@trac3er/oh-my-god 2.1.8 → 2.2.2

package/build/lib/runtime/mutation_gate.py

@@ -8,8 +8,9 @@ from datetime import datetime, timezone
 from hashlib import sha256
 from pathlib import Path
 
-from runtime.release_run_coordinator import resolve_current_run_id
-from runtime.test_intent_lock import verify_lock
+from runtime.release_run_coordinator import get_active_coordinator_run_id, resolve_current_run_id
+from runtime.test_intent_lock import verify_done_when, verify_lock
+from runtime.tool_plan_gate import has_tool_plan_for_run
 
 
 _MUTATING_TOOLS = frozenset({"Write", "Edit", "MultiEdit"})
@@ -19,7 +20,14 @@ _MUTATION_BASH_PATTERNS = (
     r"\b(rm|mv|cp|tee|touch|mkdir|rmdir|ln)\b",
     r"\b(sed\s+-i|perl\s+-pi)\b",
     r"\b(chmod|chown)\b",
-    r">\s*[^\s]",
+)
+_HARMLESS_REDIRECTION_PATTERNS = (
+    re.compile(r"(?:^|[\s;&|()])\d*>>?\s*/dev/(?:null|stdout|stderr)(?=\s|$)"),
+    re.compile(r"(?:^|[\s;&|()])\d*>&\d+(?=\s|$)"),
+    re.compile(r"(?:^|[\s;&|()])\d*>&-(?=\s|$)"),
+)
+_FILE_WRITE_REDIRECTION_PATTERN = re.compile(
+    r"(?:^|[\s;&|()])\d*>>?(?!\s*(?:/dev/(?:null|stdout|stderr)\b|&\d+\b|&-\b))\s*\S+"
 )
 
 
@@ -41,9 +49,9 @@ def check_mutation_allowed(
     normalized_command = str(command or "").strip()
     metadata_obj = metadata if isinstance(metadata, dict) else {}
     explicit_exempt = bool(metadata_obj.get("exempt") is True)
-    strict_mode = os.environ.get("OMG_TDD_GATE_STRICT", "0").strip() == "1"
+    strict_mode = os.environ.get("OMG_TDD_GATE_STRICT", "1").strip() != "0"
 
-    if explicit_exempt:
+    if explicit_exempt and (normalized_exemption in _EXEMPTIONS or metadata_obj.get("exempt_reason")):
         return {
             "status": "exempt",
             "reason": "metadata exemption allows mutation without lock",
@@ -68,33 +76,84 @@ def check_mutation_allowed(
             "lock_id": normalized_lock_id,
         }
 
-    resolved_run_id = str(run_id or "").strip() or resolve_current_run_id(project_dir=project_dir)
+    resolved_run_id = (
+        get_active_coordinator_run_id(project_dir=project_dir)
+        or str(run_id or "").strip()
+        or resolve_current_run_id(project_dir=project_dir)
+    )
+
     verification = verify_lock(project_dir, run_id=resolved_run_id, lock_id=normalized_lock_id)
-    if verification.get("status") == "ok":
+    if verification.get("status") != "ok":
+        reason = str(verification.get("reason", "no_active_test_intent_lock"))
+        if strict_mode:
+            _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+            return {
+                "status": "blocked",
+                "reason": reason,
+                "lock_id": normalized_lock_id,
+            }
+
+        _write_warning_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+        warnings.warn(
+            f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
+            RuntimeWarning,
+            stacklevel=2,
+        )
         return {
             "status": "allowed",
-            "reason": "active test intent lock found",
-            "lock_id": str(verification.get("lock_id") or normalized_lock_id or "") or None,
+            "reason": reason,
+            "lock_id": normalized_lock_id,
         }
 
-    reason = str(verification.get("reason", "no_active_test_intent_lock"))
-    if strict_mode:
-        _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+    if resolved_run_id and not has_tool_plan_for_run(project_dir, resolved_run_id):
+        reason = "tool_plan_required"
+        if strict_mode:
+            _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+            return {
+                "status": "blocked",
+                "reason": reason,
+                "lock_id": normalized_lock_id,
+            }
+        _write_warning_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+        warnings.warn(
+            f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
+            RuntimeWarning,
+            stacklevel=2,
+        )
         return {
-            "status": "blocked",
+            "status": "allowed",
             "reason": reason,
             "lock_id": normalized_lock_id,
         }
 
-    warnings.warn(
-        f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
-        RuntimeWarning,
-        stacklevel=2,
-    )
+    if resolved_run_id:
+        done_when_verification = verify_done_when(metadata_obj, run_id=resolved_run_id)
+        if done_when_verification.get("status") != "ok":
+            reason = str(done_when_verification.get("reason", "done_when_required"))
+            if strict_mode:
+                _write_block_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+                return {
+                    "status": "blocked",
+                    "reason": reason,
+                    "lock_id": normalized_lock_id,
+                }
+
+            _write_warning_artifact(project_dir, normalized_tool, normalized_file_path, reason)
+            warnings.warn(
+                f"mutation_gate_permissive_allow:{normalized_tool}:{reason}",
+                RuntimeWarning,
+                stacklevel=2,
+            )
+            return {
+                "status": "allowed",
+                "reason": reason,
+                "lock_id": normalized_lock_id,
+            }
+
     return {
         "status": "allowed",
-        "reason": reason,
-        "lock_id": normalized_lock_id,
+        "reason": "active test intent lock found",
+        "lock_id": str(verification.get("lock_id") or normalized_lock_id or "") or None,
     }
 
 
@@ -102,13 +161,41 @@ def _is_mutation_capable_bash(command: str) -> bool:
     normalized_command = str(command or "").strip()
     if not normalized_command:
         return False
-    lowered = normalized_command.lower()
+    lowered = _strip_harmless_redirections(normalized_command.lower())
     for pattern in _MUTATION_BASH_PATTERNS:
         if re.search(pattern, lowered):
             return True
+    if _FILE_WRITE_REDIRECTION_PATTERN.search(lowered):
+        return True
     return False
 
 
+def _strip_harmless_redirections(command: str) -> str:
+    sanitized = command
+    for pattern in _HARMLESS_REDIRECTION_PATTERNS:
+        sanitized = pattern.sub(" ", sanitized)
+    return re.sub(r"\s+", " ", sanitized).strip()
+
+
+def _write_warning_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:
+    state_dir = Path(project_dir) / ".omg" / "state" / "mutation_gate"
+    state_dir.mkdir(parents=True, exist_ok=True)
+
+    path_hash = sha256(file_path.encode("utf-8")).hexdigest()[:8]
+    artifact_path = state_dir / f"warn-{path_hash}.json"
+    payload = {
+        "status": "warning",
+        "tool": tool,
+        "file_path": file_path,
+        "reason": reason,
+        "ts": datetime.now(timezone.utc).isoformat(),
+    }
+
+    temp_path = artifact_path.with_suffix(".tmp")
+    temp_path.write_text(json.dumps(payload, sort_keys=True, indent=2), encoding="utf-8")
+    os.replace(temp_path, artifact_path)
+
+
 def _write_block_artifact(project_dir: str, tool: str, file_path: str, reason: str) -> None:
     state_dir = Path(project_dir) / ".omg" / "state" / "mutation_gate"
     state_dir.mkdir(parents=True, exist_ok=True)

package/build/lib/runtime/omg_compat_contract_snapshot.json

@@ -1,6 +1,6 @@
 {
   "schema": "OmgCompatContractSnapshot",
-  "contract_version": "2.1.8",
+  "contract_version": "2.2.2",
   "count": 47,
   "contracts": [
     {

package/build/lib/runtime/omg_mcp_server.py

@@ -8,6 +8,7 @@ from pathlib import Path
 from typing import Any
 
 from runtime.asset_loader import resolve_asset
+from runtime.compliance_governor import classify_bash_command_mode
 from runtime.tool_plan_gate import resolve_current_run_id, tool_plan_gate_check
 
 _mcp_import_error: ModuleNotFoundError | None = None
@@ -138,8 +139,13 @@ def omg_policy_evaluate(tool: str, input: dict[str, Any]) -> dict[str, Any]:
         if not run_id:
             run_id = resolve_current_run_id()
 
-        if tool in {"Write", "Edit", "MultiEdit"}:
-            tool_plan_result = tool_plan_gate_check(_service().project_dir, run_id, tool)
+        should_gate_tool_plan = tool in {"Write", "Edit", "MultiEdit"}
+        if tool == "Bash":
+            bash_mode = classify_bash_command_mode(str(input.get("command", ""))) if isinstance(input, dict) else "read"
+            should_gate_tool_plan = bash_mode in {"mutation", "external"}
+
+        if should_gate_tool_plan:
+            tool_plan_result = tool_plan_gate_check(_service().project_dir, run_id, tool, tool_input=input)
             if tool_plan_result.get("status") == "blocked":
                 return tool_plan_result
 
@@ -248,6 +254,24 @@ def omg_get_session_health(run_id: str | None = None) -> dict[str, Any]:
     return payload
 
 
+@mcp.tool()
+def omg_tool_fabric_request(
+    lane_name: str,
+    tool_name: str,
+    run_id: str,
+    context: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    _status, payload = _service().tool_fabric_request(
+        {
+            "lane_name": lane_name,
+            "tool_name": tool_name,
+            "run_id": run_id,
+            "context": context or {},
+        }
+    )
+    return payload
+
+
 @mcp.prompt(name="omg_contract_summary", description="Summarize the OMG production contract and generated host outputs")
 def omg_contract_summary(channel: str = "public") -> str:
     return (

package/build/lib/runtime/playwright_pack.py

@@ -12,6 +12,7 @@ from runtime.untrusted_content import (
     TRUST_TIER_CONFIG,
     TrustTier,
     get_untrusted_content_state,
+    mark_untrusted_content,
 )
 
 
@@ -120,6 +121,22 @@ class PlaywrightPack:
 
         timestamp = datetime.now(timezone.utc).isoformat()
 
+        mark_untrusted_content(
+            str(self.project_dir),
+            source_type="browser",
+            source_ref=str(fixture),
+            content=json.dumps(
+                {
+                    "event": "playwright_run_smoke",
+                    "fixture": str(fixture),
+                    "isolated": self.isolated,
+                },
+                sort_keys=True,
+                ensure_ascii=True,
+            ),
+            tier=TrustTier.BROWSER,
+        )
+
         artifacts = self.emit_artifacts(output_dir)
         metadata = self._build_metadata(timestamp=timestamp)
 
@@ -176,6 +193,22 @@ class PlaywrightPack:
         if metadata:
             final_metadata.update(metadata)
 
+        mark_untrusted_content(
+            str(self.project_dir),
+            source_type="browser",
+            source_ref=str(output_root),
+            content=json.dumps(
+                {
+                    "event": "playwright_ingest_external_artifacts",
+                    "artifacts": sorted(artifacts.keys()),
+                    "metadata": final_metadata,
+                },
+                sort_keys=True,
+                ensure_ascii=True,
+            ),
+            tier=TrustTier.BROWSER,
+        )
+
         evidence_path = _write_browser_evidence(
             output_root,
             fixture=Path(final_metadata.get("fixture", output_root / "playwright-cli")),

package/build/lib/runtime/plugin_interop.py

@@ -12,6 +12,13 @@ from pathlib import Path
 from typing import cast
 import yaml
 
+from runtime.canonical_surface import (
+    get_all_supported_hosts,
+    get_canonical_hosts,
+    get_compat_hosts,
+    is_canonical_parity_host,
+    is_compat_only_host,
+)
 from runtime.hook_governor import validate_order
 
 
@@ -61,9 +68,9 @@ CONFLICT_SEVERITY_MAP: dict[ConflictCode, ConflictSeverity] = {
     ConflictCode.HOST_PRECEDENCE_OVERLAP: ConflictSeverity.INFO,
 }
 
-SUPPORTED_HOSTS: set[str] = {"claude", "codex", "gemini", "kimi", "opencode"}
+SUPPORTED_HOSTS: set[str] = set(get_all_supported_hosts())
 SECURITY_PRETOOL_PLUGINS: tuple[str, ...] = ("firewall", "secret-guard")
-PRESET_ORDER: tuple[str, ...] = ("safe", "balanced", "interop", "labs")
+PRESET_ORDER: tuple[str, ...] = ("safe", "balanced", "interop", "labs", "buffet")
 _PRESET_ORDER_INDEX: dict[str, int] = {name: idx for idx, name in enumerate(PRESET_ORDER)}
 _SEVERITY_RANK: dict[str, int] = {
     ConflictSeverity.BLOCKER.value: 0,
@@ -71,6 +78,12 @@ _SEVERITY_RANK: dict[str, int] = {
     ConflictSeverity.INFO.value: 2,
 }
 
+_ISSUE_SEVERITY_MAP: dict[str, str] = {
+    ConflictSeverity.BLOCKER.value: "high",
+    ConflictSeverity.WARNING.value: "medium",
+    ConflictSeverity.INFO.value: "low",
+}
+
 
 @dataclass(slots=True)
 class PluginInteropRecord:
@@ -174,7 +187,12 @@ def validate_plugin_allowlist_entry(payload: Mapping[str, object]) -> None:
     if not isinstance(source, str) or not source:
         raise ValueError("source must be a non-empty string")
     if not isinstance(host, str) or host not in SUPPORTED_HOSTS:
-        raise ValueError(f"host must be one of {sorted(SUPPORTED_HOSTS)}")
+        canonical_hosts = ", ".join(get_canonical_hosts())
+        compat_hosts = ", ".join(get_compat_hosts())
+        raise ValueError(
+            f"host must be one of {sorted(SUPPORTED_HOSTS)} "
+            f"(canonical parity: {canonical_hosts}; compatibility-only: {compat_hosts})"
+        )
     if not isinstance(resource_type, str) or resource_type not in {"mcp_server", "skill", "plugin"}:
         raise ValueError("resource_type must be one of: mcp_server, skill, plugin")
     if not isinstance(reason, str) or not reason.strip():
@@ -404,13 +422,17 @@ def classify_conflicts(records: list[PluginInteropRecord]) -> list[ConflictResul
             )
 
     for record in records:
-        if record.host not in SUPPORTED_HOSTS:
+        normalized_host = record.host.strip().lower()
+        if not (is_canonical_parity_host(normalized_host) or is_compat_only_host(normalized_host)):
+            canonical_hosts = ", ".join(get_canonical_hosts())
+            compat_hosts = ", ".join(get_compat_hosts())
             add_conflict(
                 ConflictCode.UNSUPPORTED_HOST,
                 [record.plugin_id],
                 [record.host],
                 f"Plugin '{record.plugin_id}' targets unsupported host '{record.host}'.",
-                "Use one of the supported hosts: claude, codex, gemini, kimi, opencode.",
+                f"Use one of the supported hosts: canonical parity [{canonical_hosts}] "
+                f"or compatibility-only [{compat_hosts}].",
             )
 
     for record in records:
@@ -461,7 +483,8 @@ def classify_conflicts(records: list[PluginInteropRecord]) -> list[ConflictResul
 
 
 def approval_status_for_record(record: PluginInteropRecord, approvals: list[PluginAllowlistEntry]) -> str:
-    if record.host not in SUPPORTED_HOSTS:
+    normalized_host = record.host.strip().lower()
+    if not (is_canonical_parity_host(normalized_host) or is_compat_only_host(normalized_host)):
         return "blocked"
 
     record_conflicts = classify_conflicts([record])
@@ -482,6 +505,10 @@ def get_approval_status_for_all(
     return {record.plugin_id: approval_status_for_record(record, approvals) for record in records}
 
 
+def conflict_severity_to_issue_severity(severity: str) -> str:
+    return _ISSUE_SEVERITY_MAP.get(str(severity).strip().lower(), "info")
+
+
 def _approval_sources_for_record(record: PluginInteropRecord) -> set[str]:
     source_ids: set[str] = set()
     for server_name in record.mcp_servers:
@@ -995,6 +1022,7 @@ __all__ = [
     "PluginInteropRecord",
     "Source",
     "approval_status_for_record",
+    "conflict_severity_to_issue_severity",
     "classify_conflicts",
     "discover_host_plugin_state",
     "discover_omg_plugin_state",

package/build/lib/runtime/preflight.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import importlib
+from runtime.canonical_surface import DOMAIN_DEFAULTS, RELEASE_SURFACE_LABELS
 from runtime.delta_classifier import classify_project_changes
 from runtime.tracebank import record_trace
 from typing import Any
@@ -36,33 +37,36 @@ _HIGH_RISK_DELTA_TOKENS = (
     "configs",
 )
 
+_ROUTES = RELEASE_SURFACE_LABELS["routes"]
+_PREFLIGHT_DOMAIN_PACKS = set(DOMAIN_DEFAULTS["preflight_domain_packs"])
+
 
 def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
     lowered = goal.lower()
     task_class = "implementation"
     risk_class = "medium"
-    route = "teams"
+    route = _ROUTES["teams"]
     delta = classify_project_changes(project_dir, goal=goal)
     categories = set(delta["categories"])
     requires_security_check = _requires_security_check(delta)
-    domain_packs = [category for category in delta["categories"] if category in {"robotics", "vision", "algorithms", "health"}]
+    domain_packs = [category for category in delta["categories"] if category in _PREFLIGHT_DOMAIN_PACKS]
     evidence_requirements = _requirements_for_profile(delta.get("evidence_profile"))
 
     if requires_security_check:
         task_class = "security"
         risk_class = "high"
-        route = "security-check"
+        route = _ROUTES["security_check"]
     elif categories & {"api"} or any(token in lowered for token in ("openapi", "swagger", "postman", "contract", "fixture", "replay")):
         task_class = "contract"
-        route = "api-twin"
+        route = _ROUTES["api_twin"]
     elif any(token in lowered for token in ("auth", "secret", "security", "token", "injection")):
         task_class = "security"
         risk_class = "high"
-        route = "security-check"
+        route = _ROUTES["security_check"]
     elif any(token in lowered for token in ("full stack", "frontend and backend", "dashboard", "orchestrate")):
         task_class = "orchestration"
         risk_class = "high"
-        route = "crazy"
+        route = _ROUTES["crazy"]
 
     trace = record_trace(
         project_dir,
@@ -82,7 +86,7 @@ def run_preflight(project_dir: str, *, goal: str) -> dict[str, Any]:
         "route": route,
         "requires_security_check": requires_security_check,
         "required_tools": _required_tools(route),
-        "required_mcps": ["omg-control"] if route in {"security-check", "api-twin", "crazy"} else [],
+        "required_mcps": ["omg-control"] if route in {_ROUTES["security_check"], _ROUTES["api_twin"], _ROUTES["crazy"]} else [],
         "missing_constraints": [],
         "evidence_plan": _evidence_plan(route),
         "evidence_requirements": evidence_requirements,
@@ -117,15 +121,15 @@ def _requirements_for_profile(evidence_profile: str | None) -> list[str]:
 
 def _required_tools(route: str) -> list[str]:
     return {
-        "security-check": ["security"],
-        "api-twin": ["api-twin"],
-        "crazy": ["teams", "ccg"],
-    }.get(route, ["teams"])
+        _ROUTES["security_check"]: ["security"],
+        _ROUTES["api_twin"]: ["api-twin"],
+        _ROUTES["crazy"]: ["teams", "ccg"],
+    }.get(route, [_ROUTES["teams"]])
 
 
 def _evidence_plan(route: str) -> list[str]:
     return {
-        "security-check": ["security findings", "provenance"],
-        "api-twin": ["fixture fidelity", "live verification"],
-        "crazy": ["verification output", "evidence pack"],
+        _ROUTES["security_check"]: ["security findings", "provenance"],
+        _ROUTES["api_twin"]: ["fixture fidelity", "live verification"],
+        _ROUTES["crazy"]: ["verification output", "evidence pack"],
     }.get(route, ["verification output"])

package/build/lib/runtime/profile_io.py

@@ -292,3 +292,37 @@ def _coerce_decay_score(raw: Any) -> float:
     if score > 1.0:
         return 1.0
     return round(score, 3)
+
+
+def assess_profile_risk(profile: dict[str, Any]) -> dict[str, Any]:
+    governed_obj = profile.get("governed_preferences")
+    governed = governed_obj if isinstance(governed_obj, dict) else {}
+
+    style_entries = governed.get("style", [])
+    style_entries = style_entries if isinstance(style_entries, list) else []
+    safety_entries = governed.get("safety", [])
+    safety_entries = safety_entries if isinstance(safety_entries, list) else []
+
+    destructive: list[dict[str, Any]] = []
+    pending = 0
+
+    for entry in style_entries + safety_entries:
+        if not isinstance(entry, dict):
+            continue
+        field = str(entry.get("field", ""))
+        value = str(entry.get("value", ""))
+        if is_destructive_preference(field, value):
+            destructive.append(entry)
+        if str(entry.get("confirmation_state", "")).strip() == "pending_confirmation":
+            pending += 1
+
+    risk_level = "low"
+    if destructive or pending > 0:
+        risk_level = "high" if destructive else "medium"
+
+    return {
+        "risk_level": risk_level,
+        "destructive_entries": destructive,
+        "pending_confirmations": pending,
+        "requires_review": risk_level in ("medium", "high"),
+    }

package/build/lib/runtime/proof_chain.py

@@ -327,7 +327,7 @@ def assemble_proof_chain(project_dir: str, *, evidence_path: str | None = None)
         evidence_links = [selected_path] if selected_path else []
         publish_verification_state(
             project_dir=project_dir,
-            run_id=str(chain.get("eval_id", "")),
+            run_id=str(chain.get("run_id", "")),
             status=str(validation["status"]),
             blockers=list(validation.get("blockers", [])),
             evidence_links=evidence_links,

package/build/lib/runtime/providers/codex_provider.py

@@ -11,12 +11,24 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_codex_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
 
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "codex",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
+
 class CodexProvider(CLIProvider):
     """CLIProvider implementation for the Codex CLI (``codex``)."""
 
@@ -52,12 +64,14 @@ class CodexProvider(CLIProvider):
             result = self.run_tool(
                 ["codex", "exec", "--json", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "codex-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "codex-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -73,10 +87,21 @@ class CodexProvider(CLIProvider):
         try:
             mgr = TmuxSessionManager()
             session_name = mgr.make_session_name("codex", unique_id=str(uuid.uuid4())[:8])
-            session = mgr.get_or_create_session(session_name)
-            output = mgr.send_command(session, f"codex exec --json {shlex.quote(prompt)}", timeout=timeout)
+            session = mgr.get_or_create_session(session_name, cwd=project_dir)
+            output = mgr.send_command(
+                session,
+                (
+                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"codex exec --json {shlex.quote(prompt)}"
+                ),
+                timeout=timeout,
+            )
             mgr.kill_session(session)
-            return {"model": "codex-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "codex-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux codex invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)

package/build/lib/runtime/providers/gemini_provider.py

@@ -11,11 +11,23 @@ import uuid
 from typing import Any
 
 from runtime.cli_provider import CLIProvider, register_provider
+from runtime.host_parity import normalize_output
 from runtime.mcp_config_writers import write_gemini_mcp_config
 from runtime.tmux_session_manager import TmuxSessionManager
 
 _logger = logging.getLogger(__name__)
 
+
+def _attach_normalized_output(payload: dict[str, Any], *, prompt: str, project_dir: str) -> dict[str, Any]:
+    normalized = normalize_output(
+        "gemini",
+        payload,
+        context={"prompt": prompt, "project_dir": project_dir, "no_json_mode": True},
+    )
+    merged = dict(payload)
+    merged["normalized_output"] = normalized
+    return merged
+
 HOST_RULES = {
     "compilation_targets": [".gemini/settings.json"],
     "mcp": ["omg-control"],
@@ -62,12 +74,14 @@ class GeminiProvider(CLIProvider):
             result = self.run_tool(
                 ["gemini", "-p", prompt],
                 timeout=timeout,
+                cwd=project_dir,
+                env={"CLAUDE_PROJECT_DIR": project_dir},
             )
-            return {
+            return _attach_normalized_output({
                 "model": "gemini-cli",
                 "output": result.stdout,
                 "exit_code": result.returncode,
-            }
+            }, prompt=prompt, project_dir=project_dir)
         except subprocess.TimeoutExpired:
             return {"error": "gemini-cli timeout", "fallback": "claude"}
         except FileNotFoundError:
@@ -83,10 +97,21 @@ class GeminiProvider(CLIProvider):
         try:
             mgr = TmuxSessionManager()
             session_name = mgr.make_session_name("gemini", unique_id=str(uuid.uuid4())[:8])
-            session = mgr.get_or_create_session(session_name)
-            output = mgr.send_command(session, f"gemini -p {shlex.quote(prompt)}", timeout=timeout)
+            session = mgr.get_or_create_session(session_name, cwd=project_dir)
+            output = mgr.send_command(
+                session,
+                (
+                    f"env CLAUDE_PROJECT_DIR={shlex.quote(project_dir)} "
+                    f"gemini -p {shlex.quote(prompt)}"
+                ),
+                timeout=timeout,
+            )
             mgr.kill_session(session)
-            return {"model": "gemini-cli", "output": output, "exit_code": 0}
+            return _attach_normalized_output(
+                {"model": "gemini-cli", "output": output, "exit_code": 0},
+                prompt=prompt,
+                project_dir=project_dir,
+            )
         except Exception as exc:
             _logger.warning("tmux gemini invocation failed, falling back to subprocess: %s", exc)
             return self.invoke(prompt, project_dir, timeout=timeout)