@trac3er/oh-my-god 2.1.0 → 2.1.4

package/build/lib/control_plane/service.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 from datetime import datetime, timezone
 import os
+from pathlib import Path
 from typing import Any
 
 from hooks.policy_engine import (
@@ -20,6 +21,7 @@ from runtime.guide_assert import guide_assert
 from runtime.dispatcher import dispatch_runtime
 from runtime.claim_judge import judge_claims
 from runtime.mutation_gate import check_mutation_allowed
+from runtime.runtime_contracts import read_run_state
 from runtime.security_check import run_security_check
 from runtime.test_intent_lock import lock_intent, verify_intent
 
@@ -275,15 +277,24 @@ class ControlPlaneService:
         file_path = payload.get("file_path")
         lock_id = payload.get("lock_id")
         exemption = payload.get("exemption")
+        command = payload.get("command")
+        run_id = payload.get("run_id")
+        metadata = payload.get("metadata")
 
         if not isinstance(tool, str) or not tool.strip():
             raise ValueError("tool is required")
-        if not isinstance(file_path, str) or not file_path.strip():
+        if not isinstance(file_path, str) or (tool != "Bash" and not file_path.strip()):
             raise ValueError("file_path is required")
         if lock_id is not None and not isinstance(lock_id, str):
             raise ValueError("lock_id must be a string when provided")
         if exemption is not None and not isinstance(exemption, str):
             raise ValueError("exemption must be a string when provided")
+        if command is not None and not isinstance(command, str):
+            raise ValueError("command must be a string when provided")
+        if run_id is not None and not isinstance(run_id, str):
+            raise ValueError("run_id must be a string when provided")
+        if metadata is not None and not isinstance(metadata, dict):
+            raise ValueError("metadata must be an object when provided")
 
         result = check_mutation_allowed(
             tool=tool,
@@ -291,9 +302,37 @@ class ControlPlaneService:
             project_dir=self.project_dir,
             lock_id=lock_id,
             exemption=exemption,
+            command=command,
+            run_id=run_id,
+            metadata=metadata,
         )
         return 200, result
 
+    def session_health(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        run_id = payload.get("run_id")
+        if isinstance(run_id, str) and run_id.strip():
+            state = read_run_state(self.project_dir, "session_health", run_id.strip())
+            if state is None:
+                return 404, {"status": "error", "message": f"No session health for run_id: {run_id}"}
+            return 200, dict(state)
+
+        health_dir = Path(self.project_dir) / ".omg" / "state" / "session_health"
+        if not health_dir.exists():
+            return 404, {"status": "error", "message": "No session health state found"}
+
+        candidates = sorted(
+            (f for f in health_dir.iterdir() if f.suffix == ".json" and not f.name.endswith(".tmp")),
+            key=lambda p: p.stat().st_mtime,
+        )
+        if not candidates:
+            return 404, {"status": "error", "message": "No session health state found"}
+
+        latest_run_id = candidates[-1].stem
+        state = read_run_state(self.project_dir, "session_health", latest_run_id)
+        if state is None:
+            return 404, {"status": "error", "message": "Failed to read session health state"}
+        return 200, dict(state)
+
     def scoreboard_baseline(self) -> tuple[int, dict[str, Any]]:
         return 200, {
             "generated_at": datetime.now(timezone.utc).isoformat(),

package/build/lib/hooks/_agent_registry.py

@@ -224,6 +224,8 @@ INTENT_ROUTING = {
     "INTENT_EXPLORE":     "explore",      # explore/find → fast search agent
     "INTENT_REVIEW":      "reviewer",     # review/audit → code review agent
     "INTENT_QUICK":       "quick_task",   # quick/simple → fast task agent
+    # Clarification intent (Task 3) — halts mutation-capable execution
+    "INTENT_CLARIFICATION": None,         # clarification needed → halt (no agent dispatch)
 }
 
 # Core agent model preferences. NOT keyword-matched — used by orchestration pipeline only. model_version is informational (not passed to CLI).

package/build/lib/hooks/firewall.py

@@ -7,23 +7,234 @@ one centralized decision model.
 import json
 import os
 import sys
+from pathlib import Path
+from typing import Any
 
 HOOKS_DIR = os.path.dirname(__file__)
-if HOOKS_DIR not in sys.path:
-    sys.path.insert(0, HOOKS_DIR)
+PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
+for path in (HOOKS_DIR, PROJECT_ROOT):
+    if path not in sys.path:
+        sys.path.insert(0, path)
 
-from _common import setup_crash_handler, json_input, deny_decision, is_bypass_mode
+from _common import setup_crash_handler, json_input, deny_decision, is_bypass_mode, get_project_dir  # pyright: ignore[reportImplicitRelativeImport]
 
 # Fail-closed: deny on crash (security hook)
 setup_crash_handler("firewall", fail_closed=True)
 
 try:
-    from policy_engine import evaluate_bash_command, to_pretool_hook_output
+    from policy_engine import evaluate_bash_command, to_pretool_hook_output, scan_mutation_command, ask, deny  # pyright: ignore[reportImplicitRelativeImport]
+    from runtime.defense_state import DefenseState
+    from runtime.session_health import compute_session_health
+    from runtime.mutation_gate import check_mutation_allowed
+    from runtime.tool_plan_gate import journal_mutation_bash
 except Exception as _import_err:
     print(f"OMG firewall: policy_engine import failed: {_import_err}", file=sys.stderr)
     deny_decision(f"OMG firewall crash: policy_engine import failed: {_import_err}. Denying for safety.")
     sys.exit(0)
 
+
+def _enrich_risk_context(decision, payload: dict[str, object]):
+    try:
+        project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+        run_id = _resolve_run_id(payload)
+
+        suffixes: list[str] = []
+        defense_risk = _read_defense_risk(project_dir)
+        if defense_risk:
+            suffixes.append(f"defense risk={defense_risk}")
+
+        council_signal = _read_council_signal(project_dir, run_id)
+        if council_signal:
+            suffixes.append(council_signal)
+
+        if suffixes:
+            decision.reason = f"{decision.reason} [{'; '.join(suffixes)}]".strip()
+    except Exception:
+        return decision
+    return decision
+
+
+def _resolve_run_id(payload: dict[str, object]) -> str:
+    if isinstance(payload, dict):
+        run_id = payload.get("run_id")
+        if isinstance(run_id, str) and run_id.strip():
+            return run_id.strip()
+        tool_input = payload.get("tool_input")
+        if isinstance(tool_input, dict):
+            metadata = tool_input.get("metadata")
+            if isinstance(metadata, dict):
+                metadata_run_id = metadata.get("run_id")
+                if isinstance(metadata_run_id, str) and metadata_run_id.strip():
+                    return metadata_run_id.strip()
+    env_run_id = os.environ.get("OMG_RUN_ID", "")
+    return env_run_id.strip()
+
+
+def _resolve_active_run_id(project_dir: str) -> str:
+    active_run_path = Path(project_dir) / ".omg" / "shadow" / "active-run"
+    if not active_run_path.exists():
+        return ""
+    try:
+        return active_run_path.read_text(encoding="utf-8").strip()
+    except OSError:
+        return ""
+
+
+def _read_defense_risk(project_dir: str) -> str:
+    path = Path(project_dir) / ".omg" / "state" / "defense_state" / "current.json"
+    if not path.exists():
+        return ""
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return ""
+    if not isinstance(payload, dict):
+        return ""
+    return str(payload.get("risk_level", "")).strip().lower()
+
+
+def _read_council_signal(project_dir: str, run_id: str) -> str:
+    if not run_id:
+        return ""
+    path = Path(project_dir) / ".omg" / "state" / "council_verdicts" / f"{run_id}.json"
+    if not path.exists():
+        return ""
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return ""
+    if not isinstance(payload, dict):
+        return ""
+
+    verdicts = payload.get("verdicts")
+    if not isinstance(verdicts, dict):
+        return ""
+    evidence = verdicts.get("evidence_completeness")
+    if not isinstance(evidence, dict):
+        return ""
+    verdict = str(evidence.get("verdict", "")).strip().lower()
+    findings = evidence.get("findings")
+    findings_count = len(findings) if isinstance(findings, list) else 0
+    if not verdict:
+        return ""
+    return f"council evidence={verdict} findings={findings_count}"
+
+
+def _read_clarification_state(project_dir: str, run_id: str) -> dict[str, object]:
+    if not run_id:
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    path = Path(project_dir) / ".omg" / "state" / "intent_gate" / f"{run_id}.json"
+    if not path.exists():
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    if not isinstance(payload, dict):
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    prompt = " ".join(str(payload.get("clarification_prompt", "")).split())
+    try:
+        confidence = float(payload.get("confidence", 0.0))
+    except (TypeError, ValueError):
+        confidence = 0.0
+    return {
+        "requires_clarification": bool(payload.get("requires_clarification") is True),
+        "intent_class": str(payload.get("intent_class", "")).strip(),
+        "clarification_prompt": prompt,
+        "confidence": round(max(0.0, min(1.0, confidence)), 2),
+    }
+
+
+def _clarification_reason(clarification_prompt: str) -> str:
+    prompt = " ".join(str(clarification_prompt or "").split())
+    if prompt:
+        return f"Clarification required before mutation: {prompt}"
+    return "Clarification required before mutation: provide the missing intent details."
+
+
+def _to_float(value: Any, default: float) -> float:
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def _mutating_defense_decision(
+    *,
+    project_dir: str,
+    cmd: str,
+    run_id: str,
+):
+    scan = scan_mutation_command(cmd)
+    defense_state = DefenseState(project_dir).update(
+        injection_hits=int(_to_float(scan.get("injection_hits"), 0.0)),
+        contamination_score=_to_float(scan.get("contamination_score"), 0.0),
+        overthinking_score=_to_float(scan.get("overthinking_score"), 0.0),
+        premature_fixer_score=_to_float(scan.get("premature_fixer_score"), 0.0),
+    )
+
+    resolved_run_id = run_id.strip() or _resolve_active_run_id(project_dir) or "default"
+    session_health = compute_session_health(project_dir, run_id=resolved_run_id)
+
+    contamination = _to_float(session_health.get("contamination_risk"), _to_float(defense_state.get("contamination_score"), 0.0))
+    overthinking = _to_float(session_health.get("overthinking_score"), _to_float(defense_state.get("overthinking_score"), 0.0))
+    premature_fixer = _to_float(defense_state.get("premature_fixer_score"), 0.0)
+    health_action = str(session_health.get("recommended_action", "continue"))
+    thresholds = session_health.get("thresholds") if isinstance(session_health, dict) else {}
+    contamination_thresholds = thresholds.get("contamination_risk") if isinstance(thresholds, dict) else {}
+    overthinking_thresholds = thresholds.get("overthinking_score") if isinstance(thresholds, dict) else {}
+    reflect_contamination = _to_float(contamination_thresholds.get("reflect") if isinstance(contamination_thresholds, dict) else None, 0.05)
+    reflect_overthinking = _to_float(overthinking_thresholds.get("reflect") if isinstance(overthinking_thresholds, dict) else None, 0.15)
+    reflect_triggers = session_health.get("reflect_triggers") if isinstance(session_health, dict) else {}
+    contamination_trigger = bool(reflect_triggers.get("contamination")) if isinstance(reflect_triggers, dict) else contamination > reflect_contamination
+    overthinking_trigger = bool(reflect_triggers.get("overthinking")) if isinstance(reflect_triggers, dict) else overthinking > reflect_overthinking
+    pause_required = bool(session_health.get("defense_pause_required") is True) if isinstance(session_health, dict) else (contamination_trigger or overthinking_trigger)
+    signal_text = ", ".join(str(item) for item in scan.get("signals", []) if str(item)) or "none"
+    context = (
+        f"defense hits={int(_to_float(defense_state.get('injection_hits'), 0.0))} "
+        f"contamination={contamination:.4f} overthinking={overthinking:.4f} "
+        f"premature_fixer={premature_fixer:.4f} "
+        f"session_health={health_action} signals={signal_text}"
+    )
+
+    if health_action == "block":
+        return deny(
+            f"Blocked: mutation denied by defense/session-health reducer [{context}]",
+            "high",
+            ["defense-reducer", "session-health"],
+        )
+
+    if pause_required or contamination_trigger or overthinking_trigger:
+        return ask(
+            "Pause: mutation requires reflection before execution "
+            f"[{context}; thresholds contamination>{reflect_contamination:.2f} "
+            f"overthinking>{reflect_overthinking:.2f}]",
+            "high",
+            ["reflect", "defense-reducer", "session-health"],
+        )
+
+    return None
+
 data = json_input()
 
 tool = data.get("tool_name", "")
@@ -36,11 +247,59 @@ if not cmd:
 
 decision = evaluate_bash_command(cmd)
 
+tool_input = data.get("tool_input")
+metadata = tool_input.get("metadata") if isinstance(tool_input, dict) else None
+lock_id = tool_input.get("lock_id") if isinstance(tool_input, dict) else None
+if not isinstance(lock_id, str) and isinstance(metadata, dict):
+    lock_id = metadata.get("lock_id")
+run_id = _resolve_run_id(data)
+
+gate_result = check_mutation_allowed(
+    tool="Bash",
+    file_path=cmd,
+    project_dir=get_project_dir(),
+    lock_id=lock_id if isinstance(lock_id, str) else None,
+    command=cmd,
+    run_id=run_id or None,
+    metadata=metadata if isinstance(metadata, dict) else None,
+)
+is_mutation_capable = str(gate_result.get("reason", "")) != "tool is read-only for mutation gate"
+clarification_state = _read_clarification_state(get_project_dir(), run_id)
+if is_mutation_capable:
+    defense_decision = _mutating_defense_decision(
+        project_dir=get_project_dir(),
+        cmd=cmd,
+        run_id=run_id,
+    )
+    if defense_decision is not None:
+        decision = defense_decision
+
+if clarification_state.get("requires_clarification") is True and is_mutation_capable:
+    deny_decision(_clarification_reason(str(clarification_state.get("clarification_prompt", ""))))
+    sys.exit(0)
+
+if is_mutation_capable and gate_result.get("status") == "blocked":
+    deny_decision(str(gate_result.get("reason", "mutation denied by test intent lock gate")))
+    sys.exit(0)
+
+decision = _enrich_risk_context(decision, data)
+
 # In bypass-permission mode, only enforce hard denials (critical safety).
 # Skip "ask" decisions so the user is not prompted for confirmation.
 if is_bypass_mode(data) and decision.action != "deny":
     sys.exit(0)
 
+if decision.action == "allow" and is_mutation_capable:
+    try:
+        journal_mutation_bash(
+            project_dir=get_project_dir(),
+            command=cmd,
+            run_id=run_id or None,
+            metadata=metadata if isinstance(metadata, dict) else None,
+        )
+    except Exception:
+        pass
+
 out = to_pretool_hook_output(decision)
 if out:
     json.dump(out, sys.stdout)

package/build/lib/hooks/intentgate-keyword-detector.py

@@ -38,7 +38,7 @@ try:
         get_feature_flag,
         _resolve_project_dir,
         check_performance_budget,
-        PRE_TOOL_INJECT_MAX_MS,
+        PRE_TOOL_INJECT_MAX_MS as pre_tool_inject_max_ms,
     )
 except ImportError:
     import importlib
@@ -48,7 +48,7 @@ except ImportError:
     get_feature_flag = _common.get_feature_flag
     _resolve_project_dir = _common._resolve_project_dir
     check_performance_budget = _common.check_performance_budget
-    PRE_TOOL_INJECT_MAX_MS = _common.PRE_TOOL_INJECT_MAX_MS
+    pre_tool_inject_max_ms = _common.PRE_TOOL_INJECT_MAX_MS
 
 setup_crash_handler("intentgate-keyword-detector", fail_closed=False)
 
@@ -64,6 +64,18 @@ KEYWORD_INTENT_MAP = {
     "search": "INTENT_SEARCH",
     "stop": "INTENT_STOP",
     "crazy": "INTENT_CRAZY",
+    "auth": "INTENT_AUTH_SETUP",
+    "login": "INTENT_AUTH_SETUP",
+    "credentials": "INTENT_AUTH_SETUP",
+    "setup my credentials": "INTENT_AUTH_SETUP",
+    "setup credentials": "INTENT_AUTH_SETUP",
+    "remember my settings": "INTENT_PREFERENCE_MEMORY",
+    "remember settings": "INTENT_PREFERENCE_MEMORY",
+    "preferences": "INTENT_PREFERENCE_MEMORY",
+    "memory style": "INTENT_PREFERENCE_MEMORY",
+    "setup preferences": "INTENT_AMBIGUOUS_CONFIG",
+    "configure preferences": "INTENT_AMBIGUOUS_CONFIG",
+    "remember setup": "INTENT_AMBIGUOUS_CONFIG",
 }
 
 
@@ -179,7 +191,7 @@ if detected_intents:
 # PERFORMANCE BUDGET CHECK
 # ═══════════════════════════════════════════════════════════
 elapsed_ms = (time.time() - start_time) * 1000
-check_performance_budget("intentgate-keyword-detector", elapsed_ms, PRE_TOOL_INJECT_MAX_MS)
+check_performance_budget("intentgate-keyword-detector", elapsed_ms, pre_tool_inject_max_ms)
 
 # ═══════════════════════════════════════════════════════════
 # OUTPUT

package/build/lib/hooks/policy_engine.py

@@ -126,6 +126,33 @@ UNTRUSTED_MUTATION_PATTERNS = [
 TRUSTED_CONTENT_TIERS = frozenset({"local", "balanced"})
 UNTRUSTED_EXTERNAL_TIERS = frozenset({"research", "browser"})
 
+INJECTION_MARKER_PATTERNS: tuple[tuple[re.Pattern[str], float, str], ...] = (
+    (re.compile(r"\bIGNORE\s+(?:ALL\s+)?PREVIOUS(?:\s+INSTRUCTIONS?)?\b", re.IGNORECASE), 0.03, "ignore-previous-instructions"),
+    (re.compile(r"<\|im_start\|>", re.IGNORECASE), 0.03, "im-start-token"),
+    (re.compile(r"<\|im_end\|>", re.IGNORECASE), 0.03, "im-end-token"),
+    (re.compile(r"\[INST\]", re.IGNORECASE), 0.03, "inst-token"),
+    (re.compile(r"\[/INST\]", re.IGNORECASE), 0.03, "inst-close-token"),
+)
+
+HIDDEN_INSTRUCTION_PATTERNS: tuple[tuple[re.Pattern[str], float, str], ...] = (
+    (re.compile(r"(?:^|\s)SYSTEM\s*:", re.IGNORECASE), 0.02, "system-role-token"),
+    (re.compile(r"(?:^|\s)ASSISTANT\s*:", re.IGNORECASE), 0.02, "assistant-role-token"),
+    (re.compile(r"(?:(?:#|//|/\*|<!--).{0,80})\b(?:ignore|override|jailbreak|bypass)\b", re.IGNORECASE), 0.01, "comment-hidden-instruction"),
+    (re.compile(r"\bbase64\s+(?:-d|--decode)\b", re.IGNORECASE), 0.01, "base64-decoder-token"),
+    (re.compile(r"\b[A-Za-z0-9+/]{48,}={0,2}\b"), 0.01, "opaque-base64-payload"),
+)
+
+CACHE_POISONING_PATTERNS: tuple[tuple[re.Pattern[str], float, str], ...] = (
+    (re.compile(r"(?:>|>>|tee\b|cp\b|mv\b|rm\b|sed\s+-i\b).{0,120}/\.omg/state/", re.IGNORECASE), 0.04, "state-path-overwrite-attempt"),
+    (re.compile(r"(?:>|>>|tee\b|cp\b|mv\b|rm\b|sed\s+-i\b).{0,120}/\.omg/shadow/active-run", re.IGNORECASE), 0.04, "active-run-overwrite-attempt"),
+    (re.compile(r"\b(?:cache|state)\s*(?:poison|override|overwrite|tamper)\b", re.IGNORECASE), 0.02, "cache-poisoning-language"),
+)
+
+CLARIFICATION_AMBIGUITY_PATTERNS: tuple[tuple[re.Pattern[str], float, str], ...] = (
+    (re.compile(r"\b(?:without\s+asking|no\s+questions\s+asked|skip\s+clarif(?:y|ication))\b", re.IGNORECASE), 0.08, "clarification-bypass-language"),
+    (re.compile(r"\b(?:just\s+fix\s+it|fix\s+everything|do\s+whatever\s+it\s+takes)\b", re.IGNORECASE), 0.08, "ambiguous-mutation-intent"),
+)
+
 
 def _project_dir() -> str:
     return os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
@@ -211,6 +238,56 @@ def _is_untrusted_content_mode_active() -> bool:
         return False
 
 
+def scan_mutation_command(cmd: str) -> dict[str, Any]:
+    text = str(cmd or "")
+    if not text.strip():
+        return {
+            "injection_hits": 0,
+            "contamination_score": 0.0,
+            "overthinking_score": 0.0,
+            "premature_fixer_score": 0.0,
+            "signals": [],
+        }
+
+    contamination_score = 0.0
+    overthinking_score = 0.0
+    premature_fixer_score = 0.0
+    injection_hits = 0
+    signals: list[str] = []
+
+    for pattern, weight, label in INJECTION_MARKER_PATTERNS:
+        if pattern.search(text):
+            injection_hits += 1
+            contamination_score += weight
+            signals.append(label)
+
+    for pattern, weight, label in HIDDEN_INSTRUCTION_PATTERNS:
+        if pattern.search(text):
+            injection_hits += 1
+            contamination_score += weight
+            signals.append(label)
+
+    for pattern, weight, label in CACHE_POISONING_PATTERNS:
+        if pattern.search(text):
+            injection_hits += 1
+            contamination_score += weight
+            signals.append(label)
+
+    for pattern, weight, label in CLARIFICATION_AMBIGUITY_PATTERNS:
+        if pattern.search(text):
+            overthinking_score += weight
+            premature_fixer_score += weight
+            signals.append(label)
+
+    return {
+        "injection_hits": max(0, injection_hits),
+        "contamination_score": round(max(0.0, min(1.0, contamination_score)), 4),
+        "overthinking_score": round(max(0.0, min(1.0, overthinking_score)), 4),
+        "premature_fixer_score": round(max(0.0, min(1.0, premature_fixer_score)), 4),
+        "signals": signals,
+    }
+
+
 def evaluate_bash_command(cmd: str) -> PolicyDecision:
     if not cmd:
         return allow("empty command")