@trac3er/oh-my-god 2.0.7 → 2.0.9

package/build/lib/hooks/shadow_manager.py

@@ -6,6 +6,7 @@ Maintains overlay-style shadow writes and evidence artifacts.
 from __future__ import annotations
 
 import hashlib
+import importlib
 import json
 import os
 import platform
@@ -18,8 +19,15 @@ from typing import Any
 HOOKS_DIR = os.path.dirname(__file__)
 if HOOKS_DIR not in sys.path:
     sys.path.insert(0, HOOKS_DIR)
-from _common import _resolve_project_dir
-from security_validators import ensure_path_within_dir, validate_opaque_identifier
+try:
+    from hooks._common import _resolve_project_dir
+    from hooks.security_validators import ensure_path_within_dir, validate_opaque_identifier
+except ImportError:
+    _common = importlib.import_module("_common")
+    security_validators = importlib.import_module("security_validators")
+    _resolve_project_dir = _common._resolve_project_dir
+    ensure_path_within_dir = security_validators.ensure_path_within_dir
+    validate_opaque_identifier = security_validators.validate_opaque_identifier
 
 
 def _project_dir() -> str:
@@ -189,6 +197,11 @@ def create_evidence_pack(
     lineage: dict[str, Any] | None = None,
     executor: dict[str, Any] | None = None,
     environment: dict[str, Any] | None = None,
+    artifacts: list[dict[str, Any]] | None = None,
+    claims: list[dict[str, Any]] | None = None,
+    test_delta: dict[str, Any] | None = None,
+    browser_evidence_path: str | None = None,
+    repro_pack_path: str | None = None,
 ) -> str:
     ensure_shadow_dirs(project_dir)
     run_id = _validated_run_id(run_id)
@@ -209,6 +222,7 @@ def create_evidence_pack(
     
     evidence = {
         "schema": "EvidencePack",
+        "schema_version": 2,
         "run_id": run_id,
         "created_at": _utc_now(),
         "tests": tests or [],
@@ -224,7 +238,16 @@ def create_evidence_pack(
         "lineage": lineage or {},
         "executor": executor,
         "environment": environment,
+        "artifacts": artifacts or [],
     }
+    if claims is not None:
+        evidence["claims"] = claims
+    if test_delta is not None:
+        evidence["test_delta"] = test_delta
+    if browser_evidence_path is not None:
+        evidence["browser_evidence_path"] = browser_evidence_path
+    if repro_pack_path is not None:
+        evidence["repro_pack_path"] = repro_pack_path
     evidence_path = ensure_path_within_dir(
         _evidence_root(project_dir),
         os.path.join(_evidence_root(project_dir), f"{run_id}.json"),

package/build/lib/hooks/state_migration.py

@@ -115,6 +115,9 @@ MIGRATION_MAP: list[tuple[str, str, str]] = [
     ("dir", "repl_sessions", "state/repl_sessions"),
     ("dir", "sessions", "state/sessions"),
     ("dir", "snapshots", "state/snapshots"),
+    ("file", "current_branch.json", "state/current_branch.json"),
+    ("file", "background-verification.json", "state/background-verification.json"),
+    ("dir", "branches", "state/branches"),
     ("dir", "knowledge", "knowledge"),
 ]
 

package/build/lib/plugins/README.md

@@ -28,7 +28,7 @@ OMG exposes a small native front door and keeps the rest of the surface availabl
 
 | Command | Category | Description |
 |---------|----------|-------------|
-| `/OMG:deep-plan` | Planning | Strategic planning with domain awareness (routes to `plan-council`) |
+| `/OMG:deep-plan` | Planning | Strategic planning with domain awareness (compatibility path to `plan-council`) |
 | `/OMG:learn` | Knowledge | Convert patterns into OMG-native instincts and skills |
 | `/OMG:code-review` | Quality | Deep review flow |
 | `/OMG:ship` | Delivery | Idea to evidence to release |

package/build/lib/plugins/advanced/commands/OMG:deep-plan.md

@@ -10,7 +10,8 @@ argument-hint: "[feature or goal to plan]"
 Regular planning = "what steps to take."
 Deep planning = "understand WHY the user wants this, WHAT direction they're heading, and HOW it fits the bigger picture."
 
-This command is the compatibility front door to the canonical `plan-council` bundle.
+This command is the public compatibility path to the canonical `plan-council` bundle.
+Users invoke `/OMG:deep-plan`; the runtime routes to `plan-council` for execution.
 
 ## Step 1: Direction Discovery (MANDATORY)
 

package/build/lib/plugins/advanced/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-advanced",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
   "type": "omg-plugin",
   "commands": {

package/build/lib/plugins/core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-core",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
   "type": "omg-plugin",
   "commands": {

package/build/lib/plugins/dephealth/cve_scanner.py

@@ -10,7 +10,11 @@ import urllib.request
 
 
 OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch"
+KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+EPSS_URL_TEMPLATE = "https://api.first.org/data/v1/epss?cve={cve_id}"
 CACHE_REL_PATH = Path(".omg") / "state" / "cve-cache.json"
+KEV_CACHE_REL_PATH = Path(".omg") / "state" / "kev-cache.json"
+EPSS_CACHE_REL_PATH = Path(".omg") / "state" / "epss-cache.json"
 CACHE_TTL_HOURS = 24
 
 
@@ -72,6 +76,93 @@ def scan_for_cves(dependency_list: list[dict[str, str]], project_dir: str = ".")
     return scan_result
 
 
+def enrich_with_kev(finding: dict[str, Any], cache_dir: str) -> dict[str, Any]:
+    result = dict(finding)
+    if not _dep_health_enabled():
+        result["kev_listed"] = False
+        return result
+
+    cve_id = str(finding.get("id", "")).strip()
+    if not cve_id:
+        result["kev_listed"] = False
+        return result
+
+    cache_path = Path(cache_dir) / KEV_CACHE_REL_PATH
+    cached = _load_cache(cache_path)
+
+    if cached and _is_cache_fresh(cached.get("fetched_at")):
+        result["kev_listed"] = cve_id in cached.get("cve_ids", [])
+        return result
+
+    try:
+        kev_data = _fetch_kev_catalog()
+        kev_ids = [v.get("cveID", "") for v in kev_data.get("vulnerabilities", [])]
+        _save_cache(cache_path, {
+            "fetched_at": datetime.now(timezone.utc).isoformat(),
+            "cve_ids": kev_ids,
+        })
+        result["kev_listed"] = cve_id in kev_ids
+    except (urllib.error.URLError, OSError, json.JSONDecodeError):
+        if cached:
+            result["kev_listed"] = cve_id in cached.get("cve_ids", [])
+        else:
+            result["kev_listed"] = False
+    return result
+
+
+def enrich_with_epss(finding: dict[str, Any], cache_dir: str) -> dict[str, Any]:
+    result = dict(finding)
+    if not _dep_health_enabled():
+        result["epss_score"] = None
+        return result
+
+    cve_id = str(finding.get("id", "")).strip()
+    if not cve_id:
+        result["epss_score"] = None
+        return result
+
+    cache_path = Path(cache_dir) / EPSS_CACHE_REL_PATH
+    cached = _load_cache(cache_path) or {}
+    entries = cached.get("entries", {})
+
+    entry = entries.get(cve_id)
+    if entry and _is_cache_fresh(entry.get("fetched_at")):
+        result["epss_score"] = entry.get("epss")
+        return result
+
+    try:
+        epss_data = _fetch_epss_score(cve_id)
+        data_list = epss_data.get("data", [])
+        score = float(data_list[0].get("epss", 0)) if data_list else None
+        entries[cve_id] = {
+            "epss": score,
+            "fetched_at": datetime.now(timezone.utc).isoformat(),
+        }
+        _save_cache(cache_path, {"entries": entries})
+        result["epss_score"] = score
+    except (urllib.error.URLError, OSError, json.JSONDecodeError, ValueError, TypeError):
+        if entry:
+            result["epss_score"] = entry.get("epss")
+        else:
+            result["epss_score"] = None
+    return result
+
+
+def _fetch_kev_catalog() -> dict[str, Any]:
+    request = urllib.request.Request(KEV_URL, headers={"Accept": "application/json"})
+    with urllib.request.urlopen(request, timeout=15) as response:
+        body = response.read().decode("utf-8")
+    return json.loads(body)
+
+
+def _fetch_epss_score(cve_id: str) -> dict[str, Any]:
+    url = EPSS_URL_TEMPLATE.format(cve_id=cve_id)
+    request = urllib.request.Request(url, headers={"Accept": "application/json"})
+    with urllib.request.urlopen(request, timeout=15) as response:
+        body = response.read().decode("utf-8")
+    return json.loads(body)
+
+
 def _query_osv_batch(dependency_list: list[dict[str, str]]) -> dict[str, Any]:
     payload = {
         "queries": [

package/build/lib/plugins/dephealth/vuln_analyzer.py

@@ -3,6 +3,8 @@ import re
 from pathlib import Path
 from typing import Any
 
+from plugins.dephealth.cve_scanner import enrich_with_kev, enrich_with_epss
+
 
 _CRITICAL_PATTERN = re.compile(r"\bcritical\b", re.IGNORECASE)
 _HIGH_PATTERN = re.compile(r"\bhigh\b", re.IGNORECASE)
@@ -33,6 +35,9 @@ def analyze_reachability(cve_result: dict[str, Any], project_dir: str) -> dict[s
     risk_level = _classify_risk(reachability, summary)
     recommendation = _build_recommendation(package, fixed_version, reachability)
 
+    kev_enriched = enrich_with_kev({"id": cve_id}, project_dir)
+    epss_enriched = enrich_with_epss({"id": cve_id}, project_dir)
+
     return {
         "package": package,
         "cve_id": cve_id,
@@ -40,6 +45,8 @@ def analyze_reachability(cve_result: dict[str, Any], project_dir: str) -> dict[s
         "import_locations": sorted(imported_files),
         "risk_level": risk_level,
         "recommendation": recommendation,
+        "kev_listed": kev_enriched.get("kev_listed", False),
+        "epss_score": epss_enriched.get("epss_score"),
     }
 
 

package/build/lib/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.0.7
+version: 2.0.8
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/build/lib/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.0.7
+version: 2.0.8
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/build/lib/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.0.7
+version: 2.0.8
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/build/lib/registry/bundles/control-plane.yaml

@@ -1,6 +1,6 @@
 id: control-plane
 kind: skill
-version: 2.0.7
+version: 2.0.8
 title: OMG Control Plane
 description: Canonical production control plane bundle for Claude and Codex.
 hosts:

package/build/lib/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.0.7
+version: 2.0.8
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/build/lib/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.0.7
+version: 2.0.8
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/build/lib/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.0.7
+version: 2.0.8
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/build/lib/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.0.7
+version: 2.0.8
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts:

package/build/lib/registry/bundles/hook-governor.yaml

@@ -1,6 +1,6 @@
 id: hook-governor
 kind: governance
-version: 2.0.7
+version: 2.0.8
 title: OMG Hook Governor
 description: Canonical hook ordering, policy reinjection, and protected-path governance.
 hosts:

package/build/lib/registry/bundles/incident-replay.yaml

@@ -1,6 +1,6 @@
 id: incident-replay
 kind: debugging
-version: 2.0.7
+version: 2.0.8
 title: OMG Incident Replay
 description: Replayable bug packs built from logs, failing tests, traces, and diffs.
 hosts:

package/build/lib/registry/bundles/lsp-pack.yaml

@@ -1,6 +1,6 @@
 id: lsp-pack
 kind: diagnostics
-version: 2.0.7
+version: 2.0.8
 title: OMG LSP Pack
 description: Optional LSP-backed diagnostics and navigation bundle for production verification.
 hosts:

package/build/lib/registry/bundles/mcp-fabric.yaml

@@ -1,6 +1,6 @@
 id: mcp-fabric
 kind: mcp
-version: 2.0.7
+version: 2.0.8
 title: OMG MCP Fabric
 description: Tools, prompts, resources, and server instructions for the OMG control plane.
 hosts:

package/build/lib/registry/bundles/plan-council.yaml

@@ -1,6 +1,6 @@
 id: plan-council
 kind: planning
-version: 2.0.7
+version: 2.0.8
 title: OMG Plan Council
 description: Canonical council-style planning bundle for explicit, evidence-backed deep plans.
 hosts:
@@ -8,7 +8,7 @@ hosts:
   - codex
 assets:
   references:
-    - commands/OMG:deep-plan.md
+    - plugins/advanced/commands/OMG:deep-plan.md
 invocation_policy:
   user_invocable: true
   model_invocable: false

package/build/lib/registry/bundles/preflight.yaml

@@ -1,6 +1,6 @@
 id: preflight
 kind: routing
-version: 2.0.7
+version: 2.0.8
 title: OMG Preflight
 description: Repo-aware route selection based on diff, manifests, and classified risk.
 hosts:

package/build/lib/registry/bundles/proof-gate.yaml

@@ -1,6 +1,6 @@
 id: proof-gate
 kind: proof
-version: 2.0.7
+version: 2.0.8
 title: OMG Proof Gate
 description: Structured release proof gate that binds claims to required evidence artifacts and trace links.
 hosts:

package/build/lib/registry/bundles/remote-supervisor.yaml

@@ -1,6 +1,6 @@
 id: remote-supervisor
 kind: orchestration
-version: 2.0.7
+version: 2.0.8
 title: OMG Remote Supervisor
 description: Local-only authenticated supervisor sessions for worker orchestration.
 hosts:

package/build/lib/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.0.7
+version: 2.0.8
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/build/lib/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.0.7
+version: 2.0.8
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/build/lib/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.0.7
+version: 2.0.8
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/build/lib/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.0.7
+version: 2.0.8
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/build/lib/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.0.7
+version: 2.0.8
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/build/lib/registry/bundles/vision.yaml

@@ -1,6 +1,6 @@
 id: vision
 kind: domain-pack
-version: 2.0.7
+version: 2.0.8
 title: OMG Vision Pack
 description: Vision-specific lineage, drift, and replay attachments.
 hosts:

package/build/lib/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "type": "object",
   "required": [
     "id",
@@ -43,7 +43,9 @@
         "type": "string",
         "enum": [
           "claude",
-          "codex"
+          "codex",
+          "gemini",
+          "kimi"
         ]
       },
       "minItems": 1
@@ -281,6 +283,86 @@
                 }
               },
               "additionalProperties": true
+            },
+            "gemini": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "mcp",
+                "skills",
+                "automations"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "mcp": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "automations": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
+            },
+            "kimi": {
+              "type": "object",
+              "required": [
+                "compilation_targets",
+                "mcp",
+                "skills",
+                "automations"
+              ],
+              "properties": {
+                "compilation_targets": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "mcp": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "skills": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "automations": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "additionalProperties": true
             }
           },
           "additionalProperties": true

package/build/lib/runtime/adoption.py

@@ -2,8 +2,8 @@
 from __future__ import annotations
 
 import json
+import importlib
 from pathlib import Path
-from typing import Any
 
 
 CANONICAL_BRAND = "OMG"
@@ -11,10 +11,12 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.0.7"
+CANONICAL_VERSION = "2.0.8"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 VALID_PRESETS = ("safe", "balanced", "interop", "labs")
+CANONICAL_MODE_NAMES = ("chill", "focused", "exploratory")
+"""Cross-surface user-facing mode names reserved for the shared mode system."""
 
 MANAGED_PRESET_FLAGS = (
     "SETUP",
@@ -91,6 +93,12 @@ def get_preset_features(preset: str | None) -> dict[str, bool]:
     return dict(PRESET_FEATURES[resolved])
 
 
+def get_mode_profile(mode: str) -> dict[str, object]:
+    runtime_profile = importlib.import_module("runtime.runtime_profile")
+    loader = getattr(runtime_profile, "load_canonical_mode_profile")
+    return loader(mode)
+
+
 def _resolve_claude_dir(base_dir: Path) -> Path:
     nested = base_dir / ".claude"
     if nested.exists():
@@ -180,7 +188,7 @@ def build_adoption_report(
     requested_mode: str | None = None,
     preset: str | None = None,
     adopt: str = "auto",
-) -> dict[str, Any]:
+) -> dict[str, object]:
     detected_ecosystems = detect_ecosystems(project_dir) if adopt == "auto" else []
     recommended_mode = recommend_mode(detected_ecosystems)
     selected_mode = requested_mode if requested_mode in VALID_ADOPTION_MODES else recommended_mode
@@ -204,9 +212,9 @@ def build_adoption_report(
     }
 
 
-def write_adoption_report(project_dir: str | Path, report: dict[str, Any]) -> str:
+def write_adoption_report(project_dir: str | Path, report: dict[str, object]) -> str:
     state_dir = Path(project_dir) / ".omg" / "state"
     state_dir.mkdir(parents=True, exist_ok=True)
     report_path = state_dir / "adoption-report.json"
-    report_path.write_text(json.dumps(report, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
+    _ = report_path.write_text(json.dumps(report, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
     return str(report_path)

package/build/lib/runtime/api_twin.py

@@ -353,15 +353,15 @@ def _state_path(project_dir: str) -> Path:
 def _load_state(project_dir: str) -> dict[str, Any]:
     path = _state_path(project_dir)
     if not path.exists():
-        return {"schema": "ApiTwinState", "version": "2.0.7", "contracts": {}, "fixtures": {}}
+        return {"schema": "ApiTwinState", "version": "2.0.8", "contracts": {}, "fixtures": {}}
     try:
         payload = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
-        return {"schema": "ApiTwinState", "version": "2.0.7", "contracts": {}, "fixtures": {}}
+        return {"schema": "ApiTwinState", "version": "2.0.8", "contracts": {}, "fixtures": {}}
     if not isinstance(payload, dict):
-        return {"schema": "ApiTwinState", "version": "2.0.7", "contracts": {}, "fixtures": {}}
+        return {"schema": "ApiTwinState", "version": "2.0.8", "contracts": {}, "fixtures": {}}
     payload.setdefault("schema", "ApiTwinState")
-    payload.setdefault("version", "2.0.7")
+    payload.setdefault("version", "2.0.8")
     payload.setdefault("contracts", {})
     payload.setdefault("fixtures", {})
     return payload