@trac3er/oh-my-god 2.1.9 → 2.2.3

package/runtime/tool_plan_gate.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+import re
 from collections.abc import Mapping
 from datetime import datetime, timezone
 from pathlib import Path
@@ -9,10 +10,15 @@ from uuid import uuid4
 import json
 
 from runtime.context_engine import ContextEngine
-from runtime.compliance_governor import evaluate_tool_compliance
+from runtime.compliance_governor import classify_bash_command_mode, evaluate_tool_compliance
 from runtime.complexity_scorer import score_complexity
-from runtime.release_run_coordinator import resolve_current_run_id as resolve_coordinator_run_id
+from runtime.release_run_coordinator import (
+    get_active_coordinator_run_id,
+    is_release_orchestration_active,
+    resolve_current_run_id as resolve_coordinator_run_id,
+)
 from runtime.runtime_contracts import read_run_state
+from runtime.test_intent_lock import verify_done_when, verify_lock
 
 
 _TOOL_KEYWORDS: dict[str, tuple[str, ...]] = {
@@ -21,6 +27,14 @@ _TOOL_KEYWORDS: dict[str, tuple[str, ...]] = {
     "omg_security_check": ("security", "scan", "vulnerability", "audit", "auth", "token", "secret"),
     "omg-control": ("policy", "governance", "release", "proof", "control plane"),
 }
+_MUTATION_TOOLS = frozenset({"write", "edit", "multiedit", "bash"})
+_READ_ONLY_BASH_ALLOWLIST = (
+    re.compile(r"^python\d?(?:\s+-[vV]{1,2}|\s+--version)(?:\s|$)"),
+    re.compile(r"^git\s+status(?:\s|$)"),
+    re.compile(r"^gh\s+pr\s+view(?:\s|$)"),
+    re.compile(r"^(?:.+\|\s*)?tee\s+/dev/null(?:\s|$)"),
+)
+_FULLY_QUOTED_PATTERN = re.compile(r"^\s*([\"']).*\1\s*$")
 
 def build_tool_plan(
     goal: str,
@@ -102,33 +116,92 @@ def has_tool_plan_for_run(project_dir: str, run_id: str | None) -> bool:
     return any(plans_dir.glob(f"{run_prefix}-plan-*.json"))
 
 
-def tool_plan_gate_check(project_dir: str, run_id: str | None, tool: str) -> dict[str, object]:
-    if not run_id:
+def tool_plan_gate_check(
+    project_dir: str,
+    run_id: str | None,
+    tool: str,
+    tool_input: dict[str, object] | None = None,
+) -> dict[str, object]:
+    effective_run_id = get_active_coordinator_run_id(project_dir=project_dir) or run_id
+    if not effective_run_id:
         return {"status": "allowed", "reason": "run_id unavailable; skip tool plan gate"}
 
+    tool_input_obj = tool_input if isinstance(tool_input, dict) else {}
+    has_plan = has_tool_plan_for_run(project_dir, effective_run_id)
+
     context_packet = _resolve_bounded_context_packet(
         project_dir=project_dir,
-        run_id=run_id,
+        run_id=effective_run_id,
         fallback_context=None,
     )
     clarification = _clarification_status(context_packet)
     decision = evaluate_tool_compliance(
         project_dir=project_dir,
-        run_id=run_id,
+        run_id=effective_run_id,
         tool=tool,
-        has_tool_plan=has_tool_plan_for_run(project_dir, run_id),
+        has_tool_plan=has_plan,
         clarification_status=clarification,
+        tool_input=tool_input,
     )
     reason = str(decision.get("reason", ""))
     if decision.get("status") == "blocked":
-        _persist_gate_error(project_dir, run_id, tool, reason)
+        _persist_gate_error(project_dir, effective_run_id, tool, reason)
+        return {
+            **decision,
+            "run_id": effective_run_id,
+            "tool": tool,
+        }
+
+    if _is_mutation_capable_tool(tool, tool_input_obj) and not _is_docs_exemption(tool_input_obj):
+        lock_id = _extract_lock_id(tool_input_obj)
+        lock_verdict = verify_lock(project_dir, run_id=effective_run_id, lock_id=lock_id)
+        if lock_verdict.get("status") != "ok":
+            return {
+                "status": "blocked",
+                "authority": "test_intent_lock",
+                "reason": "test_intent_lock_required_before_mutation",
+                "run_id": effective_run_id,
+                "tool": tool,
+            }
+
+        if is_release_orchestration_active(project_dir=project_dir):
+            return {
+                **decision,
+                "run_id": effective_run_id,
+                "tool": tool,
+            }
+
+        metadata = _extract_metadata(tool_input_obj)
+        done_when_verdict = verify_done_when(metadata, run_id=effective_run_id)
+        if done_when_verdict.get("status") != "ok":
+            return {
+                "status": "blocked",
+                "authority": "done_when",
+                "reason": "done_when_required_before_mutation",
+                "run_id": effective_run_id,
+                "tool": tool,
+            }
+
     return {
         **decision,
-        "run_id": run_id,
+        "run_id": effective_run_id,
         "tool": tool,
     }
 
 
+def governed_tool_plan_gate_check(
+    project_dir: str,
+    run_id: str | None,
+    lane_name: str,
+    tool: str,
+) -> dict[str, object]:
+    decision = tool_plan_gate_check(project_dir=project_dir, run_id=run_id, tool=tool)
+    return {
+        **decision,
+        "lane_name": str(lane_name).strip().lower(),
+    }
+
+
 def _normalize_tools(available_tools: list[str]) -> list[str]:
     output: list[str] = []
     seen: set[str] = set()
@@ -334,3 +407,54 @@ def _clarification_status(context_packet: dict[str, object]) -> dict[str, object
         "clarification_prompt": prompt,
         "confidence": round(max(0.0, min(1.0, confidence)), 2),
     }
+
+
+def _is_mutation_capable_tool(tool: str, tool_input: dict[str, object]) -> bool:
+    token = str(tool or "").strip().lower()
+    if token == "bash":
+        command = str(tool_input.get("command", "")).strip()
+        lowered = command.lower()
+        if _is_allowlisted_read_only_bash(lowered):
+            return False
+        return classify_bash_command_mode(command) == "mutation"
+    return token in _MUTATION_TOOLS
+
+
+def _is_allowlisted_read_only_bash(command: str) -> bool:
+    stripped = command.strip()
+    if not stripped:
+        return True
+    if _FULLY_QUOTED_PATTERN.match(stripped):
+        return True
+    for pattern in _READ_ONLY_BASH_ALLOWLIST:
+        if pattern.search(stripped):
+            return True
+    return False
+
+
+def _extract_metadata(tool_input: dict[str, object]) -> dict[str, object]:
+    metadata = tool_input.get("metadata")
+    if isinstance(metadata, dict):
+        return dict(metadata)
+    return {}
+
+
+def _extract_lock_id(tool_input: dict[str, object]) -> str | None:
+    lock_id = tool_input.get("lock_id")
+    if isinstance(lock_id, str) and lock_id.strip():
+        return lock_id.strip()
+    metadata = _extract_metadata(tool_input)
+    metadata_lock_id = metadata.get("lock_id")
+    if isinstance(metadata_lock_id, str) and metadata_lock_id.strip():
+        return metadata_lock_id.strip()
+    return None
+
+
+def _is_docs_exemption(tool_input: dict[str, object]) -> bool:
+    exemption = str(tool_input.get("exemption", "")).strip().lower()
+    if exemption == "docs":
+        return True
+    metadata = _extract_metadata(tool_input)
+    if metadata.get("exempt") is True and str(metadata.get("exemption", "")).strip().lower() == "docs":
+        return True
+    return False

package/runtime/untrusted_content.py

@@ -133,7 +133,7 @@ def write_trust_evidence(inputs: list[dict[str, Any]], output_dir: str | Path) -
     normalized_inputs: list[dict[str, Any]] = []
     for item in inputs:
         data = dict(item)
-        trust_tier = str(data.get("_trust_tier", "research"))
+        trust_tier = str(data.get("trust_tier", data.get("_trust_tier", "research")))
         trust_label = str(data.get("_trust_label", "UNTRUSTED_EXTERNAL_CONTENT"))
         try:
             trust_score = float(data.get("_trust_score", 0.0))
@@ -203,20 +203,24 @@ def mark_untrusted_content(
     resolved_tier = normalize_trust_tier(tier) if tier is not None else trust_tier_for_source(source_type)
     entry = tag_content(
         {
-        "source_type": source_type,
-        "source_ref": source_ref,
-        "quarantined_fragments": quarantined,
-        "sanitized_content": sanitized,
+            "source_type": source_type,
+            "source_ref": source_ref,
+            "quarantined_fragments": quarantined,
+            "sanitized_content": sanitized,
         },
         resolved_tier,
     )
+    entry["trust_tier"] = resolved_tier.value
     entry["trust_score"] = entry.get("_trust_score", 0.0)
-    provenance = list(state.get("provenance", []))
-    provenance.append(entry)
+
     evidence_path = write_trust_evidence(
         [entry],
         output_dir=Path(project_dir) / EVIDENCE_REL_DIR,
     )
+    entry["evidence_artifact"] = evidence_path
+
+    provenance = list(state.get("provenance", []))
+    provenance.append(entry)
 
     prior_scores = state.get("trust_scores", {})
     next_external_score = min(
@@ -232,6 +236,7 @@ def mark_untrusted_content(
         "last_trust_tier": resolved_tier.value,
         "last_trust_label": entry.get("_trust_label"),
         "last_trust_score": entry.get("_trust_score"),
+        "last_evidence_artifact": evidence_path,
         "sanitized_content": sanitized,
         "quarantined_fragments": quarantined,
         "provenance": provenance[-20:],

package/runtime/vision_jobs.py

@@ -7,7 +7,10 @@ import itertools
 from pathlib import Path
 from typing import Any
 
-from omg_natives.image import image
+try:
+    from omg_natives.image import image
+except ImportError:
+    image = None  # omg_natives is an optional dependency
 
 from runtime.vision_artifacts import write_vision_artifacts
 from runtime.vision_cache import build_cache_key, load_cached_result, store_cached_result