@trac3er/oh-my-god 2.0.5 → 2.0.7

package/control_plane/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OMG Control Plane API
-  version: 2.0.5
+  version: 2.0.7
   description: Policy/trust/evidence/runtime/registry/lab endpoints for OMG v2, with deprecated v1 aliases for one release.
 servers:
   - url: https://api.omg.local
@@ -62,6 +62,12 @@ paths:
   /v2/security/check:
     post:
       summary: Run canonical OMG security check
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SecurityCheckInput'
       responses:
         '200':
           description: Security check result
@@ -190,6 +196,32 @@ components:
           type: integer
         verdict:
           type: string
+    SecurityCheckInput:
+      type: object
+      properties:
+        scope:
+          type: string
+          default: "."
+          description: Directory scope to scan
+        include_live_enrichment:
+          type: boolean
+          default: false
+          description: Whether to include live enrichment data
+        external_inputs:
+          type: array
+          nullable: true
+          items:
+            type: object
+          description: External input sources to include in provenance
+        waivers:
+          type: array
+          nullable: true
+          items:
+            oneOf:
+              - type: string
+              - type: object
+          description: Finding identifiers or waiver objects to suppress matched findings
+      additionalProperties: false
     SecurityCheckResult:
       type: object
       required: [schema, status, scope, findings, summary, provenance, trust_scores]

package/control_plane/server.py

@@ -106,14 +106,38 @@ def run_server(host: str = "127.0.0.1", port: int = 8787, project_dir: str | Non
         server.server_close()
 
 
+_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
+
+
 def _main() -> int:
     parser = argparse.ArgumentParser(description="Run OMG control-plane API server")
     parser.add_argument("--host", default="127.0.0.1")
     parser.add_argument("--port", type=int, default=8787)
     parser.add_argument("--project-dir", default=None)
+    parser.add_argument(
+        "--unsafe", action="store_true",
+        help="Allow binding to non-loopback addresses (no auth; use at own risk)",
+    )
+    parser.add_argument(
+        "--dev", action="store_true",
+        help="Development mode — implies --unsafe for non-loopback binding",
+    )
     args = parser.parse_args()
-    if args.host != "127.0.0.1":
-        print(f"⚠ WARNING: Binding to {args.host} exposes the control plane to the network. No authentication is configured.", file=sys.stderr)
+
+    if args.host not in _LOOPBACK_HOSTS:
+        if not (args.unsafe or args.dev):
+            print(
+                f"ERROR: Binding to '{args.host}' exposes the control plane to the network.\n"
+                "No authentication is configured. This is blocked by default.\n"
+                "Pass --unsafe or --dev to override.",
+                file=sys.stderr,
+            )
+            return 1
+        print(
+            f"⚠ WARNING: Binding to {args.host} with {'--unsafe' if args.unsafe else '--dev'} flag. "
+            "No authentication is configured.",
+            file=sys.stderr,
+        )
 
     run_server(args.host, args.port, args.project_dir)
     return 0

package/control_plane/service.py

@@ -113,10 +113,47 @@ class ControlPlaneService:
     def security_check(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
         scope = str(payload.get("scope", "."))
         include_live_enrichment = bool(payload.get("include_live_enrichment", False))
+        external_inputs = payload.get("external_inputs")
+        waivers = payload.get("waivers")
+        
+        # Normalize external_inputs: must be list of dicts or None
+        if external_inputs is not None:
+            if not isinstance(external_inputs, list):
+                return 400, {
+                    "status": "error",
+                    "error_code": "INVALID_EXTERNAL_INPUTS",
+                    "message": "external_inputs must be a list of objects or null",
+                }
+            # Validate each item is a dict
+            for item in external_inputs:
+                if not isinstance(item, dict):
+                    return 400, {
+                        "status": "error",
+                        "error_code": "INVALID_EXTERNAL_INPUTS",
+                        "message": "each item in external_inputs must be an object",
+                    }
+
+        if waivers is not None:
+            if not isinstance(waivers, list):
+                return 400, {
+                    "status": "error",
+                    "error_code": "INVALID_WAIVERS",
+                    "message": "waivers must be a list of finding identifiers or objects",
+                }
+            for item in waivers:
+                if not isinstance(item, (str, dict)):
+                    return 400, {
+                        "status": "error",
+                        "error_code": "INVALID_WAIVERS",
+                        "message": "each waiver must be a string or object",
+                    }
+
         result = run_security_check(
             project_dir=self.project_dir,
             scope=scope,
             include_live_enrichment=include_live_enrichment,
+            external_inputs=external_inputs,
+            waivers=waivers,
         )
         return 200, result
 

package/dist/enterprise/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -1,5 +1,52 @@
-# OMG Codex Protection Rules
+# OMG Codex Governance (channel: enterprise)
 
-- Channel: `enterprise`
-- Protect `.omg/`, `.agents/`, `.codex/`, and `.claude/` from unreviewed mutation.
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel enterprise
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
+
+- Rules: `protected_paths, explicit_invocation`
+- Automations: `contract-compile, release-readiness`
 - Require explicit invocation for production-control-plane skills.

package/dist/enterprise/bundle/.agents/skills/omg/codex-rules.md

@@ -0,0 +1,29 @@
+# OMG Codex Rules (channel: enterprise)
+
+## Defaults
+
+- `cached_web_search: prefer_cached`
+- `live_network: deny_by_default`
+- `destructive_approval: required`
+
+## Protected Paths
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Approval Matrix
+
+| Action | Approval Required |
+|--------|------------------|
+| Read / Grep | No |
+| Write to protected paths | Yes |
+| Bash (python3:*) | Yes (balanced+ tier) |
+| git push --force | Yes |
+| Production deploy | Yes |

package/dist/enterprise/bundle/.claude-plugin/marketplace.json

@@ -5,16 +5,16 @@
     "name": "trac3er00"
   },
   "metadata": {
-    "description": "OMG - Oh-My-God for Claude Code",
-    "version": "2.0.5",
+    "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
+    "version": "2.0.7",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
   "plugins": [
     {
       "name": "omg",
-      "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
-      "version": "2.0.5",
+      "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
+      "version": "2.0.7",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.0.5"
+  "version": "2.0.7"
 }

package/dist/enterprise/bundle/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/dist/enterprise/bundle/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.0.5
+version: 2.0.7
 canonical_hosts:
   - claude
   - codex

package/dist/enterprise/bundle/plugins/advanced/commands/OMG:code-review.md

@@ -0,0 +1,114 @@
+---
+description: Deep code review — reads file completely, checks line-by-line for issues, then analyzes whole-file structure. Enforces code hygiene.
+allowed-tools: Read, Bash(cat:*), Bash(grep:*), Bash(wc:*), Bash(head:*), Bash(find:*), Bash(rg:*), Grep, Glob
+argument-hint: "[file path or 'recent' for git-changed files]"
+---
+
+# /OMG:code-review — Line-by-Line + Structural Review
+
+## Philosophy
+Two passes: LINE-BY-LINE precision, then WHOLE-FILE understanding.
+Don't just scan — READ and UNDERSTAND every line.
+
+## Step 1: Determine Scope
+
+- If file specified: review that file
+- If "recent" or no argument: review uncommitted changes
+  ```bash
+  git diff --name-only HEAD 2>/dev/null
+  git diff --cached --name-only 2>/dev/null
+  ```
+
+## Step 2: Read the FULL File First
+
+Read the ENTIRE file. Not just the changed part. Not just a function.
+Understanding comes from seeing the whole context.
+
+Note:
+- What does this file DO? (its purpose in the system)
+- What are its DEPENDENCIES? (imports, calls)
+- What does it EXPORT? (public API)
+
+## Step 3: Line-by-Line Scan
+
+For each line, check:
+
+**Correctness:**
+- Logic errors (off-by-one, null checks, type mismatches)
+- Missing error handling (unhandled promises, bare except, no null check)
+- Race conditions (shared state, async without await, unchecked concurrent access)
+
+**Security (if auth/payment/database):**
+- Hardcoded secrets → CRITICAL
+- SQL injection (string concatenation in queries) → CRITICAL
+- XSS (innerHTML, dangerouslySetInnerHTML) → HIGH
+- Missing input validation → MEDIUM
+- Overly permissive CORS/cookies → MEDIUM
+
+**Hygiene:**
+- Dead code (unused imports, variables, unreachable branches)
+- Noise comments ("increment i", "return result", "constructor")
+- console.log/print left in production code
+- TODO/FIXME/HACK without tracking
+- Overly complex functions (>40 lines → suggest extract)
+- Duplicated logic (same pattern in 2+ places → suggest DRY)
+
+## Step 4: Whole-File Structure Analysis
+
+After line-by-line:
+- Does the file do ONE thing well, or is it a dumping ground?
+- Are functions ordered logically? (public first, helpers after, or lifecycle order)
+- Is naming consistent? (camelCase throughout? PascalCase for classes?)
+- Does it follow the project's domain pattern? (check .omg/knowledge/domain-patterns/)
+- Any circular dependencies?
+- Is error handling consistent across all functions?
+
+## Step 5: Report
+
+```
+Code Review — [file]
+━━━━━━━━━━━━━━━━━━━━
+
+Structure: [CLEAN | NEEDS_WORK | MESSY]
+Security:  [SAFE | REVIEW_NEEDED | CRITICAL]
+Hygiene:   [CLEAN | NEEDS_CLEANUP]
+
+Issues:
+  [line:col] CRITICAL: [description]
+  [line:col] HIGH: [description]
+  [line:col] MEDIUM: [description]
+  [line:col] LOW: [description]
+
+Dead Code:
+  [line] unused import: [name]
+  [line] unreachable after return
+
+Noise Comments (remove these):
+  [line] "// increment counter"
+  [line] "// return the value"
+
+Structural:
+  - [function] is [N] lines — consider extracting [suggestion]
+  - [pattern] duplicated at lines [X] and [Y]
+
+Recommendation: [summary of what to fix, in priority order]
+```
+
+## Step 6: For Security-Critical Files
+
+If the file touches auth, payment, or database:
+```
+/OMG:escalate codex "Line-by-line security review of [file]. Check:
+1. Every input validation point
+2. Every database query for injection
+3. Every auth check for bypass
+4. Every secret reference for hardcoding
+Report: line numbers + severity + fix suggestion"
+```
+
+## Anti-patterns
+- DON'T skim and say "looks good" — read every line
+- DON'T only check the diff — read the full file for context
+- DON'T ignore test files — they can have real issues too
+- DON'T add more noise comments as "fixes" — remove them instead
+- DON'T suggest unnecessary code as improvements

package/dist/enterprise/bundle/plugins/advanced/commands/OMG:deep-plan.md

@@ -0,0 +1,221 @@
+---
+description: Deep strategic planning — understands user direction, asks smart questions, creates comprehensive plan with domain awareness
+allowed-tools: Read, Write, Edit, MultiEdit, Bash(find:*), Bash(cat:*), Bash(git:*), Bash(wc:*), Bash(tree:*), Bash(mkdir:*), Bash(tee:*), Grep, Glob
+argument-hint: "[feature or goal to plan]"
+---
+
+# /OMG:deep-plan — Strategic Planning with Direction Understanding
+
+## Philosophy
+Regular planning = "what steps to take."
+Deep planning = "understand WHY the user wants this, WHAT direction they're heading, and HOW it fits the bigger picture."
+
+## Step 1: Direction Discovery (MANDATORY)
+
+Do not assume goals, constraints, or context. Extract direction from:
+- user prompt
+- `.omg/state/handoff.md`
+- `.omg/state/ledger/failure-tracker.json`
+- current repo structure and patterns
+
+Before planning anything, understand:
+1. **User's real goal** — Often the stated request is one step toward something bigger. Ask: "What's the end state you're imagining?"
+2. **User's constraints** — Time, budget, existing code, team preferences, tech stack decisions already made.
+3. **User's domain knowledge** — Are they expert in this domain (follow their lead) or exploring (guide them)?
+4. **What they've already tried** — Check .omg/state/handoff.md, failure-tracker.json, git log.
+
+If direction is still ambiguous after repo exploration, ask only minimal focused questions.
+
+Examples of BAD questions: "What framework do you want?" "What's your deadline?"
+Examples of GOOD questions:
+- "I see you have a Stripe integration started in /src/payment/. Are you building on that, or replacing it?"
+- "Your auth uses JWT in cookies. Should the new feature respect that pattern, or are you migrating to sessions?"
+- "The DB schema has 3 user types. Does this feature apply to all of them or just one?"
+
+## Step 2: Map the Domain
+
+Read the codebase to understand the CURRENT state:
+```bash
+# Directory structure
+find . -type f -name "*.ts" -o -name "*.py" -o -name "*.go" | head -50
+
+# Key architectural patterns
+grep -rn "export class\|export function\|def \|func \|struct " src/ --include="*.{ts,py,go}" | head -30
+
+# Existing domain boundaries
+ls -la src/*/  # or app/*/ or packages/*/
+
+# Data flow
+grep -rn "import.*from\|require(" src/ --include="*.{ts,js}" | head -20
+```
+
+If DDD reference patterns exist (see .omg/knowledge/ or existing domain modules):
+- Read the reference domain FIRST
+- Plan the new feature to MATCH the pattern
+- Note any intentional deviations with WHY
+
+## Step 3: Create the Deep Plan
+
+Use Bash heredoc to write `.omg/state/_plan.md` (and `.omg/idea.yml`). Do NOT use the `Write` tool — it requires a prior Read which is unnecessary for fresh plan creation:
+
+```markdown
+# Deep Plan: [Feature Name]
+Created: [date]
+CHANGE_BUDGET=[small|medium|large]
+
+## Direction
+[1-2 sentences: what the user is building toward, not just this task]
+
+## Domain Context
+Reference pattern: [file/module that sets the pattern]
+Bounded contexts affected: [list]
+Key interfaces: [list the interfaces/types this touches]
+
+## Architecture Decisions
+- [Decision]: [chosen approach] because [reason]
+  Alternatives considered: [what was rejected and why]
+
+## Implementation Plan
+
+### Phase 1: Foundation [N files, ~M lines]
+1. [ ] [specific action] — [file] — [what and why]
+2. [ ] [specific action] — [file]
+
+### Phase 2: Core Logic [N files, ~M lines]
+3. [ ] [specific action]
+4. [ ] [specific action]
+
+### Phase 3: Integration + Security [N files, ~M lines]
+5. [ ] [specific action]
+6. [ ] Security review: /OMG:security-check [affected files]
+
+### Phase 4: Verification
+7. [ ] Tests: [what to test, how]
+8. [ ] Edge cases: [list]
+9. [ ] Manual verification: [steps]
+
+## Risk Map
+- [Risk]: [mitigation]
+- [Risk]: [mitigation]
+
+## What NOT to Do
+- [Anti-pattern specific to this feature]
+- [Approach that looks tempting but will fail because...]
+
+## Files to Read Before Starting
+1. [file] — [why: contains the reference pattern]
+2. [file] — [why: defines the interface this must implement]
+```
+
+## Step 4: Present and Iterate
+
+Show the plan to the user. Ask:
+- "Does this match the direction you're thinking?"
+- "Anything I'm missing about your goals?"
+- "Should I adjust the scope or priority?"
+
+Update the plan based on feedback BEFORE starting implementation.
+
+## Step 4.5: Codex Plan Validation (MANDATORY)
+
+Before implementation, run a dedicated Codex validation pass on the final plan.
+
+Checklist for Codex validation:
+- ordering and dependency correctness
+- hidden edge cases and rollback gaps
+- security/performance blind spots
+- missing verification steps
+
+Only after applying those corrections, continue to execution.
+
+## Step 4.6: Multi-Agent Bootstrap (MANDATORY)
+
+After validation, launch exactly 5 planning tracks with mixed-model intent using OMG-native routing (same planning discipline as OMG):
+
+1. Architect track (Claude)
+2. Backend track (GPT/Codex)
+3. Frontend track (Gemini)
+4. Security track (GPT/Codex)
+5. Verification track (Claude)
+
+Dispatch pattern is mandatory: all 5 tracks launch in parallel as background sub-agents.
+
+```python
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Architect planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Backend planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Frontend planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Security planning track", prompt="...")
+task(subagent_type="explore", run_in_background=true, load_skills=[], description="Verification planning track", prompt="...")
+```
+
+Collection and merge protocol:
+- collect every track using `background_output(task_id="...")`
+- run a `sequential-thinking` merge pass to resolve conflicts and ordering
+- emit one final executable checklist only after the merge pass
+
+Each track must return:
+- concrete plan steps
+- risk notes
+- verification commands
+
+Then merge outputs into a single execution checklist before implementation.
+
+## Step 5: Generate Checklist
+
+Convert the plan into `.omg/state/_checklist.md` with concrete steps.
+Each step should be completable in ONE tool interaction (not "implement the feature").
+
+## Step 5.5: Business Workflow Contract (MANDATORY)
+
+Deep-plan owns the business-style delivery workflow and task-plan contract.
+
+Always generate a normalized workflow path and task plan directly from user instructions:
+
+- canonical stages: `plan -> implement -> qa -> simulate -> final_test -> production`
+- accepted user path keys: `workflow`, `path`, `delivery_path`, `workflow_path`
+- accepted stage aliases:
+  - `planning -> plan`
+  - `implementation|build -> implement`
+  - `quality|quality_assurance -> qa`
+  - `testing|test -> final_test`
+  - `prod|deploy -> production`
+
+Rules:
+1. If user provides a partial path, keep user order and append missing canonical stages.
+2. If user provides no path, use the full canonical path.
+3. Build tasks from:
+   - `user_instructions[]` (source of truth for requested workflow)
+   - `constraints[]` (delivery boundaries)
+   - `acceptance[]` (final test criteria)
+4. Include stage readiness for production handoff:
+   - `production=ready` only when QA/simulation/final_test gates pass.
+
+Persist this contract into planning artifacts:
+- `.omg/state/_plan.md` (human-readable plan)
+- `.omg/state/_checklist.md` (atomic execution items)
+- include structured task metadata in the plan output (`stage`, `title`, `detail`, `source`).
+
+## Integration with DDD
+
+If this is a new domain:
+1. Ask the user to write (or help write) the first domain reference
+2. Extract the pattern: naming convention, data flow, error handling style
+3. Document the pattern in .omg/knowledge/domain-patterns/[name].md
+4. Use the pattern for ALL subsequent domains
+
+## Idea-as-Code Contract (required)
+
+Before leaving planning, ensure `.omg/idea.yml` exists with:
+- `goal`
+- `constraints[]`
+- `acceptance[]`
+- `risk.security[]|risk.performance[]|risk.compatibility[]`
+- `evidence_required.tests[]|security_scans[]|reproducibility[]`
+
+If missing, scaffold from template and fill from the conversation.
+
+## Anti-patterns
+- Don't plan in your head and dump a wall of text — INTERACT with the user
+- Don't make architecture decisions without checking existing patterns
+- Don't create a plan with vague steps like "implement feature" — be specific
+- Don't skip the Direction step — it's the difference between useful and useless