@trac3er/oh-my-god 2.1.7 → 2.1.9

package/build/lib/runtime/tool_plan_gate.py

@@ -9,6 +9,8 @@ from uuid import uuid4
 import json
 
 from runtime.context_engine import ContextEngine
+from runtime.compliance_governor import evaluate_tool_compliance
+from runtime.complexity_scorer import score_complexity
 from runtime.release_run_coordinator import resolve_current_run_id as resolve_coordinator_run_id
 from runtime.runtime_contracts import read_run_state
 
@@ -20,20 +22,6 @@ _TOOL_KEYWORDS: dict[str, tuple[str, ...]] = {
     "omg-control": ("policy", "governance", "release", "proof", "control plane"),
 }
 
-_READ_ONLY_TOOL_HINTS = (
-    "read",
-    "search",
-    "review",
-    "grep",
-    "glob",
-    "list",
-    "ls",
-    "context7",
-    "websearch",
-)
-_MUTATION_TOOLS = frozenset({"write", "edit", "multiedit", "bash"})
-
-
 def build_tool_plan(
     goal: str,
     available_tools: list[str],
@@ -50,14 +38,13 @@ def build_tool_plan(
     )
     council = _read_council_verdicts(str(_project_dir()), canonical_run_id)
 
-    project_dir = _project_dir()
     selected_tools: list[dict[str, object]] = []
     for tool_name in normalized_tools:
         if _is_tool_needed(tool_name, normalized_goal):
             selected_tools.append(
                 {
                     "name": tool_name,
-                    "args": _default_args(tool_name, normalized_goal, bounded_context, project_dir=project_dir),
+                    "args": _default_args(tool_name, normalized_goal, bounded_context),
                     "rationale": _rationale(tool_name),
                 }
             )
@@ -67,13 +54,20 @@ def build_tool_plan(
         selected_tools.append(
             {
                 "name": fallback,
-                "args": _default_args(fallback, normalized_goal, bounded_context, project_dir=project_dir),
+                "args": _default_args(fallback, normalized_goal, bounded_context),
                 "rationale": "fallback: no explicit keyword match; keep single minimal tool",
             }
         )
 
     selected_tools = _apply_context_optimization(selected_tools, bounded_context, council)
     plan_id = _new_plan_id(run_id=canonical_run_id)
+    _governance: dict[str, object] = {}
+    try:
+        governance_raw = score_complexity(normalized_goal).get("governance")
+        if isinstance(governance_raw, Mapping):
+            _governance = {str(key): value for key, value in governance_raw.items()}
+    except Exception:
+        pass
     payload: dict[str, object] = {
         "plan_id": plan_id,
         "goal": normalized_goal,
@@ -84,11 +78,12 @@ def build_tool_plan(
             "goal_complexity": _goal_complexity(normalized_goal),
         },
         "context_packet": bounded_context,
+        "governance_payload": _governance,
         "council_verdicts": council.get("verdicts", {}),
         "run_id": canonical_run_id,
         "created_at": datetime.now(timezone.utc).isoformat(),
     }
-    _persist_plan(project_dir, plan_id, payload)
+    _persist_plan(_project_dir(), plan_id, payload)
     return payload
 
 
@@ -117,43 +112,21 @@ def tool_plan_gate_check(project_dir: str, run_id: str | None, tool: str) -> dic
         fallback_context=None,
     )
     clarification = _clarification_status(context_packet)
-    if clarification["requires_clarification"]:
-        reason = _clarification_reason(str(clarification["clarification_prompt"]))
-        if _is_mutation_capable_tool(tool):
-            _persist_gate_error(project_dir, run_id, tool, reason)
-            return {
-                "status": "blocked",
-                "reason": reason,
-                "run_id": run_id,
-                "tool": tool,
-                "clarification_status": clarification,
-            }
-        if _is_read_search_review_tool(tool):
-            return {
-                "status": "allowed",
-                "reason": "clarification pending; read/search/review tool allowed",
-                "run_id": run_id,
-                "clarification_status": clarification,
-            }
-
-    if has_tool_plan_for_run(project_dir, run_id):
-        council = _read_council_verdicts(project_dir, run_id)
-        verdict = _council_gate_verdict(council)
-        if verdict["blocked"]:
-            reason = str(verdict["reason"])
-            _persist_gate_error(project_dir, run_id, tool, reason)
-            return {
-                "status": "blocked",
-                "reason": reason,
-                "run_id": run_id,
-                "tool": tool,
-                "council_verdicts": council.get("verdicts", {}),
-            }
-        return {"status": "allowed", "reason": "tool plan present", "run_id": run_id}
-
-    reason = "tool plan required before mutation-capable MCP evaluation"
-    _persist_gate_error(project_dir, run_id, tool, reason)
-    return {"status": "blocked", "reason": reason, "run_id": run_id, "tool": tool}
+    decision = evaluate_tool_compliance(
+        project_dir=project_dir,
+        run_id=run_id,
+        tool=tool,
+        has_tool_plan=has_tool_plan_for_run(project_dir, run_id),
+        clarification_status=clarification,
+    )
+    reason = str(decision.get("reason", ""))
+    if decision.get("status") == "blocked":
+        _persist_gate_error(project_dir, run_id, tool, reason)
+    return {
+        **decision,
+        "run_id": run_id,
+        "tool": tool,
+    }
 
 
 def _normalize_tools(available_tools: list[str]) -> list[str]:
@@ -175,15 +148,7 @@ def _is_tool_needed(tool_name: str, goal: str) -> bool:
     return any(token in lowered_goal for token in keywords)
 
 
-def _default_args(
-    tool_name: str,
-    goal: str,
-    context_packet: dict[str, object] | None,
-    *,
-    project_dir: Path,
-) -> dict[str, object]:
-    token = tool_name.strip().lower()
-
+def _default_args(tool_name: str, goal: str, context_packet: dict[str, object] | None) -> dict[str, object]:
     if tool_name == "context7":
         return {"query": goal}
     if tool_name == "websearch":
@@ -193,23 +158,6 @@ def _default_args(
     if tool_name == "omg-control":
         return {"query": goal}
 
-    if token in {"todowrite", "proxy_todowrite"}:
-        content = goal.strip()[:120] or "Track current task"
-        return {
-            "todos": [
-                {
-                    "content": content,
-                    "status": "in_progress",
-                    "priority": "medium",
-                }
-            ]
-        }
-    if token in {"read", "proxy_read"}:
-        default_target = project_dir / "README.md"
-        if not default_target.exists():
-            default_target = project_dir
-        return {"filePath": str(default_target)}
-
     context_hint = ""
     if isinstance(context_packet, dict):
         context_hint = str(context_packet.get("summary", ""))[:120]
@@ -230,12 +178,10 @@ def _estimate_context_chars(context_packet: dict[str, object] | None) -> int:
 
 
 def _goal_complexity(goal: str) -> str:
-    length = len(goal.split())
-    if length >= 25:
-        return "high"
-    if length >= 10:
-        return "medium"
-    return "low"
+    category = str(score_complexity(goal).get("category", "low"))
+    if category == "trivial":
+        return "low"
+    return category
 
 
 def _new_plan_id(run_id: str | None) -> str:
@@ -246,8 +192,8 @@ def _new_plan_id(run_id: str | None) -> str:
 
 def _project_dir(project_dir: str | None = None) -> Path:
     if project_dir:
-        return Path(project_dir).resolve()
-    return Path(os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())).resolve()
+        return Path(project_dir)
+    return Path(os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd()))
 
 
 def _persist_plan(project_dir: Path, plan_id: str, payload: dict[str, object]) -> None:
@@ -336,23 +282,6 @@ def _read_council_verdicts(project_dir: str, run_id: str | None) -> dict[str, ob
     return {}
 
 
-def _council_gate_verdict(council: dict[str, object]) -> dict[str, object]:
-    verdicts = council.get("verdicts")
-    if not isinstance(verdicts, dict):
-        return {"blocked": False, "reason": ""}
-
-    for critic_name, critic_payload in verdicts.items():
-        if not isinstance(critic_payload, dict):
-            continue
-        token = str(critic_payload.get("verdict", "")).strip().lower()
-        if token == "fail":
-            return {
-                "blocked": True,
-                "reason": f"council critic '{critic_name}' failed; block mutation-capable tool execution",
-            }
-    return {"blocked": False, "reason": ""}
-
-
 def _apply_context_optimization(
     tools: list[dict[str, object]],
     context_packet: dict[str, object],
@@ -405,24 +334,3 @@ def _clarification_status(context_packet: dict[str, object]) -> dict[str, object
         "clarification_prompt": prompt,
         "confidence": round(max(0.0, min(1.0, confidence)), 2),
     }
-
-
-def _clarification_reason(clarification_prompt: str) -> str:
-    prompt = " ".join(str(clarification_prompt or "").split())
-    if prompt:
-        return f"Clarification required before mutation: {prompt}"
-    return "Clarification required before mutation: provide the missing intent details."
-
-
-def _is_mutation_capable_tool(tool: str) -> bool:
-    token = str(tool or "").strip().lower()
-    if token in _MUTATION_TOOLS:
-        return True
-    return token.startswith("bash:")
-
-
-def _is_read_search_review_tool(tool: str) -> bool:
-    token = str(tool or "").strip().lower()
-    if not token:
-        return False
-    return any(hint in token for hint in _READ_ONLY_TOOL_HINTS)

package/build/lib/runtime/untrusted_content.py

@@ -164,6 +164,31 @@ def write_trust_evidence(inputs: list[dict[str, Any]], output_dir: str | Path) -
     return evidence_path.as_posix()
 
 
+def write_sandbox_budget_evidence(
+    *,
+    project_dir: str | Path,
+    run_id: str,
+    budget: dict[str, Any],
+    isolation: dict[str, Any],
+) -> str:
+    tagged = tag_content(
+        {
+            "source_type": "workspace",
+            "source_ref": f"forge:{run_id}",
+            "content": {
+                "run_id": run_id,
+                "budget": budget,
+                "isolation": isolation,
+            },
+        },
+        TrustTier.BALANCED,
+    )
+    return write_trust_evidence(
+        [tagged],
+        output_dir=Path(project_dir) / EVIDENCE_REL_DIR,
+    )
+
+
 def mark_untrusted_content(
     project_dir: str,
     *,

package/build/lib/runtime/validate.py

@@ -15,7 +15,7 @@ from runtime.adoption import CANONICAL_VERSION
 from runtime.compat import run_doctor, _doctor_check
 from runtime.contract_compiler import validate_contract_registry
 from runtime.plugin_diagnostics import run_plugin_diagnostics
-from runtime.profile_io import load_profile, ensure_governed_preferences
+from runtime.profile_io import load_profile, ensure_governed_preferences, assess_profile_risk
 
 
 def _check_contract_registry(root_dir: Path) -> dict[str, Any]:
@@ -81,9 +81,13 @@ def _check_profile_governor(root_dir: Path) -> dict[str, Any]:
         if isinstance(e, dict) and e.get("confirmation_state") == "pending_confirmation"
     )
 
+    risk = assess_profile_risk(profile)
+    risk_level = str(risk.get("risk_level", "low"))
+
     parts = [f"{len(style_entries)} style, {len(safety_entries)} safety"]
     if pending:
         parts.append(f"{pending} pending confirmation")
+    parts.append(f"risk={risk_level}")
 
     return _doctor_check(
         "profile_governor",

package/build/lib/runtime/vision_artifacts.py

@@ -0,0 +1,31 @@
+"""Artifact writers for vision runtime jobs."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+
+def write_vision_artifacts(
+    project_dir: str,
+    job: dict[str, Any],
+    deterministic_results: list[dict[str, Any]],
+) -> dict[str, Any]:
+    artifacts_dir = Path(project_dir) / ".omg" / "vision"
+    artifacts_dir.mkdir(parents=True, exist_ok=True)
+
+    artifact_path = artifacts_dir / f"{job['job_id']}.json"
+    payload = {
+        "schema": "VisionJobArtifact",
+        "job": job,
+        "results": deterministic_results,
+    }
+    artifact_path.write_text(json.dumps(payload, indent=2, sort_keys=True), encoding="utf-8")
+
+    return {
+        "artifact_path": str(artifact_path.relative_to(project_dir)),
+        "compare_count": sum(1 for item in deterministic_results if item.get("operation") == "compare"),
+        "ocr_count": sum(1 for item in deterministic_results if item.get("operation") == "ocr"),
+        "result_count": len(deterministic_results),
+    }

package/build/lib/runtime/vision_cache.py

@@ -0,0 +1,38 @@
+"""Content-addressed cache helpers for vision jobs."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from typing import Any
+
+
+def _cache_dir(project_dir: str) -> Path:
+    path = Path(project_dir) / ".omg" / "cache" / "vision"
+    path.mkdir(parents=True, exist_ok=True)
+    return path
+
+
+def build_cache_key(mode: str, inputs: list[str]) -> str:
+    digest = hashlib.sha256()
+    digest.update(mode.encode("utf-8"))
+    for input_path in sorted(inputs):
+        digest.update(input_path.encode("utf-8"))
+        with open(input_path, "rb") as handle:
+            for chunk in iter(lambda: handle.read(65536), b""):
+                digest.update(chunk)
+    return digest.hexdigest()
+
+
+def load_cached_result(project_dir: str, cache_key: str) -> dict[str, Any] | None:
+    cache_path = _cache_dir(project_dir) / f"{cache_key}.json"
+    if not cache_path.exists():
+        return None
+    return json.loads(cache_path.read_text(encoding="utf-8"))
+
+
+def store_cached_result(project_dir: str, cache_key: str, payload: dict[str, Any]) -> str:
+    cache_path = _cache_dir(project_dir) / f"{cache_key}.json"
+    cache_path.write_text(json.dumps(payload, indent=2, sort_keys=True), encoding="utf-8")
+    return str(cache_path)

package/build/lib/runtime/vision_jobs.py

@@ -0,0 +1,89 @@
+"""Runtime orchestration for vision jobs."""
+
+from __future__ import annotations
+
+import hashlib
+import itertools
+from pathlib import Path
+from typing import Any
+
+from omg_natives.image import image
+
+from runtime.vision_artifacts import write_vision_artifacts
+from runtime.vision_cache import build_cache_key, load_cached_result, store_cached_result
+
+
+VALID_VISION_MODES = frozenset({"ocr", "compare", "analyze", "batch", "eval"})
+IMPLEMENTED_VISION_MODES = frozenset({"ocr", "compare"})
+
+
+def _resolve_inputs(project_dir: str, inputs: list[str]) -> list[str]:
+    return [str((Path(project_dir) / item).resolve()) for item in inputs]
+
+
+def _job_id(mode: str, inputs: list[str]) -> str:
+    digest = hashlib.sha256()
+    digest.update(mode.encode("utf-8"))
+    for item in inputs:
+        digest.update(item.encode("utf-8"))
+    return f"vision-{digest.hexdigest()[:12]}"
+
+
+def normalize_vision_payload(project_dir: str, payload: dict[str, Any]) -> dict[str, Any]:
+    mode = str(payload.get("mode", "")).strip()
+    raw_inputs = payload.get("inputs")
+    if mode not in VALID_VISION_MODES:
+        raise ValueError(f"unsupported vision mode: {mode}")
+    if mode not in IMPLEMENTED_VISION_MODES:
+        raise ValueError(f"vision mode is not implemented yet: {mode}")
+    if not isinstance(raw_inputs, list) or not raw_inputs or not all(isinstance(item, str) and item.strip() for item in raw_inputs):
+        raise ValueError("inputs must be a non-empty list of file paths")
+    if mode == "compare" and len(raw_inputs) < 2:
+        raise ValueError("compare mode requires at least two input files")
+
+    resolved_inputs = _resolve_inputs(project_dir, raw_inputs)
+    for input_path in resolved_inputs:
+        if not Path(input_path).exists():
+            raise ValueError(f"missing vision input: {input_path}")
+
+    return {
+        "job_id": _job_id(mode, resolved_inputs),
+        "mode": mode,
+        "inputs": resolved_inputs,
+    }
+
+
+def expand_pairs(job: dict[str, Any]) -> list[tuple[str, str]]:
+    if job["mode"] != "compare":
+        return []
+    return list(itertools.combinations(job["inputs"], 2))
+
+
+def run_vision_job(project_dir: str, payload: dict[str, Any]) -> dict[str, Any]:
+    job = normalize_vision_payload(project_dir, payload)
+    cache_key = build_cache_key(job["mode"], job["inputs"])
+    cached = load_cached_result(project_dir, cache_key)
+    if cached is not None:
+        cached["cached"] = True
+        return cached
+
+    if job["mode"] == "compare":
+        deterministic_results = [
+            image(left_path, "compare", other_path=right_path)
+            for left_path, right_path in expand_pairs(job)
+        ]
+    elif job["mode"] == "ocr":
+        deterministic_results = [image(input_path, "ocr") for input_path in job["inputs"]]
+    else:
+        deterministic_results = []
+
+    artifacts = write_vision_artifacts(project_dir, job, deterministic_results)
+    result = {
+        "status": "ok",
+        "job": job,
+        "results": deterministic_results,
+        "artifacts": artifacts,
+        "cached": False,
+    }
+    store_cached_result(project_dir, cache_key, result)
+    return result

package/commands/OMG:health-check.md

@@ -24,7 +24,10 @@ Run all checks silently, report only issues:
 
 5. **Tools**: Hooks installed? OMG team aliases available? MCP servers listed?
    - Check ~/.claude/hooks/.omg-version exists.
-   - Check if `~/.claude/commands/OMG:teams.md` and `OMG:ccg.md` exist (WARN if missing, not FAIL).
+   - Check if Claude sees OMG through plugin-managed skills/surfaces rather than legacy `~/.claude/commands/` files:
+     - `~/.claude/plugins/known_marketplaces.json` contains `omg`
+     - `~/.claude/plugins/cache/omg/omg/<version>/.claude-plugin/plugin.json` exists
+     - WARN if only legacy command files exist without the plugin-managed surface
    - List MCP servers from .mcp.json (informational).
 
 6. **Failures**: Stale failure patterns in failure-tracker.json?

package/commands/OMG:preset.md

@@ -0,0 +1,49 @@
+---
+description: "Inspect or apply the canonical OMG preset for the current project."
+allowed-tools: Read, Write, Edit, Bash(python*:*), Bash(ls:*), Bash(grep:*)
+argument-hint: "[safe|balanced|interop|labs|buffet|plugins-first]"
+---
+
+# /OMG:preset
+
+Inspect or apply the canonical OMG preset for the current project.
+
+## Usage
+
+```text
+/OMG:preset
+/OMG:preset safe
+/OMG:preset balanced
+/OMG:preset interop
+/OMG:preset labs
+/OMG:preset buffet
+/OMG:preset plugins-first
+```
+
+## Presets
+
+- `safe`: minimum managed OMG surface
+- `balanced`: safe defaults plus extra productivity MCPs
+- `interop`: coexistence and shared-memory oriented setup
+- `labs`: enables experimental and browser-heavy surfaces
+- `buffet`: full preset; enables every managed preset flag
+- `plugins-first`: compatibility alias for `interop`
+
+## Behavior
+
+When a preset is supplied:
+
+1. Resolve the requested preset through `runtime.adoption.resolve_preset`.
+2. Persist the canonical preset via `hooks.setup_wizard.set_preferences(...)`.
+3. Update project preset metadata in `.omg/state/cli-config.yaml` and project `settings.json` when present.
+4. Report the resolved preset, enabled features, and selected MCP defaults.
+
+When no preset is supplied:
+
+1. Read the current project preset from `.omg/state/cli-config.yaml` or project `settings.json`.
+2. Report the resolved preset and its managed feature flags.
+
+## Notes
+
+- `buffet` is the top-tier preset and should be treated as a superset of `labs`.
+- If the host install also needs updating, rerun `/OMG:setup` with the same preset so the host-level command and MCP surfaces stay aligned.

package/commands/OMG:setup.md

@@ -1,7 +1,7 @@
 ---
 description: "Native OMG setup and adoption flow for supported hosts"
 allowed-tools: Read, Write, Edit, Bash(python*:*), Bash(ls:*), Bash(grep:*)
-argument-hint: "[optional: --non-interactive, --mode omg-only|coexist, --preset safe|balanced|interop|labs|plugins-first]"
+argument-hint: "[optional: --non-interactive, --mode omg-only|coexist, --preset safe|balanced|interop|labs|buffet|plugins-first]"
 ---
 
 # /OMG:setup
@@ -43,6 +43,7 @@ Step 4: Choose preset
   - balanced
   - interop
   - labs
+  - buffet
   - plugins-first (alias for interop)
 
 Step 5: Configure MCP and persist preferences

package/commands/OMG:validate.md

@@ -36,7 +36,7 @@ python3 scripts/omg.py validate --format json
       "required": true | false
     }
   ],
-  "version": "2.1.7"
+  "version": "2.1.9"
 }
 ```
 

package/control_plane/openapi.yaml

@@ -29,6 +29,23 @@ paths:
       responses:
         '200':
           description: Decision result
+  /v2/vision/jobs:
+    post:
+      summary: Submit a vision analysis job
+      responses:
+        '202':
+          description: Accepted
+        '400':
+          description: Invalid vision payload
+  /v1/vision/jobs:
+    post:
+      deprecated: true
+      summary: Deprecated alias of /v2/vision/jobs
+      responses:
+        '202':
+          description: Accepted
+        '400':
+          description: Invalid vision payload
   /v2/trust/review:
     post:
       summary: Review trust-sensitive config changes

package/control_plane/server.py

@@ -36,6 +36,8 @@ def _read_json(handler: BaseHTTPRequestHandler) -> dict[str, Any]:
 _POST_ROUTE_TABLE = {
     "/v2/policy/evaluate": ("policy_evaluate", False),
     "/v1/policy/evaluate": ("policy_evaluate", True),
+    "/v2/vision/jobs": ("vision_jobs", False),
+    "/v1/vision/jobs": ("vision_jobs", True),
     "/v2/trust/review": ("trust_review", False),
     "/v1/trust/review": ("trust_review", True),
     "/v2/evidence/ingest": ("evidence_ingest", False),

package/control_plane/service.py

@@ -30,6 +30,46 @@ class ControlPlaneService:
     def __init__(self, project_dir: str | None = None):
         self.project_dir = project_dir or os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
 
+    def vision_jobs(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+        if not isinstance(payload, dict):
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_VISION_INPUT",
+                "message": "vision job payload must be an object",
+            }
+
+        mode = str(payload.get("mode", "")).strip()
+        inputs = payload.get("inputs")
+        valid_modes = {"ocr", "compare", "analyze", "batch", "eval"}
+
+        if mode not in valid_modes:
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_VISION_INPUT",
+                "message": f"mode must be one of: {', '.join(sorted(valid_modes))}",
+            }
+        if not isinstance(inputs, list) or not inputs or not all(isinstance(item, str) and item.strip() for item in inputs):
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_VISION_INPUT",
+                "message": "inputs must be a non-empty list of file paths",
+            }
+
+        missing = [item for item in inputs if not (Path(self.project_dir) / item).exists()]
+        if missing:
+            return 400, {
+                "status": "error",
+                "error_code": "INVALID_VISION_INPUT",
+                "message": f"input paths do not exist: {', '.join(missing)}",
+            }
+
+        return 202, {
+            "status": "accepted",
+            "job_type": "vision",
+            "mode": mode,
+            "input_count": len(inputs),
+        }
+
     def policy_evaluate(self, payload: dict[str, Any]) -> tuple[int, dict[str, Any]]:
         tool = str(payload.get("tool", ""))
         input_data = payload.get("input", {})