@trac3er/oh-my-god 2.2.3 → 2.3.0

package/build/lib/plugins/viz/regex_parser.py

@@ -1,112 +0,0 @@
-"""Regex-based import parsers for JavaScript/TypeScript and Go.
-
-These parsers are intentionally lightweight and best-effort.
-"""
-
-from pathlib import Path
-import re
-from typing import NotRequired, TypedDict, cast
-
-
-class ParseResult(TypedDict):
-    imports: list[str]
-    accuracy: str
-    language: str
-    error: NotRequired[str]
-
-
-def _read_text_file(file_path: str) -> tuple[str | None, str | None]:
-    """Read UTF-8 text safely, returning (text, error)."""
-    try:
-        raw = Path(file_path).read_bytes()
-    except OSError as exc:
-        return None, f"file-read-error: {exc}"
-
-    if b"\x00" in raw:
-        return None, "unparseable-file: binary content detected"
-
-    try:
-        return raw.decode("utf-8"), None
-    except UnicodeDecodeError as exc:
-        return None, f"unparseable-file: {exc}"
-
-
-def _result(imports: list[str], accuracy: str, language: str, error: str | None) -> ParseResult:
-    result: ParseResult = {
-        "imports": imports,
-        "accuracy": accuracy,
-        "language": language,
-    }
-    if error:
-        result["error"] = error
-    return result
-
-
-def _unique(values: list[str]) -> list[str]:
-    seen: set[str] = set()
-    ordered: list[str] = []
-    for value in values:
-        if value not in seen:
-            seen.add(value)
-            ordered.append(value)
-    return ordered
-
-
-def parse_js_imports(file_path: str) -> ParseResult:
-    """Parse JS/TS import specifiers from a file via regex (~70% accuracy).
-
-    Accuracy: ~70% ("regex-70%").
-    Known misses: dynamic imports with variables/template literals,
-    complex transpiler syntax, and imports hidden in non-UTF8 files.
-    """
-    text, error = _read_text_file(file_path)
-    if text is None:
-        return _result([], "regex-70%", "javascript", error)
-
-    imports: list[str] = []
-
-    static_import_re = re.compile(
-        r"^\s*import\s+(?:[\w*$\s{},]+\s+from\s+)?['\"]([^'\"]+)['\"]",
-        re.MULTILINE,
-    )
-    require_re = re.compile(r"require\s*\(\s*['\"]([^'\"]+)['\"]\s*\)")
-    export_from_re = re.compile(
-        r"^\s*export\s+\*\s+from\s+['\"]([^'\"]+)['\"]",
-        re.MULTILINE,
-    )
-    dynamic_import_re = re.compile(r"import\s*\(\s*['\"]([^'\"]+)['\"]\s*\)")
-
-    imports.extend(static_import_re.findall(text))
-    imports.extend(require_re.findall(text))
-    imports.extend(export_from_re.findall(text))
-    imports.extend(dynamic_import_re.findall(text))
-
-    return _result(_unique(imports), "regex-70%", "javascript", None)
-
-
-def parse_go_imports(file_path: str) -> ParseResult:
-    """Parse Go import paths from a file via regex (~80% accuracy).
-
-    Accuracy: ~80% ("regex-80%").
-    Known misses: imports gated by build tags/conditional file inclusion,
-    and non-UTF8 or unparseable files.
-    """
-    text, error = _read_text_file(file_path)
-    if text is None:
-        return _result([], "regex-80%", "go", error)
-
-    imports: list[str] = []
-
-    single_or_alias_re = re.compile(
-        r'^\s*import\s+(?:[A-Za-z_][\w.]*)?\s*"([^"]+)"',
-        re.MULTILINE,
-    )
-    block_re = re.compile(r"import\s*\((.*?)\)", re.DOTALL)
-    block_entry_re = re.compile(r'(?:[A-Za-z_][\w.]*)?\s*"([^"]+)"')
-
-    imports.extend(single_or_alias_re.findall(text))
-
-    for block in cast(list[str], block_re.findall(text)):
-        imports.extend(block_entry_re.findall(block))
-
-    return _result(_unique(imports), "regex-80%", "go", None)

package/build/lib/registry/__init__.py

@@ -1 +0,0 @@
-"""Registry package for OMG."""

package/build/lib/registry/approval_artifact.py

@@ -1,236 +0,0 @@
-"""Signed approval artifacts binding approvals to artifact digests via Ed25519/minisign."""
-from __future__ import annotations
-
-import base64
-import hashlib
-import json
-from dataclasses import asdict, dataclass
-from pathlib import Path
-from typing import Any
-
-from registry.verify_artifact import (
-    _canonical_json,
-    _key_id_from_public_key,
-    _load_ed25519_backend,
-    _load_trusted_signers,
-    _parse_minisign_detached,
-    _utc_now,
-    sign_artifact,
-)
-
-_APPROVAL_TYPE = "omg-approval-artifact-v1"
-
-
-@dataclass
-class ApprovalArtifact:
-    artifact_digest: str
-    action: str
-    scope: str
-    reason: str
-    signer_key_id: str
-    issued_at: str
-    signature: str
-    run_id: str = ""
-
-
-def _approval_signing_payload(approval: ApprovalArtifact) -> dict[str, object]:
-    # Security-critical: signature field excluded from signing payload
-    return {
-        "artifact_digest": approval.artifact_digest,
-        "action": approval.action,
-        "scope": approval.scope,
-        "reason": approval.reason,
-        "signer_key_id": approval.signer_key_id,
-        "issued_at": approval.issued_at,
-        "type": _APPROVAL_TYPE,
-        "run_id": approval.run_id,
-    }
-
-
-def create_approval_artifact(
-    artifact_digest: str,
-    action: str,
-    scope: str,
-    reason: str,
-    signer_key_id: str,
-    signer_private_key: str,
-    run_id: str = "",
-) -> ApprovalArtifact:
-
-    clean_digest = str(artifact_digest).strip().lower()
-    if len(clean_digest) != 64 or any(ch not in "0123456789abcdef" for ch in clean_digest):
-        raise ValueError("artifact_digest_must_be_sha256_hex")
-    if not str(action).strip():
-        raise ValueError("action_required")
-    if not str(scope).strip():
-        raise ValueError("scope_required")
-    if not signer_private_key:
-        raise ValueError("signer_private_key_required")
-
-    issued_at = _utc_now()
-
-    approval = ApprovalArtifact(
-        artifact_digest=clean_digest,
-        action=str(action).strip(),
-        scope=str(scope).strip(),
-        reason=str(reason).strip(),
-        signer_key_id=signer_key_id,
-        issued_at=issued_at,
-        signature="",
-        run_id=str(run_id).strip(),
-    )
-
-    sig_result = sign_artifact(
-        artifact_path=f"approval:{clean_digest}",
-        subject_digest=clean_digest,
-        signer_key_id=signer_key_id,
-        signer_private_key=signer_private_key,
-        trusted_comment=(
-            f"type={_APPROVAL_TYPE} keyid={signer_key_id} "
-            f"issued_at={issued_at} digest={clean_digest}"
-        ),
-        signing_payload=_approval_signing_payload(approval),
-    )
-
-    approval.signature = sig_result["signature"]
-    return approval
-
-
-def verify_approval_artifact(
-    approval: ApprovalArtifact | dict[str, Any],
-    expected_artifact_digest: str,
-) -> dict[str, Any]:
-
-    if isinstance(approval, ApprovalArtifact):
-        data = asdict(approval)
-    elif isinstance(approval, dict):
-        data = dict(approval)
-    else:
-        return {"valid": False, "reason": "invalid approval artifact type"}
-
-    required = ("artifact_digest", "action", "scope", "reason", "signer_key_id", "issued_at", "signature")
-    for field in required:
-        if not isinstance(data.get(field), str) or not data[field].strip():
-            return {"valid": False, "reason": f"missing or empty field: {field}"}
-    run_id_value = data.get("run_id", "")
-    if run_id_value is not None and not isinstance(run_id_value, str):
-        return {"valid": False, "reason": "run_id must be a string when present"}
-
-    clean_expected = str(expected_artifact_digest).strip().lower()
-    clean_actual = str(data["artifact_digest"]).strip().lower()
-    if clean_actual != clean_expected:
-        return {"valid": False, "reason": "artifact digest mismatch"}
-
-    key_id = data["signer_key_id"]
-    trusted_signers = _load_trusted_signers()
-    signer = trusted_signers.get(key_id)
-    if signer is None:
-        return {"valid": False, "reason": "unknown signer key id"}
-    if str(signer.get("algorithm", "")) != "ed25519-minisign":
-        return {"valid": False, "reason": "algorithm mismatch for trusted signer"}
-
-    public_key_b64 = signer.get("public_key")
-    if not isinstance(public_key_b64, str) or not public_key_b64:
-        return {"valid": False, "reason": "invalid trusted signer public key"}
-    try:
-        _, _, Ed25519PublicKey = _load_ed25519_backend()
-        public_key_raw = base64.b64decode(public_key_b64, validate=True)
-        public_key = Ed25519PublicKey.from_public_bytes(public_key_raw)
-    except ModuleNotFoundError as exc:
-        return {"valid": False, "reason": str(exc)}
-    except Exception:
-        return {"valid": False, "reason": "invalid trusted signer public key"}
-
-    if _key_id_from_public_key(public_key_raw) != key_id:
-        return {"valid": False, "reason": "trusted signer key id mismatch"}
-
-    signature_value = data["signature"]
-    try:
-        detached_sig, _trusted_comment, _tc_sig = _parse_minisign_detached(signature_value, None)
-    except ValueError as exc:
-        return {"valid": False, "reason": str(exc)}
-
-    temp_approval = ApprovalArtifact(
-        artifact_digest=clean_actual,
-        action=data["action"],
-        scope=data["scope"],
-        reason=data["reason"],
-        signer_key_id=key_id,
-        issued_at=data["issued_at"],
-        signature="",
-        run_id=str(run_id_value).strip(),
-    )
-    payload = _approval_signing_payload(temp_approval)
-
-    try:
-        public_key.verify(detached_sig, _canonical_json(payload))
-    except Exception:
-        return {"valid": False, "reason": "invalid approval signature"}
-
-    return {"valid": True, "reason": "verified"}
-
-
-def load_approval_artifact_from_path(
-    path: str | Path,
-    expected_artifact_digest: str,
-) -> dict[str, Any]:
-
-    file_path = Path(path)
-    if not file_path.is_file():
-        return {"valid": False, "reason": f"file not found: {path}", "approval": None}
-
-    try:
-        data = json.loads(file_path.read_text(encoding="utf-8"))
-    except Exception:
-        return {"valid": False, "reason": "invalid JSON in approval artifact file", "approval": None}
-
-    if not isinstance(data, dict):
-        return {"valid": False, "reason": "approval artifact must be a JSON object", "approval": None}
-
-    result = verify_approval_artifact(data, expected_artifact_digest)
-    return {
-        "valid": result["valid"],
-        "reason": result["reason"],
-        "approval": data if result["valid"] else None,
-    }
-
-
-def build_tool_approval_digest(lane_name: str, tool_name: str, run_id: str) -> str:
-    payload = {
-        "lane": str(lane_name).strip().lower(),
-        "tool": str(tool_name).strip(),
-        "run_id": str(run_id).strip(),
-        "type": "omg-tool-fabric-approval-v1",
-    }
-    return hashlib.sha256(_canonical_json(payload)).hexdigest()
-
-
-def verify_tool_approval(
-    approval: ApprovalArtifact | dict[str, Any],
-    *,
-    lane_name: str,
-    tool_name: str,
-    run_id: str,
-) -> dict[str, Any]:
-    expected_digest = build_tool_approval_digest(lane_name=lane_name, tool_name=tool_name, run_id=run_id)
-    verified = verify_approval_artifact(approval, expected_artifact_digest=expected_digest)
-    if not bool(verified.get("valid")):
-        return verified
-
-    approval_obj: dict[str, Any]
-    if isinstance(approval, ApprovalArtifact):
-        approval_obj = asdict(approval)
-    elif isinstance(approval, dict):
-        approval_obj = dict(approval)
-    else:
-        return {"valid": False, "reason": "invalid approval artifact type"}
-
-    run_binding = str(approval_obj.get("run_id", "")).strip()
-    if not run_binding:
-        scope = str(approval_obj.get("scope", "")).strip()
-        token = f"/runs/{run_id}"
-        if token in scope:
-            run_binding = run_id
-    if run_binding != str(run_id).strip():
-        return {"valid": False, "reason": "approval artifact run_id mismatch"}
-    return verified

package/build/lib/registry/bundles/algorithms.yaml

@@ -1,45 +0,0 @@
-id: algorithms
-kind: domain-pack
-version: 2.2.3
-title: OMG Algorithms Pack
-description: Determinism and benchmark attachments for algorithm-heavy work.
-hosts:
-  - claude
-  - codex
-assets:
-  references:
-    - runtime/domain_packs.py
-invocation_policy:
-  user_invocable: true
-  model_invocable: true
-  allow_implicit_invocation: false
-tool_policy:
-  side_effect_level: medium
-  allowed_tools:
-    claude:
-      - Read
-    codex:
-      - Read
-lifecycle_hooks:
-  native:
-    - PostToolUse
-  emulated:
-    - TaskCompleted
-mcp_contract:
-  servers:
-    - omg-control
-lsp_contract:
-  languages:
-    - python
-evidence_outputs:
-  artifacts:
-    - .omg/evals/latest.json
-execution_contract:
-  modes:
-    - embedded
-    - local_supervisor
-channel_overrides:
-  public:
-    benchmarks: advisory
-  enterprise:
-    benchmarks: required

package/build/lib/registry/bundles/api-twin.yaml

@@ -1,48 +0,0 @@
-id: api-twin
-kind: simulation
-version: 2.2.3
-title: OMG API Twin
-description: Versioned endpoint cassette replay with latency, drift, and cost reporting.
-hosts:
-  - claude
-  - codex
-assets:
-  references:
-    - runtime/api_twin.py
-    - commands/OMG:api-twin.md
-invocation_policy:
-  user_invocable: true
-  model_invocable: true
-  allow_implicit_invocation: false
-tool_policy:
-  side_effect_level: medium
-  allowed_tools:
-    claude:
-      - Read
-      - Bash(python3:*)
-    codex:
-      - Read
-      - Bash(python3:*)
-lifecycle_hooks:
-  native:
-    - PostToolUse
-  emulated:
-    - TaskCompleted
-mcp_contract:
-  servers:
-    - omg-control
-lsp_contract:
-  languages:
-    - python
-evidence_outputs:
-  artifacts:
-    - .omg/state/api_twin.json
-execution_contract:
-  modes:
-    - embedded
-    - local_supervisor
-channel_overrides:
-  public:
-    fidelity: validated
-  enterprise:
-    fidelity: policy-required

package/build/lib/registry/bundles/ast-pack.yaml

@@ -1,80 +0,0 @@
-id: ast-pack
-kind: governance
-version: 2.2.3
-title: OMG AST Pack Lane
-description: Governed AST search and replace lane with canonical approvals and proofs.
-hosts:
-  - claude
-  - codex
-assets:
-  references:
-    - runtime/tool_fabric.py
-    - registry/verify_artifact.py
-invocation_policy:
-  user_invocable: true
-  model_invocable: true
-  allow_implicit_invocation: false
-tool_policy:
-  side_effect_level: medium
-  allowed_tools:
-    claude:
-      - Grep
-      - Edit
-    codex:
-      - Grep
-      - Edit
-lifecycle_hooks:
-  native:
-    - PreToolUse
-    - PostToolUse
-  emulated:
-    - TaskCompleted
-mcp_contract:
-  servers:
-    - omg-control
-lsp_contract:
-  languages:
-    - python
-    - typescript
-evidence_outputs:
-  artifacts:
-    - .omg/evidence/ast-pack-{run_id}.json
-execution_contract:
-  modes:
-    - embedded
-    - local_supervisor
-tool_fabric:
-  lane: ast-pack
-  enforcement_order:
-    - tool_selection
-    - approval_state
-    - evidence_requirements
-    - attestation_proof_validation
-    - execution
-  tools:
-    - Grep
-    - Edit
-  semantic_operations:
-    - name: ast_search
-      tool: Grep
-      mutation_capable: false
-      requires_explicit_promotion: false
-    - name: ast_rewrite
-      tool: Edit
-      mutation_capable: true
-      requires_explicit_promotion: true
-  requires_signed_approval: true
-  requires_signed_approval_for_mutation: true
-  requires_attestation: false
-  requires_attestation_for_mutation: true
-  dry_run_first: true
-  require_run_scoped_evidence: true
-  require_fresh_evidence: true
-  evidence_max_age_seconds: 3600
-  required_evidence:
-    - .omg/evidence/ast-pack-{run_id}.json
-channel_overrides:
-  public:
-    posture: advisory
-  enterprise:
-    posture: managed

package/build/lib/registry/bundles/claim-judge.yaml

@@ -1,49 +0,0 @@
-id: claim-judge
-kind: proof
-version: 2.2.3
-title: OMG Claim Judge
-description: Evidence-backed claim validator for structured release and completion claims.
-hosts:
-  - claude
-  - codex
-assets:
-  references:
-    - runtime/claim_judge.py
-invocation_policy:
-  user_invocable: true
-  model_invocable: true
-  allow_implicit_invocation: false
-tool_policy:
-  side_effect_level: low
-  allowed_tools:
-    claude:
-      - Read
-      - Grep
-      - Bash(python3:*)
-    codex:
-      - Read
-      - Grep
-      - Bash(python3:*)
-lifecycle_hooks:
-  native:
-    - PostToolUse
-  emulated:
-    - TaskCompleted
-mcp_contract:
-  servers:
-    - omg-control
-lsp_contract:
-  languages:
-    - python
-evidence_outputs:
-  artifacts:
-    - .omg/evidence/claim-judge-*.json
-execution_contract:
-  modes:
-    - embedded
-    - local_supervisor
-channel_overrides:
-  public:
-    posture: self-serve
-  enterprise:
-    posture: managed