@trac3er/oh-my-god 2.1.9 → 2.2.3

package/build/lib/runtime/incident_replay.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 from datetime import datetime, timezone
 import json
 from pathlib import Path
+import re
 from typing import Any
 from uuid import uuid4
 
@@ -12,6 +13,32 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _write_pack(project_dir: str, incident_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+    rel_path = Path(".omg") / "incidents" / f"{incident_id}.json"
+    path = Path(project_dir) / rel_path
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+    payload["path"] = rel_path.as_posix()
+    return payload
+
+
+def _slug(value: str) -> str:
+    normalized = re.sub(r"[^a-z0-9]+", "-", str(value).strip().lower())
+    normalized = normalized.strip("-")
+    return normalized or "chaos"
+
+
+def _to_blockers(value: object) -> list[str]:
+    if not isinstance(value, list):
+        return []
+    blockers: list[str] = []
+    for item in value:
+        cleaned = str(item).strip()
+        if cleaned:
+            blockers.append(cleaned)
+    return blockers
+
+
 def build_incident_pack(
     project_dir: str,
     *,
@@ -39,9 +66,245 @@ def build_incident_pack(
         "regression_guards": failing_tests,
     }
 
-    rel_path = Path(".omg") / "incidents" / f"{incident_id}.json"
-    path = Path(project_dir) / rel_path
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
-    payload["path"] = rel_path.as_posix()
-    return payload
+    return _write_pack(project_dir, incident_id, payload)
+
+
+def build_worker_lifecycle_pack(
+    project_dir: str,
+    *,
+    run_id: str,
+    event: str,
+    heartbeat: dict[str, Any] | None = None,
+    termination: dict[str, Any] | None = None,
+    cleanup: dict[str, Any] | None = None,
+    trace_id: str | None = None,
+) -> dict[str, Any]:
+    incident_id = f"worker-lifecycle-{uuid4().hex[:12]}"
+    payload: dict[str, Any] = {
+        "schema": "WorkerLifecycleReplayPack",
+        "incident_id": incident_id,
+        "run_id": run_id,
+        "event": event,
+        "generated_at": _now(),
+        "trace_id": trace_id or "",
+        "heartbeat": heartbeat or {},
+        "termination": termination or {},
+        "cleanup": cleanup or {},
+        "reproduction_steps": [
+            f"Review heartbeat state for run_id={run_id}.",
+            f"Inspect worker lifecycle event: {event}.",
+            "Check .omg/evidence/subagents/ for replay evidence.",
+        ],
+    }
+
+    return _write_pack(project_dir, incident_id, payload)
+
+
+def build_chaos_replay_pack(
+    project_dir: str,
+    *,
+    run_id: str,
+    scenario: str,
+    fixture: str,
+    fault: str,
+    expected_outcome: dict[str, Any],
+    observed: dict[str, Any],
+    blockers: list[str] | None = None,
+    trace_id: str | None = None,
+    deterministic_seed: str | None = None,
+    evidence_freshness_max_age_seconds: float | None = None,
+) -> dict[str, Any]:
+    scenario_slug = _slug(scenario)
+    incident_id = f"chaos-{scenario_slug}-{uuid4().hex[:12]}"
+    expected_blockers = _to_blockers(expected_outcome.get("blockers"))
+    observed_blockers = _to_blockers(observed.get("blockers"))
+    generated_at = _now()
+
+    evidence_freshness: dict[str, Any] = {
+        "generated_at": generated_at,
+        "fixture_id": fixture,
+        "trace_id": trace_id or "",
+    }
+    if evidence_freshness_max_age_seconds is not None:
+        evidence_freshness["max_age_seconds"] = evidence_freshness_max_age_seconds
+
+    payload: dict[str, Any] = {
+        "schema": "ChaosReplayPack",
+        "incident_id": incident_id,
+        "run_id": run_id,
+        "scenario": scenario,
+        "fixture": fixture,
+        "fault": fault,
+        "generated_at": generated_at,
+        "trace_id": trace_id or "",
+        "deterministic_seed": deterministic_seed or "",
+        "expected_outcome": expected_outcome,
+        "observed": observed,
+        "blockers": blockers or expected_blockers or observed_blockers,
+        "evidence_freshness": evidence_freshness,
+        "reproduction_steps": [
+            f"Load fixture '{fixture}' and inject fault '{fault}'.",
+            "Execute the deterministic chaos scenario with bounded timeout.",
+            "Replay this pack and verify the blocker status reproduces.",
+        ],
+    }
+    return _write_pack(project_dir, incident_id, payload)
+
+
+def replay_chaos_pack(project_dir: str, pack_path: str) -> dict[str, Any]:
+    root = Path(project_dir)
+    source_path = Path(pack_path)
+    if not source_path.is_absolute():
+        source_path = root / source_path
+
+    if not source_path.exists():
+        return {
+            "schema": "ChaosReplayResult",
+            "status": "error",
+            "reproduced": False,
+            "reason": "pack_not_found",
+            "pack_path": str(pack_path),
+        }
+
+    try:
+        payload = json.loads(source_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {
+            "schema": "ChaosReplayResult",
+            "status": "error",
+            "reproduced": False,
+            "reason": "pack_unreadable",
+            "pack_path": str(pack_path),
+        }
+
+    if not isinstance(payload, dict) or payload.get("schema") != "ChaosReplayPack":
+        return {
+            "schema": "ChaosReplayResult",
+            "status": "error",
+            "reproduced": False,
+            "reason": "invalid_pack_schema",
+            "pack_path": str(pack_path),
+        }
+
+    expected = payload.get("expected_outcome")
+    observed = payload.get("observed")
+    if not isinstance(expected, dict) or not isinstance(observed, dict):
+        return {
+            "schema": "ChaosReplayResult",
+            "status": "error",
+            "reproduced": False,
+            "reason": "missing_outcomes",
+            "pack_path": str(source_path.relative_to(root)).replace("\\", "/"),
+        }
+
+    expected_status = str(expected.get("status", "")).strip().lower()
+    observed_status = str(observed.get("status", "")).strip().lower()
+    expected_blockers = set(_to_blockers(expected.get("blockers")))
+    observed_blockers = set(_to_blockers(observed.get("blockers")))
+    status_match = not expected_status or expected_status == observed_status
+    blocker_match = expected_blockers.issubset(observed_blockers)
+    reproduced = status_match and blocker_match
+
+    return {
+        "schema": "ChaosReplayResult",
+        "status": "blocked" if reproduced and observed_status == "blocked" else ("ok" if reproduced else "mismatch"),
+        "reproduced": reproduced,
+        "run_id": str(payload.get("run_id", "")).strip(),
+        "scenario": str(payload.get("scenario", "")).strip(),
+        "pack_path": str(source_path.relative_to(root)).replace("\\", "/"),
+        "expected_status": expected_status,
+        "observed_status": observed_status,
+        "expected_blockers": sorted(expected_blockers),
+        "observed_blockers": sorted(observed_blockers),
+    }
+
+
+def collect_incident_signals(project_dir: str, run_id: str) -> dict[str, object]:
+    root = Path(project_dir)
+    incident_dir = root / ".omg" / "incidents"
+    ledger_path = root / ".omg" / "state" / "ledger" / "tool-ledger.jsonl"
+
+    incident_count = 0
+    issue_payloads: list[dict[str, object]] = []
+    if incident_dir.is_dir():
+        for path in sorted(incident_dir.glob("*.json")):
+            incident_count += 1
+            try:
+                payload = json.loads(path.read_text(encoding="utf-8"))
+            except (OSError, json.JSONDecodeError):
+                continue
+            if not isinstance(payload, dict):
+                continue
+            title = str(payload.get("title") or payload.get("event") or payload.get("scenario") or "incident")
+            issue_payloads.append(
+                {
+                    "severity": "low",
+                    "surface": "hooks",
+                    "title": f"Incident replay artifact present: {title}",
+                    "description": "Incident artifact available for replay and triage verification.",
+                    "fix_guidance": "Link this artifact to issue remediation if related to current run.",
+                    "evidence_links": [str(path.relative_to(root)).replace("\\", "/")],
+                    "approval_required": False,
+                    "approval_reason": "",
+                }
+            )
+
+    hook_issues: list[dict[str, object]] = list(issue_payloads)
+    governed_tool_issues: list[dict[str, object]] = []
+    if ledger_path.exists():
+        try:
+            with ledger_path.open("r", encoding="utf-8") as handle:
+                for raw in handle:
+                    line = raw.strip()
+                    if not line:
+                        continue
+                    try:
+                        entry = json.loads(line)
+                    except json.JSONDecodeError:
+                        continue
+                    if not isinstance(entry, dict):
+                        continue
+                    entry_run_id = str(entry.get("run_id", "")).strip()
+                    if run_id and entry_run_id and entry_run_id != run_id:
+                        continue
+                    lane = str(entry.get("lane", "")).strip()
+                    governed_tool = str(entry.get("governed_tool", "")).strip()
+                    if lane or governed_tool:
+                        evidence = str(entry.get("evidence_path", "")).strip()
+                        if not evidence:
+                            governed_tool_issues.append(
+                                {
+                                    "severity": "high",
+                                    "surface": "governed_tools",
+                                    "title": "Governed tool execution missing evidence link",
+                                    "description": (
+                                        f"Governed tool '{governed_tool or entry.get('tool', '')}' ran on lane '{lane}' without evidence_path."
+                                    ),
+                                    "fix_guidance": "Attach signed evidence artifacts before approving governed tool output.",
+                                    "evidence_links": [".omg/state/ledger/tool-ledger.jsonl"],
+                                    "approval_required": True,
+                                    "approval_reason": "signed approval required when governed tools lack evidence linkage",
+                                }
+                            )
+                    exit_code = entry.get("exit_code")
+                    if isinstance(exit_code, int) and exit_code != 0:
+                        hook_issues.append(
+                            {
+                                "severity": "medium",
+                                "surface": "hooks",
+                                "title": "Hook/tool execution returned non-zero exit",
+                                "description": f"Tool '{entry.get('tool', '')}' exited with code {exit_code}.",
+                                "fix_guidance": "Inspect the tool ledger entry and replay with bounded diagnostics.",
+                                "evidence_links": [".omg/state/ledger/tool-ledger.jsonl"],
+                                "approval_required": False,
+                                "approval_reason": "",
+                            }
+                        )
+        except OSError:
+            pass
+
+    return {
+        "incident_count": incident_count,
+        "hook_issues": hook_issues,
+        "governed_tool_issues": governed_tool_issues,
+    }

package/build/lib/runtime/issue_surface.py

@@ -0,0 +1,362 @@
+from __future__ import annotations
+
+from dataclasses import asdict, dataclass
+from datetime import datetime, timezone
+import json
+import os
+from pathlib import Path
+from typing import cast
+
+from runtime.forge_agents import collect_forge_evidence_issues
+from runtime.incident_replay import collect_incident_signals
+from runtime.plugin_diagnostics import run_plugin_diagnostics
+from runtime.plugin_interop import conflict_severity_to_issue_severity
+from runtime.session_health import collect_session_health_risks
+from tools.session_snapshot import collect_snapshot_signals
+
+
+_ALL_SURFACES: tuple[str, ...] = (
+    "live_session",
+    "forge_runs",
+    "hooks",
+    "skills",
+    "mcps",
+    "plugin_interop",
+    "governed_tools",
+    "domain_pipelines",
+)
+
+_SEVERITY_RANK: dict[str, int] = {
+    "critical": 0,
+    "high": 1,
+    "medium": 2,
+    "low": 3,
+    "info": 4,
+}
+
+
+@dataclass(slots=True)
+class Issue:
+    id: str
+    severity: str
+    surface: str
+    title: str
+    description: str
+    fix_guidance: str
+    evidence_links: list[str]
+    approval_required: bool
+    approval_reason: str
+
+    def to_dict(self) -> dict[str, object]:
+        return asdict(self)
+
+
+@dataclass(slots=True)
+class IssueReport:
+    run_id: str
+    timestamp: str
+    issues: list[Issue]
+    summary: dict[str, object]
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "schema": "IssueReport",
+            "run_id": self.run_id,
+            "timestamp": self.timestamp,
+            "issues": [issue.to_dict() for issue in self.issues],
+            "summary": dict(self.summary),
+        }
+
+
+class IssueSurface:
+    def __init__(self, project_dir: str | None = None) -> None:
+        self.project_dir: str = str(Path(project_dir or os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())).resolve())
+
+    def scan(self, run_id: str, surfaces: list[str] | tuple[str, ...] | None = None) -> IssueReport:
+        selected_surfaces = self._normalize_surfaces(surfaces)
+        issues: list[Issue] = []
+        scan_map = {
+            "live_session": self._scan_live_session,
+            "forge_runs": self._scan_forge_runs,
+            "hooks": self._scan_hooks,
+            "skills": self._scan_skills,
+            "mcps": self._scan_mcps,
+            "plugin_interop": self._scan_plugin_interop,
+            "governed_tools": self._scan_governed_tools,
+            "domain_pipelines": self._scan_domain_pipelines,
+        }
+
+        for surface in selected_surfaces:
+            scanner = scan_map.get(surface)
+            if scanner is not None:
+                issues.extend(scanner(run_id))
+
+        ranked_issues = sorted(
+            issues,
+            key=lambda issue: (
+                _SEVERITY_RANK.get(issue.severity, 99),
+                issue.surface,
+                issue.id,
+            ),
+        )
+        summary = self._build_summary(ranked_issues, selected_surfaces)
+        report = IssueReport(
+            run_id=run_id,
+            timestamp=datetime.now(timezone.utc).isoformat(),
+            issues=ranked_issues,
+            summary=summary,
+        )
+        report_path = self.emit_report(run_id, report)
+        report.summary["report_path"] = report_path
+        return report
+
+    def simulate_failure(self, surface: str, scenario: str) -> dict[str, object]:
+        normalized_surface = str(surface).strip().lower() or "unknown"
+        normalized_scenario = str(scenario).strip().lower() or "unknown"
+        dangerous_probe = any(
+            token in normalized_scenario
+            for token in ("delete", "overwrite", "rm -rf", "exfiltrate", "credential", "chmod")
+        )
+        severity = "high" if dangerous_probe else "medium"
+        approval_required = dangerous_probe
+        issue = Issue(
+            id=f"sim-{normalized_surface}-{abs(hash(normalized_scenario)) % 100000}",
+            severity=severity,
+            surface=normalized_surface,
+            title="Sandboxed red-team simulation result",
+            description=(
+                "Probe classified as potentially destructive and blocked in simulation mode."
+                if dangerous_probe
+                else "Probe classified as non-destructive simulation scenario."
+            ),
+            fix_guidance=(
+                "Keep simulation read-only; require signed approval artifact before any real mutation workflow."
+                if dangerous_probe
+                else "Document scenario and add replay fixture for continued diagnostics."
+            ),
+            evidence_links=[f"sim://{normalized_surface}/{normalized_scenario}"],
+            approval_required=approval_required,
+            approval_reason=(
+                "signed approval required before leaving read-only simulation mode"
+                if dangerous_probe
+                else ""
+            ),
+        )
+        return {
+            "schema": "IssueSimulationResult",
+            "surface": normalized_surface,
+            "scenario": normalized_scenario,
+            "mutated": False,
+            "issue": issue.to_dict(),
+        }
+
+    def emit_report(self, run_id: str, report: IssueReport) -> str:
+        evidence_dir = Path(self.project_dir) / ".omg" / "evidence" / "issues"
+        evidence_dir.mkdir(parents=True, exist_ok=True)
+        path = evidence_dir / f"{run_id}.json"
+        tmp_path = path.with_name(f"{path.name}.tmp")
+        _ = tmp_path.write_text(json.dumps(report.to_dict(), indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+        os.replace(tmp_path, path)
+        return str(path.relative_to(self.project_dir)).replace("\\", "/")
+
+    def _normalize_surfaces(self, surfaces: list[str] | tuple[str, ...] | None) -> list[str]:
+        if not surfaces:
+            return list(_ALL_SURFACES)
+        normalized: list[str] = []
+        for item in surfaces:
+            candidate = str(item).strip().lower()
+            if candidate in _ALL_SURFACES and candidate not in normalized:
+                normalized.append(candidate)
+        return normalized or list(_ALL_SURFACES)
+
+    def _build_summary(self, issues: list[Issue], surfaces: list[str]) -> dict[str, object]:
+        by_severity = {name: 0 for name in _SEVERITY_RANK}
+        by_surface = {surface: 0 for surface in surfaces}
+        for issue in issues:
+            if issue.severity in by_severity:
+                by_severity[issue.severity] += 1
+            by_surface[issue.surface] = by_surface.get(issue.surface, 0) + 1
+        return {
+            "total": len(issues),
+            "surfaces_scanned": surfaces,
+            "by_severity": by_severity,
+            "by_surface": by_surface,
+            "requires_signed_approval": any(issue.approval_required for issue in issues),
+        }
+
+    def _issue_from_payload(self, run_id: str, idx: int, payload: dict[str, object]) -> Issue:
+        severity = str(payload.get("severity", "info"))
+        approval_required = bool(payload.get("approval_required", severity in {"critical", "high"}))
+        approval_reason = str(payload.get("approval_reason", "")).strip()
+        if approval_required and not approval_reason:
+            approval_reason = "signed approval required before fix execution"
+        surface = str(payload.get("surface", "unknown"))
+        return Issue(
+            id=f"{run_id}-{surface}-{idx}",
+            severity=severity,
+            surface=surface,
+            title=str(payload.get("title", "Issue detected")),
+            description=str(payload.get("description", "")),
+            fix_guidance=str(payload.get("fix_guidance", "")),
+            evidence_links=self._to_str_list(payload.get("evidence_links")),
+            approval_required=approval_required,
+            approval_reason=approval_reason,
+        )
+
+    def _to_str_list(self, value: object) -> list[str]:
+        if not isinstance(value, list):
+            return []
+        result: list[str] = []
+        for item in cast(list[object], value):
+            text = str(item).strip()
+            if text:
+                result.append(text)
+        return result
+
+    def _scan_live_session(self, run_id: str) -> list[Issue]:
+        payloads = collect_session_health_risks(self.project_dir, run_id)
+        snapshots = collect_snapshot_signals(str(Path(self.project_dir) / ".omg" / "state"))
+        issues = [self._issue_from_payload(run_id, idx, payload) for idx, payload in enumerate(payloads, start=1)]
+        if int(snapshots.get("snapshot_count", 0)) == 0:
+            issues.append(
+                self._issue_from_payload(
+                    run_id,
+                    len(issues) + 1,
+                    {
+                        "severity": "low",
+                        "surface": "live_session",
+                        "title": "No session snapshots available",
+                        "description": "Issue scan found no state snapshots for replay diagnostics.",
+                        "fix_guidance": "Enable snapshot capture or run a snapshot before deep issue triage.",
+                        "evidence_links": [".omg/state/snapshots/"],
+                        "approval_required": False,
+                        "approval_reason": "",
+                    },
+                )
+            )
+        return issues
+
+    def _scan_forge_runs(self, run_id: str) -> list[Issue]:
+        payloads = collect_forge_evidence_issues(self.project_dir, run_id)
+        return [self._issue_from_payload(run_id, idx, payload) for idx, payload in enumerate(payloads, start=1)]
+
+    def _scan_hooks(self, run_id: str) -> list[Issue]:
+        signals = collect_incident_signals(self.project_dir, run_id)
+        payloads = signals.get("hook_issues", [])
+        if not isinstance(payloads, list):
+            return []
+        typed_payloads = [payload for payload in payloads if isinstance(payload, dict)]
+        return [
+            self._issue_from_payload(run_id, idx, payload)
+            for idx, payload in enumerate(typed_payloads, start=1)
+        ]
+
+    def _scan_skills(self, run_id: str) -> list[Issue]:
+        diagnostics = run_plugin_diagnostics(root=self.project_dir, live=False)
+        records = diagnostics.get("records", [])
+        if not isinstance(records, list):
+            return []
+        typed_records = [record for record in records if isinstance(record, dict)]
+        skill_records = [record for record in typed_records if record.get("source") == "skill_registry"]
+        if skill_records:
+            return []
+        return [
+            self._issue_from_payload(
+                run_id,
+                1,
+                {
+                    "severity": "medium",
+                    "surface": "skills",
+                    "title": "No compiled skills discovered",
+                    "description": "Diagnostic scan did not detect skill-registry entries for the active workspace.",
+                    "fix_guidance": "Regenerate skill registry artifacts and verify .omg/state/skill_registry/compact.json.",
+                    "evidence_links": [".omg/state/skill_registry/compact.json"],
+                    "approval_required": False,
+                    "approval_reason": "",
+                },
+            )
+        ]
+
+    def _scan_mcps(self, run_id: str) -> list[Issue]:
+        diagnostics = run_plugin_diagnostics(root=self.project_dir, live=False)
+        records = diagnostics.get("records", [])
+        if not isinstance(records, list):
+            return []
+        typed_records = [record for record in records if isinstance(record, dict)]
+        mcp_records = [record for record in typed_records if record.get("mcp_servers")]
+        if mcp_records:
+            return []
+        return [
+            self._issue_from_payload(
+                run_id,
+                1,
+                {
+                    "severity": "medium",
+                    "surface": "mcps",
+                    "title": "No MCP servers discovered",
+                    "description": "Issue scan found no configured MCP servers across discovered host configs.",
+                    "fix_guidance": "Register required MCP servers and rerun diagnostics.",
+                    "evidence_links": [".mcp.json", ".claude-plugin/mcp.json"],
+                    "approval_required": False,
+                    "approval_reason": "",
+                },
+            )
+        ]
+
+    def _scan_plugin_interop(self, run_id: str) -> list[Issue]:
+        diagnostics = run_plugin_diagnostics(root=self.project_dir, live=False)
+        conflicts = diagnostics.get("conflicts", [])
+        if not isinstance(conflicts, list):
+            return []
+
+        issues: list[Issue] = []
+        typed_conflicts = [conflict for conflict in conflicts if isinstance(conflict, dict)]
+        for idx, conflict in enumerate(typed_conflicts, start=1):
+            severity = conflict_severity_to_issue_severity(str(conflict.get("severity", "info")))
+            code = str(conflict.get("code", "conflict"))
+            detail = str(conflict.get("detail", ""))
+            fix_guidance = str(conflict.get("next_action", ""))
+            approval_required = severity in {"critical", "high"}
+            issues.append(
+                self._issue_from_payload(
+                    run_id,
+                    idx,
+                    {
+                        "severity": severity,
+                        "surface": "plugin_interop",
+                        "title": f"Plugin interop conflict: {code}",
+                        "description": detail,
+                        "fix_guidance": fix_guidance,
+                        "evidence_links": [".omg/state/plugins-allowlist.yaml", ".mcp.json"],
+                        "approval_required": approval_required,
+                        "approval_reason": (
+                            "signed approval required to modify plugin ownership on blocker/high conflicts"
+                            if approval_required
+                            else ""
+                        ),
+                    },
+                )
+            )
+        return issues
+
+    def _scan_governed_tools(self, run_id: str) -> list[Issue]:
+        signals = collect_incident_signals(self.project_dir, run_id)
+        payloads = signals.get("governed_tool_issues", [])
+        if not isinstance(payloads, list):
+            return []
+        typed_payloads = [payload for payload in payloads if isinstance(payload, dict)]
+        return [
+            self._issue_from_payload(run_id, idx, payload)
+            for idx, payload in enumerate(typed_payloads, start=1)
+        ]
+
+    def _scan_domain_pipelines(self, run_id: str) -> list[Issue]:
+        payloads = collect_forge_evidence_issues(self.project_dir, run_id, domain_pipeline_only=True)
+        return [self._issue_from_payload(run_id, idx, payload) for idx, payload in enumerate(payloads, start=1)]
+
+
+__all__ = [
+    "Issue",
+    "IssueReport",
+    "IssueSurface",
+]