@trac3er/oh-my-god 2.1.9 → 2.2.2

package/build/lib/hooks/credential_store.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# pyright: reportConstantRedefinition=false, reportMissingTypeArgument=false
 """OMG Multi-Credential Encrypted Store
 
 Fernet-based encrypted credential storage with PBKDF2HMAC key derivation.
@@ -17,27 +18,24 @@ import base64
 import gc
 import getpass
 import hashlib
-import hmac
 import json
 import os
 import sys
 from datetime import datetime, timezone
 from typing import Any
 
-# --- Ensure hooks dir is on sys.path for _common imports ---
 HOOKS_DIR = os.path.dirname(os.path.abspath(__file__))
-if HOOKS_DIR not in sys.path:
-    sys.path.insert(0, HOOKS_DIR)
+PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
+if PROJECT_ROOT not in sys.path:
+    sys.path.insert(0, PROJECT_ROOT)
 
-from _common import (
+from hooks._common import (
     atomic_json_write,
     get_feature_flag,
     get_project_dir,
     setup_crash_handler,
 )
 
-# Credential storage prefers Fernet, but standalone/no-vendor verification
-# still needs a local authenticated fallback when optional crypto wheels are absent.
 setup_crash_handler("credential_store", fail_closed=True)
 
 # --- Lazy-loaded cryptography imports ---
@@ -47,9 +45,11 @@ _CRYPTO_BACKEND: str | None = None
 
 
 def _ensure_crypto():
-    """Prefer cryptography, but allow a stdlib fallback in standalone mode."""
+    """Require cryptography/Fernet for credential-store encryption."""
     global _Fernet, _InvalidToken, _CRYPTO_BACKEND
     if _CRYPTO_BACKEND is not None:
+        if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
+            raise RuntimeError("Secure credential backend unavailable: cryptography is required")
         return
     try:
         from cryptography.fernet import Fernet, InvalidToken
@@ -57,10 +57,11 @@ def _ensure_crypto():
         _Fernet = Fernet
         _InvalidToken = InvalidToken
         _CRYPTO_BACKEND = "fernet"
-    except ImportError:
+    except ImportError as exc:
         _Fernet = None
-        _InvalidToken = ValueError
-        _CRYPTO_BACKEND = "stdlib"
+        _InvalidToken = None
+        _CRYPTO_BACKEND = "unavailable"
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required") from exc
 
 
 # --- Constants ---
@@ -73,57 +74,6 @@ MIN_PASSPHRASE_LEN = 8
 
 # Default empty store schema
 _EMPTY_STORE = {"version": 1, "providers": {}}
-_STDLIB_TOKEN_PREFIX = b"OMG1"
-
-
-def _raw_key(key: bytes) -> bytes:
-    return base64.urlsafe_b64decode(key)
-
-
-def _derive_keystream(secret: bytes, nonce: bytes, length: int) -> bytes:
-    chunks: list[bytes] = []
-    counter = 0
-    produced = 0
-    while produced < length:
-        block = hmac.new(secret, nonce + counter.to_bytes(4, "big"), hashlib.sha256).digest()
-        chunks.append(block)
-        produced += len(block)
-        counter += 1
-    return b"".join(chunks)[:length]
-
-
-def _encrypt_store_stdlib(payload: bytes, key: bytes) -> bytes:
-    secret = _raw_key(key)
-    nonce = os.urandom(16)
-    keystream = _derive_keystream(secret, nonce, len(payload))
-    ciphertext = bytes(left ^ right for left, right in zip(payload, keystream))
-    digest = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    return base64.urlsafe_b64encode(_STDLIB_TOKEN_PREFIX + nonce + digest + ciphertext)
-
-
-def _decrypt_store_stdlib(token: bytes, key: bytes) -> dict | None:
-    try:
-        payload = base64.urlsafe_b64decode(token)
-    except Exception as exc:  # pragma: no cover - invalid base64 still handled as bad token
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store") from exc
-
-    if not payload.startswith(_STDLIB_TOKEN_PREFIX):
-        return None
-    if len(payload) < len(_STDLIB_TOKEN_PREFIX) + 16 + 32:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    secret = _raw_key(key)
-    prefix_len = len(_STDLIB_TOKEN_PREFIX)
-    nonce = payload[prefix_len : prefix_len + 16]
-    digest = payload[prefix_len + 16 : prefix_len + 48]
-    ciphertext = payload[prefix_len + 48 :]
-    expected = hmac.new(secret, _STDLIB_TOKEN_PREFIX + nonce + ciphertext, hashlib.sha256).digest()
-    if not hmac.compare_digest(digest, expected):
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
-
-    keystream = _derive_keystream(secret, nonce, len(ciphertext))
-    plaintext = bytes(left ^ right for left, right in zip(ciphertext, keystream))
-    return json.loads(plaintext.decode("utf-8"))
 
 
 # =============================================================================
@@ -151,7 +101,7 @@ def derive_key(passphrase: bytes, salt: bytes, kdf_config: dict | None = None) -
 
 
 def encrypt_store(data: dict, key: bytes) -> bytes:
-    """Encrypt credential store payload with Fernet or the stdlib fallback.
+    """Encrypt credential store payload with Fernet.
 
     Args:
         data: Credential store dict to encrypt
@@ -159,12 +109,15 @@ def encrypt_store(data: dict, key: bytes) -> bytes:
 
     Returns:
         Token bytes
+
+    Raises:
+        RuntimeError: If secure cryptography backend is unavailable
     """
     _ensure_crypto()
     payload = json.dumps(data, separators=(",", ":")).encode("utf-8")
-    if _CRYPTO_BACKEND == "fernet" and _Fernet is not None:
-        return _Fernet(key).encrypt(payload)
-    return _encrypt_store_stdlib(payload, key)
+    if _Fernet is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
+    return _Fernet(key).encrypt(payload)
 
 
 def decrypt_store(token: bytes, key: bytes) -> dict:
@@ -179,14 +132,11 @@ def decrypt_store(token: bytes, key: bytes) -> dict:
 
     Raises:
         ValueError: If passphrase is wrong or store contents are corrupted
+        RuntimeError: If secure cryptography backend is unavailable
     """
-    fallback = _decrypt_store_stdlib(token, key)
-    if fallback is not None:
-        return fallback
-
     _ensure_crypto()
-    if _CRYPTO_BACKEND != "fernet" or _Fernet is None or _InvalidToken is None:
-        raise ValueError("Decryption failed: wrong passphrase or corrupted store")
+    if _Fernet is None or _InvalidToken is None:
+        raise RuntimeError("Secure credential backend unavailable: cryptography is required")
 
     f = _Fernet(key)
     try:
@@ -618,7 +568,7 @@ def get_active_key(provider: str, project_dir: str | None = None) -> str | None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return None
 
     providers = store.get("providers", {})
@@ -661,7 +611,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
 
     try:
         store = load_store(passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         return
 
     providers = store.get("providers", {})
@@ -688,7 +638,7 @@ def advance_key(provider: str, project_dir: str | None = None) -> None:
     # Failover only advances on error, not after success
     try:
         save_store(store, passphrase, project_dir)
-    except (ValueError, OSError):
+    except (ValueError, OSError, RuntimeError):
         pass  # Best-effort; don't crash the API call
 
 

package/build/lib/hooks/firewall.py

@@ -26,6 +26,8 @@ setup_crash_handler("firewall", fail_closed=True)
 
 try:
     from policy_engine import evaluate_bash_command, to_pretool_hook_output, scan_mutation_command, ask, deny  # pyright: ignore[reportImplicitRelativeImport]
+    from runtime.compliance_governor import classify_bash_command_mode
+    from runtime.context_engine import _extract_clarification
     from runtime.defense_state import DefenseState
     from runtime.session_health import compute_session_health
     from runtime.mutation_gate import check_mutation_allowed
@@ -125,47 +127,17 @@ def _read_council_signal(project_dir: str, run_id: str) -> str:
 
 def _read_clarification_state(project_dir: str, run_id: str) -> dict[str, object]:
     if not run_id:
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     path = Path(project_dir) / ".omg" / "state" / "intent_gate" / f"{run_id}.json"
     if not path.exists():
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     try:
         payload = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
+        return _extract_clarification({})
     if not isinstance(payload, dict):
-        return {
-            "requires_clarification": False,
-            "intent_class": "",
-            "clarification_prompt": "",
-            "confidence": 0.0,
-        }
-    prompt = " ".join(str(payload.get("clarification_prompt", "")).split())
-    try:
-        confidence = float(payload.get("confidence", 0.0))
-    except (TypeError, ValueError):
-        confidence = 0.0
-    return {
-        "requires_clarification": bool(payload.get("requires_clarification") is True),
-        "intent_class": str(payload.get("intent_class", "")).strip(),
-        "clarification_prompt": prompt,
-        "confidence": round(max(0.0, min(1.0, confidence)), 2),
-    }
+        return _extract_clarification({})
+    return _extract_clarification(payload)
 
 
 def _clarification_reason(clarification_prompt: str) -> str:
@@ -175,6 +147,18 @@ def _clarification_reason(clarification_prompt: str) -> str:
     return "Clarification required before mutation: provide the missing intent details."
 
 
+def _clarification_external_reason(clarification_prompt: str) -> str:
+    prompt = " ".join(str(clarification_prompt or "").split())
+    if prompt:
+        return f"Clarification required before external execution: {prompt}"
+    return "Clarification required before external execution: provide the missing intent details."
+
+
+def _strict_ambiguity_mode_enabled() -> bool:
+    token = str(os.environ.get("OMG_STRICT_AMBIGUITY_MODE", "1")).strip().lower()
+    return token not in {"0", "false", "off", "no"}
+
+
 def _to_float(value: Any, default: float) -> float:
     try:
         return float(value)
@@ -266,8 +250,11 @@ gate_result = check_mutation_allowed(
     run_id=run_id or None,
     metadata=metadata if isinstance(metadata, dict) else None,
 )
-is_mutation_capable = str(gate_result.get("reason", "")) != "tool is read-only for mutation gate"
+bash_mode = classify_bash_command_mode(cmd)
+is_mutation_capable = bash_mode == "mutation"
+is_external_execution = bash_mode == "external"
 clarification_state = _read_clarification_state(get_project_dir(), run_id)
+strict_ambiguity_mode = _strict_ambiguity_mode_enabled()
 if is_mutation_capable:
     defense_decision = _mutating_defense_decision(
         project_dir=get_project_dir(),
@@ -277,8 +264,12 @@ if is_mutation_capable:
     if defense_decision is not None:
         decision = defense_decision
 
-if clarification_state.get("requires_clarification") is True and is_mutation_capable:
-    deny_decision(_clarification_reason(str(clarification_state.get("clarification_prompt", ""))))
+if strict_ambiguity_mode and clarification_state.get("requires_clarification") is True and (is_mutation_capable or is_external_execution):
+    prompt = str(clarification_state.get("clarification_prompt", ""))
+    if is_external_execution:
+        deny_decision(_clarification_external_reason(prompt))
+    else:
+        deny_decision(_clarification_reason(prompt))
     sys.exit(0)
 
 if is_mutation_capable and gate_result.get("status") == "blocked":

package/build/lib/hooks/pre-compact.py

@@ -32,6 +32,12 @@ except ImportError:
     except Exception:
         collect_protected_context = None
 
+try:
+    from runtime.context_limits import get_model_limits, compaction_trigger
+except Exception:
+    get_model_limits = None
+    compaction_trigger = None
+
 
 MAX_SNAPSHOT_BYTES = int(os.environ.get("OMG_PRECOMPACT_MAX_SNAPSHOT_BYTES", "262144"))
 GIT_DIFF_TIMEOUT_SEC = int(os.environ.get("OMG_PRECOMPACT_GIT_DIFF_TIMEOUT_SEC", "1"))
@@ -225,6 +231,51 @@ def _load_context_budget_config(project_dir):
     return defaults
 
 
+def _detect_model_id(data):
+    for key in ("CLAUDE_MODEL", "OMG_MODEL_ID", "OPENAI_MODEL"):
+        value = os.environ.get(key, "").strip()
+        if value:
+            return value
+
+    if not isinstance(data, dict):
+        return ""
+
+    model = data.get("model")
+    if isinstance(model, dict):
+        for key in ("id", "display_name", "name"):
+            value = str(model.get(key, "") or "").strip()
+            if value:
+                return value
+    elif isinstance(model, str) and model.strip():
+        return model.strip()
+
+    context = data.get("context")
+    if isinstance(context, dict):
+        nested_model = context.get("model")
+        if isinstance(nested_model, dict):
+            for key in ("id", "display_name", "name"):
+                value = str(nested_model.get(key, "") or "").strip()
+                if value:
+                    return value
+
+    return ""
+
+
+def _host_aware_compaction_threshold(data):
+    model_id = _detect_model_id(data)
+    if get_model_limits is not None and compaction_trigger is not None:
+        limits = get_model_limits(model_id)
+        trigger = int(compaction_trigger(model_id))
+    else:
+        limits = {"class_label": "128k-class"}
+        trigger = 80_000
+    return {
+        "model_id": model_id,
+        "class_label": str(limits.get("class_label", "128k-class")),
+        "trigger_tokens": trigger,
+    }
+
+
 # ---------------------------------------------------------------------------
 # Main hook execution (side-effects — only runs when invoked as script)
 # ---------------------------------------------------------------------------
@@ -236,6 +287,7 @@ def main():
         sys.exit(0)
 
     project_dir = _resolve_project_dir()
+    compaction_limits = _host_aware_compaction_threshold(data)
     ts = datetime.now().strftime("%Y%m%d_%H%M%S")
     state_dir = resolve_state_dir(project_dir, "state", "")
     snapshot_dir = os.path.join(state_dir, "snapshots", ts)
@@ -278,6 +330,12 @@ def main():
         f"# Handoff -- {datetime.now().strftime('%Y-%m-%d %H:%M')}",
         "Auto-generated before context compaction.",
     ]
+    model_label = compaction_limits["model_id"] or "unknown"
+    parts.append(
+        "## Compaction Budget\n"
+        f"Model: {model_label} ({compaction_limits['class_label']})\n"
+        f"Trigger: {compaction_limits['trigger_tokens']} tokens"
+    )
     if profile:
         parts.append("<!-- section: working-state -->")
         parts.append("## Project\n" + profile)
@@ -378,23 +436,28 @@ def main():
             if turns:
                 config = _load_context_budget_config(project_dir)
                 result = _apply_hybrid_summarization(turns, config)
+                summaries = result.get("summaries", [])
+                discarded_raw = result.get("discarded_count", 0)
+                discarded_count = discarded_raw if isinstance(discarded_raw, int) else 0
+                full_turns = result.get("full_turns", [])
                 # Format as additionalContext supplement
                 summary_parts = []
-                if result["summaries"]:
+                if isinstance(summaries, list) and summaries:
                     summary_parts.append("## Conversation Context (Hybrid Summary)")
-                    for s in result["summaries"]:
-                        summary_parts.append(s)
-                    if result["discarded_count"] > 0:
+                    for s in summaries:
+                        if isinstance(s, str):
+                            summary_parts.append(s)
+                    if discarded_count > 0:
                         summary_parts.append(
-                            f"({result['discarded_count']} oldest turns discarded — see memory/handoff)"
+                            f"({discarded_count} oldest turns discarded — see memory/handoff)"
                         )
-                    summary_text = "\n".join(summary_parts)
+                    _summary_text = "\n".join(summary_parts)
                     # Output as JSON if no protected context was already output
                     print(
                         f"[OMG pre-compact] Hybrid summarization: "
-                        f"{len(result['full_turns'])} full, "
-                        f"{len(result['summaries'])} batches, "
-                        f"{result['discarded_count']} discarded",
+                        f"{len(full_turns) if isinstance(full_turns, list) else 0} full, "
+                        f"{len(summaries)} batches, "
+                        f"{discarded_count} discarded",
                         file=sys.stderr,
                     )
     except Exception:

package/build/lib/hooks/prompt-enhancer.py

@@ -258,6 +258,14 @@ def _build_intent_gate_state(prompt_text, payload):
     run_id = _resolve_run_id(payload, source_prompt_hash)
     signal_hits = _count_signals(INTENT_MAP[intent_class]["signals"], prompt_text)
     confidence = min(0.99, 0.76 + (signal_hits * 0.07) + (0.06 if intent_class == "ambiguous_config" else 0.0))
+    governance_payload = {}
+    if score_complexity is not None:
+        try:
+            governance_raw = score_complexity(prompt_text).get("governance")
+            if isinstance(governance_raw, dict):
+                governance_payload = governance_raw
+        except Exception:
+            governance_payload = {}
 
     return {
         "schema": "IntentGateClarificationState",
@@ -269,7 +277,7 @@ def _build_intent_gate_state(prompt_text, payload):
         "missing_slots": missing_slots,
         "clarification_prompt": clarification_prompt,
         "source_prompt_hash": source_prompt_hash,
-        "governance": score_complexity(prompt_text).get("governance", {}),
+        "governance": governance_payload,
         "updated_at": datetime.now(timezone.utc).isoformat(),
     }
 
@@ -310,6 +318,12 @@ if detected_intent in ("fix", "implement", "refactor"):
     parts.append(
         "@verify: After EVERY change run build/lint/test. Show exit code."
     )
+    methodology_run_id = _resolve_run_id(data, _hash_prompt(prompt))
+    parts.append(
+        "@methodology: "
+        f"run_id={methodology_run_id} require plan+lock+done_when before mutation; "
+        "verify done_when after run."
+    )
 
 _gov_payload: dict[str, object] | None = None
 if score_complexity is not None and detected_intent in (