@trac3er/oh-my-god 2.0.5 → 2.0.8

package/control_plane/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: OMG Control Plane API
-  version: 2.0.5
+  version: 2.0.8
   description: Policy/trust/evidence/runtime/registry/lab endpoints for OMG v2, with deprecated v1 aliases for one release.
 servers:
   - url: https://api.omg.local
@@ -62,6 +62,12 @@ paths:
   /v2/security/check:
     post:
       summary: Run canonical OMG security check
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SecurityCheckInput'
       responses:
         '200':
           description: Security check result
@@ -190,6 +196,32 @@ components:
           type: integer
         verdict:
           type: string
+    SecurityCheckInput:
+      type: object
+      properties:
+        scope:
+          type: string
+          default: "."
+          description: Directory scope to scan
+        include_live_enrichment:
+          type: boolean
+          default: false
+          description: Whether to include live enrichment data
+        external_inputs:
+          type: array
+          nullable: true
+          items:
+            type: object
+          description: External input sources to include in provenance
+        waivers:
+          type: array
+          nullable: true
+          items:
+            oneOf:
+              - type: string
+              - type: object
+          description: Finding identifiers or waiver objects to suppress matched findings
+      additionalProperties: false
     SecurityCheckResult:
       type: object
       required: [schema, status, scope, findings, summary, provenance, trust_scores]

package/control_plane/server.py

@@ -106,14 +106,38 @@ def run_server(host: str = "127.0.0.1", port: int = 8787, project_dir: str | Non
         server.server_close()
 
 
+_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
+
+
 def _main() -> int:
     parser = argparse.ArgumentParser(description="Run OMG control-plane API server")
     parser.add_argument("--host", default="127.0.0.1")
     parser.add_argument("--port", type=int, default=8787)
     parser.add_argument("--project-dir", default=None)
+    parser.add_argument(
+        "--unsafe", action="store_true",
+        help="Allow binding to non-loopback addresses (no auth; use at own risk)",
+    )
+    parser.add_argument(
+        "--dev", action="store_true",
+        help="Development mode — implies --unsafe for non-loopback binding",
+    )
     args = parser.parse_args()
-    if args.host != "127.0.0.1":
-        print(f"⚠ WARNING: Binding to {args.host} exposes the control plane to the network. No authentication is configured.", file=sys.stderr)
+
+    if args.host not in _LOOPBACK_HOSTS:
+        if not (args.unsafe or args.dev):
+            print(
+                f"ERROR: Binding to '{args.host}' exposes the control plane to the network.\n"
+                "No authentication is configured. This is blocked by default.\n"
+                "Pass --unsafe or --dev to override.",
+                file=sys.stderr,
+            )
+            return 1
+        print(
+            f"⚠ WARNING: Binding to {args.host} with {'--unsafe' if args.unsafe else '--dev'} flag. "
+            "No authentication is configured.",
+            file=sys.stderr,
+        )
 
     run_server(args.host, args.port, args.project_dir)
     return 0

package/control_plane/service.py

@@ -113,10 +113,47 @@ class ControlPlaneService:
     def security_check(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
         scope = str(payload.get("scope", "."))
         include_live_enrichment = bool(payload.get("include_live_enrichment", False))
+        external_inputs = payload.get("external_inputs")
+        waivers = payload.get("waivers")
+        
+        # Normalize external_inputs: must be list of dicts or None
+        if external_inputs is not None:
+            if not isinstance(external_inputs, list):
+                return 400, {
+                    "status": "error",
+                    "error_code": "INVALID_EXTERNAL_INPUTS",
+                    "message": "external_inputs must be a list of objects or null",
+                }
+            # Validate each item is a dict
+            for item in external_inputs:
+                if not isinstance(item, dict):
+                    return 400, {
+                        "status": "error",
+                        "error_code": "INVALID_EXTERNAL_INPUTS",
+                        "message": "each item in external_inputs must be an object",
+                    }
+
+        if waivers is not None:
+            if not isinstance(waivers, list):
+                return 400, {
+                    "status": "error",
+                    "error_code": "INVALID_WAIVERS",
+                    "message": "waivers must be a list of finding identifiers or objects",
+                }
+            for item in waivers:
+                if not isinstance(item, (str, dict)):
+                    return 400, {
+                        "status": "error",
+                        "error_code": "INVALID_WAIVERS",
+                        "message": "each waiver must be a string or object",
+                    }
+
         result = run_security_check(
             project_dir=self.project_dir,
             scope=scope,
             include_live_enrichment=include_live_enrichment,
+            external_inputs=external_inputs,
+            waivers=waivers,
         )
         return 200, result
 

package/dist/enterprise/bundle/.agents/skills/omg/AGENTS.fragment.md

@@ -1,5 +1,58 @@
-# OMG Codex Protection Rules
+# OMG Codex Governance (channel: enterprise)
 
-- Channel: `enterprise`
-- Protect `.omg/`, `.agents/`, `.codex/`, and `.claude/` from unreviewed mutation.
-- Require explicit invocation for production-control-plane skills.
+## Build & Test
+
+```bash
+python3 -m pytest tests -q
+python3 scripts/omg.py contract validate
+python3 scripts/omg.py contract compile --host codex --channel enterprise
+```
+
+## Protected Paths
+
+The following paths require tier-gated review before mutation:
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Evidence Contract
+
+Every production action must emit evidence containing these fields:
+
+- `executor`
+- `lineage`
+- `timestamp`
+- `trace_id`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+Council planning skills are protected and explicit-invocation only:
+
+- `omg/plan-council`
+
+## Web Search Policy
+
+- Prefer cached results over live network requests.
+- Do NOT initiate live web searches unless explicitly instructed.
+- Use `context7` or local documentation before external lookups.
+- Set `cached_web_search: prefer_cached` as the default.
+
+## Approval Constraints
+
+- Destructive file operations require explicit user approval.
+- `git push --force` and branch deletions require explicit approval.
+- Production deployments require explicit approval.
+- Mutations to protected paths require tier-gated approval.
+
+## Rules & Automations
+
+- Rules: `protected_paths, explicit_invocation`
+- Automations: `contract-compile, release-readiness`
+- Require explicit invocation for protected production planning skills.

package/dist/enterprise/bundle/.agents/skills/omg/claim-judge/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-claim-judge
+description: "Evidence-backed claim validator for structured release and completion claims."
+---
+
+# OMG Claim Judge
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/claim-judge-*.json`

package/dist/enterprise/bundle/.agents/skills/omg/claim-judge/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-claim-judge
+description: "Evidence-backed claim validator for structured release and completion claims."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: claim-judge
+  title: "OMG Claim Judge"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/codex-rules.md

@@ -0,0 +1,33 @@
+# OMG Codex Rules (channel: enterprise)
+
+## Defaults
+
+- `cached_web_search: prefer_cached`
+- `live_network: deny_by_default`
+- `destructive_approval: required`
+
+## Protected Paths
+
+- `.omg/**`
+- `.agents/**`
+- `.codex/**`
+- `.claude/**`
+
+## Required Skills
+
+- `omg/control-plane`
+- `omg/mcp-fabric`
+
+## Protected Planning Surface
+
+- `omg/plan-council` (explicit invocation only)
+
+## Approval Matrix
+
+| Action | Approval Required |
+|--------|------------------|
+| Read / Grep | No |
+| Write to protected paths | Yes |
+| Bash (python3:*) | Yes (balanced+ tier) |
+| git push --force | Yes |
+| Production deploy | Yes |

package/dist/enterprise/bundle/.agents/skills/omg/plan-council/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-plan-council
+description: "Canonical council-style planning bundle for explicit, evidence-backed deep plans."
+---
+
+# OMG Plan Council
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/plans/deep-plan.md, .omg/plans/deep-plan.json, .omg/plans/dissent.json, .omg/evidence/plan-council.json`

package/dist/enterprise/bundle/.agents/skills/omg/plan-council/openai.yaml

@@ -0,0 +1,12 @@
+name: omg-plan-council
+description: "Canonical council-style planning bundle for explicit, evidence-backed deep plans."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: plan-council
+  title: "OMG Plan Council"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"

package/dist/enterprise/bundle/.agents/skills/omg/proof-gate/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-proof-gate
+description: "Structured release proof gate that binds claims to required evidence artifacts and trace links."
+---
+
+# OMG Proof Gate
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/proof-gate-*.json`

package/dist/enterprise/bundle/.agents/skills/omg/proof-gate/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-proof-gate
+description: "Structured release proof gate that binds claims to required evidence artifacts and trace links."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: proof-gate
+  title: "OMG Proof Gate"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.agents/skills/omg/test-intent-lock/SKILL.md

@@ -0,0 +1,11 @@
+---
+name: omg-test-intent-lock
+description: "Structured test-delta guard that blocks weakened tests unless explicit override evidence is present."
+---
+
+# OMG Test Intent Lock
+
+- Channel: `enterprise`
+- Execution modes: `embedded, local_supervisor`
+- MCP servers: `omg-control`
+- Evidence outputs: `.omg/evidence/test-intent-lock-*.json`

package/dist/enterprise/bundle/.agents/skills/omg/test-intent-lock/openai.yaml

@@ -0,0 +1,13 @@
+name: omg-test-intent-lock
+description: "Structured test-delta guard that blocks weakened tests unless explicit override evidence is present."
+allow_implicit_invocation: false
+metadata:
+  channel: enterprise
+  bundle_id: test-intent-lock
+  title: "OMG Test Intent Lock"
+mcp_servers:
+  - omg-control
+allowed_tools:
+  - "Read"
+  - "Grep"
+  - "Bash(python3:*)"

package/dist/enterprise/bundle/.claude-plugin/marketplace.json

@@ -5,16 +5,16 @@
     "name": "trac3er00"
   },
   "metadata": {
-    "description": "OMG - Oh-My-God for Claude Code",
-    "version": "2.0.5",
+    "description": "OMG - Oh-My-God for Claude Code and supported agent hosts",
+    "version": "2.0.8",
     "homepage": "https://github.com/trac3er00/OMG",
     "repository": "https://github.com/trac3er00/OMG"
   },
   "plugins": [
     {
       "name": "omg",
-      "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
-      "version": "2.0.5",
+      "description": "OMG plugin layer for Claude Code and supported agent hosts with native setup, orchestration, and interop.",
+      "version": "2.0.8",
       "source": "./",
       "author": {
         "name": "trac3er00"
@@ -32,5 +32,5 @@
       ]
     }
   ],
-  "version": "2.0.5"
+  "version": "2.0.8"
 }

package/dist/enterprise/bundle/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg",
-  "version": "2.0.5",
+  "version": "2.0.8",
   "description": "OMG plugin layer for Claude Code with native setup, orchestration, and interop.",
   "author": {
     "name": "trac3er00"

package/dist/enterprise/bundle/.mcp.json

@@ -1,11 +1,5 @@
 {
   "mcpServers": {
-    "context7": {
-      "command": "npx",
-      "args": [
-        "@upstash/context7-mcp@2.1.3"
-      ]
-    },
     "filesystem": {
       "command": "npx",
       "args": [
@@ -13,22 +7,6 @@
         "."
       ]
     },
-    "websearch": {
-      "command": "npx",
-      "args": [
-        "@zhafron/mcp-web-search@1.2.2"
-      ]
-    },
-    "chrome-devtools": {
-      "command": "npx",
-      "args": [
-        "chrome-devtools-mcp@0.19.0"
-      ]
-    },
-    "omg-memory": {
-      "type": "http",
-      "url": "http://127.0.0.1:8765/mcp"
-    },
     "omg-control": {
       "command": "python3",
       "args": [

package/dist/enterprise/bundle/OMG_COMPAT_CONTRACT.md

@@ -1,6 +1,6 @@
 ---
 title: OMG Production Control Plane
-version: 2.0.5
+version: 2.0.8
 canonical_hosts:
   - claude
   - codex
@@ -11,6 +11,13 @@ status: active
 
 `OMG_COMPAT_CONTRACT.md` is the normative human-readable contract for OMG capability bundles. Machine-readable manifests in `registry/bundles/` are executable inputs and must remain version-locked to this document.
 
+## provider_tiers
+
+OMG distinguishes between canonical hosts and compatibility providers.
+
+- **Canonical Hosts**: `claude` and `codex`. These are the primary targets for bundle compilation, native hook integration, and production-grade state management.
+- **Compatibility Providers**: `gemini` and `kimi`. These are supported via routing providers that emulate host behavior and bridge MCP configurations. They are not targets for direct bundle compilation or normative contract enforcement.
+
 ## metadata
 
 Every bundle must declare `id`, `kind`, `version`, `title`, `description`, `hosts`, and `assets`.

package/dist/enterprise/bundle/plugins/advanced/commands/OMG:code-review.md

@@ -0,0 +1,114 @@
+---
+description: Deep code review — reads file completely, checks line-by-line for issues, then analyzes whole-file structure. Enforces code hygiene.
+allowed-tools: Read, Bash(cat:*), Bash(grep:*), Bash(wc:*), Bash(head:*), Bash(find:*), Bash(rg:*), Grep, Glob
+argument-hint: "[file path or 'recent' for git-changed files]"
+---
+
+# /OMG:code-review — Line-by-Line + Structural Review
+
+## Philosophy
+Two passes: LINE-BY-LINE precision, then WHOLE-FILE understanding.
+Don't just scan — READ and UNDERSTAND every line.
+
+## Step 1: Determine Scope
+
+- If file specified: review that file
+- If "recent" or no argument: review uncommitted changes
+  ```bash
+  git diff --name-only HEAD 2>/dev/null
+  git diff --cached --name-only 2>/dev/null
+  ```
+
+## Step 2: Read the FULL File First
+
+Read the ENTIRE file. Not just the changed part. Not just a function.
+Understanding comes from seeing the whole context.
+
+Note:
+- What does this file DO? (its purpose in the system)
+- What are its DEPENDENCIES? (imports, calls)
+- What does it EXPORT? (public API)
+
+## Step 3: Line-by-Line Scan
+
+For each line, check:
+
+**Correctness:**
+- Logic errors (off-by-one, null checks, type mismatches)
+- Missing error handling (unhandled promises, bare except, no null check)
+- Race conditions (shared state, async without await, unchecked concurrent access)
+
+**Security (if auth/payment/database):**
+- Hardcoded secrets → CRITICAL
+- SQL injection (string concatenation in queries) → CRITICAL
+- XSS (innerHTML, dangerouslySetInnerHTML) → HIGH
+- Missing input validation → MEDIUM
+- Overly permissive CORS/cookies → MEDIUM
+
+**Hygiene:**
+- Dead code (unused imports, variables, unreachable branches)
+- Noise comments ("increment i", "return result", "constructor")
+- console.log/print left in production code
+- TODO/FIXME/HACK without tracking
+- Overly complex functions (>40 lines → suggest extract)
+- Duplicated logic (same pattern in 2+ places → suggest DRY)
+
+## Step 4: Whole-File Structure Analysis
+
+After line-by-line:
+- Does the file do ONE thing well, or is it a dumping ground?
+- Are functions ordered logically? (public first, helpers after, or lifecycle order)
+- Is naming consistent? (camelCase throughout? PascalCase for classes?)
+- Does it follow the project's domain pattern? (check .omg/knowledge/domain-patterns/)
+- Any circular dependencies?
+- Is error handling consistent across all functions?
+
+## Step 5: Report
+
+```
+Code Review — [file]
+━━━━━━━━━━━━━━━━━━━━
+
+Structure: [CLEAN | NEEDS_WORK | MESSY]
+Security:  [SAFE | REVIEW_NEEDED | CRITICAL]
+Hygiene:   [CLEAN | NEEDS_CLEANUP]
+
+Issues:
+  [line:col] CRITICAL: [description]
+  [line:col] HIGH: [description]
+  [line:col] MEDIUM: [description]
+  [line:col] LOW: [description]
+
+Dead Code:
+  [line] unused import: [name]
+  [line] unreachable after return
+
+Noise Comments (remove these):
+  [line] "// increment counter"
+  [line] "// return the value"
+
+Structural:
+  - [function] is [N] lines — consider extracting [suggestion]
+  - [pattern] duplicated at lines [X] and [Y]
+
+Recommendation: [summary of what to fix, in priority order]
+```
+
+## Step 6: For Security-Critical Files
+
+If the file touches auth, payment, or database:
+```
+/OMG:escalate codex "Line-by-line security review of [file]. Check:
+1. Every input validation point
+2. Every database query for injection
+3. Every auth check for bypass
+4. Every secret reference for hardcoding
+Report: line numbers + severity + fix suggestion"
+```
+
+## Anti-patterns
+- DON'T skim and say "looks good" — read every line
+- DON'T only check the diff — read the full file for context
+- DON'T ignore test files — they can have real issues too
+- DON'T add more noise comments as "fixes" — remove them instead
+- DON'T suggest unnecessary code as improvements