@trac3er/oh-my-god 2.2.3 → 2.2.5

package/runtime/compat.py

@@ -6,12 +6,14 @@ from __future__ import annotations
 
 from collections import Counter
 from datetime import datetime, timezone
+from importlib import import_module
 import json
 import os
 from pathlib import Path
 import re
 import sys
-from typing import Any
+import tempfile
+from typing import Any, Callable, TypedDict
 
 from hooks.policy_engine import evaluate_bash_command
 from lab.pipeline import run_pipeline
@@ -55,6 +57,11 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _normalize_verdict_payload(payload: dict[str, Any]) -> dict[str, Any]:
+    module = import_module("runtime.verdict_schema")
+    return dict(module.normalize_verdict(payload))
+
+
 def _project_dir(project_dir: str | None) -> str:
     return project_dir or os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
 
@@ -846,12 +853,203 @@ def run_doctor(*, root_dir: Path | None = None) -> dict[str, Any]:
     checks.append(plugin_check)
 
     has_blocker = any(c["status"] == "blocker" for c in checks)
+    verdict_receipt = _normalize_verdict_payload({
+        "status": "fail" if has_blocker else "pass",
+        "blockers": [
+            str(check.get("name", ""))
+            for check in checks
+            if check.get("status") == "blocker"
+        ],
+        "planned_actions": [
+            "Fix blocker checks before shipping.",
+        ],
+        "executed_actions": [
+            "run_doctor",
+        ],
+        "provenance": "runtime.compat.run_doctor",
+        "evidence_paths": {},
+        "next_steps": [
+            "Fix any blocker checks before shipping.",
+        ],
+        "executed": True,
+    })
     return {
         "schema": "DoctorResult",
         "status": "fail" if has_blocker else "pass",
+        "verdict": "fail" if has_blocker else "pass",
         "checks": checks,
         "plugin_compatibility": plugin_check,
         "version": CANONICAL_VERSION,
+        "verdict_receipt": verdict_receipt,
+    }
+
+
+class DoctorFixSpec(TypedDict):
+    fixable: bool
+    fix_handler: Callable[[Path, dict[str, Any]], dict[str, Any]] | None
+    fixable_in_context: bool
+    suggestion: str
+
+
+def _fix_omg_control_reachable(root_dir: Path, _check: dict[str, Any]) -> dict[str, Any]:
+    from runtime.config_transaction import ConfigTransaction
+
+    mcp_json_path = root_dir / ".mcp.json"
+    mcp_data: dict[str, Any] = {}
+    if mcp_json_path.exists():
+        try:
+            with open(mcp_json_path, "r", encoding="utf-8") as f:
+                mcp_data = json.load(f)
+        except (json.JSONDecodeError, OSError):
+            pass
+    servers = mcp_data.setdefault("mcpServers", {})
+    servers["omg-control"] = {
+        "command": "python3",
+        "args": ["-m", "runtime.omg_mcp_server"],
+    }
+    content = json.dumps(mcp_data, indent=2, ensure_ascii=True) + "\n"
+    return {"planned_path": str(mcp_json_path), "content": content, "mode": 0o644}
+
+
+def _fix_policy_files(root_dir: Path, _check: dict[str, Any]) -> dict[str, Any]:
+    policy_path = root_dir / ".omg" / "policy.yaml"
+    if policy_path.exists():
+        return {}
+    content = "mode: warn_and_run\ncritical_block: true\n"
+    return {"planned_path": str(policy_path), "content": content, "mode": 0o644}
+
+
+def _fix_metadata_drift(root_dir: Path, check: dict[str, Any]) -> dict[str, Any]:
+    from runtime.adoption import CANONICAL_VERSION
+    from runtime.contract_compiler import _check_version_identity_drift
+
+    drift_result = _check_version_identity_drift(root_dir)
+    drift_details = drift_result.get("drift_details", {})
+    if not drift_details:
+        return {}
+
+    first_label = next(iter(drift_details))
+    old_version = drift_details[first_label]
+    parts = first_label.split(":", 1)
+    rel_path = parts[0] if parts else first_label
+    target = root_dir / rel_path
+    if not target.exists():
+        return {}
+    original = target.read_text(encoding="utf-8")
+    patched = original.replace(old_version, CANONICAL_VERSION) if old_version != "<not found>" else original
+    if patched == original:
+        return {}
+    return {"planned_path": str(target), "content": patched, "mode": 0o644}
+
+
+DOCTOR_FIX_SPECS: dict[str, DoctorFixSpec] = {
+    "python_version": {
+        "fixable": False,
+        "fix_handler": None,
+        "fixable_in_context": False,
+        "suggestion": "Install Python >= 3.10 from python.org or via your package manager",
+    },
+    "fastmcp": {
+        "fixable": False,
+        "fix_handler": None,
+        "fixable_in_context": False,
+        "suggestion": "Run: pip install fastmcp",
+    },
+    "omg_control_reachable": {
+        "fixable": True,
+        "fix_handler": _fix_omg_control_reachable,
+        "fixable_in_context": True,
+        "suggestion": "",
+    },
+    "policy_files": {
+        "fixable": True,
+        "fix_handler": _fix_policy_files,
+        "fixable_in_context": True,
+        "suggestion": "",
+    },
+    "metadata_drift": {
+        "fixable": True,
+        "fix_handler": _fix_metadata_drift,
+        "fixable_in_context": True,
+        "suggestion": "",
+    },
+}
+
+_DEFAULT_FIX_SPEC: DoctorFixSpec = {
+    "fixable": False,
+    "fix_handler": None,
+    "fixable_in_context": False,
+    "suggestion": "Manual intervention required",
+}
+
+
+def run_doctor_fix(*, root_dir: Path | None = None, dry_run: bool = True) -> dict[str, Any]:
+    from runtime.config_transaction import ConfigTransaction, ConfigTransactionError
+
+    doctor_result = run_doctor(root_dir=root_dir)
+    repo_root = root_dir or Path(__file__).resolve().parent.parent
+
+    enriched_checks: list[dict[str, Any]] = []
+    fix_receipts: list[dict[str, Any]] = []
+
+    for check in doctor_result["checks"]:
+        spec = DOCTOR_FIX_SPECS.get(check["name"], _DEFAULT_FIX_SPEC)
+        enriched = dict(check)
+        enriched["fixable"] = spec["fixable"]
+        if not spec["fixable"]:
+            enriched["suggestion"] = spec["suggestion"]
+        enriched_checks.append(enriched)
+
+        if check["status"] == "ok" or not spec["fixable"] or spec["fix_handler"] is None:
+            continue
+
+        handler = spec["fix_handler"]
+        plan_data = handler(repo_root, check)
+        if not plan_data or "planned_path" not in plan_data:
+            continue
+
+        lock_dir = tempfile.mkdtemp(prefix="doctor-fix-")
+        tx = ConfigTransaction(
+            lock_path=Path(lock_dir) / "doctor-fix.lock",
+            backup_root=Path(lock_dir) / "backups",
+        )
+        tx.plan(
+            plan_data["planned_path"],
+            plan_data["content"],
+            mode=plan_data.get("mode", 0o644),
+        )
+
+        try:
+            receipt = tx.dry_run() if dry_run else tx.execute()
+        except ConfigTransactionError as exc:
+            receipt = exc.receipt or {
+                "planned_writes": [],
+                "executed_writes": [],
+                "backup_path": "",
+                "verification": {},
+                "executed": False,
+                "rollback": None,
+            }
+
+        fix_receipts.append({
+            "check": check["name"],
+            "action": plan_data.get("action", f"fix_{check['name']}"),
+            "backup_path": receipt.get("backup_path", ""),
+            "verification": receipt.get("verification", {}),
+            "executed": receipt.get("executed", False),
+            "rollback": receipt.get("rollback"),
+        })
+
+    has_blocker = any(c["status"] == "blocker" for c in enriched_checks)
+    unfixed_blockers = has_blocker and dry_run
+
+    return {
+        "schema": "DoctorFixResult",
+        "mode": "dry_run" if dry_run else "fix",
+        "status": "fail" if unfixed_blockers else doctor_result["status"],
+        "checks": enriched_checks,
+        "fix_receipts": fix_receipts,
+        "version": CANONICAL_VERSION,
     }
 
 
@@ -1294,10 +1492,26 @@ def dispatch_compat_skill(
     if route == "health":
         if normalized == "omg-doctor":
             doctor_result = run_doctor(root_dir=Path(root))
+            verdict_receipt = _normalize_verdict_payload({
+                "status": doctor_result.get("status", "pending"),
+                "verdict": doctor_result.get("verdict", doctor_result.get("status", "pending")),
+                "blockers": doctor_result.get("verdict_receipt", {}).get("blockers", []),
+                "planned_actions": doctor_result.get("verdict_receipt", {}).get("planned_actions", []),
+                "executed_actions": doctor_result.get("verdict_receipt", {}).get("executed_actions", []),
+                "provenance": "runtime.compat.dispatch_compat_skill",
+                "evidence_paths": doctor_result.get("verdict_receipt", {}).get("evidence_paths", {}),
+                "next_steps": doctor_result.get("verdict_receipt", {}).get("next_steps", []),
+                "executed": True,
+                "metadata": {
+                    "checks": doctor_result.get("checks", []),
+                },
+            })
             snapshot = {
                 "project_dir": root,
                 "status": doctor_result["status"],
+                "verdict": doctor_result.get("verdict", doctor_result["status"]),
                 "checks": doctor_result["checks"],
+                "verdict_receipt": verdict_receipt,
             }
             return _res(
                 skill=normalized,

package/runtime/compliance_governor.py

@@ -36,7 +36,7 @@ _EXTERNAL_BASH_PATTERNS = (
     re.compile(r"\bgit\s+(clone|fetch|pull)\b"),
 )
 _MUTATION_BASH_PATTERNS = (
-    r"\b(git\s+(add|commit|push|rebase|cherry-pick|merge|tag))\b",
+    r"\b(git\s+(add|commit|push|rebase|cherry-pick|merge|tag(?!\s+(-l|--list)\b)))\b",
     r"\b(rm|mv|cp|tee|touch|mkdir|rmdir|ln)\b",
     r"\b(sed\s+-i|perl\s+-pi)\b",
     r"\b(chmod|chown)\b",
@@ -430,8 +430,34 @@ def _is_mutation_capable_bash(command: str) -> bool:
     for pattern in _MUTATION_BASH_PATTERNS:
         if re.search(pattern, lowered):
             return True
+    # File-write redirection: only classify as mutation if the command itself
+    # is NOT a known read-only program.  `python3 script.py > out.json` is a
+    # read-only computation that merely saves output; the actual mutation
+    # patterns (git commit, rm, mv, etc.) are already caught above.
     if _FILE_WRITE_REDIRECTION_PATTERN.search(lowered):
-        return True
+        if not _is_read_only_program_with_redirect(normalized_command):
+            return True
+    return False
+
+
+def _is_read_only_program_with_redirect(command: str) -> bool:
+    """Return True when the command before any > redirect is a read-only program."""
+    cmd_portion = re.split(r"(?<!\d)\s*>>?\s+\S+", command)[0].strip()
+    if not cmd_portion:
+        return False
+    lowered = cmd_portion.lower()
+    _read_only_prefixes = (
+        "python", "python3", "node", "ruby", "perl",
+        "jq", "yq",
+        "git log", "git diff", "git status", "git show", "git branch",
+        "gh pr", "gh run", "gh api",
+        "ls", "find", "grep", "rg", "ag", "wc", "sort", "uniq",
+        "head", "tail", "less", "more", "file", "stat", "du", "df",
+        "env", "printenv", "uname", "whoami", "hostname", "date",
+    )
+    for prefix in _read_only_prefixes:
+        if lowered.startswith(prefix):
+            return True
     return False
 
 

package/runtime/config_transaction.py

@@ -0,0 +1,304 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import hashlib
+import os
+from pathlib import Path
+import time
+from typing import Literal, NotRequired, TypedDict, cast
+
+from runtime import mcp_config_writers as _mcp_config_writers
+
+
+_ATOMIC_WRITE_TEXT_SAFE = cast(
+    "_AtomicWriteFn",
+    getattr(_mcp_config_writers, "_atomic_write_text_safe"),
+)
+_FSYNC_DIR = cast("_FsyncDirFn", getattr(_mcp_config_writers, "_fsync_dir"))
+
+
+class _AtomicWriteFn:
+    def __call__(self, path: Path, content: str, *, mode: int = 0o600) -> None: ...
+
+
+class _FsyncDirFn:
+    def __call__(self, path: Path | str) -> None: ...
+
+
+VerificationStatus = Literal["ok", "mismatch", "missing"]
+
+
+class PlannedWriteReceipt(TypedDict):
+    path: str
+    content_hash: str
+
+
+class ExecutedWriteReceipt(TypedDict):
+    path: str
+    content_hash: str
+    executed: bool
+    error: NotRequired[str]
+
+
+class RollbackReceipt(TypedDict):
+    restored: list[str]
+    failed: list[str]
+
+
+class ConfigReceipt(TypedDict):
+    planned_writes: list[PlannedWriteReceipt]
+    executed_writes: list[ExecutedWriteReceipt]
+    backup_path: str
+    verification: dict[str, VerificationStatus]
+    executed: bool
+    rollback: RollbackReceipt | None
+
+
+class ConfigTransactionError(RuntimeError):
+    receipt: ConfigReceipt | None
+
+    def __init__(self, message: str, *, receipt: ConfigReceipt | None = None) -> None:
+        super().__init__(message)
+        self.receipt = receipt
+
+
+@dataclass
+class _PlannedWrite:
+    path: Path
+    content: str
+    content_hash: str
+    mode: int = 0o600
+
+
+class ConfigTransaction:
+    def __init__(
+        self,
+        *,
+        stale_lock_ms: int = 10000,
+        lock_path: Path | None = None,
+        backup_root: Path | None = None,
+    ) -> None:
+        home = Path.home()
+        self._lock_path: Path = lock_path or (home / ".omg" / "state" / "config-transaction.lock")
+        self._backup_root: Path = backup_root or (home / ".omg" / "backups")
+        self._stale_lock_ms: int = stale_lock_ms
+        self._planned: list[_PlannedWrite] = []
+        self._last_backup_path: str | None = None
+        self._last_backup_index: dict[str, str | None] = {}
+        self._last_planned_paths: list[str] = []
+
+    def plan(self, target_path: Path | str, content: str, *, mode: int = 0o600) -> None:
+        path = Path(target_path).resolve()
+        digest = hashlib.sha256(content.encode("utf-8")).hexdigest()
+        self._planned.append(_PlannedWrite(path=path, content=content, content_hash=digest, mode=mode))
+
+    def execute(self) -> ConfigReceipt:
+        return self._run(executed=True)
+
+    def dry_run(self) -> ConfigReceipt:
+        return self._run(executed=False)
+
+    def rollback(self) -> RollbackReceipt:
+        if not self._last_backup_path:
+            raise ConfigTransactionError("rollback requested before any backup snapshot")
+
+        restored: list[str] = []
+        failed: list[str] = []
+        backup_dir = Path(self._last_backup_path)
+        for target in self._last_planned_paths:
+            backup_file = self._last_backup_index.get(target)
+            target_path = Path(target)
+            try:
+                if backup_file is None:
+                    if target_path.exists() or target_path.is_symlink():
+                        target_path.unlink()
+                        _FSYNC_DIR(target_path.parent)
+                    restored.append(target)
+                    continue
+                source = backup_dir / backup_file
+                if not source.exists():
+                    failed.append(target)
+                    continue
+                content = source.read_text(encoding="utf-8")
+                _ATOMIC_WRITE_TEXT_SAFE(target_path, content)
+                restored.append(target)
+            except OSError:
+                failed.append(target)
+        return {"restored": restored, "failed": failed}
+
+    def list_backups(self) -> list[str]:
+        if not self._backup_root.exists():
+            return []
+        dirs = [path for path in self._backup_root.iterdir() if path.is_dir()]
+        dirs.sort(key=lambda path: (path.stat().st_mtime_ns, path.name), reverse=True)
+        return [str(path) for path in dirs]
+
+    def _run(self, *, executed: bool) -> ConfigReceipt:
+        self._acquire_lock()
+        try:
+            backup_path = self._snapshot_backups()
+            receipt: ConfigReceipt = {
+                "planned_writes": [
+                    {"path": str(item.path), "content_hash": item.content_hash}
+                    for item in self._planned
+                ],
+                "executed_writes": [],
+                "backup_path": backup_path,
+                "verification": {},
+                "executed": executed,
+                "rollback": None,
+            }
+
+            if executed:
+                for item in self._planned:
+                    try:
+                        _ATOMIC_WRITE_TEXT_SAFE(item.path, item.content, mode=item.mode)
+                        receipt["executed_writes"].append(
+                            {
+                                "path": str(item.path),
+                                "content_hash": item.content_hash,
+                                "executed": True,
+                            }
+                        )
+                    except OSError as exc:
+                        receipt["executed_writes"].append(
+                            {
+                                "path": str(item.path),
+                                "content_hash": item.content_hash,
+                                "executed": False,
+                                "error": str(exc),
+                            }
+                        )
+                        rollback_data = self.rollback()
+                        receipt["rollback"] = rollback_data
+                        raise ConfigTransactionError(str(exc), receipt=receipt) from exc
+            else:
+                for item in self._planned:
+                    receipt["executed_writes"].append(
+                        {
+                            "path": str(item.path),
+                            "content_hash": item.content_hash,
+                            "executed": False,
+                        }
+                    )
+
+            receipt["verification"] = self._verify_written_content()
+            return receipt
+        finally:
+            self._release_lock()
+
+    def _verify_written_content(self) -> dict[str, VerificationStatus]:
+        verification: dict[str, VerificationStatus] = {}
+        for item in self._planned:
+            if not item.path.exists():
+                verification[str(item.path)] = "missing"
+                continue
+            content = item.path.read_text(encoding="utf-8")
+            actual_hash = hashlib.sha256(content.encode("utf-8")).hexdigest()
+            verification[str(item.path)] = "ok" if actual_hash == item.content_hash else "mismatch"
+        return verification
+
+    def _snapshot_backups(self) -> str:
+        backup_dir = self._new_backup_dir()
+        backup_dir.mkdir(parents=True, exist_ok=False)
+
+        index: dict[str, str | None] = {}
+        planned_paths: list[str] = []
+        for idx, item in enumerate(self._planned):
+            path_str = str(item.path)
+            planned_paths.append(path_str)
+            if not item.path.exists():
+                index[path_str] = None
+                continue
+            backup_name = f"{idx:04d}.bak"
+            backup_path = backup_dir / backup_name
+            original = item.path.read_text(encoding="utf-8")
+            _ATOMIC_WRITE_TEXT_SAFE(backup_path, original)
+            index[path_str] = backup_name
+
+        self._last_backup_path = str(backup_dir)
+        self._last_backup_index = index
+        self._last_planned_paths = planned_paths
+        return str(backup_dir)
+
+    def _new_backup_dir(self) -> Path:
+        self._backup_root.mkdir(parents=True, exist_ok=True)
+        stamp = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H-%M-%S.%fZ")
+        base = self._backup_root / f"{stamp}-{os.getpid()}"
+        if not base.exists():
+            return base
+        counter = 1
+        while True:
+            candidate = self._backup_root / f"{stamp}-{os.getpid()}-{counter}"
+            if not candidate.exists():
+                return candidate
+            counter += 1
+
+    def _acquire_lock(self) -> None:
+        self._lock_path.parent.mkdir(parents=True, exist_ok=True)
+        self._cleanup_stale_lock_if_needed()
+        try:
+            fd = os.open(str(self._lock_path), os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        except FileExistsError as exc:
+            raise ConfigTransactionError(
+                f"config transaction lock already held: {self._lock_path}"
+            ) from exc
+        try:
+            ts_ms = int(time.time() * 1000)
+            payload = f"{os.getpid()}\n{ts_ms}\n".encode("utf-8")
+            written = 0
+            while written < len(payload):
+                written += os.write(fd, payload[written:])
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        _FSYNC_DIR(self._lock_path.parent)
+
+    def _release_lock(self) -> None:
+        try:
+            self._lock_path.unlink(missing_ok=True)
+        except OSError:
+            return
+        _FSYNC_DIR(self._lock_path.parent)
+
+    def _cleanup_stale_lock_if_needed(self) -> None:
+        if not self._lock_path.exists():
+            return
+
+        try:
+            raw = self._lock_path.read_text(encoding="utf-8").splitlines()
+            pid = int(raw[0].strip()) if raw else -1
+            ts_ms = int(raw[1].strip()) if len(raw) > 1 else 0
+        except (OSError, ValueError):
+            try:
+                self._lock_path.unlink(missing_ok=True)
+                _FSYNC_DIR(self._lock_path.parent)
+            except OSError:
+                pass
+            return
+
+        age_ms = int(time.time() * 1000) - ts_ms
+        if age_ms <= self._stale_lock_ms:
+            return
+        if self._pid_is_alive(pid):
+            return
+
+        try:
+            self._lock_path.unlink(missing_ok=True)
+            _FSYNC_DIR(self._lock_path.parent)
+        except OSError:
+            pass
+
+    def _pid_is_alive(self, pid: int) -> bool:
+        if pid <= 0:
+            return False
+        try:
+            os.kill(pid, 0)
+        except ProcessLookupError:
+            return False
+        except PermissionError:
+            return True
+        except OSError:
+            return False
+        return True