@trac3er/oh-my-god 2.1.7 → 2.1.9

package/runtime/vision_jobs.py

@@ -0,0 +1,89 @@
+"""Runtime orchestration for vision jobs."""
+
+from __future__ import annotations
+
+import hashlib
+import itertools
+from pathlib import Path
+from typing import Any
+
+from omg_natives.image import image
+
+from runtime.vision_artifacts import write_vision_artifacts
+from runtime.vision_cache import build_cache_key, load_cached_result, store_cached_result
+
+
+VALID_VISION_MODES = frozenset({"ocr", "compare", "analyze", "batch", "eval"})
+IMPLEMENTED_VISION_MODES = frozenset({"ocr", "compare"})
+
+
+def _resolve_inputs(project_dir: str, inputs: list[str]) -> list[str]:
+    return [str((Path(project_dir) / item).resolve()) for item in inputs]
+
+
+def _job_id(mode: str, inputs: list[str]) -> str:
+    digest = hashlib.sha256()
+    digest.update(mode.encode("utf-8"))
+    for item in inputs:
+        digest.update(item.encode("utf-8"))
+    return f"vision-{digest.hexdigest()[:12]}"
+
+
+def normalize_vision_payload(project_dir: str, payload: dict[str, Any]) -> dict[str, Any]:
+    mode = str(payload.get("mode", "")).strip()
+    raw_inputs = payload.get("inputs")
+    if mode not in VALID_VISION_MODES:
+        raise ValueError(f"unsupported vision mode: {mode}")
+    if mode not in IMPLEMENTED_VISION_MODES:
+        raise ValueError(f"vision mode is not implemented yet: {mode}")
+    if not isinstance(raw_inputs, list) or not raw_inputs or not all(isinstance(item, str) and item.strip() for item in raw_inputs):
+        raise ValueError("inputs must be a non-empty list of file paths")
+    if mode == "compare" and len(raw_inputs) < 2:
+        raise ValueError("compare mode requires at least two input files")
+
+    resolved_inputs = _resolve_inputs(project_dir, raw_inputs)
+    for input_path in resolved_inputs:
+        if not Path(input_path).exists():
+            raise ValueError(f"missing vision input: {input_path}")
+
+    return {
+        "job_id": _job_id(mode, resolved_inputs),
+        "mode": mode,
+        "inputs": resolved_inputs,
+    }
+
+
+def expand_pairs(job: dict[str, Any]) -> list[tuple[str, str]]:
+    if job["mode"] != "compare":
+        return []
+    return list(itertools.combinations(job["inputs"], 2))
+
+
+def run_vision_job(project_dir: str, payload: dict[str, Any]) -> dict[str, Any]:
+    job = normalize_vision_payload(project_dir, payload)
+    cache_key = build_cache_key(job["mode"], job["inputs"])
+    cached = load_cached_result(project_dir, cache_key)
+    if cached is not None:
+        cached["cached"] = True
+        return cached
+
+    if job["mode"] == "compare":
+        deterministic_results = [
+            image(left_path, "compare", other_path=right_path)
+            for left_path, right_path in expand_pairs(job)
+        ]
+    elif job["mode"] == "ocr":
+        deterministic_results = [image(input_path, "ocr") for input_path in job["inputs"]]
+    else:
+        deterministic_results = []
+
+    artifacts = write_vision_artifacts(project_dir, job, deterministic_results)
+    result = {
+        "status": "ok",
+        "job": job,
+        "results": deterministic_results,
+        "artifacts": artifacts,
+        "cached": False,
+    }
+    store_cached_result(project_dir, cache_key, result)
+    return result

package/scripts/check-omg-public-ready.py

@@ -123,10 +123,11 @@ def _find_missing_templates(root: Path) -> list[str]:
 
 
 def _find_internal_docs(root: Path) -> list[str]:
+    violations: list[str] = []
     plans_dir = root / "docs" / "plans"
-    if plans_dir.exists():
-        return [f"{plans_dir.relative_to(root)}: internal planning docs must not ship in public branch"]
-    return []
+    if plans_dir.exists() and any(path.is_file() for path in plans_dir.rglob("*")):
+        violations.append("docs/plans/: internal planning docs must not ship in public branch")
+    return violations
 
 
 def _normalize_link_target(raw: str) -> str:

package/scripts/migrate-legacy.py

@@ -50,61 +50,61 @@ CANONICAL_HOOKS: dict[str, list[dict[str, Any]]] = {
     "PreToolUse": [
         {
             "matcher": "Bash",
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/firewall.py"', "timeout": 5}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/firewall.py"', "timeout": 5}],
         },
         {
             "matcher": "Read|Write|Edit|MultiEdit",
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/secret-guard.py"', "timeout": 5}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/secret-guard.py"', "timeout": 5}],
         },
     ],
     "PostToolUse": [
         {
             "matcher": "Bash|Write|Edit|MultiEdit",
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/tool-ledger.py"', "timeout": 10}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/tool-ledger.py"', "timeout": 10}],
         },
         {
             "matcher": "Bash",
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/circuit-breaker.py"', "timeout": 10}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/circuit-breaker.py"', "timeout": 10}],
         },
         {
             "matcher": "Write|Edit|MultiEdit",
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/post-write.py"', "timeout": 30}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/post-write.py"', "timeout": 30}],
         },
         {
             "matcher": "Write|Edit|MultiEdit",
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/shadow_manager.py"', "timeout": 15}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/shadow_manager.py"', "timeout": 15}],
         },
     ],
     "Stop": [
         {
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/quality-gate.py"', "timeout": 10}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/quality-gate.py"', "timeout": 10}],
         },
         {
             "hooks": [
-                {"type": "command", "command": 'python3 "$HOME/.claude/hooks/stop-gate.py"', "timeout": 15},
-                {"type": "command", "command": 'python3 "$HOME/.claude/hooks/test-validator.py"', "timeout": 30},
-                {"type": "command", "command": 'python3 "$HOME/.claude/hooks/quality-runner.py"', "timeout": 180},
+                {"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/stop-gate.py"', "timeout": 15},
+                {"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/test-validator.py"', "timeout": 30},
+                {"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/quality-runner.py"', "timeout": 180},
             ],
         },
     ],
     "PreCompact": [
         {
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/pre-compact.py"', "timeout": 15}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/pre-compact.py"', "timeout": 15}],
         },
     ],
     "SessionStart": [
         {
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/session-start.py"', "timeout": 10}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/session-start.py"', "timeout": 10}],
         },
     ],
     "UserPromptSubmit": [
         {
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/prompt-enhancer.py"', "timeout": 10}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/prompt-enhancer.py"', "timeout": 10}],
         },
     ],
     "ConfigChange": [
         {
-            "hooks": [{"type": "command", "command": 'python3 "$HOME/.claude/hooks/config-guard.py"', "timeout": 10}],
+            "hooks": [{"type": "command", "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/config-guard.py"', "timeout": 10}],
         },
     ],
 }

package/scripts/omg.py

@@ -29,6 +29,10 @@ ROOT_DIR = Path(SCRIPTS_DIR).resolve().parent
 if str(ROOT_DIR) not in sys.path:
     sys.path.insert(0, str(ROOT_DIR))
 
+from hooks._common import bootstrap_runtime_paths
+
+bootstrap_runtime_paths(__file__)
+
 from hooks.policy_engine import evaluate_bash_command
 from hooks.shadow_manager import create_evidence_pack
 from hooks.trust_review import review_config_change, write_trust_manifest
@@ -331,6 +335,40 @@ def cmd_domain_pack(args: argparse.Namespace) -> int:
     return 0
 
 
+def _emit_vision_placeholder(command: str) -> int:
+    print(
+        json.dumps(
+            {
+                "status": "error",
+                "error_code": "INVALID_VISION_INPUT",
+                "message": f"{command} is registered, but runtime execution is not implemented yet",
+            },
+            indent=2,
+        )
+    )
+    return 2
+
+
+def cmd_vision_ocr(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision ocr")
+
+
+def cmd_vision_compare(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision compare")
+
+
+def cmd_vision_analyze(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision analyze")
+
+
+def cmd_vision_batch(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision batch")
+
+
+def cmd_vision_eval(args: argparse.Namespace) -> int:
+    return _emit_vision_placeholder("vision eval")
+
+
 def cmd_trace_record(args: argparse.Namespace) -> int:
     result = record_trace(
         _ensure_project_dir(),
@@ -1181,6 +1219,19 @@ def build_parser() -> argparse.ArgumentParser:
     domain_pack.add_argument("--name", required=True, choices=["robotics", "vision", "algorithms", "health"])
     domain_pack.set_defaults(func=cmd_domain_pack)
 
+    vision = sub.add_parser("vision", help="OCR, visual diff, and semantic image analysis")
+    vision_sub = vision.add_subparsers(dest="vision_command", required=True)
+    vision_ocr = vision_sub.add_parser("ocr", help="Extract text from one or more images")
+    vision_ocr.set_defaults(func=cmd_vision_ocr)
+    vision_compare = vision_sub.add_parser("compare", help="Compare one or more images deterministically")
+    vision_compare.set_defaults(func=cmd_vision_compare)
+    vision_analyze = vision_sub.add_parser("analyze", help="Run semantic image analysis")
+    vision_analyze.set_defaults(func=cmd_vision_analyze)
+    vision_batch = vision_sub.add_parser("batch", help="Run a vision batch job")
+    vision_batch.set_defaults(func=cmd_vision_batch)
+    vision_eval = vision_sub.add_parser("eval", help="Evaluate vision job outputs")
+    vision_eval.set_defaults(func=cmd_vision_eval)
+
     tracebank = sub.add_parser("tracebank", help="Record structured route traces")
     tracebank.add_argument("--trace-type", required=True)
     tracebank.add_argument("--route", required=True)

package/scripts/pre-release-check.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# pre-release-check.sh — Run before creating any GitHub release or pushing a version tag.
+# Checks that the tag name is not locked by a previously-deleted immutable GitHub release.
+set -euo pipefail
+
+VERSION="${1:-}"
+REPO="${2:-trac3er00/OMG}"
+
+if [ -z "$VERSION" ]; then
+  echo "Usage: $0 <version> [repo]"
+  echo "Example: $0 2.1.8 trac3er00/OMG"
+  exit 1
+fi
+
+TAG="v${VERSION}"
+echo "Checking tag ${TAG} on ${REPO}..."
+
+# Check if tag already exists on remote
+if git ls-remote --tags origin "refs/tags/${TAG}" | grep -q "refs/tags/${TAG}"; then
+  echo "ERROR: Tag ${TAG} already exists on remote. Delete it first or use a new version."
+  exit 1
+fi
+
+# Check if GitHub has an immutable release ghost for this tag
+RESPONSE=$(gh api "repos/${REPO}/releases/tags/${TAG}" 2>&1 || true)
+if echo "$RESPONSE" | grep -q '"immutable": true'; then
+  echo "ERROR: Tag ${TAG} was used by an immutable release that was deleted."
+  echo "GitHub permanently locks this tag name. You MUST use a different version."
+  echo "Contact GitHub Support at https://support.github.com to clear it, or bump the version."
+  exit 1
+fi
+
+# Check if any release references this tag
+if echo "$RESPONSE" | grep -q '"tag_name"'; then
+  echo "WARNING: A release already exists for ${TAG}. Verify this is intentional before proceeding."
+fi
+
+echo "OK: Tag ${TAG} is available for release."

package/scripts/prepare-release-proof-fixtures.py

@@ -6,6 +6,18 @@ import hashlib
 import json
 from pathlib import Path
 
+from registry.verify_artifact import sign_artifact_statement
+
+
+_DEV_PRIVATE_KEY = "Hx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8="
+_DEV_KEY_ID = "1f5fe64ec2f8c901"
+_DETERMINISM_VERSION = "forge-determinism-v1"
+_DETERMINISM_SCOPE = "same-hardware"
+_TEMPERATURE_LOCK = {
+    "critical_model_paths": 0.0,
+    "critical_tool_paths": 0.0,
+}
+
 
 def _write_json(path: Path, payload: object) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -22,6 +34,16 @@ def _context_checksum(*, run_id: str, profile_version: str, intent_gate_version:
     return hashlib.sha256(material.encode("utf-8", errors="ignore")).hexdigest()
 
 
+def _build_deterministic_contract(run_id: str) -> dict[str, object]:
+    digest = hashlib.sha256(run_id.encode("utf-8")).digest()
+    return {
+        "seed": int.from_bytes(digest[:8], byteorder="big", signed=False),
+        "temperature_lock": dict(_TEMPERATURE_LOCK),
+        "determinism_version": _DETERMINISM_VERSION,
+        "determinism_scope": _DETERMINISM_SCOPE,
+    }
+
+
 def prepare_release_proof_fixtures(output_root: Path) -> None:
     trace_id = "trace-1"
     eval_id = "eval-1"
@@ -34,6 +56,23 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
         profile_version=profile_version,
         intent_gate_version=intent_gate_version,
     )
+    deterministic_contract = _build_deterministic_contract(run_id)
+    artifact_digest = hashlib.sha256(f"{run_id}:release-artifact".encode("utf-8")).hexdigest()
+    artifact_path = f"dist/public/{run_id}-release-bundle.tgz"
+    artifact = {
+        "id": f"release-{run_id}",
+        "signer": "omg-local",
+        "checksum": f"sha256:{artifact_digest}",
+        "attestation": sign_artifact_statement(
+            artifact_path=artifact_path,
+            subject_digest=artifact_digest,
+            signer_key=_DEV_PRIVATE_KEY,
+            signer_key_id=_DEV_KEY_ID,
+        ),
+        "permissions": ["read"],
+        "static_scan": [],
+        "risk_level": "low",
+    }
 
     junit_path = output_root / ".omg" / "evidence" / "junit.xml"
     coverage_path = output_root / ".omg" / "evidence" / "coverage.xml"
@@ -122,12 +161,18 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             {
                 "schema": "EvidencePack",
                 "run_id": run_id,
+                "evidence_profile": "release",
                 "timestamp": "2026-03-07T00:00:00Z",
                 "executor": {"user": "release-bot", "pid": 1},
                 "environment": {"hostname": "localhost", "platform": "linux"},
                 "context_checksum": context_checksum,
                 "profile_version": profile_version,
                 "intent_gate_version": intent_gate_version,
+                "seed": deterministic_contract["seed"],
+                "temperature_lock": deterministic_contract["temperature_lock"],
+                "determinism_version": deterministic_contract["determinism_version"],
+                "determinism_scope": deterministic_contract["determinism_scope"],
+                "artifact": artifact,
             "tests": [{"name": "release_readiness", "passed": True}],
             "security_scans": [{"tool": "security-check", "path": ".omg/evidence/security-check.json"}],
             "diff_summary": {"files": 1},
@@ -138,11 +183,13 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             "claims": [
                 {
                     "claim_type": "release_ready",
+                    "run_id": run_id,
+                    "evidence_profile": "release",
                     "artifacts": [
-                        "junit.xml",
-                        "coverage.xml",
-                        "results.sarif",
-                        "browser_trace.json",
+                        ".omg/evidence/junit.xml",
+                        ".omg/evidence/coverage.xml",
+                        ".omg/evidence/results.sarif",
+                        ".omg/evidence/browser_trace.json",
                     ],
                     "trace_ids": [trace_id],
                 }
@@ -204,6 +251,12 @@ def prepare_release_proof_fixtures(output_root: Path) -> None:
             "phase": "finalize",
             "resolution_source": "fixtures",
             "resolution_reason": "deterministic_release_seed",
+            "compliance_authority": "release",
+            "compliance_reason": "compliance checks passed",
+            "artifact_verdict": "allow",
+            "artifact_alg": "ed25519-minisign",
+            "artifact_key_id": _DEV_KEY_ID,
+            "artifact_subject_sha256": artifact_digest,
             "updated_at": "2026-03-07T00:00:00Z",
             "context_checksum": context_checksum,
             "profile_version": profile_version,

package/scripts/sync-release-identity.py

@@ -27,6 +27,7 @@ from runtime.release_surfaces import (
     AUTHORED_SURFACES,
     DERIVED_SURFACE_DIRS,
     AuthoredSurface,
+    surface_applies_to_root,
 )
 
 KeyPath = list[Union[str, int]]
@@ -393,6 +394,8 @@ def check_surface(
     repo_root: Path, surface: AuthoredSurface, canonical: str,
 ) -> list[tuple[str, str | None]]:
     """Check a single surface for version drift."""
+    if not surface_applies_to_root(surface, repo_root):
+        return []
     _guard_derived(surface)
     handler = _CHECK_DISPATCH.get(surface.surface_type)
     if handler is None:
@@ -404,6 +407,8 @@ def update_surface(
     repo_root: Path, surface: AuthoredSurface, canonical: str,
 ) -> list[str]:
     """Update a single surface to canonical version."""
+    if not surface_applies_to_root(surface, repo_root):
+        return []
     _guard_derived(surface)
     handler = _UPDATE_DISPATCH.get(surface.surface_type)
     if handler is None:

package/scripts/verify-standalone.sh

@@ -26,9 +26,9 @@ echo "=== Validating release identity ==="
 python3 scripts/validate-release-identity.py --scope all --forbid-version "${FORBID_VERSION}"
 
 if command -v pyenv >/dev/null 2>&1 && pyenv prefix 3.12.7 >/dev/null 2>&1; then
-  PYENV_VERSION=3.12.7 python -m pytest -q
+  PYENV_VERSION=3.12.7 python -m pytest -q -o addopts=''
 else
-  python3 -m pytest -q
+  python3 -m pytest -q -o addopts=''
 fi
 
 echo "[verify-standalone] passed"

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.1.7 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.1.9 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -171,7 +171,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/session-start.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/session-start.py\\\"",
             "timeout": 10
           }
         ]
@@ -182,7 +182,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/session-end-capture.py\""
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/session-end-capture.py\\\""
           }
         ]
       }
@@ -192,7 +192,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/firewall.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/firewall.py\\\"",
             "timeout": 10
           }
         ],
@@ -202,7 +202,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/secret-guard.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/secret-guard.py\\\"",
             "timeout": 10
           }
         ],
@@ -212,17 +212,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/tdd-gate.py\"",
-            "timeout": 10
-          }
-        ],
-        "matcher": ""
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/pre-tool-inject.py\""
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/pre-tool-inject.py\\\""
           }
         ],
         "matcher": ""
@@ -233,7 +223,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/circuit-breaker.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/circuit-breaker.py\\\"",
             "timeout": 10
           }
         ],
@@ -243,7 +233,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/tool-ledger.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/tool-ledger.py\\\"",
             "timeout": 10
           }
         ],
@@ -253,7 +243,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/test_generator_hook.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/test_generator_hook.py\\\"",
             "timeout": 10
           }
         ],
@@ -263,7 +253,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/budget_governor.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/budget_governor.py\\\"",
             "timeout": 10
           }
         ],
@@ -275,7 +265,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/post-tool-failure.py\""
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/post-tool-failure.py\\\""
           }
         ]
       }
@@ -285,7 +275,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/stop_dispatcher.py\"",
+            "command": "\\\"$HOME/.claude/omg-runtime/.venv/bin/python\\\" \\\"$HOME/.claude/hooks/stop_dispatcher.py\\\"",
             "timeout": 90
           }
         ],
@@ -297,7 +287,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/user-prompt-submit.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/user-prompt-submit.py\"",
             "timeout": 10
           }
         ]
@@ -308,7 +298,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/instructions-loaded.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/instructions-loaded.py\"",
             "timeout": 10
           }
         ]
@@ -316,7 +306,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.1.7",
+    "_version": "2.1.9",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -376,7 +366,7 @@
       "NOTEBOOKLM": false
     },
     "generated": {
-      "contract_version": "2.1.7",
+      "contract_version": "2.1.9",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
@@ -669,6 +659,16 @@
           "execution_primitives"
         ]
       }
-    }
+    },
+    "plugin_allowlist": [
+      "oh-my-openagent",
+      "oh-my-opencode",
+      "oh-my-codex",
+      "oh-my-claudecode"
+    ]
+  },
+  "enabledPlugins": {
+    "oh-my-opencode@omg": true,
+    "oh-my-opencode": true
   }
 }