@trac3er/oh-my-god 2.1.7 → 2.1.9

package/build/lib/runtime/mutation_gate.py

@@ -19,7 +19,14 @@ _MUTATION_BASH_PATTERNS = (
     r"\b(rm|mv|cp|tee|touch|mkdir|rmdir|ln)\b",
     r"\b(sed\s+-i|perl\s+-pi)\b",
     r"\b(chmod|chown)\b",
-    r">\s*[^\s]",
+)
+_HARMLESS_REDIRECTION_PATTERNS = (
+    re.compile(r"(?:^|[\s;&|()])\d*>>?\s*/dev/(?:null|stdout|stderr)(?=\s|$)"),
+    re.compile(r"(?:^|[\s;&|()])\d*>&\d+(?=\s|$)"),
+    re.compile(r"(?:^|[\s;&|()])\d*>&-(?=\s|$)"),
+)
+_FILE_WRITE_REDIRECTION_PATTERN = re.compile(
+    r"(?:^|[\s;&|()])\d*>>?(?!\s*(?:/dev/(?:null|stdout|stderr)\b|&\d+\b|&-\b))\s*\S+"
 )
 
 
@@ -43,7 +50,7 @@ def check_mutation_allowed(
     explicit_exempt = bool(metadata_obj.get("exempt") is True)
     strict_mode = os.environ.get("OMG_TDD_GATE_STRICT", "0").strip() == "1"
 
-    if explicit_exempt:
+    if explicit_exempt and (normalized_exemption in _EXEMPTIONS or metadata_obj.get("exempt_reason")):
         return {
             "status": "exempt",
             "reason": "metadata exemption allows mutation without lock",
@@ -86,6 +93,7 @@ def check_mutation_allowed(
             "lock_id": normalized_lock_id,
         }
 
+    _write_warning_artifact(project_dir, normalized_tool, normalized_file_path, reason)
     warnings.warn(
         f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
         RuntimeWarning,
@@ -102,13 +110,41 @@ def _is_mutation_capable_bash(command: str) -> bool:
     normalized_command = str(command or "").strip()
     if not normalized_command:
         return False
-    lowered = normalized_command.lower()
+    lowered = _strip_harmless_redirections(normalized_command.lower())
     for pattern in _MUTATION_BASH_PATTERNS:
         if re.search(pattern, lowered):
             return True
+    if _FILE_WRITE_REDIRECTION_PATTERN.search(lowered):
+        return True
     return False
 
 
+def _strip_harmless_redirections(command: str) -> str:
+    sanitized = command
+    for pattern in _HARMLESS_REDIRECTION_PATTERNS:
+        sanitized = pattern.sub(" ", sanitized)
+    return re.sub(r"\s+", " ", sanitized).strip()
+
+
+def _write_warning_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:
+    state_dir = Path(project_dir) / ".omg" / "state" / "mutation_gate"
+    state_dir.mkdir(parents=True, exist_ok=True)
+
+    path_hash = sha256(file_path.encode("utf-8")).hexdigest()[:8]
+    artifact_path = state_dir / f"warn-{path_hash}.json"
+    payload = {
+        "status": "warning",
+        "tool": tool,
+        "file_path": file_path,
+        "reason": reason,
+        "ts": datetime.now(timezone.utc).isoformat(),
+    }
+
+    temp_path = artifact_path.with_suffix(".tmp")
+    temp_path.write_text(json.dumps(payload, sort_keys=True, indent=2), encoding="utf-8")
+    os.replace(temp_path, artifact_path)
+
+
 def _write_block_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:
     state_dir = Path(project_dir) / ".omg" / "state" / "mutation_gate"
     state_dir.mkdir(parents=True, exist_ok=True)

package/build/lib/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.1.7",
+  "contract_version": "2.1.9",
   "count": 47,
   "contracts": [
     {

package/build/lib/runtime/plugin_interop.py

@@ -63,7 +63,7 @@ CONFLICT_SEVERITY_MAP: dict[ConflictCode, ConflictSeverity] = {
 
 SUPPORTED_HOSTS: set[str] = {"claude", "codex", "gemini", "kimi", "opencode"}
 SECURITY_PRETOOL_PLUGINS: tuple[str, ...] = ("firewall", "secret-guard")
-PRESET_ORDER: tuple[str, ...] = ("safe", "balanced", "interop", "labs")
+PRESET_ORDER: tuple[str, ...] = ("safe", "balanced", "interop", "labs", "buffet")
 _PRESET_ORDER_INDEX: dict[str, int] = {name: idx for idx, name in enumerate(PRESET_ORDER)}
 _SEVERITY_RANK: dict[str, int] = {
     ConflictSeverity.BLOCKER.value: 0,

package/build/lib/runtime/profile_io.py

@@ -292,3 +292,37 @@ def _coerce_decay_score(raw: Any) -> float:
     if score > 1.0:
         return 1.0
     return round(score, 3)
+
+
+def assess_profile_risk(profile: dict[str, Any]) -> dict[str, Any]:
+    governed_obj = profile.get("governed_preferences")
+    governed = governed_obj if isinstance(governed_obj, dict) else {}
+
+    style_entries = governed.get("style", [])
+    style_entries = style_entries if isinstance(style_entries, list) else []
+    safety_entries = governed.get("safety", [])
+    safety_entries = safety_entries if isinstance(safety_entries, list) else []
+
+    destructive: list[dict[str, Any]] = []
+    pending = 0
+
+    for entry in style_entries + safety_entries:
+        if not isinstance(entry, dict):
+            continue
+        field = str(entry.get("field", ""))
+        value = str(entry.get("value", ""))
+        if is_destructive_preference(field, value):
+            destructive.append(entry)
+        if str(entry.get("confirmation_state", "")).strip() == "pending_confirmation":
+            pending += 1
+
+    risk_level = "low"
+    if destructive or pending > 0:
+        risk_level = "high" if destructive else "medium"
+
+    return {
+        "risk_level": risk_level,
+        "destructive_entries": destructive,
+        "pending_confirmations": pending,
+        "requires_review": risk_level in ("medium", "high"),
+    }

package/build/lib/runtime/providers/codex_provider.py

@@ -52,6 +52,8 @@ class CodexProvider(CLIProvider):
             result = self.run_tool(
                 ["codex", "exec", "--json", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
             return {
                 "model": "codex-cli",
@@ -73,8 +75,15 @@ class CodexProvider(CLIProvider):
         try:
             mgr = TmuxSessionManager()
             session_name = mgr.make_session_name("codex", unique_id=str(uuid.uuid4())[:8])
-            session = mgr.get_or_create_session(session_name)
-            output = mgr.send_command(session, f"codex exec --json {shlex.quote(prompt)}", timeout=timeout)
+            session = mgr.get_or_create_session(session_name, cwd=project_dir)
+            output = mgr.send_command(
+                session,
+                (
+                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"codex exec --json {shlex.quote(prompt)}"
+                ),
+                timeout=timeout,
+            )
             mgr.kill_session(session)
             return {"model": "codex-cli", "output": output, "exit_code": 0}
         except Exception as exc:

package/build/lib/runtime/providers/gemini_provider.py

@@ -62,6 +62,8 @@ class GeminiProvider(CLIProvider):
             result = self.run_tool(
                 ["gemini", "-p", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
             return {
                 "model": "gemini-cli",
@@ -83,8 +85,15 @@ class GeminiProvider(CLIProvider):
         try:
             mgr = TmuxSessionManager()
             session_name = mgr.make_session_name("gemini", unique_id=str(uuid.uuid4())[:8])
-            session = mgr.get_or_create_session(session_name)
-            output = mgr.send_command(session, f"gemini -p {shlex.quote(prompt)}", timeout=timeout)
+            session = mgr.get_or_create_session(session_name, cwd=project_dir)
+            output = mgr.send_command(
+                session,
+                (
+                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"gemini -p {shlex.quote(prompt)}"
+                ),
+                timeout=timeout,
+            )
             mgr.kill_session(session)
             return {"model": "gemini-cli", "output": output, "exit_code": 0}
         except Exception as exc:

package/build/lib/runtime/providers/kimi_provider.py

@@ -66,6 +66,8 @@ class KimiCodeProvider(CLIProvider):
             result = self.run_tool(
                 ["kimi", "--print", "-p", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
             return {
                 "model": "kimi-cli",
@@ -85,6 +87,8 @@ class KimiCodeProvider(CLIProvider):
             result = self.run_tool(
                 ["kimi", "--print", "--output-format", "stream-json", "-p", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
             return {
                 "model": "kimi-cli",
@@ -106,8 +110,15 @@ class KimiCodeProvider(CLIProvider):
         try:
             mgr = TmuxSessionManager()
             session_name = mgr.make_session_name("kimi", unique_id=str(uuid.uuid4())[:8])
-            session = mgr.get_or_create_session(session_name)
-            output = mgr.send_command(session, f"kimi --print -p {shlex.quote(prompt)}", timeout=timeout)
+            session = mgr.get_or_create_session(session_name, cwd=project_dir)
+            output = mgr.send_command(
+                session,
+                (
+                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"kimi --print -p {shlex.quote(prompt)}"
+                ),
+                timeout=timeout,
+            )
             mgr.kill_session(session)
             return {"model": "kimi-cli", "output": output, "exit_code": 0}
         except Exception as exc:

package/build/lib/runtime/providers/opencode_provider.py

@@ -42,7 +42,12 @@ class OpenCodeProvider(CLIProvider):
 
     def invoke(self, prompt: str, project_dir: str, timeout: int = 120) -> dict[str, Any]:  # pyright: ignore[reportExplicitAny, reportImplicitOverride]
         try:
-            result = self.run_tool(["opencode", prompt], timeout=timeout)
+            result = self.run_tool(
+                ["opencode", prompt],
+                timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
+            )
             return {
                 "model": "opencode-cli",
                 "output": result.stdout,

package/build/lib/runtime/release_run_coordinator.py

@@ -15,6 +15,7 @@ from runtime.compliance_governor import evaluate_release_compliance
 from runtime.runtime_contracts import write_run_state
 from runtime.session_health import compute_session_health
 from runtime.verification_controller import VerificationController
+from runtime.claim_judge import evaluate_claims_for_release
 
 
 class RunIdConflictError(ValueError):
@@ -149,11 +150,33 @@ class ReleaseRunCoordinator:
         canonical_run_id = resolved.run_id
 
         release_evidence = self._read_release_evidence(canonical_run_id)
-        compliance = evaluate_release_compliance(
-            project_dir=self.project_dir,
-            run_id=canonical_run_id,
-            release_evidence=release_evidence,
-        )
+        compliance: dict[str, object] = {
+            "status": "allowed",
+            "authority": "release",
+            "reason": "no release evidence supplied",
+        }
+        if isinstance(release_evidence, dict) and release_evidence:
+            raw_claims = release_evidence.get("claims")
+            claims = raw_claims if isinstance(raw_claims, list) else []
+            artifact = release_evidence.get("artifact")
+            if claims and not isinstance(artifact, dict):
+                claim_decision = evaluate_claims_for_release(
+                    project_dir=self.project_dir,
+                    run_id=canonical_run_id,
+                    claims=claims,
+                )
+                if claim_decision.get("status") == "blocked":
+                    compliance = {
+                        "status": "blocked",
+                        "authority": "claim_judge",
+                        "reason": str(claim_decision.get("reason", "claim_judge_verdict=unknown")),
+                    }
+            else:
+                compliance = evaluate_release_compliance(
+                    project_dir=self.project_dir,
+                    run_id=canonical_run_id,
+                    release_evidence=release_evidence,
+                )
         resolved_status = status
         resolved_blockers = list(blockers)
         if compliance.get("status") == "blocked":

package/build/lib/runtime/release_surfaces.py

@@ -14,6 +14,7 @@ Consumers:
 from __future__ import annotations
 
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Union
 
 # ── Valid surface type identifiers ──────────────────────────────────────────
@@ -48,6 +49,7 @@ class AuthoredSurface:
     surface_type: str
     field: Union[list[Union[str, int]], str]
     description: str = ""
+    source_only: bool = False
 
 
 # ── Explicit YAML bundle names (22 files) ──────────────────────────────────
@@ -186,6 +188,7 @@ AUTHORED_SURFACES: list[AuthoredSurface] = [
         ".claude-plugin/scripts/install.sh", "banner_literal",
         r'v(\d+\.\d+\.\d+)',
         "installer banner version",
+        source_only=True,
     ),
 
     # 6. runtime/omg_compat_contract_snapshot.json — contract_version field
@@ -253,3 +256,10 @@ def get_authored_paths() -> list[str]:
 def get_derived_dirs() -> list[str]:
     """Return all generated directory paths."""
     return list(DERIVED_SURFACE_DIRS)
+
+
+def surface_applies_to_root(surface: AuthoredSurface, root_dir: Path) -> bool:
+    """Return whether a surface should be enforced for the given root layout."""
+    if not surface.source_only:
+        return True
+    return (root_dir / ".git").exists()

package/build/lib/runtime/runtime_contracts.py

@@ -121,6 +121,10 @@ def write_run_state(project_dir: str, module: str, run_id: str, payload: dict[st
     tmp_path = path.with_name(f"{path.name}.tmp")
     _ = tmp_path.write_text(json.dumps(state, indent=2, ensure_ascii=True), encoding="utf-8")
     _ = os.rename(tmp_path, path)
+    latest_path = path.parent / "latest.json"
+    latest_tmp_path = latest_path.with_name("latest.json.tmp")
+    _ = latest_tmp_path.write_text(json.dumps(state, indent=2, ensure_ascii=True), encoding="utf-8")
+    _ = os.rename(latest_tmp_path, latest_path)
     return str(path)
 
 
@@ -225,6 +229,15 @@ def _resolve_active_run_id(project_dir: Path, run_id: str | None) -> str:
     if candidate:
         return candidate
 
+    active_run_path = project_dir / ".omg" / "shadow" / "active-run"
+    if active_run_path.exists():
+        try:
+            candidate = active_run_path.read_text(encoding="utf-8").strip()
+        except OSError:
+            candidate = ""
+        if candidate:
+            return candidate
+
     for path in (
         project_dir / ".omg" / "state" / "defense_state" / "current.json",
         project_dir / ".omg" / "state" / "context_engine_packet.json",

package/build/lib/runtime/session_health.py

@@ -236,3 +236,130 @@ def _to_int(value: Any, default: int) -> int:
         return int(value)
     except (TypeError, ValueError):
         return default
+
+
+_BOUNDED_ACTIONS = frozenset({"continue", "warn", "reflect", "pause", "require-review"})
+
+_HEALTH_TO_AUTO_ACTION: dict[str, str] = {
+    "block": "pause",
+    "reflect": "reflect",
+    "warn": "warn",
+    "continue": "continue",
+}
+
+
+def evaluate_auto_actions(
+    health: dict[str, Any],
+    *,
+    profile_risk: dict[str, Any] | None = None,
+    project_dir: str | None = None,
+    run_id: str = "default",
+) -> dict[str, Any]:
+    recommended = str(health.get("recommended_action", "continue"))
+    action = _HEALTH_TO_AUTO_ACTION.get(recommended, "warn")
+
+    risk = profile_risk if isinstance(profile_risk, dict) else {}
+    risk_requires_review = bool(risk.get("requires_review"))
+    has_destructive = bool(risk.get("destructive_entries"))
+
+    review_route: str | None = None
+
+    if action == "pause" and (risk_requires_review or has_destructive):
+        action = "require-review"
+        review_route = "/OMG:profile-review"
+    elif action in ("warn", "reflect") and risk_requires_review:
+        action = "require-review"
+        review_route = "/OMG:profile-review"
+    elif risk_requires_review:
+        review_route = "/OMG:profile-review"
+
+    reason = _build_action_reason(health, action, risk)
+
+    result = {
+        "action": action,
+        "reason": reason,
+        "review_route": review_route,
+        "bounded": True,
+        "health_status": str(health.get("status", "unknown")),
+        "recommended_action": recommended,
+    }
+
+    if project_dir is not None and action in ("pause", "require-review"):
+        persist_auto_action_evidence(project_dir, result, run_id=run_id)
+
+    return result
+
+
+def persist_auto_action_evidence(
+    project_dir: str,
+    action_result: dict[str, Any],
+    *,
+    run_id: str = "default",
+) -> str:
+    root = Path(project_dir)
+    actions_dir = root / ".omg" / "state" / "session_health" / "actions"
+    actions_dir.mkdir(parents=True, exist_ok=True)
+    path = actions_dir / f"{run_id}.json"
+
+    evidence: dict[str, Any] = {
+        "schema": "SessionHealthAutoAction",
+        "schema_version": "1.0.0",
+        "run_id": run_id,
+        "action": str(action_result.get("action", "continue")),
+        "reason": str(action_result.get("reason", "")),
+        "review_route": action_result.get("review_route"),
+        "bounded": True,
+        "health_status": str(action_result.get("health_status", "unknown")),
+        "recommended_action": str(action_result.get("recommended_action", "continue")),
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+    }
+
+    _write_atomic(path, evidence)
+    return str(path)
+
+
+def _build_action_reason(
+    health: dict[str, Any],
+    action: str,
+    risk: dict[str, Any],
+) -> str:
+    parts: list[str] = []
+
+    contamination = _to_float(health.get("contamination_risk"), 0.0)
+    overthinking = _to_float(health.get("overthinking_score"), 0.0)
+    context_health = _to_float(health.get("context_health"), 1.0)
+
+    if action == "pause":
+        if contamination >= _DEFAULT_THRESHOLDS["contamination_risk"]["block"]:
+            parts.append(f"contamination_risk={contamination:.2f} >= block threshold")
+        if overthinking >= _DEFAULT_THRESHOLDS["overthinking_score"]["block"]:
+            parts.append(f"overthinking_score={overthinking:.2f} >= block threshold")
+    elif action == "reflect":
+        if contamination > _DEFAULT_THRESHOLDS["contamination_risk"]["reflect"]:
+            parts.append(f"contamination_risk={contamination:.2f} > reflect threshold")
+        if overthinking > _DEFAULT_THRESHOLDS["overthinking_score"]["reflect"]:
+            parts.append(f"overthinking_score={overthinking:.2f} > reflect threshold")
+    elif action == "warn":
+        verification = str(health.get("verification_status", ""))
+        if verification in ("error", "blocked"):
+            parts.append(f"verification_status={verification}")
+        if context_health <= _DEFAULT_THRESHOLDS["context_health"]["warn"]:
+            parts.append(f"context_health={context_health:.2f} <= warn threshold")
+
+    if action == "require-review":
+        if contamination >= _DEFAULT_THRESHOLDS["contamination_risk"]["block"]:
+            parts.append(f"contamination_risk={contamination:.2f} >= block threshold")
+        if overthinking >= _DEFAULT_THRESHOLDS["overthinking_score"]["block"]:
+            parts.append(f"overthinking_score={overthinking:.2f} >= block threshold")
+        destructive_count = len(risk.get("destructive_entries") or [])
+        if destructive_count:
+            parts.append(f"{destructive_count} destructive preference(s) detected")
+        parts.append("profile_risk requires review")
+
+    elif risk.get("destructive_entries"):
+        parts.append(f"{len(risk['destructive_entries'])} destructive preference(s) detected")
+
+    if not parts:
+        parts.append("session healthy")
+
+    return "; ".join(parts)

package/build/lib/runtime/subagent_dispatcher.py

@@ -84,6 +84,27 @@ def _jobs_dir() -> str:
     return os.path.join(_get_project_dir(), ".omg", "state", "jobs")
 
 
+def resolve_execution_boundary(*, isolation: str = "worktree") -> dict[str, Any]:
+    normalized = isolation.strip().lower() if isolation else "none"
+    if normalized == "worktree":
+        return {
+            "sandbox_mode": "ephemeral_worktree",
+            "worker_policy": os.environ.get("OMG_WORKER_POLICY", "managed-local"),
+            "execution_mode": "local_supervisor",
+        }
+    if normalized == "container":
+        return {
+            "sandbox_mode": "container-like",
+            "worker_policy": os.environ.get("OMG_WORKER_POLICY", "managed-local"),
+            "execution_mode": "automation",
+        }
+    return {
+        "sandbox_mode": "none",
+        "worker_policy": "local-only",
+        "execution_mode": "automation",
+    }
+
+
 def _job_path(job_id: str) -> str:
     """Return the file path for a specific job."""
     return os.path.join(_jobs_dir(), f"{job_id}.json")

package/build/lib/runtime/team_router.py

@@ -82,18 +82,29 @@ def _check_tool_available(tool_name: str) -> bool:
     return False
 
 
-def _run_tool(cmd: list[str], *, timeout: int = 30) -> subprocess.CompletedProcess[str]:
+def _run_tool(
+    cmd: list[str],
+    *,
+    timeout: int = 30,
+    cwd: str | None = None,
+    env: dict[str, str] | None = None,
+) -> subprocess.CompletedProcess[str]:
     """Run an external tool with a mandatory timeout.
 
     Every subprocess call in the team router MUST go through this helper
     to guarantee the ``timeout`` parameter is always set.
     """
+    proc_env = os.environ.copy()
+    if env:
+        proc_env.update({key: str(value) for key, value in env.items()})
     return subprocess.run(
         cmd,
         capture_output=True,
         text=True,
         check=False,
         timeout=timeout,
+        cwd=cwd,
+        env=proc_env,
     )
 
 
@@ -411,6 +422,8 @@ def invoke_codex(prompt: str, project_dir: str, timeout: int = 120) -> dict[str,
         result = _run_tool(
             ["codex", "exec", "--json", prompt],
             timeout=timeout,
+            cwd=project_dir,
+            env={"CLAUDE_PROJECT_DIR": project_dir},
         )
         return {
             "model": "codex-cli",
@@ -448,9 +461,13 @@ def invoke_codex_tmux(prompt: str, project_dir: str, timeout: int = 120) -> dict
     session: str | None = None
     try:
         session_name = mgr.make_session_name("codex", unique_id=str(uuid.uuid4())[:8])
-        session = mgr.get_or_create_session(session_name)
+        session = mgr.get_or_create_session(session_name, cwd=project_dir)
         quoted_prompt = shlex.quote(prompt)
-        cmd = f"codex exec --json {quoted_prompt}; printf '\\n{_TMUX_EXIT_MARKER}:%s\\n' \"$?\""
+        cmd = (
+            f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+            f"codex exec --json {quoted_prompt}; "
+            f"printf '\\n{_TMUX_EXIT_MARKER}:%s\\n' \"$?\""
+        )
         raw_output = mgr.send_command(session, cmd, timeout=timeout)
         output, exit_code = _parse_tmux_command_result(raw_output)
         return {"model": "codex-cli", "output": output, "exit_code": exit_code}
@@ -470,6 +487,8 @@ def invoke_gemini(prompt: str, project_dir: str, timeout: int = 120) -> dict[str
         result = _run_tool(
             ["gemini", "-p", prompt],
             timeout=timeout,
+            cwd=project_dir,
+            env={"CLAUDE_PROJECT_DIR": project_dir},
         )
         return {
             "model": "gemini-cli",
@@ -493,9 +512,13 @@ def invoke_gemini_tmux(prompt: str, project_dir: str, timeout: int = 120) -> dic
     session: str | None = None
     try:
         session_name = mgr.make_session_name("gemini", unique_id=str(uuid.uuid4())[:8])
-        session = mgr.get_or_create_session(session_name)
+        session = mgr.get_or_create_session(session_name, cwd=project_dir)
         quoted_prompt = shlex.quote(prompt)
-        cmd = f"gemini -p {quoted_prompt}; printf '\\n{_TMUX_EXIT_MARKER}:%s\\n' \"$?\""
+        cmd = (
+            f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+            f"gemini -p {quoted_prompt}; "
+            f"printf '\\n{_TMUX_EXIT_MARKER}:%s\\n' \"$?\""
+        )
         raw_output = mgr.send_command(session, cmd, timeout=timeout)
         output, exit_code = _parse_tmux_command_result(raw_output)
         return {"model": "gemini-cli", "output": output, "exit_code": exit_code}

package/build/lib/runtime/test_intent_lock.py

@@ -142,7 +142,7 @@ def verify_lock(project_dir: str, run_id: str | None, lock_id: str | None = None
     }
 
 
-def evaluate_test_delta(delta: dict[str, Any]) -> dict[str, Any]:
+def evaluate_test_delta(delta: dict[str, Any], project_dir: str | None = None) -> dict[str, Any]:
     override = delta.get("override")
     waiver_artifact = delta.get("waiver_artifact")
     if _has_override(override):
@@ -160,7 +160,10 @@ def evaluate_test_delta(delta: dict[str, Any]) -> dict[str, Any]:
     lock_payload: dict[str, Any] | None = None
     lock_id = str(delta.get("lock_id", "")).strip()
     if lock_id:
-        lock_payload = _load_lock_payload(lock_id)
+        if project_dir:
+            lock_payload = _load_lock_payload_from_project(project_dir, lock_id)
+        else:
+            lock_payload = _load_lock_payload(lock_id)
         if lock_payload is None:
             return {
                 "verdict": "fail",
@@ -175,6 +178,7 @@ def evaluate_test_delta(delta: dict[str, Any]) -> dict[str, Any]:
             old_tests=old_tests,
             new_tests=new_tests,
             touched_paths=touched_paths,
+            project_dir=project_dir,
         )
         if contract_reasons and not _has_waiver_artifact(waiver_artifact):
             unique_flags = list(dict.fromkeys(contract_flags))
@@ -352,6 +356,7 @@ def _evaluate_locked_contract(
     old_tests: list[dict[str, Any]],
     new_tests: list[dict[str, Any]],
     touched_paths: list[str],
+    project_dir: str | None = None,
 ) -> tuple[list[str], list[str]]:
     reasons: list[str] = []
     flags: list[str] = []
@@ -375,7 +380,8 @@ def _evaluate_locked_contract(
             path_key = str(selector_path).strip()
             if not path_key:
                 continue
-            current_hash = _hash_test_file(Path("."), path_key)
+            hash_project_dir = Path(project_dir) if project_dir else Path(".")
+            current_hash = _hash_test_file(hash_project_dir, path_key)
             expected_hash_value = str(expected_hash).strip() if expected_hash is not None else None
             if expected_hash_value and current_hash is None:
                 flags.append("locked_test_file_missing")

package/build/lib/runtime/tmux_session_manager.py

@@ -41,13 +41,16 @@ class TmuxSessionManager:
             _logger.warning("Failed to check tmux session %r: %s", name, exc)
             return False
 
-    def create_session(self, name: str) -> bool:
+    def create_session(self, name: str, cwd: str | None = None) -> bool:
         """Create a detached tmux session and return success state."""
         if not self.is_tmux_available():
             return False
         try:
+            cmd = ["tmux", "new-session", "-d", "-s", name]
+            if cwd:
+                cmd.extend(["-c", cwd])
             result = subprocess.run(
-                ["tmux", "new-session", "-d", "-s", name],
+                cmd,
                 capture_output=True,
                 text=True,
                 check=False,
@@ -124,11 +127,11 @@ class TmuxSessionManager:
             _logger.warning("Failed to send tmux command to %r: %s", name, exc)
             return ""
 
-    def get_or_create_session(self, name: str) -> str:
+    def get_or_create_session(self, name: str, cwd: str | None = None) -> str:
         """Return a fresh tmux session name, recreating stale sessions if needed."""
         if self.session_exists(name):
             _ = self.kill_session(name)
-        if not self.create_session(name):
+        if not self.create_session(name, cwd=cwd):
             raise RuntimeError(f"Unable to create tmux session: {name}")
         return name