@agentikos/omega-os 0.2.0 → 0.19.6

package/README.md

@@ -64,12 +64,30 @@ Full reference + lifecycle table: [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)
 
 ## Install
 
+**This package is private** — `npm login` to the `agentikos` org first.
+The GitHub repo is private as well; clone with credentials.
+
 One command on a fresh VPS (Ubuntu) or workstation (macOS):
 
 ```bash
-npx @agentikos/omega-os                  # interactive
+npm login                                # if you haven't already
+npx @agentikos/omega-os                  # interactive — installs for $USER
+```
+
+The installer is **modular about which user owns Omega OS** — three modes
+([details](docs/INSTALL.md#3-user-modes--who-omega-os-runs-as)):
+
+```bash
+npx @agentikos/omega-os                            # mode 1: current user (default)
+npx @agentikos/omega-os --user agentik             # mode 2: adopt an existing user
+sudo npx @agentikos/omega-os --create-user         # mode 3: create a new user (default name: omega)
+sudo npx @agentikos/omega-os --create-user agentik # mode 3 with a custom name
 ```
 
+Default new-user name is **`omega`** — neutral, matches `~omega/Omega/`,
+never collides with stock Linux accounts. Linux-only; on macOS just run as
+yourself.
+
 Headless (CI / scripted provisioning):
 
 ```bash
@@ -100,6 +118,7 @@ Details: [`docs/INSTALL.md`](docs/INSTALL.md).
 | [`docs/AUTONOMOUS-AGENTS.md`](docs/AUTONOMOUS-AGENTS.md) | Long-running autonomous agents as first-class nodes |
 | [`docs/MCP-AND-PLUGINS.md`](docs/MCP-AND-PLUGINS.md) | MCP servers & Claude Code plugins — catalog, placement, install |
 | [`docs/ACCOUNT-AND-BILLING.md`](docs/ACCOUNT-AND-BILLING.md) | Claude Max account pool, login flow, per-account billing |
+| [`docs/AUDITS.md`](docs/AUDITS.md) | The Quality Arsenal — 18 forensic audits as data, per-domain evidence |
 | [`docs/INSTALL.md`](docs/INSTALL.md) | Install guide — profiles, manifest, troubleshooting |
 
 ## Status
@@ -130,8 +149,19 @@ pool** (OAuth + encrypted vault) and the live `omega billing` aggregation work
 end to end. The **installer** (`step_mcp`) really installs MCP servers from the
 catalog and `omega sync` projects the SSOT to Claude Code's native layout.
 
-**81 tests across 13 files, all green** — end-to-end mission, live PDF, forensic
-gate, autonomous supervisor, multi-RAG, account vault, snapshot + PARTIAL.
+The **graphify integration** is wired in: `uv tool install graphifyy` (the
+installer does this), then `omega graph <path> --rag` runs the codebase
+through graphify and merges the resulting node + edge graph into Graph RAG
+so the multi-RAG router can answer relational queries about the code. The
+**Claude Code plugin layer** is now a first-class install step
+(`45-claude-plugins`): a separate SSOT catalog
+(`Agentik_SSOT/claude-plugins/claude-plugins.yaml`) drives marketplace
+registration + `claude plugin install` per selected plugin, interactively
+or from the manifest.
+
+**87 tests across 14 files, all green** — end-to-end mission, live PDF,
+forensic gate, autonomous supervisor, multi-RAG, account vault, snapshot +
+PARTIAL, graphify integration.
 
 ---
 

package/bootstrap/lib/claude-code-settings.py

@@ -0,0 +1,176 @@
+#!/usr/bin/env python3
+"""Merge OmegaOS-driven settings into ~/.claude/settings.json.
+
+Called by ``step_claude_code_settings`` in ``bootstrap/lib/steps.sh``.
+Reads ``claude_code_settings:`` from the install manifest and updates the
+Claude Code global settings file safely:
+
+  * **Backup first** — the existing file is copied to ``settings.json.bak``
+    so the operator can roll back.
+  * **Merge, don't replace** — only the keys we own are touched; user
+    customisations elsewhere stay.
+  * **Idempotent** — re-running produces the same final file.
+
+The three settings we manage:
+
+  * ``env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS`` — Agent Teams flag.
+  * ``permissions.defaultMode`` — set to ``bypassPermissions`` when the
+    manifest says so.
+  * ``hooks.Stop`` — when ``audit_gate: true``, add a hook that calls
+    ``omega audit gate`` to block "I'm done" claims that fail the audit.
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+
+_AUDIT_GATE_HOOK_TAG = "omega-audit-gate"   # marker so we can update in place
+
+
+def _load_json(path: Path) -> dict[str, Any]:
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text())
+    except json.JSONDecodeError:
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _ensure_dict(parent: dict[str, Any], key: str) -> dict[str, Any]:
+    if not isinstance(parent.get(key), dict):
+        parent[key] = {}
+    return parent[key]
+
+
+def _ensure_list(parent: dict[str, Any], key: str) -> list[Any]:
+    if not isinstance(parent.get(key), list):
+        parent[key] = []
+    return parent[key]
+
+
+def _stop_hook_entry(omega_home: str) -> dict[str, Any]:
+    """The Stop-hook entry we write into settings.json."""
+    bin_path = f"{omega_home}/Agentik_Tools/bin/omega"
+    return {
+        "matcher": "*",
+        "tag": _AUDIT_GATE_HOOK_TAG,
+        "hooks": [
+            {
+                "type": "command",
+                "command": bin_path,
+                "args": ["audit", "gate"],
+                "timeout": 30,
+            },
+        ],
+    }
+
+
+def _strip_existing_audit_gate(stop_entries: list[Any]) -> list[Any]:
+    """Drop any prior audit-gate entry so re-runs are idempotent."""
+    out = []
+    for entry in stop_entries:
+        if isinstance(entry, dict) and entry.get("tag") == _AUDIT_GATE_HOOK_TAG:
+            continue
+        # Also strip any entry that points at `omega audit gate` even if
+        # the operator removed our tag manually — keep the file clean.
+        hooks = (entry.get("hooks") if isinstance(entry, dict) else None) or []
+        if any(
+            isinstance(h, dict) and h.get("command", "").endswith("/omega")
+            and "gate" in (h.get("args") or [])
+            for h in hooks
+        ):
+            continue
+        out.append(entry)
+    return out
+
+
+def apply_settings(
+    manifest_path: str | Path, *,
+    omega_home: str | Path,
+    settings_path: str | Path | None = None,
+) -> dict[str, Any]:
+    """Merge ``claude_code_settings:`` into ~/.claude/settings.json.
+
+    Returns a summary dict (for the shell side to print).
+    """
+    home = Path(omega_home)
+    settings_file = (
+        Path(settings_path) if settings_path
+        else Path.home() / ".claude" / "settings.json"
+    )
+
+    cfg: dict[str, Any] = {}
+    mp = Path(manifest_path)
+    if mp.exists():
+        data = yaml.safe_load(mp.read_text()) or {}
+        cfg = (data.get("claude_code_settings") or {}) if isinstance(data, dict) else {}
+
+    agent_teams = bool(cfg.get("experimental_agent_teams", True))
+    bypass = bool(cfg.get("bypass_permissions", True))
+    audit_gate = bool(cfg.get("audit_gate", True))
+
+    settings_file.parent.mkdir(parents=True, exist_ok=True)
+    if settings_file.exists():
+        backup = settings_file.with_suffix(".json.bak")
+        try:
+            shutil.copy(settings_file, backup)
+        except OSError:
+            pass
+
+    settings = _load_json(settings_file)
+
+    # 1. Agent Teams env var.
+    env_block = _ensure_dict(settings, "env")
+    if agent_teams:
+        env_block["CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS"] = "1"
+    else:
+        env_block.pop("CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS", None)
+
+    # 2. Permissions default mode.
+    perms = _ensure_dict(settings, "permissions")
+    if bypass:
+        perms["defaultMode"] = "bypassPermissions"
+    elif perms.get("defaultMode") == "bypassPermissions":
+        # We previously set it; revert to "default" so the per-tool dialog returns.
+        perms["defaultMode"] = "default"
+
+    # 3. Stop hook.
+    hooks = _ensure_dict(settings, "hooks")
+    stop_entries = _ensure_list(hooks, "Stop")
+    stop_entries = _strip_existing_audit_gate(stop_entries)
+    if audit_gate:
+        stop_entries.append(_stop_hook_entry(str(home)))
+    hooks["Stop"] = stop_entries
+
+    settings_file.write_text(json.dumps(settings, indent=2) + "\n")
+
+    return {
+        "path": str(settings_file),
+        "agent_teams": agent_teams,
+        "bypass_permissions": bypass,
+        "audit_gate": audit_gate,
+    }
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) < 3:
+        print("usage: claude-code-settings.py <manifest> <omega_home>")
+        return 2
+    result = apply_settings(argv[1], omega_home=argv[2])
+    print(f"  settings: {result['path']}")
+    print(f"  agent_teams={result['agent_teams']}  "
+          f"bypass_permissions={result['bypass_permissions']}  "
+          f"audit_gate={result['audit_gate']}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))