@trac3er/oh-my-god 2.1.8 → 2.2.2

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.1.8 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.2.2 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -171,7 +171,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/session-start.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-start.py\"",
             "timeout": 10
           }
         ]
@@ -182,7 +182,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/session-end-capture.py\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/session-end-capture.py\""
           }
         ]
       }
@@ -192,7 +192,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/firewall.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/firewall.py\"",
             "timeout": 10
           }
         ],
@@ -202,7 +202,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/secret-guard.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/secret-guard.py\"",
             "timeout": 10
           }
         ],
@@ -212,17 +212,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/tdd-gate.py\"",
-            "timeout": 10
-          }
-        ],
-        "matcher": ""
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/pre-tool-inject.py\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/pre-tool-inject.py\""
           }
         ],
         "matcher": ""
@@ -233,7 +223,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/circuit-breaker.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/circuit-breaker.py\"",
             "timeout": 10
           }
         ],
@@ -243,7 +233,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/tool-ledger.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/tool-ledger.py\"",
             "timeout": 10
           }
         ],
@@ -253,7 +243,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/test_generator_hook.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/test_generator_hook.py\"",
             "timeout": 10
           }
         ],
@@ -263,7 +253,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/budget_governor.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/budget_governor.py\"",
             "timeout": 10
           }
         ],
@@ -275,7 +265,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/post-tool-failure.py\""
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/post-tool-failure.py\""
           }
         ]
       }
@@ -285,7 +275,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/stop_dispatcher.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/stop_dispatcher.py\"",
             "timeout": 90
           }
         ],
@@ -297,7 +287,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/user-prompt-submit.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/user-prompt-submit.py\"",
             "timeout": 10
           }
         ]
@@ -308,7 +298,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "python3 \"$HOME/.claude/hooks/instructions-loaded.py\"",
+            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/instructions-loaded.py\"",
             "timeout": 10
           }
         ]
@@ -316,7 +306,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.1.8",
+    "_version": "2.2.2",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -376,7 +366,7 @@
       "NOTEBOOKLM": false
     },
     "generated": {
-      "contract_version": "2.1.8",
+      "contract_version": "2.2.2",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
@@ -492,6 +482,21 @@
             "requires_approval": true
           }
         ],
+        "tool_fabric_contract": {
+          "enforcement_order": [
+            "tool_selection",
+            "approval_state",
+            "evidence_requirements",
+            "attestation_proof_validation",
+            "execution"
+          ],
+          "lanes": [
+            "lsp-pack",
+            "hash-edit",
+            "ast-pack",
+            "terminal-lane"
+          ]
+        },
         "protected_paths": [
           {
             "path_pattern": ".omg/**",
@@ -667,8 +672,23 @@
           "claim_judge",
           "compliance_governor",
           "execution_primitives"
+        ],
+        "runtime_behavior_surfaces": [
+          "execution_primitives",
+          "provider_host_parity",
+          "host_semantic_parity"
         ]
       }
-    }
+    },
+    "plugin_allowlist": [
+      "oh-my-openagent",
+      "oh-my-opencode",
+      "oh-my-codex",
+      "oh-my-claudecode"
+    ]
+  },
+  "enabledPlugins": {
+    "oh-my-opencode@omg": true,
+    "oh-my-opencode": true
   }
 }

package/tools/python_repl.py

@@ -18,7 +18,7 @@ import sys
 import traceback
 import uuid
 from datetime import datetime, timezone
-from typing import Any, Dict, Generator, List, Optional, Union
+from typing import Any, Dict, Generator, List, Optional, Union, cast
 
 
 # --- Lazy imports for hooks/_common.py ---
@@ -61,11 +61,11 @@ def _check_jupyter() -> bool:
     global _HAS_JUPYTER, _jupyter_client
     if _HAS_JUPYTER is None:
         try:
-            import jupyter_client as _jc
+            import jupyter_client as _jc  # pyright: ignore[reportMissingImports]
             _jupyter_client = _jc
-            _HAS_JUPYTER = True
+            _HAS_JUPYTER = True  # pyright: ignore[reportConstantRedefinition]
         except ImportError:
-            _HAS_JUPYTER = False
+            _HAS_JUPYTER = False  # pyright: ignore[reportConstantRedefinition]
     return _HAS_JUPYTER
 
 
@@ -112,7 +112,7 @@ def _get_helpers_flag() -> bool:
     return False
 
 
-def _build_prelude_namespace() -> dict:
+def _build_prelude_namespace() -> dict[str, Any]:
     """Build the prelude namespace with helper functions for REPL sessions.
 
     Returns a dict of helper functions injected into every session when
@@ -140,7 +140,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return False
 
-    def lines(path: str) -> list:
+    def lines(path: str) -> list[str]:
         """Read file lines as list. Returns empty list on error."""
         try:
             with open(path, "r") as f:
@@ -148,7 +148,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return []
 
-    def search_code(pattern: str, path: str = ".", ext=None) -> list:
+    def search_code(pattern: str, path: str = ".", ext: str | None = None) -> list[dict[str, Any]]:
         """Grep-like search across files. Returns list of {file, line, match} dicts."""
         results = []
         try:
@@ -173,7 +173,7 @@ def _build_prelude_namespace() -> dict:
             pass
         return results
 
-    def grep(pattern: str, text: str) -> list:
+    def grep(pattern: str, text: str) -> list[str]:
         """Regex grep on a string. Returns matching lines."""
         try:
             compiled = _re.compile(pattern)
@@ -181,7 +181,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return []
 
-    def insert_at(lines_list: list, index: int, new_line: str) -> list:
+    def insert_at(lines_list: list[str], index: int, new_line: str) -> list[str]:
         """Insert a line at index. Returns new list."""
         try:
             result = list(lines_list)
@@ -190,7 +190,7 @@ def _build_prelude_namespace() -> dict:
         except Exception:
             return list(lines_list)
 
-    def delete_lines(lines_list: list, start: int, end: int) -> list:
+    def delete_lines(lines_list: list[str], start: int, end: int) -> list[str]:
         """Delete lines from start to end (exclusive). Returns new list."""
         try:
             result = list(lines_list)
@@ -223,6 +223,24 @@ def _now_iso() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _exec_kernel_metadata() -> Dict[str, Any]:
+    try:
+        from runtime.exec_kernel import get_exec_kernel
+        from runtime.release_run_coordinator import resolve_current_run_id
+
+        project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+        run_id = resolve_current_run_id(project_dir)
+        kernel = get_exec_kernel(project_dir)
+        return {
+            "run_id": run_id,
+            "enabled": kernel.enabled,
+            "attach_log": kernel.attach_log(run_id) if run_id else "",
+            "evidence_hooks": [".omg/evidence/subagents"],
+        }
+    except Exception:
+        return {"run_id": None, "enabled": False, "attach_log": "", "evidence_hooks": []}
+
+
 def _validate_session_id(session_id: str) -> str:
     """Validate a caller-supplied session identifier."""
     _ensure_imports()
@@ -280,6 +298,8 @@ class _IPythonSession:
     """Wraps a jupyter_client kernel for code execution."""
 
     def __init__(self):
+        if _jupyter_client is None:
+            raise RuntimeError("jupyter_client unavailable")
         km, kc = _jupyter_client.manager.start_new_kernel(kernel_name="python3")
         self.kernel_manager = km
         self.kernel_client = kc
@@ -478,8 +498,10 @@ def start_repl_session(session_id: Optional[str] = None) -> Dict[str, Any]:
     # Inject prelude helpers if enabled
     if _get_helpers_flag():
         prelude = _build_prelude_namespace()
-        if hasattr(backend, "namespace"):
-            backend.namespace.update(prelude)
+        backend_any = backend
+        namespace_obj = getattr(backend_any, "namespace", None)
+        if isinstance(namespace_obj, dict):
+            namespace_obj.update(prelude)
     _persist_session(new_id)
 
     return _session_info(_sessions[new_id])
@@ -506,20 +528,23 @@ def execute_code(session_id: str, code_str: str) -> Dict[str, Any]:
     if _get_sandbox_flag():
         from tools.python_sandbox import execute_sandboxed
         session = _sessions[session_id]
-        backend = session.get("_backend")
-        ns = backend.namespace if hasattr(backend, "namespace") else None
+        backend_any = session.get("_backend")
+        namespace_obj = getattr(backend_any, "namespace", None)
+        ns = namespace_obj if isinstance(namespace_obj, dict) else None
         output = execute_sandboxed(code_str, namespace=ns)
         session["exec_count"] += 1
         session["last_used"] = _now_iso()
         output["exec_count"] = session["exec_count"]
+        output["exec_kernel"] = _exec_kernel_metadata()
         _persist_session(session_id)
         return output
 
     session = _sessions[session_id]
     backend = session["_backend"]
+    output: Dict[str, Any]
 
     try:
-        output = backend.execute(code_str)
+        output = cast(Dict[str, Any], backend.execute(code_str))
     except Exception as e:
         output = {
             "stdout": "",
@@ -531,6 +556,7 @@ def execute_code(session_id: str, code_str: str) -> Dict[str, Any]:
     session["exec_count"] += 1
     session["last_used"] = _now_iso()
     output["exec_count"] = session["exec_count"]
+    output["exec_kernel"] = _exec_kernel_metadata()
 
     _persist_session(session_id)
     return output

package/tools/python_sandbox.py

@@ -624,6 +624,24 @@ def _run_isolated_python(code: str, timeout_seconds: int) -> Dict[str, Any]:
     }
 
 
+def _exec_kernel_metadata() -> Dict[str, Any]:
+    try:
+        from runtime.exec_kernel import get_exec_kernel
+        from runtime.release_run_coordinator import resolve_current_run_id
+
+        project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+        run_id = resolve_current_run_id(project_dir)
+        kernel = get_exec_kernel(project_dir)
+        return {
+            "run_id": run_id,
+            "enabled": kernel.enabled,
+            "attach_log": kernel.attach_log(run_id) if run_id else "",
+            "evidence_hooks": [".omg/evidence/subagents"],
+        }
+    except Exception:
+        return {"run_id": None, "enabled": False, "attach_log": "", "evidence_hooks": []}
+
+
 def execute_budgeted_run(
     *,
     trainer_code: str,
@@ -692,6 +710,7 @@ def execute_budgeted_run(
         },
         "trainer": trainer_result,
         "sidecar": sidecar_result,
+        "exec_kernel": _exec_kernel_metadata(),
     }
 
 

package/tools/session_snapshot.py

@@ -32,7 +32,7 @@ def _get_feature_flag_enabled() -> bool:
     if hooks_dir not in sys.path:
         sys.path.insert(0, hooks_dir)
     try:
-        from _common import get_feature_flag  # type: ignore[import-untyped]
+        from _common import get_feature_flag  # type: ignore[import-untyped]  # pyright: ignore[reportMissingImports]
         return get_feature_flag("SNAPSHOT", default=False)
     except ImportError:
         return False
@@ -46,7 +46,7 @@ def _get_atomic_json_write():
     if hooks_dir not in sys.path:
         sys.path.insert(0, hooks_dir)
     try:
-        from _common import atomic_json_write  # type: ignore[import-untyped]
+        from _common import atomic_json_write  # type: ignore[import-untyped]  # pyright: ignore[reportMissingImports]
         return atomic_json_write
     except ImportError:
         return None
@@ -234,6 +234,15 @@ def delete_snapshot(snapshot_id: str, state_dir: str = ".omg/state") -> bool:
     return deleted
 
 
+def collect_snapshot_signals(state_dir: str = ".omg/state") -> Dict[str, Any]:
+    snapshots = list_snapshots(state_dir=state_dir)
+    latest = snapshots[0] if snapshots else {}
+    return {
+        "snapshot_count": len(snapshots),
+        "latest_snapshot_id": str(latest.get("id", "")) if isinstance(latest, dict) else "",
+    }
+
+
 # --- Branch / Fork API ---
 
 
@@ -252,7 +261,7 @@ def _get_branching_flag_enabled() -> bool:
     if hooks_dir not in sys.path:
         sys.path.insert(0, hooks_dir)
     try:
-        from _common import get_feature_flag  # type: ignore[import-untyped]
+        from _common import get_feature_flag  # type: ignore[import-untyped]  # pyright: ignore[reportMissingImports]
         return get_feature_flag("BRANCHING", default=False)
     except ImportError:
         return False
@@ -442,7 +451,7 @@ def _get_merge_flag_enabled() -> bool:
     if hooks_dir not in sys.path:
         sys.path.insert(0, hooks_dir)
     try:
-        from _common import get_feature_flag  # type: ignore[import-untyped]
+        from _common import get_feature_flag  # type: ignore[import-untyped]  # pyright: ignore[reportMissingImports]
         return get_feature_flag("MERGE", default=False)
     except ImportError:
         return False

package/tools/web_search.py

@@ -52,6 +52,32 @@ _has_credential_store: Optional[bool] = None
 _HAS_CREDENTIAL_STORE = None
 
 
+def _resolve_project_dir() -> str:
+    return os.environ.get("CLAUDE_PROJECT_DIR") or os.getcwd()
+
+
+def _mark_external_ingress(*, source_ref: str, content: Any) -> None:
+    try:
+        from runtime.untrusted_content import TrustTier, mark_untrusted_content
+    except Exception:
+        return
+
+    payload = content
+    if not isinstance(payload, str):
+        payload = json.dumps(payload, sort_keys=True, ensure_ascii=True)
+
+    try:
+        mark_untrusted_content(
+            _resolve_project_dir(),
+            source_type="web",
+            source_ref=source_ref,
+            content=payload,
+            tier=TrustTier.RESEARCH,
+        )
+    except Exception:
+        return
+
+
 def _check_credential_store() -> bool:
     """Check if credential_store is available (cached after first check)."""
     global _has_credential_store, _credential_store
@@ -195,7 +221,7 @@ def get_api_key(provider_name: str) -> Optional[str]:
             key = _credential_store.get_active_key(provider_name)
             if key:
                 return key
-        except Exception:
+        except (RuntimeError, ValueError, OSError):
             pass  # Fall through to env var
 
     # Fallback to environment variable
@@ -307,6 +333,15 @@ class WebSearchManager:
         for item in raw_results:
             item.setdefault("source", provider_name)
             results.append(SearchResult.from_dict(item))
+
+        _mark_external_ingress(
+            source_ref=f"search:{provider_name}",
+            content={
+                "query": query,
+                "provider": provider_name,
+                "results": [result.to_dict() for result in results],
+            },
+        )
         return results
 
     def fetch(
@@ -330,12 +365,30 @@ class WebSearchManager:
         provider_name = provider or self._default_provider
         if provider_name and provider_name in self._providers:
             try:
-                return self._providers[provider_name].fetch(url)
+                content = self._providers[provider_name].fetch(url)
             except Exception:
                 return ""
+            _mark_external_ingress(
+                source_ref=f"fetch:{provider_name}:{url}",
+                content={
+                    "url": url,
+                    "provider": provider_name,
+                    "content": content,
+                },
+            )
+            return content
 
         # Fallback: use stdlib urllib if no provider available
-        return _stdlib_fetch(url)
+        content = _stdlib_fetch(url)
+        _mark_external_ingress(
+            source_ref=f"fetch:stdlib:{url}",
+            content={
+                "url": url,
+                "provider": "stdlib",
+                "content": content,
+            },
+        )
+        return content
 
 
 # =============================================================================

package/.coveragerc

@@ -1,26 +0,0 @@
-[run]
-source = .
-omit =
-    tests/*
-    */__pycache__/*
-    .venv/*
-    setup.py
-    */site-packages/*
-
-[report]
-exclude_lines =
-    pragma: no cover
-    def __repr__
-    raise AssertionError
-    raise NotImplementedError
-    if __name__ == .__main__.:
-    if TYPE_CHECKING:
-    @abstractmethod
-    @abc.abstractmethod
-    pass
-
-precision = 2
-show_missing = True
-
-[html]
-directory = htmlcov