@trac3er/oh-my-god 2.2.3 → 2.2.5

package/hooks/terms-guard.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+import re
+import sys
+from pathlib import Path
+
+HOOKS_DIR = str(Path(__file__).resolve().parent)
+PROJECT_ROOT = str(Path(HOOKS_DIR).parent)
+PORTABLE_RUNTIME_ROOT = str(Path(PROJECT_ROOT) / "omg-runtime")
+for path in (HOOKS_DIR, PROJECT_ROOT, PORTABLE_RUNTIME_ROOT):
+    if path not in sys.path:
+        sys.path.insert(0, path)
+
+from hooks._common import bootstrap_runtime_paths, setup_crash_handler, json_input, deny_decision, get_feature_flag
+
+bootstrap_runtime_paths(__file__)
+setup_crash_handler("terms-guard", fail_closed=True)
+
+MODEL_TOKENS = ("claude", "codex", "gemini", "kimi", "gpt", "openai", "anthropic")
+
+
+def _collect_mutation_text(tool_name: str, tool_input: object) -> str:
+    if tool_name not in {"Write", "Edit", "MultiEdit"}:
+        return ""
+    if not isinstance(tool_input, dict):
+        return ""
+
+    parts: list[str] = []
+    for key in ("content", "new_string", "old_string", "insert_text", "text"):
+        value = tool_input.get(key)
+        if isinstance(value, str) and value:
+            parts.append(value)
+
+    edits = tool_input.get("edits")
+    if isinstance(edits, list):
+        for item in edits:
+            if not isinstance(item, dict):
+                continue
+            for key in ("newText", "oldText", "new_string", "old_string", "content"):
+                value = item.get(key)
+                if isinstance(value, str) and value:
+                    parts.append(value)
+
+    return "\n".join(parts)
+
+
+def _model_mentions(text: str) -> int:
+    seen = {token for token in MODEL_TOKENS if re.search(rf"\b{re.escape(token)}\b", text, flags=re.IGNORECASE)}
+    return len(seen)
+
+
+def _detect_violation_reason(text: str) -> str | None:
+    lowered = text.lower()
+    has_star = re.search(r"\b(star|starring|upvote)\b", lowered) is not None
+    has_share = re.search(r"\b(share|forward|broadcast|cross-model|cross model|copy this prompt|paste this prompt)\b", lowered) is not None
+    if has_star and has_share and _model_mentions(lowered) >= 2:
+        return "promotion_star_cross_model"
+
+    has_switching = re.search(r"\b(route|switch|proxy|forward|delegate)\b", lowered) is not None
+    has_identity_claim = re.search(
+        r"\b(tell\s+the\s+user|claim|pretend|masquerade|say\s+this\s+came\s+from|present\s+as)\b",
+        lowered,
+    ) is not None
+    has_hidden = re.search(
+        r"\b(hidden|hide\s+this|secretly|without\s+disclos(?:ing|ure)|do\s+not\s+disclose|don['’]?t\s+disclose|undisclosed)\b",
+        lowered,
+    ) is not None
+    if has_switching and has_identity_claim and has_hidden and _model_mentions(lowered) >= 2:
+        return "hidden_model_identity_switch"
+
+    has_third_party = re.search(r"\b(third[- ]party|external\s+(?:api|service|vendor)|analytics\s+(?:api|service))\b", lowered) is not None
+    has_data = re.search(r"\b(logs?|conversation|prompt|chat\s*history|transcript|user\s*data)\b", lowered) is not None
+    has_no_disclosure = re.search(
+        r"\b(without\s+(?:user\s+)?disclos(?:ing|ure)|without\s+consent|undisclosed|do\s+not\s+disclose|don['’]?t\s+disclose)\b",
+        lowered,
+    ) is not None
+    if has_third_party and has_data and has_no_disclosure:
+        return "undisclosed_third_party_sharing"
+
+    return None
+
+
+data = json_input()
+if not get_feature_flag("TERMS_ENFORCEMENT", default=False):
+    sys.exit(0)
+
+tool_name = data.get("tool_name", "") if isinstance(data, dict) else ""
+tool_input = data.get("tool_input", {}) if isinstance(data, dict) else {}
+mutation_text = _collect_mutation_text(tool_name, tool_input)
+if not mutation_text:
+    sys.exit(0)
+
+reason = _detect_violation_reason(mutation_text)
+if reason is not None:
+    deny_decision(f"terms_guard:{reason}")
+
+sys.exit(0)

package/hooks/test-validator.py

@@ -38,6 +38,13 @@ _BUILTIN_FUNCS = frozenset({
     "assert_equal", "assertEqual", "patch", "mock", "Mock", "MagicMock",
     "expect", "require", "import", "open", "super", "getattr", "setattr",
     "hasattr", "sorted", "enumerate", "zip", "map", "filter", "min", "max",
+    "get", "append", "extend", "insert", "pop", "remove", "update", "add",
+    "setdefault", "keys", "values", "items", "join", "split", "strip",
+    "replace", "format", "encode", "decode", "startswith", "endswith",
+    "write", "read", "write_text", "read_text", "mkdir", "exists",
+    "param", "parametrize", "mark", "fixture", "yield_fixture",
+    "setenv", "delenv", "monkeypatch", "chdir",
+    "dumps", "loads", "dump", "load",
 })
 _MUTATION_TOOLS = frozenset({"write", "edit", "multiedit", "bash"})
 _SKIP_DIR_SEGMENTS = frozenset({"build", "dist", "node_modules", ".git"})
@@ -221,11 +228,10 @@ def _detect_parameterized_gap(content, issues):
             call_groups.setdefault(func, set()).add(arg)
 
     for func, args in call_groups.items():
-        if len(args) >= 3:
+        if len(args) >= 6:
             issues.append(
                 f"PARAMETERIZED: '{func}' called with {len(args)} different "
-                f"literal values — consider @pytest.mark.parametrize or "
-                f"@pytest.mark.parametrize")
+                f"literal values — consider @pytest.mark.parametrize")
 
 
 def persist_metrics(project_dir, analysis):
@@ -374,6 +380,23 @@ def check_test_quality(data, project_dir):
     return []
 
 
+def _is_mutation_capable_bash_for_methodology(command):
+    """Check if a bash command is truly mutation-capable for methodology enforcement.
+    File-write redirections of read-only commands are excluded."""
+    import re as _re
+    lowered = command.strip().lower()
+    _m_patterns = (
+        r"\b(git\s+(add|commit|push|rebase|cherry-pick|merge|tag(?!\s+(-l|--list)\b)))\b",
+        r"\b(rm|mv|cp|tee|touch|mkdir|rmdir|ln)\b",
+        r"\b(sed\s+-i|perl\s+-pi)\b",
+        r"\b(chmod|chown)\b",
+    )
+    for pattern in _m_patterns:
+        if _re.search(pattern, lowered):
+            return True
+    return False
+
+
 def check_methodology_contract(data):
     if not isinstance(data, dict):
         return []
@@ -382,6 +405,15 @@ def check_methodology_contract(data):
     if tool_name not in _MUTATION_TOOLS:
         return []
 
+    # For Bash tools, only enforce methodology on actually mutation-capable commands.
+    # Read-only commands (git status, ls, python3 script.py) and commands that only
+    # redirect output (python3 script.py > file.json) should not require done_when.
+    if tool_name == "bash":
+        tool_input_raw = data.get("tool_input")
+        cmd = str((tool_input_raw or {}).get("command", "")).strip() if isinstance(tool_input_raw, dict) else ""
+        if not cmd or not _is_mutation_capable_bash_for_methodology(cmd):
+            return []
+
     tool_input = data.get("tool_input")
     if not isinstance(tool_input, dict):
         return ["METHODOLOGY: mutation-capable flow requires metadata with done_when criteria"]
@@ -392,7 +424,7 @@ def check_methodology_contract(data):
 
     metadata = tool_input.get("metadata")
     if not isinstance(metadata, dict):
-        return ["METHODOLOGY: mutation-capable flow requires metadata with done_when criteria"]
+        return []  # No metadata provided -- do not block; firewall handles actual mutation gates
 
     done_when = metadata.get("done_when")
     if isinstance(done_when, str) and done_when.strip():

package/hud/omg-hud.mjs

@@ -87,7 +87,7 @@ function readOmgVersion() {
     // fall through to static fallback
   }
 
-  return "2.2.3";
+  return "2.2.5";
 }
 
 const OMG_VERSION = readOmgVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts",
   "main": "OMG-setup.sh",
   "scripts": {

package/plugins/advanced/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-advanced",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
   "type": "omg-plugin",
   "commands": {

package/plugins/core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omg-core",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
   "type": "omg-plugin",
   "commands": {

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oh-my-god"
-version = "2.2.3"
+version = "2.2.5"
 description = "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts"
 readme = "README.md"
 requires-python = ">=3.10"

package/registry/bundles/algorithms.yaml

@@ -1,6 +1,6 @@
 id: algorithms
 kind: domain-pack
-version: 2.2.3
+version: 2.2.5
 title: OMG Algorithms Pack
 description: Determinism and benchmark attachments for algorithm-heavy work.
 hosts:

package/registry/bundles/api-twin.yaml

@@ -1,6 +1,6 @@
 id: api-twin
 kind: simulation
-version: 2.2.3
+version: 2.2.5
 title: OMG API Twin
 description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
 hosts:

package/registry/bundles/ast-pack.yaml

@@ -1,6 +1,6 @@
 id: ast-pack
 kind: governance
-version: 2.2.3
+version: 2.2.5
 title: OMG AST Pack Lane
 description: Governed AST search and replace lane with canonical approvals and proofs.
 hosts:

package/registry/bundles/claim-judge.yaml

@@ -1,6 +1,6 @@
 id: claim-judge
 kind: proof
-version: 2.2.3
+version: 2.2.5
 title: OMG Claim Judge
 description: Evidence-backed claim validator for structured release and completion claims.
 hosts:

package/registry/bundles/control-plane.yaml

@@ -1,6 +1,6 @@
 id: control-plane
 kind: skill
-version: 2.2.3
+version: 2.2.5
 title: OMG Control Plane
 description: Canonical production control plane bundle for Claude, Codex, Gemini, and Kimi.
 hosts:

package/registry/bundles/data-lineage.yaml

@@ -1,6 +1,6 @@
 id: data-lineage
 kind: provenance
-version: 2.2.3
+version: 2.2.5
 title: OMG Data Lineage
 description: Provenance and privacy tracking for traces, fixtures, examples, and synthetic artifacts.
 hosts:

package/registry/bundles/delta-classifier.yaml

@@ -1,6 +1,6 @@
 id: delta-classifier
 kind: routing
-version: 2.2.3
+version: 2.2.5
 title: OMG Delta Classifier
 description: Change classifier that attaches risk-aware checks, approvals, and packs.
 hosts:

package/registry/bundles/eval-gate.yaml

@@ -1,6 +1,6 @@
 id: eval-gate
 kind: evaluation
-version: 2.2.3
+version: 2.2.5
 title: OMG Eval Gate
 description: Reproducible evaluation gate that blocks regressions before release.
 hosts:

package/registry/bundles/hash-edit.yaml

@@ -1,6 +1,6 @@
 id: hash-edit
 kind: governance
-version: 2.2.3
+version: 2.2.5
 title: OMG Hash Edit Lane
 description: Governed hash-bound edit lane with signed approvals and evidence routing.
 hosts:

package/registry/bundles/health.yaml

@@ -1,6 +1,6 @@
 id: health
 kind: domain-pack
-version: 2.2.3
+version: 2.2.5
 title: OMG Health Pack
 description: Health-sensitive approvals, provenance, and replay attachments.
 hosts:

package/registry/bundles/hook-governor.yaml

@@ -1,6 +1,6 @@
 id: hook-governor
 kind: governance
-version: 2.2.3
+version: 2.2.5
 title: OMG Hook Governor
 description: Canonical hook ordering, policy reinjection, and protected-path governance.
 hosts:

package/registry/bundles/incident-replay.yaml

@@ -1,6 +1,6 @@
 id: incident-replay
 kind: debugging
-version: 2.2.3
+version: 2.2.5
 title: OMG Incident Replay
 description: Replayable bug packs built from logs, failing tests, traces, and diffs.
 hosts:

package/registry/bundles/lsp-pack.yaml

@@ -1,6 +1,6 @@
 id: lsp-pack
 kind: diagnostics
-version: 2.2.3
+version: 2.2.5
 title: OMG LSP Pack
 description: Optional LSP-backed diagnostics and navigation bundle for production verification.
 hosts:

package/registry/bundles/mcp-fabric.yaml

@@ -1,6 +1,6 @@
 id: mcp-fabric
 kind: mcp
-version: 2.2.3
+version: 2.2.5
 title: OMG MCP Fabric
 description: Tools, prompts, resources, and server instructions for the OMG control plane.
 hosts:

package/registry/bundles/plan-council.yaml

@@ -1,6 +1,6 @@
 id: plan-council
 kind: planning
-version: 2.2.3
+version: 2.2.5
 title: OMG Plan Council
 description: Canonical council-style planning bundle for explicit, evidence-backed deep plans.
 hosts:

package/registry/bundles/preflight.yaml

@@ -1,6 +1,6 @@
 id: preflight
 kind: routing
-version: 2.2.3
+version: 2.2.5
 title: OMG Preflight
 description: Repo-aware route selection based on diff, manifests, and classified risk.
 hosts:

package/registry/bundles/proof-gate.yaml

@@ -1,6 +1,6 @@
 id: proof-gate
 kind: proof
-version: 2.2.3
+version: 2.2.5
 title: OMG Proof Gate
 description: Structured release proof gate that binds claims to required evidence artifacts and trace links.
 hosts:

package/registry/bundles/remote-supervisor.yaml

@@ -1,6 +1,6 @@
 id: remote-supervisor
 kind: orchestration
-version: 2.2.3
+version: 2.2.5
 title: OMG Remote Supervisor
 description: Local-only authenticated supervisor sessions for worker orchestration.
 hosts:

package/registry/bundles/robotics.yaml

@@ -1,6 +1,6 @@
 id: robotics
 kind: domain-pack
-version: 2.2.3
+version: 2.2.5
 title: OMG Robotics Pack
 description: Robotics safety policy, replay, and evaluation attachments.
 hosts:

package/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.2.3
+version: 2.2.5
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.2.3
+version: 2.2.5
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/registry/bundles/terminal-lane.yaml

@@ -1,6 +1,6 @@
 id: terminal-lane
 kind: governance
-version: 2.2.3
+version: 2.2.5
 title: OMG Terminal Lane
 description: Highest-risk governed terminal execution lane with strict approval and attestation.
 hosts:

package/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.2.3
+version: 2.2.5
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.2.3
+version: 2.2.5
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/registry/bundles/vision.yaml

@@ -1,6 +1,6 @@
 id: vision
 kind: domain-pack
-version: 2.2.3
+version: 2.2.5
 title: OMG Vision Pack
 description: Vision-specific OCR, comparison, lineage, drift, and replay attachments.
 hosts:

package/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "type": "object",
   "required": [
     "id",

package/registry/policy-packs/airgapped.yaml

@@ -0,0 +1,16 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: airgapped
+description: Governance overlay for fully disconnected execution environments.
+tool_restrictions:
+  - web_search
+  - browser_automation
+network_posture: airgapped
+approval_threshold: 2
+protected_paths:
+  - .omg/**
+  - .agents/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+data_sharing: restricted

package/registry/policy-packs/fintech.yaml

@@ -0,0 +1,15 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: fintech
+description: Governance overlay tuned for regulated fintech delivery.
+tool_restrictions:
+  - browser_automation
+network_posture: restricted
+approval_threshold: 2
+protected_paths:
+  - .omg/**
+  - .agents/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+data_sharing: restricted

package/registry/policy-packs/locked-prod.yaml

@@ -0,0 +1,18 @@
+# Precedence: subscription tier -> channel -> policy pack -> preset
+id: locked-prod
+description: Strict production governance overlay with mandatory human review.
+tool_restrictions:
+  - web_search
+network_posture: restricted
+approval_threshold: 3
+protected_paths:
+  - .omg/**
+  - .agents/**
+  - .claude/**
+  - .codex/**
+evidence_requirements:
+  - tests
+  - security_scan
+  - audit_trail
+  - human_review
+data_sharing: prohibited

package/runtime/adoption.py

@@ -7,19 +7,22 @@ import shutil
 from pathlib import Path
 from typing import Callable, cast
 
+from runtime.canonical_taxonomy import CANONICAL_PRESETS, RELEASE_CHANNELS
+
 
 CANONICAL_BRAND = "OMG"
 CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.2.3"
+CANONICAL_VERSION = "2.2.5"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 CANONICAL_MODE_NAMES = ("chill", "focused", "exploratory")
 
-PRESET_ORDER: tuple[str, ...] = ("safe", "balanced", "interop", "labs", "buffet")
-VALID_PRESETS = PRESET_ORDER
+PRESET_ORDER: tuple[str, ...] = CANONICAL_PRESETS
+VALID_PRESETS = CANONICAL_PRESETS
+VALID_RELEASE_CHANNELS = RELEASE_CHANNELS
 PRESET_LEVEL: dict[str, int] = {p: i for i, p in enumerate(PRESET_ORDER)}
 
 MANAGED_PRESET_FLAGS = (
@@ -96,6 +99,7 @@ PRESET_FEATURES: dict[str, dict[str, bool]] = {
         **{f: False for f in _BUFFET_ONLY_FLAGS},
     },
     "buffet": {flag: True for flag in MANAGED_PRESET_FLAGS},
+    "production": {flag: True for flag in MANAGED_PRESET_FLAGS},
 }
 
 _SUPERPOWERS_SENTINELS = (

package/runtime/canonical_taxonomy.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+
+RELEASE_CHANNELS: tuple[str, ...] = ("public", "enterprise")
+CANONICAL_PRESETS: tuple[str, ...] = ("safe", "balanced", "interop", "labs", "buffet", "production")
+SUBSCRIPTION_TIERS: tuple[str, ...] = ("free", "pro", "team", "enterprise_tier")
+POLICY_PACK_IDS: tuple[str, ...] = ("fintech", "airgapped", "locked-prod")
+
+
+def _assert_disjoint_namespaces() -> None:
+    namespaces: tuple[tuple[str, tuple[str, ...]], ...] = (
+        ("RELEASE_CHANNELS", RELEASE_CHANNELS),
+        ("CANONICAL_PRESETS", CANONICAL_PRESETS),
+        ("SUBSCRIPTION_TIERS", SUBSCRIPTION_TIERS),
+        ("POLICY_PACK_IDS", POLICY_PACK_IDS),
+    )
+
+    seen: dict[str, str] = {}
+    for namespace, values in namespaces:
+        for value in values:
+            owner = seen.get(value)
+            if owner is not None:
+                raise ValueError(f"{value!r} is defined in both {owner} and {namespace}")
+            seen[value] = namespace
+
+
+_assert_disjoint_namespaces()