@trac3er/oh-my-god 2.1.0 → 2.1.4

package/runtime/tool_plan_gate.py

@@ -8,6 +8,10 @@ from uuid import uuid4
 
 import json
 
+from runtime.context_engine import ContextEngine
+from runtime.release_run_coordinator import resolve_current_run_id as resolve_coordinator_run_id
+from runtime.runtime_contracts import read_run_state
+
 
 _TOOL_KEYWORDS: dict[str, tuple[str, ...]] = {
     "context7": ("doc", "docs", "documentation", "library", "api reference", "reference"),
@@ -16,14 +20,35 @@ _TOOL_KEYWORDS: dict[str, tuple[str, ...]] = {
     "omg-control": ("policy", "governance", "release", "proof", "control plane"),
 }
 
+_READ_ONLY_TOOL_HINTS = (
+    "read",
+    "search",
+    "review",
+    "grep",
+    "glob",
+    "list",
+    "ls",
+    "context7",
+    "websearch",
+)
+_MUTATION_TOOLS = frozenset({"write", "edit", "multiedit", "bash"})
+
 
 def build_tool_plan(
     goal: str,
     available_tools: list[str],
     context_packet: dict[str, object] | None = None,
+    run_id: str | None = None,
 ) -> dict[str, object]:
     normalized_goal = str(goal or "").strip()
     normalized_tools = _normalize_tools(available_tools)
+    canonical_run_id = run_id or resolve_current_run_id(project_dir=None)
+    bounded_context = _resolve_bounded_context_packet(
+        project_dir=str(_project_dir()),
+        run_id=canonical_run_id,
+        fallback_context=context_packet,
+    )
+    council = _read_council_verdicts(str(_project_dir()), canonical_run_id)
 
     selected_tools: list[dict[str, object]] = []
     for tool_name in normalized_tools:
@@ -31,7 +56,7 @@ def build_tool_plan(
             selected_tools.append(
                 {
                     "name": tool_name,
-                    "args": _default_args(tool_name, normalized_goal, context_packet),
+                    "args": _default_args(tool_name, normalized_goal, bounded_context),
                     "rationale": _rationale(tool_name),
                 }
             )
@@ -41,23 +66,25 @@ def build_tool_plan(
         selected_tools.append(
             {
                 "name": fallback,
-                "args": _default_args(fallback, normalized_goal, context_packet),
+                "args": _default_args(fallback, normalized_goal, bounded_context),
                 "rationale": "fallback: no explicit keyword match; keep single minimal tool",
             }
         )
 
-    run_id = resolve_current_run_id(project_dir=None)
-    plan_id = _new_plan_id(run_id=run_id)
+    selected_tools = _apply_context_optimization(selected_tools, bounded_context, council)
+    plan_id = _new_plan_id(run_id=canonical_run_id)
     payload: dict[str, object] = {
         "plan_id": plan_id,
         "goal": normalized_goal,
         "tools": selected_tools,
         "budget_estimate": {
             "estimated_calls": len(selected_tools),
-            "estimated_context_chars": _estimate_context_chars(context_packet),
+            "estimated_context_chars": _estimate_context_chars(bounded_context),
             "goal_complexity": _goal_complexity(normalized_goal),
         },
-        "run_id": run_id,
+        "context_packet": bounded_context,
+        "council_verdicts": council.get("verdicts", {}),
+        "run_id": canonical_run_id,
         "created_at": datetime.now(timezone.utc).isoformat(),
     }
     _persist_plan(_project_dir(), plan_id, payload)
@@ -65,19 +92,8 @@ def build_tool_plan(
 
 
 def resolve_current_run_id(project_dir: str | None = None) -> str | None:
-    run_id = str(os.environ.get("OMG_RUN_ID", "")).strip()
-    if run_id:
-        return run_id
-
-    root = _project_dir(project_dir)
-    active_run = root / ".omg" / "shadow" / "active-run"
-    if not active_run.exists():
-        return None
-    try:
-        value = active_run.read_text(encoding="utf-8").strip()
-    except OSError:
-        return None
-    return value or None
+    run_id = resolve_coordinator_run_id(project_dir=project_dir)
+    return run_id or None
 
 
 def has_tool_plan_for_run(project_dir: str, run_id: str | None) -> bool:
@@ -93,7 +109,45 @@ def has_tool_plan_for_run(project_dir: str, run_id: str | None) -> bool:
 def tool_plan_gate_check(project_dir: str, run_id: str | None, tool: str) -> dict[str, object]:
     if not run_id:
         return {"status": "allowed", "reason": "run_id unavailable; skip tool plan gate"}
+
+    context_packet = _resolve_bounded_context_packet(
+        project_dir=project_dir,
+        run_id=run_id,
+        fallback_context=None,
+    )
+    clarification = _clarification_status(context_packet)
+    if clarification["requires_clarification"]:
+        reason = _clarification_reason(str(clarification["clarification_prompt"]))
+        if _is_mutation_capable_tool(tool):
+            _persist_gate_error(project_dir, run_id, tool, reason)
+            return {
+                "status": "blocked",
+                "reason": reason,
+                "run_id": run_id,
+                "tool": tool,
+                "clarification_status": clarification,
+            }
+        if _is_read_search_review_tool(tool):
+            return {
+                "status": "allowed",
+                "reason": "clarification pending; read/search/review tool allowed",
+                "run_id": run_id,
+                "clarification_status": clarification,
+            }
+
     if has_tool_plan_for_run(project_dir, run_id):
+        council = _read_council_verdicts(project_dir, run_id)
+        verdict = _council_gate_verdict(council)
+        if verdict["blocked"]:
+            reason = str(verdict["reason"])
+            _persist_gate_error(project_dir, run_id, tool, reason)
+            return {
+                "status": "blocked",
+                "reason": reason,
+                "run_id": run_id,
+                "tool": tool,
+                "council_verdicts": council.get("verdicts", {}),
+            }
         return {"status": "allowed", "reason": "tool plan present", "run_id": run_id}
 
     reason = "tool plan required before mutation-capable MCP evaluation"
@@ -197,7 +251,152 @@ def _atomic_write_json(path: Path, payload: Mapping[str, object]) -> None:
     _ = os.replace(temp_path, path)
 
 
+def journal_mutation_bash(
+    project_dir: str,
+    command: str,
+    run_id: str | None = None,
+    metadata: dict[str, object] | None = None,
+) -> dict[str, object] | None:
+    try:
+        from runtime.interaction_journal import InteractionJournal
+        from runtime.rollback_manifest import classify_side_effect
+    except ImportError:
+        return None
+
+    canonical_run_id = run_id or resolve_current_run_id(project_dir)
+    if not canonical_run_id:
+        return None
+
+    meta: dict[str, object] = dict(metadata or {})
+    meta["command"] = command
+    meta["run_id"] = canonical_run_id
+
+    side_effect = classify_side_effect("bash", meta)
+    meta["side_effect_scope"] = str(side_effect.get("category", "unknown"))
+    meta["side_effect_classification"] = side_effect
+
+    journal = InteractionJournal(project_dir)
+    return journal.record_step("bash", meta)
+
+
 def _safe_token(value: str) -> str:
     chars = [ch if ch.isalnum() or ch in {"-", "_"} else "-" for ch in value.strip()]
     token = "".join(chars).strip("-")
     return token or "run"
+
+
+def _resolve_bounded_context_packet(
+    *,
+    project_dir: str,
+    run_id: str | None,
+    fallback_context: dict[str, object] | None,
+) -> dict[str, object]:
+    if run_id:
+        packet = ContextEngine(project_dir).build_packet(run_id=run_id, delta_only=True)
+        if isinstance(fallback_context, dict) and str(fallback_context.get("summary", "")).strip():
+            summary = str(packet.get("summary", "")).strip()
+            if not summary or summary == "no context signals available":
+                packet["summary"] = str(fallback_context.get("summary", ""))
+        return packet
+    return dict(fallback_context or {"summary": "", "artifact_pointers": []})
+
+
+def _read_council_verdicts(project_dir: str, run_id: str | None) -> dict[str, object]:
+    if not run_id:
+        return {}
+    payload = read_run_state(project_dir, "council_verdicts", run_id)
+    if isinstance(payload, dict):
+        return dict(payload)
+    return {}
+
+
+def _council_gate_verdict(council: dict[str, object]) -> dict[str, object]:
+    verdicts = council.get("verdicts")
+    if not isinstance(verdicts, dict):
+        return {"blocked": False, "reason": ""}
+
+    for critic_name, critic_payload in verdicts.items():
+        if not isinstance(critic_payload, dict):
+            continue
+        token = str(critic_payload.get("verdict", "")).strip().lower()
+        if token == "fail":
+            return {
+                "blocked": True,
+                "reason": f"council critic '{critic_name}' failed; block mutation-capable tool execution",
+            }
+    return {"blocked": False, "reason": ""}
+
+
+def _apply_context_optimization(
+    tools: list[dict[str, object]],
+    context_packet: dict[str, object],
+    council: dict[str, object],
+) -> list[dict[str, object]]:
+    if len(tools) <= 1:
+        return tools
+
+    budget = context_packet.get("budget")
+    used_chars = 0
+    max_chars = 0
+    if isinstance(budget, dict):
+        try:
+            used_chars = int(budget.get("used_chars", 0))
+            max_chars = int(budget.get("max_chars", 0))
+        except (TypeError, ValueError):
+            used_chars = 0
+            max_chars = 0
+
+    verdicts = council.get("verdicts")
+    evidence_warn = False
+    if isinstance(verdicts, dict):
+        evidence = verdicts.get("evidence_completeness")
+        if isinstance(evidence, dict):
+            evidence_warn = str(evidence.get("verdict", "")).strip().lower() in {"warn", "fail"}
+
+    pressure_high = max_chars > 0 and used_chars >= int(max_chars * 0.9)
+    if pressure_high or evidence_warn:
+        return tools[:1]
+    return tools
+
+
+def _clarification_status(context_packet: dict[str, object]) -> dict[str, object]:
+    raw = context_packet.get("clarification_status")
+    if not isinstance(raw, dict):
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    prompt = str(raw.get("clarification_prompt", "")).strip().replace("\n", " ")
+    try:
+        confidence = float(raw.get("confidence", 0.0))
+    except (TypeError, ValueError):
+        confidence = 0.0
+    return {
+        "requires_clarification": bool(raw.get("requires_clarification") is True),
+        "intent_class": str(raw.get("intent_class", "")).strip(),
+        "clarification_prompt": prompt,
+        "confidence": round(max(0.0, min(1.0, confidence)), 2),
+    }
+
+
+def _clarification_reason(clarification_prompt: str) -> str:
+    prompt = " ".join(str(clarification_prompt or "").split())
+    if prompt:
+        return f"Clarification required before mutation: {prompt}"
+    return "Clarification required before mutation: provide the missing intent details."
+
+
+def _is_mutation_capable_tool(tool: str) -> bool:
+    token = str(tool or "").strip().lower()
+    if token in _MUTATION_TOOLS:
+        return True
+    return token.startswith("bash:")
+
+
+def _is_read_search_review_tool(tool: str) -> bool:
+    token = str(tool or "").strip().lower()
+    if not token:
+        return False
+    return any(hint in token for hint in _READ_ONLY_TOOL_HINTS)

package/runtime/validate.py

@@ -0,0 +1,289 @@
+"""Canonical validation engine — composes doctor, contract, profile, and install checks.
+
+This module is the single entrypoint for ``omg validate``.  It delegates to
+existing checkers (``run_doctor``, ``validate_contract_registry``, profile
+governor, install integrity) rather than duplicating their logic.
+"""
+from __future__ import annotations
+
+import os
+import shutil
+from pathlib import Path
+from typing import Any
+
+from runtime.adoption import CANONICAL_VERSION
+from runtime.compat import run_doctor, _doctor_check
+from runtime.contract_compiler import validate_contract_registry
+from runtime.plugin_diagnostics import run_plugin_diagnostics
+from runtime.profile_io import load_profile, ensure_governed_preferences
+
+
+def _check_contract_registry(root_dir: Path) -> dict[str, Any]:
+    """Compose contract registry validation into a single doctor-style check."""
+    try:
+        result = validate_contract_registry(root_dir)
+    except Exception as exc:
+        return _doctor_check(
+            "contract_registry",
+            ok=False,
+            message=f"contract validation error: {exc}",
+        )
+    if result.get("status") == "ok":
+        error_count = len(result.get("errors", []))
+        return _doctor_check(
+            "contract_registry",
+            ok=True,
+            message=f"contract registry valid ({error_count} errors)",
+        )
+    errors = result.get("errors", [])
+    summary = errors[0] if errors else "unknown error"
+    if len(errors) > 1:
+        summary += f" (+{len(errors) - 1} more)"
+    return _doctor_check(
+        "contract_registry",
+        ok=False,
+        message=f"contract registry invalid: {summary}",
+    )
+
+
+def _check_profile_governor(root_dir: Path) -> dict[str, Any]:
+    """Validate that governed profile state is consistent."""
+    profile_path = os.path.join(root_dir, ".omg", "state", "profile.yaml")
+    profile = load_profile(profile_path)
+
+    if not profile:
+        return _doctor_check(
+            "profile_governor",
+            ok=True,
+            message="no profile found (optional — run /OMG:init to create)",
+            required=False,
+        )
+
+    try:
+        ensure_governed_preferences(profile)
+    except Exception as exc:
+        return _doctor_check(
+            "profile_governor",
+            ok=False,
+            message=f"governed preferences malformed: {exc}",
+            required=False,
+        )
+
+    governed = profile.get("governed_preferences", {})
+    governed = governed if isinstance(governed, dict) else {}
+    style_entries = governed.get("style", [])
+    style_entries = style_entries if isinstance(style_entries, list) else []
+    safety_entries = governed.get("safety", [])
+    safety_entries = safety_entries if isinstance(safety_entries, list) else []
+
+    pending = sum(
+        1 for e in style_entries + safety_entries
+        if isinstance(e, dict) and e.get("confirmation_state") == "pending_confirmation"
+    )
+
+    parts = [f"{len(style_entries)} style, {len(safety_entries)} safety"]
+    if pending:
+        parts.append(f"{pending} pending confirmation")
+
+    return _doctor_check(
+        "profile_governor",
+        ok=True,
+        message=f"profile governor ok ({', '.join(parts)})",
+        required=False,
+    )
+
+
+def _check_install_integrity(root_dir: Path) -> dict[str, Any]:
+    """Verify critical install paths exist and are coherent."""
+    issues: list[str] = []
+
+    # Check scripts/omg.py exists
+    omg_script = root_dir / "scripts" / "omg.py"
+    if not omg_script.exists():
+        issues.append("scripts/omg.py missing")
+
+    # Check runtime/ package exists
+    runtime_init = root_dir / "runtime" / "__init__.py"
+    runtime_dir = root_dir / "runtime"
+    if not runtime_dir.exists():
+        issues.append("runtime/ directory missing")
+
+    # Check commands/ directory exists
+    commands_dir = root_dir / "commands"
+    if not commands_dir.exists():
+        issues.append("commands/ directory missing")
+
+    # Check plugins/core/plugin.json exists
+    plugin_json = root_dir / "plugins" / "core" / "plugin.json"
+    if not plugin_json.exists():
+        issues.append("plugins/core/plugin.json missing")
+
+    # Check pyproject.toml exists
+    pyproject = root_dir / "pyproject.toml"
+    if not pyproject.exists():
+        issues.append("pyproject.toml missing")
+
+    if issues:
+        return _doctor_check(
+            "install_integrity",
+            ok=False,
+            message=f"install issues: {'; '.join(issues)}",
+        )
+    return _doctor_check(
+        "install_integrity",
+        ok=True,
+        message="install integrity ok (scripts, runtime, commands, plugins present)",
+    )
+
+
+def _check_plugin_compatibility(root_dir: Path) -> dict[str, Any]:
+    try:
+        result = run_plugin_diagnostics(str(root_dir))
+    except Exception as exc:
+        return _doctor_check(
+            "plugin_compatibility",
+            ok=False,
+            message=f"plugin diagnostics error: {exc}",
+        )
+
+    status = str(result.get("status", "error"))
+    summary = result.get("summary", {})
+    summary = summary if isinstance(summary, dict) else {}
+    total_records = int(summary.get("total_records", 0))
+    total_conflicts = int(summary.get("total_conflicts", 0))
+    blockers = int(summary.get("blockers", 0))
+
+    return _doctor_check(
+        "plugin_compatibility",
+        ok=status in {"ok", "warn"},
+        message=(
+            f"plugin compatibility: {total_records} records, "
+            f"{total_conflicts} conflicts, {blockers} blockers"
+        ),
+    )
+
+
+def _load_selected_mcps(root_dir: Path) -> list[str]:
+    """Load selected MCP IDs from cli-config.yaml.
+
+    Checks CLAUDE_PROJECT_DIR env first, then falls back to root_dir.
+    Returns an empty list when the config file is absent or unparseable.
+    """
+    import yaml as _yaml
+
+    project_dir = os.environ.get("CLAUDE_PROJECT_DIR", "")
+    if project_dir:
+        config_path = os.path.join(project_dir, ".omg", "state", "cli-config.yaml")
+    else:
+        config_path = os.path.join(root_dir, ".omg", "state", "cli-config.yaml")
+
+    if not os.path.isfile(config_path):
+        return []
+
+    try:
+        with open(config_path, "r", encoding="utf-8") as f:
+            data = _yaml.safe_load(f)
+    except Exception:
+        return []
+
+    if not isinstance(data, dict):
+        return []
+
+    mcps = data.get("selected_mcps", [])
+    return [str(m) for m in mcps] if isinstance(mcps, list) else []
+
+
+def _check_notebooklm(root_dir: Path) -> dict[str, Any] | None:
+    """Optional NotebookLM health check — only runs when notebooklm is selected.
+
+    Returns None when NotebookLM is not in the selected MCP set (meaning:
+    skip entirely, no check emitted).  When selected, checks that ``npx``
+    is reachable on PATH.  Missing npx is a *warning*, never a blocker.
+    """
+    selected = _load_selected_mcps(root_dir)
+    if "notebooklm" not in selected:
+        return None
+
+    npx_path = shutil.which("npx")
+    if npx_path is None:
+        return _doctor_check(
+            "notebooklm",
+            ok=False,
+            message="npx not found — install Node.js to use NotebookLM",
+            required=False,
+        )
+
+    return _doctor_check(
+        "notebooklm",
+        ok=True,
+        message="npx available, notebooklm-mcp callable",
+        required=False,
+    )
+
+
+def run_validate(*, root_dir: Path | None = None) -> dict[str, Any]:
+    """Run all validation checks and return a structured result.
+
+    Composes:
+    1. ``run_doctor()`` — install and runtime checks
+    2. Contract registry validation
+    3. Profile governor validation
+    4. Install integrity check
+    5. Optional NotebookLM check (only when selected in MCP config)
+
+    Returns a dict matching the ``ValidateResult`` schema:
+    ``{"schema": "ValidateResult", "status": "pass"|"fail", "checks": [...], "version": "..."}``
+    """
+    repo_root = root_dir or Path(__file__).resolve().parent.parent
+
+    checks: list[dict[str, Any]] = []
+
+    # 1. Compose doctor checks (never duplicate — delegate directly)
+    doctor_result = run_doctor(root_dir=repo_root)
+    checks.extend(doctor_result.get("checks", []))
+
+    # 2. Contract registry
+    checks.append(_check_contract_registry(repo_root))
+
+    # 3. Profile governor
+    checks.append(_check_profile_governor(repo_root))
+
+    # 4. Install integrity
+    checks.append(_check_install_integrity(repo_root))
+
+    if not any(c.get("name") == "plugin_compatibility" for c in checks):
+        checks.append(_check_plugin_compatibility(repo_root))
+
+    nb_check = _check_notebooklm(repo_root)
+    if nb_check is not None:
+        checks.append(nb_check)
+
+    has_blocker = any(c["status"] == "blocker" for c in checks)
+
+    return {
+        "schema": "ValidateResult",
+        "status": "fail" if has_blocker else "pass",
+        "checks": checks,
+        "version": CANONICAL_VERSION,
+    }
+
+
+def format_text(result: dict[str, Any]) -> str:
+    """Format a ValidateResult as human-readable text."""
+    lines: list[str] = []
+    for check in result.get("checks", []):
+        if check["status"] == "ok":
+            marker = "PASS"
+        elif check["status"] == "blocker":
+            marker = "BLOCKER"
+        else:
+            marker = "WARN"
+        req_tag = "" if check.get("required", True) else " (optional)"
+        lines.append(f"  {marker:>7} {check['name']}: {check['message']}{req_tag}")
+
+    blockers = sum(1 for c in result.get("checks", []) if c["status"] == "blocker")
+    warnings = sum(1 for c in result.get("checks", []) if c["status"] == "warning")
+    passed = sum(1 for c in result.get("checks", []) if c["status"] == "ok")
+    lines.append(f"\nPASS [{passed}] | WARN [{warnings}] | BLOCKER [{blockers}]")
+
+    return "\n".join(lines)

package/runtime/verification_controller.py

@@ -4,7 +4,11 @@ import json
 from pathlib import Path
 from typing import cast
 
-from runtime.background_verification import publish_verification_state
+from runtime.background_verification import (
+    publish_verification_state,
+    should_skip_validation,
+    skipped_stages_for_profile,
+)
 from runtime.runtime_contracts import read_run_state, write_run_state
 
 
@@ -80,8 +84,43 @@ class VerificationController:
         payload = read_run_state(self.project_dir, "verification_controller", run_id)
         return dict(payload) if isinstance(payload, dict) else {"run_id": run_id, "status": status}
 
+    def begin_run_with_profile(
+        self, run_id: str, evidence_profile: str | None = None
+    ) -> dict[str, object]:
+        """Start a run with evidence-profile-driven skip logic.
+
+        Computes which validation stages to skip based on the profile,
+        and includes step/total progress for HUD consumption.
+        """
+        from runtime.evidence_requirements import requirements_for_profile
+
+        required = requirements_for_profile(evidence_profile)
+        skipped = skipped_stages_for_profile(evidence_profile)
+
+        state: dict[str, object] = {
+            "status": "running",
+            "blockers": [],
+            "evidence_links": [],
+            "progress": self._build_progress(
+                run_id,
+                step_total={
+                    "step": 0,
+                    "total": len(required),
+                    "current_stage": required[0] if required else "",
+                    "evidence_profile": evidence_profile or "code-change",
+                    "skipped_stages": skipped,
+                },
+            ),
+        }
+        _ = write_run_state(self.project_dir, "verification_controller", run_id, state)
+        payload = read_run_state(self.project_dir, "verification_controller", run_id)
+        return dict(payload) if isinstance(payload, dict) else {"run_id": run_id, "status": "running"}
+
     def _build_progress(
-        self, run_id: str, prior: dict[str, object] | None = None
+        self,
+        run_id: str,
+        prior: dict[str, object] | None = None,
+        step_total: dict[str, object] | None = None,
     ) -> dict[str, object]:
         progress = dict(prior) if isinstance(prior, dict) else {}
         proof_artifacts = self._collect_run_artifacts("proof-gate", run_id)
@@ -98,6 +137,17 @@ class VerificationController:
             "artifact_paths": proof_artifacts,
         }
         progress["tool_ledger"] = self._collect_tool_ledger(run_id)
+
+        # Merge step/total from explicit input or preserve prior values
+        if isinstance(step_total, dict):
+            progress["step"] = step_total.get("step", 0)
+            progress["total"] = step_total.get("total", 0)
+            if "current_stage" in step_total:
+                progress["current_stage"] = step_total["current_stage"]
+            if "evidence_profile" in step_total:
+                progress["evidence_profile"] = step_total["evidence_profile"]
+            if "skipped_stages" in step_total:
+                progress["skipped_stages"] = step_total["skipped_stages"]
         return progress
 
     def _collect_test_intent_lock(self, run_id: str) -> dict[str, object]: