@trac3er/oh-my-god 2.2.3 → 2.3.0

package/build/lib/plugins/advanced/commands/OMG:ralph-stop.md

@@ -1,23 +0,0 @@
----
-description: "Stop Ralph autonomous loop — deactivates the state file."
-allowed-tools: Read, Write, Edit, Bash
-argument-hint: ""
----
-
-# /OMG:ralph-stop — Stop Ralph Autonomous Loop
-
-## Purpose
-Stops an active Ralph loop by deactivating the state file.
-
-## Usage
-```
-/OMG:ralph-stop
-```
-
-## How it Works
-1. Read `.omg/state/ralph-loop.json`
-2. Set `active: false` in the state file (preserve iteration count for review)
-3. Report: "Ralph loop stopped after N iterations. Gomg was: [original_prompt]"
-
-## If No Active Loop
-Report: "No active Ralph loop found. Nothing to stop."

package/build/lib/plugins/advanced/commands/OMG:security-review.md

@@ -1,16 +0,0 @@
----
-description: Deprecated alias to OMG's canonical security-check pipeline.
-allowed-tools: Read, Grep, Glob, Bash(python3:*), Bash(rg:*)
-argument-hint: "[path or '.' for the current project]"
----
-
-# /OMG:security-review — Deprecated Alias
-
-`/OMG:security-review` remains available only for compatibility.
-
-Use `/OMG:security-check` instead. The canonical pipeline now owns:
-
-- normalized security findings
-- dependency and AST enrichment
-- evidence-ready provenance and trust scores
-- reuse across CLI, compat routing, control plane, MCP, and ship flows

package/build/lib/plugins/advanced/commands/OMG:sequential-thinking.md

@@ -1,20 +0,0 @@
----
-description: Structured multi-step reasoning using sequential-thinking tool for complex debugging and planning.
-allowed-tools: sequential-thinking_sequentialthinking, Read, Grep, Glob
-argument-hint: "[problem statement to reason through]"
----
-
-# /OMG:sequential-thinking
-
-Use the sequential-thinking tool when the task needs explicit step-by-step reasoning,
-branching, and hypothesis verification.
-
-Execution contract:
-- Start with an initial thought budget
-- Revise or branch when new evidence appears
-- End only when a verified conclusion is reached
-
-Output contract:
-- Return final conclusion
-- Return key assumptions
-- Return verification steps used

package/build/lib/plugins/advanced/commands/OMG:ship.md

@@ -1,46 +0,0 @@
----
-description: Ship pipeline — Idea -> Plan -> Execute -> Evidence -> PR-ready summary
-allowed-tools: Read, Write, Edit, MultiEdit, Grep, Glob, Bash(git:*), Bash(rg:*), Bash(find:*), Bash(cat:*), Bash(python3:*), Bash(pytest:*), Bash(npm test:*), Bash(go test:*), Bash(cargo test:*), Bash(jest:*), Bash(vitest:*)
-argument-hint: "[goal or optional path to .omg/idea.yml]"
----
-
-# /OMG:ship — Idea -> Evidence -> PR
-
-## Step 1: Load idea contract
-- Prefer `.omg/idea.yml`.
-- If missing, scaffold from `~/.claude/templates/omg/idea.yml` and ask user for minimum fields:
-  - `goal`, `constraints`, `acceptance`, `risk`, `evidence_required`.
-
-## Step 2: Convert idea to execution plan
-- Consume plan artifacts generated by `/OMG:deep-plan`.
-- Require `.omg/plans/deep-plan.md` and `.omg/plans/deep-plan.json` to already encode the business workflow contract.
-- If missing, invoke `/OMG:deep-plan` first and return after those artifacts are created.
-- Use the deep-plan workflow path and task metadata as the execution source of truth.
-
-## Step 3: Execute with Shadow + Evidence discipline
-- Implement changes.
-- Run verification commands.
-- Build an evidence pack at `.omg/evidence/<run-id>.json` containing:
-  - `tests[]`, `security_scans[]`, `diff_summary`, `reproducibility`, `unresolved_risks[]`.
-
-## Step 4: Security and trust checks
-- Run `/OMG:security-check` for auth/payment/database/sensitive changes.
-- If config/hook/MCP changes are involved, ensure trust manifest is updated at `.omg/trust/manifest.lock.json`.
-
-## Step 5: PR-ready output
-Return:
-1. Goal and scope delivered
-2. Files changed
-3. Verification evidence (command + exit code)
-4. Risks/unknowns
-5. Suggested PR title + body
-
-## Full-power sub-agent protocol
-- Prefer parallel background sub-agent launches for independent workstreams.
-- Do not finalize until every launched track is collected via `background_output`.
-- Use `sequential-thinking` to reconcile conflicts and enforce execution order.
-
-## Anti-patterns
-- Do not claim done without evidence.
-- Do not edit tests to hide product bugs.
-- Do not skip trust review for `.claude/.omg` or MCP changes.

package/build/lib/plugins/advanced/plugin.json

@@ -1,104 +0,0 @@
-{
-  "name": "omg-advanced",
-  "version": "2.2.3",
-  "description": "Advanced OMG commands - deep planning, learning, code review, and specialized workflows",
-  "type": "omg-plugin",
-  "commands": {
-    "deep-plan": {
-      "path": "commands/OMG:deep-plan.md",
-      "description": "Deep strategic planning with domain awareness",
-      "category": "planning"
-    },
-    "learn": {
-      "path": "commands/OMG:learn.md",
-      "description": "Create reusable skills from patterns",
-      "category": "knowledge"
-    },
-    "code-review": {
-      "path": "commands/OMG:code-review.md",
-      "description": "Deep code review with line-by-line analysis",
-      "category": "quality"
-    },
-    "ship": {
-      "path": "commands/OMG:ship.md",
-      "description": "Ship pipeline - idea to PR-ready summary",
-      "category": "delivery"
-    },
-    "handoff": {
-      "path": "commands/OMG:handoff.md",
-      "description": "Intelligent session transfer",
-      "category": "collaboration"
-    },
-    "maintainer": {
-      "path": "commands/OMG:maintainer.md",
-      "description": "Open-source maintainer workflows",
-      "category": "oss"
-    },
-    "sequential-thinking": {
-      "path": "commands/OMG:sequential-thinking.md",
-      "description": "Structured multi-step reasoning",
-      "category": "thinking"
-    },
-    "ralph-start": {
-      "path": "commands/OMG:ralph-start.md",
-      "description": "Start Ralph autonomous loop",
-      "category": "automation"
-    },
-    "ralph-stop": {
-      "path": "commands/OMG:ralph-stop.md",
-      "description": "Stop Ralph autonomous loop",
-      "category": "automation"
-    }
-  },
-  "categories": {
-    "planning": {
-      "description": "Strategic planning and architecture",
-      "commands": [
-        "deep-plan"
-      ]
-    },
-    "quality": {
-      "description": "Code quality and review",
-      "commands": [
-        "code-review"
-      ]
-    },
-    "knowledge": {
-      "description": "Learning and skill creation",
-      "commands": [
-        "learn"
-      ]
-    },
-    "delivery": {
-      "description": "Shipping and release workflows",
-      "commands": [
-        "ship"
-      ]
-    },
-    "collaboration": {
-      "description": "Team collaboration and handoff",
-      "commands": [
-        "handoff"
-      ]
-    },
-    "automation": {
-      "description": "Autonomous execution modes",
-      "commands": [
-        "ralph-start",
-        "ralph-stop"
-      ]
-    },
-    "thinking": {
-      "description": "Structured thinking tools",
-      "commands": [
-        "sequential-thinking"
-      ]
-    },
-    "oss": {
-      "description": "Open source maintainer tools",
-      "commands": [
-        "maintainer"
-      ]
-    }
-  }
-}

package/build/lib/plugins/core/plugin.json

@@ -1,199 +0,0 @@
-{
-  "name": "omg-core",
-  "version": "2.2.3",
-  "description": "Core OMG commands - native setup, routing, orchestration, and verification surfaces",
-  "type": "omg-plugin",
-  "commands": {
-    "setup": {
-      "path": "commands/OMG:setup.md",
-      "description": "Native OMG setup and adoption flow for supported hosts",
-      "category": "setup"
-    },
-    "init": {
-      "path": "commands/OMG:init.md",
-      "description": "Unified initializer for project setup and domain scaffolding",
-      "category": "setup"
-    },
-    "escalate": {
-      "path": "commands/OMG:escalate.md",
-      "description": "Auto-route to Codex or Gemini",
-      "category": "routing"
-    },
-    "teams": {
-      "path": "commands/OMG:teams.md",
-      "description": "Internal team routing for standalone operation",
-      "category": "routing"
-    },
-    "ccg": {
-      "path": "commands/OMG:ccg.md",
-      "description": "CCG mode - tri-track synthesis (Claude+Codex+Gemini)",
-      "category": "routing"
-    },
-    "crazy": {
-      "path": "commands/OMG:crazy.md",
-      "description": "CRAZY mode - parallel multi-agent orchestration",
-      "category": "orchestration"
-    },
-    "compat": {
-      "path": "commands/OMG:compat.md",
-      "description": "Legacy skill compatibility dispatcher",
-      "category": "compatibility"
-    },
-    "security-check": {
-      "path": "commands/OMG:security-check.md",
-      "description": "Canonical security pipeline with normalized findings and evidence",
-      "category": "security"
-    },
-    "api-twin": {
-      "path": "commands/OMG:api-twin.md",
-      "description": "Contract replay and fixture-based API simulation",
-      "category": "contracts"
-    },
-    "preflight": {
-      "path": "commands/OMG:preflight.md",
-      "description": "Structured routing and evidence planning before execution",
-      "category": "routing"
-    },
-    "browser": {
-      "path": "commands/OMG:browser.md",
-      "description": "Canonical browser automation and verification surface powered by playwright-cli",
-      "category": "verification"
-    },
-    "health-check": {
-      "path": "commands/OMG:health-check.md",
-      "description": "Verify project setup and tool integration",
-      "category": "setup"
-    },
-    "profile-review": {
-      "path": "commands/OMG:profile-review.md",
-      "description": "Review governed profile state — preferences, confirmations, decay, provenance",
-      "category": "observability"
-    },
-    "mode": {
-      "path": "commands/OMG:mode.md",
-      "description": "Set cognitive mode for the session",
-      "category": "config"
-    },
-    "preset": {
-      "path": "commands/OMG:preset.md",
-      "description": "Inspect or apply the canonical OMG preset for the current project",
-      "category": "config"
-    },
-    "domain-init": {
-      "path": "commands/OMG:domain-init.md",
-      "description": "Alias for domain scaffolding (use init instead)",
-      "category": "setup",
-      "deprecated": true
-    },
-    "project-init": {
-      "path": "commands/OMG:project-init.md",
-      "description": "Alias for project setup (use init instead)",
-      "category": "setup",
-      "deprecated": true
-    },
-    "cost": {
-      "path": "commands/OMG:cost.md",
-      "description": "Display session cost tracking, budget status, and usage history",
-      "category": "observability"
-    },
-    "stats": {
-      "path": "commands/OMG:stats.md",
-      "description": "Display session analytics, tool usage trends, file heatmaps, and failure patterns",
-      "category": "observability"
-    },
-    "deps": {
-      "path": "commands/OMG:deps.md",
-      "description": "Scan project dependencies for CVEs, license issues, and outdated packages",
-      "category": "observability"
-    },
-    "arch": {
-      "path": "commands/OMG:arch.md",
-      "description": "Codebase visualization — dependency graphs and architecture diagrams",
-      "category": "visualization",
-      "feature_flag": "CODEBASE_VIZ"
-    },
-    "validate": {
-      "path": "commands/OMG:validate.md",
-      "description": "Canonical validation — doctor + contract + profile + install checks",
-      "category": "observability"
-    }
-  },
-  "categories": {
-    "setup": {
-      "description": "Project initialization and setup",
-      "commands": [
-        "setup",
-        "init",
-        "health-check"
-      ]
-    },
-    "routing": {
-      "description": "Model routing and escalation",
-      "commands": [
-        "escalate",
-        "teams",
-        "ccg",
-        "preflight"
-      ]
-    },
-    "verification": {
-      "description": "Verification flows with normalized evidence",
-      "commands": [
-        "browser"
-      ]
-    },
-    "orchestration": {
-      "description": "Multi-agent orchestration modes",
-      "commands": [
-        "crazy"
-      ]
-    },
-    "compatibility": {
-      "description": "Legacy compatibility",
-      "commands": [
-        "compat"
-      ]
-    },
-    "config": {
-      "description": "Configuration and settings",
-      "commands": [
-        "mode",
-        "preset"
-      ]
-    },
-    "observability": {
-      "description": "Cost tracking and session observability",
-      "commands": [
-        "cost",
-        "stats",
-        "deps",
-        "profile-review",
-        "validate"
-      ]
-    },
-    "security": {
-      "description": "Canonical security and trust checks",
-      "commands": [
-        "security-check"
-      ]
-    },
-    "contracts": {
-      "description": "Contract replay and API simulation",
-      "commands": [
-        "api-twin"
-      ]
-    },
-    "visualization": {
-      "description": "Codebase visualization and architecture diagrams",
-      "commands": [
-        "arch"
-      ]
-    }
-  },
-  "roles": {
-    "plan-council": {
-      "description": "Canonical council-style planning role",
-      "bundle": "plan-council"
-    }
-  }
-}

package/build/lib/plugins/dephealth/cve_scanner.py

@@ -1,279 +0,0 @@
-from __future__ import annotations
-
-import json
-import os
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any
-import urllib.error
-import urllib.request
-
-
-OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch"
-KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
-EPSS_URL_TEMPLATE = "https://api.first.org/data/v1/epss?cve={cve_id}"
-CACHE_REL_PATH = Path(".omg") / "state" / "cve-cache.json"
-KEV_CACHE_REL_PATH = Path(".omg") / "state" / "kev-cache.json"
-EPSS_CACHE_REL_PATH = Path(".omg") / "state" / "epss-cache.json"
-CACHE_TTL_HOURS = 24
-
-
-def _dep_health_enabled() -> bool:
-    env_val = os.environ.get("OMG_DEP_HEALTH_ENABLED", "").lower()
-    if env_val in ("1", "true", "yes"):
-        return True
-    if env_val in ("0", "false", "no"):
-        return False
-    try:
-        import sys
-        sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
-        from hooks._common import get_feature_flag
-        return get_feature_flag("DEP_HEALTH", default=False)
-    except Exception:
-        return False
-
-
-def scan_for_cves(dependency_list: list[dict[str, str]], project_dir: str = ".") -> dict[str, Any]:
-    if not _dep_health_enabled():
-        return {"results": {}, "cached": False, "scan_ts": datetime.now(timezone.utc).isoformat()}
-    
-    now = datetime.now(timezone.utc)
-    cache_path = Path(project_dir) / CACHE_REL_PATH
-    cached_payload = _load_cache(cache_path)
-
-    if not dependency_list:
-        return {
-            "results": {},
-            "cached": False,
-            "scan_ts": now.isoformat(),
-        }
-
-    if cached_payload and _is_cache_fresh(cached_payload.get("scan_ts")):
-        return {
-            "results": cached_payload.get("results", {}),
-            "cached": True,
-            "scan_ts": cached_payload.get("scan_ts", now.isoformat()),
-        }
-
-    try:
-        osv_response = _query_osv_batch(dependency_list)
-    except urllib.error.URLError:
-        if cached_payload:
-            return {
-                "results": cached_payload.get("results", {}),
-                "cached": True,
-                "scan_ts": cached_payload.get("scan_ts", now.isoformat()),
-            }
-        return {"status": "offline", "results": {}, "cached": False}
-
-    structured_results = _normalize_results(dependency_list, osv_response)
-    scan_result = {
-        "results": structured_results,
-        "cached": False,
-        "scan_ts": now.isoformat(),
-    }
-    _save_cache(cache_path, scan_result)
-    return scan_result
-
-
-def enrich_with_kev(finding: dict[str, Any], cache_dir: str) -> dict[str, Any]:
-    result = dict(finding)
-    if not _dep_health_enabled():
-        result["kev_listed"] = False
-        return result
-
-    cve_id = str(finding.get("id", "")).strip()
-    if not cve_id:
-        result["kev_listed"] = False
-        return result
-
-    cache_path = Path(cache_dir) / KEV_CACHE_REL_PATH
-    cached = _load_cache(cache_path)
-
-    if cached and _is_cache_fresh(cached.get("fetched_at")):
-        result["kev_listed"] = cve_id in cached.get("cve_ids", [])
-        return result
-
-    try:
-        kev_data = _fetch_kev_catalog()
-        kev_ids = [v.get("cveID", "") for v in kev_data.get("vulnerabilities", [])]
-        _save_cache(cache_path, {
-            "fetched_at": datetime.now(timezone.utc).isoformat(),
-            "cve_ids": kev_ids,
-        })
-        result["kev_listed"] = cve_id in kev_ids
-    except (urllib.error.URLError, OSError, json.JSONDecodeError):
-        if cached:
-            result["kev_listed"] = cve_id in cached.get("cve_ids", [])
-        else:
-            result["kev_listed"] = False
-    return result
-
-
-def enrich_with_epss(finding: dict[str, Any], cache_dir: str) -> dict[str, Any]:
-    result = dict(finding)
-    if not _dep_health_enabled():
-        result["epss_score"] = None
-        return result
-
-    cve_id = str(finding.get("id", "")).strip()
-    if not cve_id:
-        result["epss_score"] = None
-        return result
-
-    cache_path = Path(cache_dir) / EPSS_CACHE_REL_PATH
-    cached = _load_cache(cache_path) or {}
-    entries = cached.get("entries", {})
-
-    entry = entries.get(cve_id)
-    if entry and _is_cache_fresh(entry.get("fetched_at")):
-        result["epss_score"] = entry.get("epss")
-        return result
-
-    try:
-        epss_data = _fetch_epss_score(cve_id)
-        data_list = epss_data.get("data", [])
-        score = float(data_list[0].get("epss", 0)) if data_list else None
-        entries[cve_id] = {
-            "epss": score,
-            "fetched_at": datetime.now(timezone.utc).isoformat(),
-        }
-        _save_cache(cache_path, {"entries": entries})
-        result["epss_score"] = score
-    except (urllib.error.URLError, OSError, json.JSONDecodeError, ValueError, TypeError):
-        if entry:
-            result["epss_score"] = entry.get("epss")
-        else:
-            result["epss_score"] = None
-    return result
-
-
-def _fetch_kev_catalog() -> dict[str, Any]:
-    request = urllib.request.Request(KEV_URL, headers={"Accept": "application/json"})
-    with urllib.request.urlopen(request, timeout=15) as response:
-        body = response.read().decode("utf-8")
-    return json.loads(body)
-
-
-def _fetch_epss_score(cve_id: str) -> dict[str, Any]:
-    url = EPSS_URL_TEMPLATE.format(cve_id=cve_id)
-    request = urllib.request.Request(url, headers={"Accept": "application/json"})
-    with urllib.request.urlopen(request, timeout=15) as response:
-        body = response.read().decode("utf-8")
-    return json.loads(body)
-
-
-def _query_osv_batch(dependency_list: list[dict[str, str]]) -> dict[str, Any]:
-    payload = {
-        "queries": [
-            {
-                "package": {
-                    "name": dependency["name"],
-                    "ecosystem": dependency["ecosystem"],
-                },
-                "version": dependency["version"],
-            }
-            for dependency in dependency_list
-        ]
-    }
-
-    request = urllib.request.Request(
-        OSV_BATCH_URL,
-        data=json.dumps(payload).encode("utf-8"),
-        headers={"Content-Type": "application/json"},
-        method="POST",
-    )
-
-    with urllib.request.urlopen(request) as response:
-        body = response.read().decode("utf-8")
-    return json.loads(body)
-
-
-def _normalize_results(
-    dependency_list: list[dict[str, str]], osv_response: dict[str, Any]
-) -> dict[str, list[dict[str, Any]]]:
-    output: dict[str, list[dict[str, Any]]] = {}
-    response_results = osv_response.get("results", [])
-
-    for index, dependency in enumerate(dependency_list):
-        pkg_name = dependency.get("name", "")
-        query_result = response_results[index] if index < len(response_results) else {}
-        vulns = query_result.get("vulns", [])
-
-        normalized_vulns: list[dict[str, Any]] = []
-        for vuln in vulns:
-            affected_versions, fixed_version = _extract_affected(vuln)
-            normalized_vulns.append(
-                {
-                    "id": vuln.get("id", ""),
-                    "severity": _extract_severity(vuln),
-                    "summary": vuln.get("summary", ""),
-                    "affected_versions": affected_versions,
-                    "fixed_version": fixed_version,
-                }
-            )
-
-        output[pkg_name] = normalized_vulns
-
-    return output
-
-
-def _extract_severity(vuln: dict[str, Any]) -> str:
-    severities = vuln.get("severity") or []
-    if severities and isinstance(severities[0], dict):
-        score = severities[0].get("score")
-        if score:
-            return str(score)
-    return "UNKNOWN"
-
-
-def _extract_affected(vuln: dict[str, Any]) -> tuple[list[str], str]:
-    affected_versions: list[str] = []
-    fixed_version = ""
-
-    for affected in vuln.get("affected", []) or []:
-        for version in affected.get("versions", []) or []:
-            affected_versions.append(str(version))
-
-        for version_range in affected.get("ranges", []) or []:
-            for event in version_range.get("events", []) or []:
-                introduced = event.get("introduced")
-                fixed = event.get("fixed")
-                if introduced:
-                    affected_versions.append(str(introduced))
-                if fixed and not fixed_version:
-                    fixed_version = str(fixed)
-
-    deduped_versions = list(dict.fromkeys(affected_versions))
-    return deduped_versions, fixed_version
-
-
-def _load_cache(cache_path: Path) -> dict[str, Any] | None:
-    if not cache_path.exists():
-        return None
-    try:
-        return json.loads(cache_path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        return None
-
-
-def _save_cache(cache_path: Path, payload: dict[str, Any]) -> None:
-    try:
-        cache_path.parent.mkdir(parents=True, exist_ok=True)
-        cache_path.write_text(json.dumps(payload, separators=(",", ":")), encoding="utf-8")
-    except OSError:
-        return
-
-
-def _is_cache_fresh(scan_ts: str | None) -> bool:
-    if not scan_ts:
-        return False
-    try:
-        scanned_at = datetime.fromisoformat(scan_ts)
-    except ValueError:
-        return False
-
-    if scanned_at.tzinfo is None:
-        scanned_at = scanned_at.replace(tzinfo=timezone.utc)
-
-    return datetime.now(timezone.utc) - scanned_at < timedelta(hours=CACHE_TTL_HOURS)