@trac3er/oh-my-god 2.1.8 → 2.2.2

package/build/lib/hooks/_common.py

@@ -3,7 +3,9 @@ import json
 import os
 import sys
 import fcntl
+import site
 from datetime import datetime, timezone
+from pathlib import Path
 
 # --- Stop-Block Loop Breaker ---
 _STOP_BLOCK_TRACKER = ".omg/state/ledger/.stop-block-tracker.json"
@@ -19,6 +21,61 @@ PRE_TOOL_INJECT_MAX_MS = 100
 STOP_CHECK_MAX_MS = 15000
 STOP_DISPATCHER_TOTAL_MAX_MS = 90000
 
+
+def _managed_site_packages(runtime_root: Path) -> list[Path]:
+    venv_root = runtime_root / ".venv"
+    if not venv_root.is_dir():
+        return []
+
+    candidates: list[Path] = []
+    for pattern in ("lib/python*/site-packages", "Lib/site-packages"):
+        for path in venv_root.glob(pattern):
+            if path.is_dir():
+                candidates.append(path.resolve())
+    return candidates
+
+
+def bootstrap_runtime_paths(anchor: str | os.PathLike[str] | None = None) -> None:
+    """Add the repo root or portable omg-runtime root to ``sys.path``.
+
+    Installed hooks live under ``~/.claude/hooks`` while the portable runtime is
+    provisioned under ``~/.claude/omg-runtime``. Repo-local execution instead
+    keeps ``hooks/``, ``runtime/``, ``lab/`` and related packages side by side.
+    This helper resolves both layouts and is safe to call repeatedly.
+    """
+    anchor_path = Path(anchor).resolve() if anchor is not None else Path(__file__).resolve()
+    hooks_dir = anchor_path.parent
+    parent_dir = hooks_dir.parent
+
+    candidates: list[Path] = [hooks_dir]
+    for candidate in (
+        parent_dir,
+        parent_dir / "omg-runtime",
+        hooks_dir / "omg-runtime",
+    ):
+        if candidate not in candidates:
+            candidates.append(candidate)
+
+    project_dir = os.environ.get("CLAUDE_PROJECT_DIR", "").strip()
+    if project_dir:
+        project_path = Path(project_dir).resolve()
+        for candidate in (
+            project_path,
+            project_path / "omg-runtime",
+        ):
+            if candidate not in candidates:
+                candidates.append(candidate)
+
+    for candidate in candidates:
+        candidate_str = str(candidate)
+        if candidate.is_dir() and candidate_str not in sys.path:
+            sys.path.insert(0, candidate_str)
+        for site_packages in _managed_site_packages(candidate):
+            site.addsitedir(str(site_packages))
+
+
+bootstrap_runtime_paths()
+
 def json_input():
     """Parse JSON from stdin. Returns dict or exits 0 on parse failure."""
     try:
@@ -50,7 +107,7 @@ def deny_decision(reason):
     }, sys.stdout)
 
 
-def block_decision(reason):
+def block_decision(reason, *, block_reason="unknown", project_dir=None):
     """Emit a Stop hook block decision to stdout.
 
     Also records the block for loop detection. Every stop hook that calls
@@ -60,7 +117,7 @@ def block_decision(reason):
     # Record block BEFORE emitting -- ensures tracker is updated even if
     # the process is killed after emitting the decision.
     try:
-        record_stop_block()
+        record_stop_block(project_dir=project_dir, reason=block_reason)
     except Exception:
         pass  # never let tracker failure prevent the block decision
     json.dump({"decision": "block", "reason": reason}, sys.stdout)
@@ -448,17 +505,24 @@ def should_skip_stop_hooks(data):
             if os.path.exists(_tracker_path):
                 with open(_tracker_path, "r", encoding="utf-8") as _f:
                     _state = json.load(_f)
-                _elapsed = (datetime.now(timezone.utc) - datetime.fromisoformat(_state["ts"])).total_seconds()
-                if _elapsed < _BLOCK_LOOP_WINDOW_SECS and _state.get("count", 0) >= 1:
-                    _reason = _state.get("reason", "unknown")
-                    if _reason in _LOOP_BLOCK_REASONS:
-                        print(
-                            "[OMG] Guard 5 triggered: context may be exhausted and stop hooks recently blocked. "
-                            "Skipping stop-hook blocks so compaction can run. "
-                            "Tip: /OMG:handoff then continue in a fresh session.",
-                            file=sys.stderr,
-                        )
-                        return True
+                # Session isolation: stale tracker from another session cannot suppress hooks
+                _tracker_session = _state.get("session_id", "")
+                _current_session = _get_session_id()
+                if (_tracker_session and _current_session != "unknown"
+                        and _tracker_session != _current_session):
+                    pass  # Different session — not a deadlock
+                else:
+                    _elapsed = (datetime.now(timezone.utc) - datetime.fromisoformat(_state["ts"])).total_seconds()
+                    if _elapsed < _BLOCK_LOOP_WINDOW_SECS and _state.get("count", 0) >= 1:
+                        _reason = _state.get("reason", "unknown")
+                        if _reason in _LOOP_BLOCK_REASONS:
+                            print(
+                                "[OMG] Guard 5 triggered: context may be exhausted and stop hooks recently blocked. "
+                                "Skipping stop-hook blocks so compaction can run. "
+                                "Tip: /OMG:handoff then continue in a fresh session.",
+                                file=sys.stderr,
+                            )
+                            return True
         except Exception:
             pass  # fail open
     return False
@@ -466,6 +530,16 @@ def should_skip_stop_hooks(data):
 
 # --- Stop-Block Loop Breaker (file-based safety net) ---
 
+
+def _get_session_id():
+    """Get current session ID from environment, falling back to 'unknown'."""
+    for key in ("CLAUDE_SESSION_ID", "SESSION_ID", "OMG_SESSION_ID"):
+        val = os.environ.get(key, "").strip()
+        if val:
+            return val
+    return "unknown"
+
+
 def record_stop_block(project_dir=None, reason: str = "unknown", session_id: str = ""):
     """Record that a stop hook block was issued. Called before block_decision().
     
@@ -475,6 +549,8 @@ def record_stop_block(project_dir=None, reason: str = "unknown", session_id: str
         session_id: Session identifier to prevent cross-session interference
     """
     try:
+        if not session_id:
+            session_id = _get_session_id()
         pdir = project_dir or get_project_dir()
         path = os.path.join(pdir, _STOP_BLOCK_TRACKER)
         state = {
@@ -516,6 +592,8 @@ def is_stop_block_loop(project_dir=None, session_id: str = ""):
                    returns False (cross-session, not a loop).
     """
     try:
+        if not session_id:
+            session_id = _get_session_id()
         pdir = project_dir or get_project_dir()
         path = os.path.join(pdir, _STOP_BLOCK_TRACKER)
         if not os.path.exists(path):

package/build/lib/hooks/_token_counter.py

@@ -145,7 +145,7 @@ def _get_anthropic_api_key() -> str | None:
         key = store_mod.get_active_key("anthropic")
         if key:
             return key
-    except Exception:
+    except (ImportError, RuntimeError, ValueError, OSError, AttributeError):
         pass
     return os.environ.get("ANTHROPIC_API_KEY")
 

package/build/lib/hooks/branch_manager.py

@@ -164,8 +164,25 @@ def _extract_task_description(project_dir: str) -> str | None:
     return None
 
 
+def _is_merge_writer_locked(project_dir: str) -> bool:
+    try:
+        _root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        if _root not in sys.path:
+            sys.path.insert(0, _root)
+        from runtime.merge_writer import MergeWriter  # pyright: ignore[reportMissingImports]
+        return MergeWriter(project_dir).is_locked()
+    except Exception:
+        return False
+
+
 def _create_branch(project_dir: str, branch_name: str) -> bool:
     """Create and checkout a new branch. Returns True on success."""
+    if _is_merge_writer_locked(project_dir):
+        print(
+            f"[OMG branch-manager] Branch creation blocked: merge-writer lock is held",
+            file=sys.stderr,
+        )
+        return False
     try:
         result = subprocess.run(
             ["git", "-C", project_dir, "checkout", "-b", branch_name],

package/build/lib/hooks/budget_governor.py

@@ -189,6 +189,27 @@ def _check_thresholds(
     return new_messages
 
 
+def _check_budget_envelope(project_dir: str) -> str:
+    run_id = os.environ.get("OMG_RUN_ID", "").strip()
+    if not run_id:
+        return ""
+    try:
+        parent = os.path.dirname(HOOKS_DIR)
+        if parent not in sys.path:
+            sys.path.insert(0, parent)
+        from runtime.budget_envelopes import get_budget_envelope_manager
+
+        mgr = get_budget_envelope_manager(project_dir)
+        result = mgr.check_envelope(run_id)
+        if result.status == "ok":
+            return ""
+        action_tag = {"warn": "@envelope-warning", "reflect": "@envelope-critical", "block": "@envelope-limit"}
+        tag = action_tag.get(result.governance_action, "@envelope-warning")
+        return f"{tag}: {result.reason} [action={result.governance_action}]"
+    except Exception:
+        return ""
+
+
 def main() -> None:
     setup_crash_handler("budget-governor", fail_closed=False)
 
@@ -224,6 +245,10 @@ def main() -> None:
     if threshold_alerts:
         context += "\n" + "\n".join(threshold_alerts)
 
+    envelope_context = _check_budget_envelope(project_dir)
+    if envelope_context:
+        context += "\n" + envelope_context
+
     json.dump({"additionalContext": context}, sys.stdout)
     sys.exit(0)
 

package/build/lib/hooks/context_pressure.py

@@ -5,19 +5,49 @@ import json
 import os
 from datetime import datetime, timezone
 
-_DEFAULT_THRESHOLD = 150
+try:
+    from runtime.context_limits import get_model_limits, compaction_trigger
+except Exception:
+    get_model_limits = None
+    compaction_trigger = None
 
 
-def estimate_context_pressure(project_dir):
-    threshold = _DEFAULT_THRESHOLD
+def _detect_model_id(context_packet=None):
+    for key in ("CLAUDE_MODEL", "OMG_MODEL_ID", "OPENAI_MODEL"):
+        value = os.environ.get(key, "").strip()
+        if value:
+            return value
+
+    if isinstance(context_packet, dict):
+        model = context_packet.get("model")
+        if isinstance(model, dict):
+            for key in ("id", "display_name", "name"):
+                value = str(model.get(key, "") or "").strip()
+                if value:
+                    return value
+        elif isinstance(model, str) and model.strip():
+            return model.strip()
+    return ""
+
+
+def _host_aware_threshold(context_packet=None):
+    model_id = _detect_model_id(context_packet)
+    if compaction_trigger is not None and get_model_limits is not None:
+        return int(compaction_trigger(model_id)), model_id, get_model_limits(model_id)
+    return 80_000, model_id, {"class_label": "128k-class"}
+
+
+def estimate_context_pressure(project_dir, context_packet=None):
+    threshold, model_id, limits = _host_aware_threshold(context_packet)
     try:
         settings_path = os.path.join(project_dir, "settings.json")
         if os.path.exists(settings_path):
             with open(settings_path, "r", encoding="utf-8") as settings_file:
                 settings = json.load(settings_file)
-            threshold = settings.get("_omg", {}).get("context_budget", {}).get(
-                "pressure_threshold", _DEFAULT_THRESHOLD
+            configured = settings.get("_omg", {}).get("context_budget", {}).get(
+                "pressure_threshold", threshold
             )
+            threshold = int(configured)
     except Exception:
         pass
 
@@ -42,6 +72,8 @@ def estimate_context_pressure(project_dir):
                 {
                     "tool_count": tool_count,
                     "threshold": threshold,
+                    "model_id": model_id,
+                    "class_label": limits.get("class_label", "128k-class"),
                     "is_high": is_high,
                     "ts": datetime.now(timezone.utc).isoformat(),
                 },

package/build/lib/hooks/credential_store.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# pyright: reportConstantRedefinition=false, reportMissingTypeArgument=false
 """OMG Multi-Credential Encrypted Store
 
 Fernet-based encrypted credential storage with PBKDF2HMAC key derivation.
@@ -17,27 +18,24 @@ import base64
 import gc
 import getpass
 import hashlib
-import hmac
 import json
 import os
 import sys
 from datetime import datetime, timezone
 from typing import Any
 
-# --- Ensure hooks dir is on sys.path for _common imports ---
 HOOKS_DIR = os.path.dirname(os.path.abspath(__file__))
-if HOOKS_DIR not in sys.path:
-    sys.path.insert(0, HOOKS_DIR)
+PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
+if PROJECT_ROOT not in sys.path:
+    sys.path.insert(0, PROJECT_ROOT)
 
-from _common import (
+from hooks._common import (
     atomic_json_write,
     get_feature_flag,
     get_project_dir,
     setup_crash_handler,
 )
 
-# Credential storage prefers Fernet, but standalone/no-vendor verification
-# still needs a local authenticated fallback when optional crypto wheels are absent.
 setup_crash_handler("credential_store", fail_closed=True)
 
 # --- Lazy-loaded cryptography imports ---
@@ -47,9 +45,11 @@ _CRYPTO_BACKEND: str | None = None
 
 
 def _ensure_crypto():
-    """Prefer cryptography, but allow a stdlib fallback in standalone mode."""
+    """Require cryptography/Fernet for credential-store encryption."""
     global _Fernet, _InvalidToken, _CRYPTO_BACKEND
     if _CRYPTO_BACKEND is not None:
+        if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
+            raise RuntimeError("Secure credential backend unavailable: cryptography is required")
         return
     try:
         from cryptography.fernet import Fernet, InvalidToken
@@ -57,10 +57,11 @@ def _ensure_crypto():
         _Fernet = Fernet
         _InvalidToken = InvalidToken
         _CRYPTO_BACKEND = "fernet"
-    except ImportError:
+    except ImportError as exc:
         _Fernet = None
-        _InvalidToken = ValueError
-        _CRYPTO_BACKEND = "stdlib"
+        _InvalidToken = None
+        _CRYPTO_BACKEND = "unavailable"
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required") from exc
 
 
 # --- Constants ---
@@ -73,57 +74,6 @@ MIN_PASSPHRASE_LEN = 8
 
 # Default empty store schema
 _EMPTY_STORE = {"version": 1, "providers": {}}
-_STDLIB_TOKEN_PREFIX = b"OMG1"
-
-
-def _raw_key(key: bytes) -> bytes:
-    return base64.urlsafe_b64decode(key)
-
-
-def _derive_keystream(secret: bytes, nonce: bytes, length: int) -> bytes:
-    chunks: list[bytes] = []
-    counter = 0
-    produced = 0
-    while produced < length:
-        block = hmac.new(secret, nonce + counter.to_bytes(4, "big"), hashlib.sha256).digest()
-        chunks.append(block)
-        produced += len(block)
-        counter += 1
-    return b"".join(chunks)[:length]
-
-
-def _encrypt_store_stdlib(payload: bytes, key: bytes) -> bytes:
-    secret = _raw_key(key)
-    nonce = os.urandom(16)
-    keystream = _derive_keystream(secret, nonce, len(payload))
-    ciphertext = bytes(left ^ right for left, right in zip(payload, keystream))
-    digest = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    return base64.urlsafe_b64encode(_STDLIB_TOKEN_PREFIX + nonce + digest + ciphertext)
-
-
-def _decrypt_store_stdlib(token: bytes, key: bytes) -> dict | None:
-    try:
-        payload = base64.urlsafe_b64decode(token)
-    except Exception as exc:  # pragma: no cover - invalid base64 still handled as bad token
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store") from exc
-
-    if not payload.startswith(_STDLIB_TOKEN_PREFIX):
-        return None
-    if len(payload) < len(_STDLIB_TOKEN_PREFIX) + 16 + 32:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    secret = _raw_key(key)
-    prefix_len = len(_STDLIB_TOKEN_PREFIX)
-    nonce = payload[prefix_len : prefix_len + 16]
-    digest = payload[prefix_len + 16 : prefix_len + 48]
-    ciphertext = payload[prefix_len + 48 :]
-    expected = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    if not hmac.compare_digest(digest, expected):
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    keystream = _derive_keystream(secret, nonce, len(ciphertext))
-    plaintext = bytes(left ^ right for left, right in zip(ciphertext, keystream))
-    return json.loads(plaintext.decode("utf-8"))
 
 
 # =============================================================================
@@ -151,7 +101,7 @@ def derive_key(passphrase: bytes, salt: bytes, kdf_config: dict | None = None) -
 
 
 def encrypt_store(data: dict, key: bytes) -> bytes:
-    """Encrypt credential store payload with Fernet or the stdlib fallback.
+    """Encrypt credential store payload with Fernet.
 
     Args:
         data: Credential store dict to encrypt
@@ -159,12 +109,15 @@ def encrypt_store(data: dict, key: bytes) -> bytes:
 
     Returns:
         Token bytes
+
+    Raises:
+        RuntimeError: If secure cryptography backend is unavailable
     """
     _ensure_crypto()
     payload = json.dumps(data, separators=(",", ":")).encode("utf-8")
-    if _CRYPTO_BACKEND == "fernet" and _Fernet is not None:
-        return _Fernet(key).encrypt(payload)
-    return _encrypt_store_stdlib(payload, key)
+    if _Fernet is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
+    return _Fernet(key).encrypt(payload)
 
 
 def decrypt_store(token: bytes, key: bytes) -> dict:
@@ -179,14 +132,11 @@ def decrypt_store(token: bytes, key: bytes) -> dict:
 
     Raises:
         ValueError: If passphrase is wrong or store contents are corrupted
+        RuntimeError: If secure cryptography backend is unavailable
     """
-    fallback = _decrypt_store_stdlib(token, key)
-    if fallback is not None:
-        return fallback
-
     _ensure_crypto()
-    if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
+    if _Fernet is None or _InvalidToken is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
 
     f = _Fernet(key)
     try:
@@ -618,7 +568,7 @@ def get_active_key(provider: str, project_dir: str | None = None) -> str | None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return None
 
     providers = store.get("providers", {})
@@ -661,7 +611,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return
 
     providers = store.get("providers", {})
@@ -688,7 +638,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
     # Failover only advances on error, not after success
     try:
         save_store(store, passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         pass  # Best-effort; don't crash the API call
 
 

package/build/lib/hooks/firewall.py

@@ -10,19 +10,24 @@ import sys
 from pathlib import Path
 from typing import Any
 
-HOOKS_DIR = os.path.dirname(__file__)
-PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
-for path in (HOOKS_DIR, PROJECT_ROOT):
+HOOKS_DIR = str(Path(__file__).resolve().parent)
+PROJECT_ROOT = str(Path(HOOKS_DIR).parent)
+PORTABLE_RUNTIME_ROOT = str(Path(PROJECT_ROOT) / "omg-runtime")
+for path in (HOOKS_DIR, PROJECT_ROOT, PORTABLE_RUNTIME_ROOT):
     if path not in sys.path:
         sys.path.insert(0, path)
 
-from _common import setup_crash_handler, json_input, deny_decision, is_bypass_mode, get_project_dir  # pyright: ignore[reportImplicitRelativeImport]
+from _common import bootstrap_runtime_paths, setup_crash_handler, json_input, deny_decision, is_bypass_mode, get_project_dir  # pyright: ignore[reportImplicitRelativeImport]
+
+bootstrap_runtime_paths(__file__)
 
 # Fail-closed: deny on crash (security hook)
 setup_crash_handler("firewall", fail_closed=True)
 
 try:
     from policy_engine import evaluate_bash_command, to_pretool_hook_output, scan_mutation_command, ask, deny  # pyright: ignore[reportImplicitRelativeImport]
+    from runtime.compliance_governor import classify_bash_command_mode
+    from runtime.context_engine import _extract_clarification
     from runtime.defense_state import DefenseState
     from runtime.session_health import compute_session_health
     from runtime.mutation_gate import check_mutation_allowed
@@ -122,47 +127,17 @@ def _read_council_signal(project_dir: str, run_id: str) -> str:
 
 def _read_clarification_state(project_dir: str, run_id: str) -> dict[str, object]:
     if not run_id:
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     path = Path(project_dir) / ".omg" / "state" / "intent_gate" / f"{run_id}.json"
     if not path.exists():
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     try:
         payload = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     if not isinstance(payload, dict):
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
-    prompt = " ".join(str(payload.get("clarification_prompt", "")).split())
-    try:
-        confidence = float(payload.get("confidence", 0.0))
-    except (TypeError, ValueError):
-        confidence = 0.0
-    return {
-        "requires_clarification": bool(payload.get("requires_clarification") is True),
-        "intent_class": str(payload.get("intent_class", "")).strip(),
-        "clarification_prompt": prompt,
-        "confidence": round(max(0.0, min(1.0, confidence)), 2),
-    }
+        return _extract_clarification({})
+    return _extract_clarification(payload)
 
 
 def _clarification_reason(clarification_prompt: str) -> str:
@@ -172,6 +147,18 @@ def _clarification_reason(clarification_prompt: str) -> str:
     return "Clarification required before mutation: provide the missing intent details."
 
 
+def _clarification_external_reason(clarification_prompt: str) -> str:
+    prompt = " ".join(str(clarification_prompt or "").split())
+    if prompt:
+        return f"Clarification required before external execution: {prompt}"
+    return "Clarification required before external execution: provide the missing intent details."
+
+
+def _strict_ambiguity_mode_enabled() -> bool:
+    token = str(os.environ.get("OMG_STRICT_AMBIGUITY_MODE", "1")).strip().lower()
+    return token not in {"0", "false", "off", "no"}
+
+
 def _to_float(value: Any, default: float) -> float:
     try:
         return float(value)
@@ -263,8 +250,11 @@ gate_result = check_mutation_allowed(
     run_id=run_id or None,
     metadata=metadata if isinstance(metadata, dict) else None,
 )
-is_mutation_capable = str(gate_result.get("reason", "")) != "tool is read-only for mutation gate"
+bash_mode = classify_bash_command_mode(cmd)
+is_mutation_capable = bash_mode == "mutation"
+is_external_execution = bash_mode == "external"
 clarification_state = _read_clarification_state(get_project_dir(), run_id)
+strict_ambiguity_mode = _strict_ambiguity_mode_enabled()
 if is_mutation_capable:
     defense_decision = _mutating_defense_decision(
         project_dir=get_project_dir(),
@@ -274,8 +264,12 @@ if is_mutation_capable:
     if defense_decision is not None:
         decision = defense_decision
 
-if clarification_state.get("requires_clarification") is True and is_mutation_capable:
-    deny_decision(_clarification_reason(str(clarification_state.get("clarification_prompt", ""))))
+if strict_ambiguity_mode and clarification_state.get("requires_clarification") is True and (is_mutation_capable or is_external_execution):
+    prompt = str(clarification_state.get("clarification_prompt", ""))
+    if is_external_execution:
+        deny_decision(_clarification_external_reason(prompt))
+    else:
+        deny_decision(_clarification_reason(prompt))
     sys.exit(0)
 
 if is_mutation_capable and gate_result.get("status") == "blocked":