", "")) if isinstance(input, dict) else "",
                 "lock_id": lock_id,
                 "exemption": exemption,
+                "command": str(input.get("command", "")) if isinstance(input, dict) else "",
+                "run_id": run_id,
+                "metadata": metadata if isinstance(metadata, dict) else None,
             }
         )
         if gate_status == 200 and gate_payload.get("status") == "blocked":
@@ -238,6 +242,12 @@ def omg_guide_assert(candidate: str, rules: dict[str, Any]) -> dict[str, Any]:
     return payload
 
 
+@mcp.tool()
+def omg_get_session_health(run_id: str | None = None) -> dict[str, Any]:
+    _status, payload = _service().session_health({"run_id": run_id})
+    return payload
+
+
 @mcp.prompt(name="omg_contract_summary", description="Summarize the OMG production contract and generated host outputs")
 def omg_contract_summary(channel: str = "public") -> str:
     return (

package/runtime/plugin_diagnostics.py

@@ -0,0 +1,248 @@
+from __future__ import annotations
+
+import json
+import time
+from pathlib import Path
+from typing import Callable, cast
+
+from runtime import plugin_interop
+
+
+def _load_allowlist(root: str | None) -> list[plugin_interop.PluginAllowlistEntry]:
+    load_fn = cast(
+        Callable[[str | None], list[plugin_interop.PluginAllowlistEntry]] | None,
+        getattr(plugin_interop, "load_plugin_allowlist", None),
+    )
+    if callable(load_fn):
+        return load_fn(root)
+    return []
+
+
+_LIVE_BUDGET_MS: float = 3000.0
+
+
+def _resolve_mcp_command(server_name: str, root: str | None) -> list[str] | None:
+    root_path = Path(root or ".").resolve()
+    for mcp_path in (
+        root_path / ".claude-plugin" / "mcp.json",
+        root_path / ".mcp.json",
+    ):
+        try:
+            raw = mcp_path.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        try:
+            payload = json.loads(raw)
+        except (json.JSONDecodeError, ValueError):
+            continue
+        if not isinstance(payload, dict):
+            continue
+        servers = payload.get("mcpServers", {})
+        if not isinstance(servers, dict):
+            continue
+        entry = servers.get(server_name)
+        if not isinstance(entry, dict):
+            continue
+        cmd = entry.get("command")
+        args = entry.get("args", [])
+        if isinstance(cmd, str):
+            cmd_list = [cmd]
+            if isinstance(args, list):
+                cmd_list.extend(str(a) for a in args)
+            return cmd_list
+    return None
+
+
+def _probe_mcp_servers_live(
+    records: list[plugin_interop.PluginInteropRecord],
+    root: str | None,
+) -> list[dict[str, object]]:
+    budget_start = time.monotonic()
+    results: list[dict[str, object]] = []
+    seen: set[str] = set()
+
+    for record in records:
+        for server_name in record.mcp_servers:
+            if server_name in seen:
+                continue
+            seen.add(server_name)
+
+            elapsed_total_ms = (time.monotonic() - budget_start) * 1000.0
+            if elapsed_total_ms >= _LIVE_BUDGET_MS:
+                results.append({
+                    "server": server_name,
+                    "status": "skipped",
+                    "elapsed_ms": 0.0,
+                })
+                continue
+
+            command = _resolve_mcp_command(server_name, root)
+            if command is None:
+                results.append({
+                    "server": server_name,
+                    "status": "skipped",
+                    "elapsed_ms": 0.0,
+                })
+                continue
+
+            remaining_ms = _LIVE_BUDGET_MS - elapsed_total_ms
+            probe_timeout = min(1500, int(remaining_ms))
+            results.append(
+                plugin_interop.probe_mcp_server_live(
+                    server_name, command, timeout_ms=probe_timeout,
+                )
+            )
+
+    return results
+
+
+def _record_sort_key(record: plugin_interop.PluginInteropRecord) -> tuple[str, str, str, str]:
+    return (record.host, record.plugin_id, record.layer, record.source)
+
+
+def run_plugin_diagnostics(root: str | None = None, live: bool = False) -> dict[str, object]:
+    started = time.monotonic()
+
+    omg_payload = plugin_interop.discover_omg_plugin_state(root)
+    host_payload = plugin_interop.discover_host_plugin_state(root)
+
+    all_records = [*omg_payload.records, *host_payload.records]
+    ordered_records = sorted(all_records, key=_record_sort_key)
+    conflicts = plugin_interop.classify_conflicts(ordered_records)
+    approvals = _load_allowlist(root)
+    approval_states = plugin_interop.get_approval_status_for_all(ordered_records, approvals)
+
+    blocker_count = sum(1 for conflict in conflicts if conflict.severity == "blocker")
+    warning_count = sum(1 for conflict in conflicts if conflict.severity == "warning")
+    info_count = sum(1 for conflict in conflicts if conflict.severity == "info")
+
+    if blocker_count > 0:
+        status = "error"
+    elif warning_count > 0:
+        status = "warn"
+    else:
+        status = "ok"
+
+    next_actions: list[str] = []
+    for conflict in conflicts:
+        action = conflict.next_action
+        if action and action not in next_actions:
+            next_actions.append(action)
+        if len(next_actions) >= 3:
+            break
+
+    result: dict[str, object] = {
+        "schema": "PluginDiagnosticsResult",
+        "status": status,
+        "records": [record.to_dict() for record in ordered_records],
+        "conflicts": [
+            {
+                "code": conflict.code,
+                "severity": conflict.severity,
+                "affected_plugin_ids": list(conflict.affected_plugin_ids),
+                "affected_hosts": list(conflict.affected_hosts),
+                "detail": conflict.detail,
+                "next_action": conflict.next_action,
+            }
+            for conflict in conflicts
+        ],
+        "approval_states": dict(sorted(approval_states.items())),
+        "summary": {
+            "total_records": len(ordered_records),
+            "total_conflicts": len(conflicts),
+            "blockers": blocker_count,
+            "warnings": warning_count,
+            "infos": info_count,
+        },
+        "next_actions": next_actions,
+        "elapsed_ms": (time.monotonic() - started) * 1000.0,
+    }
+
+    if live:
+        result["live_probe_results"] = _probe_mcp_servers_live(ordered_records, root)
+
+    return result
+
+
+def _infer_resource_type(source: str) -> str:
+    if source.startswith("mcp:"):
+        return "mcp_server"
+    if source.startswith("skill:"):
+        return "skill"
+    if source.startswith("plugin:"):
+        return "plugin"
+    raise ValueError("source must start with one of: mcp:, skill:, plugin:")
+
+
+def _record_sources(record: dict[str, object]) -> set[str]:
+    discovered: set[str] = set()
+    for server in cast(list[object], record.get("mcp_servers", [])):
+        if isinstance(server, str):
+            discovered.add(f"mcp:{server}")
+
+    plugin_id = record.get("plugin_id")
+    source = record.get("source")
+    if isinstance(plugin_id, str):
+        if source == plugin_interop.Source.SKILL_REGISTRY.value:
+            discovered.add(f"skill:{plugin_id}")
+        else:
+            discovered.add(f"plugin:{plugin_id}")
+    return discovered
+
+
+def approve_plugin(source: str, host: str, reason: str, root: str | None = None) -> dict[str, object]:
+    diagnostics = run_plugin_diagnostics(root)
+    records = diagnostics.get("records", [])
+    approval_states = diagnostics.get("approval_states", {})
+
+    matching_discovered = False
+    if isinstance(records, list):
+        for record in cast(list[object], records):
+            if not isinstance(record, dict):
+                continue
+            record_host = cast(str | None, record.get("host"))
+            if record_host != host:
+                continue
+            if source in _record_sources(cast(dict[str, object], record)):
+                matching_discovered = True
+                break
+
+    if not matching_discovered and isinstance(approval_states, dict):
+        for plugin_id, _status in cast(dict[object, object], approval_states).items():
+            if not isinstance(plugin_id, str):
+                continue
+            if source in {f"plugin:{plugin_id}", f"skill:{plugin_id}"}:
+                matching_discovered = True
+                break
+
+    if not matching_discovered:
+        return {
+            "schema": "ApprovalResult",
+            "status": "error",
+            "message": (
+                f"No discovered resource matching source={source!r} and host={host!r}. "
+                "Run diagnose-plugins first."
+            ),
+        }
+
+    entry = plugin_interop.PluginAllowlistEntry(
+        source=source,
+        host=host,
+        resource_type=_infer_resource_type(source),
+        reason=reason,
+    )
+    plugin_interop.validate_plugin_allowlist_entry(entry.to_dict())
+    entries = plugin_interop.load_plugin_allowlist(root)
+
+    exists = any(existing.source == source and existing.host == host for existing in entries)
+    if not exists:
+        entries.append(entry)
+
+    _ = plugin_interop.save_plugin_allowlist(entries, root)
+    return {
+        "schema": "ApprovalResult",
+        "status": "ok",
+        "source": source,
+        "host": host,
+        "message": "Approved and saved to .omg/state/plugins-allowlist.yaml",
+    }