@trac3er/oh-my-god 2.2.4 → 2.2.5

package/docs/install/github-app-required-checks.md

@@ -0,0 +1,103 @@
+# GitHub App Required Checks
+
+## Required Check Context Name
+
+The OMG PR Reviewer creates a check-run with a deterministic name:
+
+```
+OMG PR Reviewer
+```
+
+This name is the **context** string used for required status checks in branch protection rules.
+
+## Pinning Required Checks to `app_id`
+
+GitHub allows any integration or workflow to create a check-run with any name. To prevent spoofing of the `OMG PR Reviewer` check, pin the required check to the OMG GitHub App's `app_id` in your branch protection settings.
+
+### REST API (branch protection)
+
+```json
+PUT /repos/{owner}/{repo}/branches/{branch}/protection
+{
+  "required_status_checks": {
+    "strict": true,
+    "contexts": [],
+    "checks": [
+      {
+        "context": "OMG PR Reviewer",
+        "app_id": YOUR_OMG_APP_ID
+      }
+    ]
+  }
+}
+```
+
+When `app_id` is set, only check-runs created by that specific GitHub App are considered authoritative. A workflow or third-party App posting a check-run with the same name but a different `app_id` will not satisfy the requirement.
+
+### Repository Settings UI
+
+1. Go to **Settings > Branches > Branch protection rules**.
+2. Edit the rule for your default branch.
+3. Under **Require status checks to pass before merging**, search for `OMG PR Reviewer`.
+4. Select the entry that shows the OMG App icon (not the GitHub Actions icon).
+
+## Merge-Readiness Evaluation via `isRequired` GraphQL Field
+
+Do **not** rely on the raw `mergeable` field from the REST API to determine merge readiness. The `mergeable` field conflates merge conflict status with required-check status and can produce false positives.
+
+Instead, use the GraphQL `statusCheckRollup` with the `isRequired` field to query whether each required check has passed:
+
+```graphql
+query MergeReadiness($owner: String!, $repo: String!, $pr: Int!) {
+  repository(owner: $owner, name: $repo) {
+    pullRequest(number: $pr) {
+      commits(last: 1) {
+        nodes {
+          commit {
+            statusCheckRollup {
+              contexts(first: 50) {
+                nodes {
+                  ... on CheckRun {
+                    name
+                    conclusion
+                    isRequired(pullRequestNumber: $pr)
+                  }
+                  ... on StatusContext {
+                    context
+                    state
+                    isRequired(pullRequestNumber: $pr)
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The `isRequired` field returns `true` only for checks that are configured as required for the target branch. A PR is merge-ready when every context where `isRequired: true` also has `conclusion: "SUCCESS"` (for check-runs) or `state: "SUCCESS"` (for status contexts).
+
+## Split-Lane Security Model
+
+The OMG CI pipeline uses a split-lane model to isolate untrusted analysis from trusted posting:
+
+| Job | Permissions | Checkout | Purpose |
+|---|---|---|---|
+| `pr-analyze` | `contents: read` | PR head (default) | Runs analysis on PR code, produces review artifacts |
+| `post-review` | `contents: read`, `pull-requests: write`, `checks: write` | **Base SHA** (`github.event.pull_request.base.sha`) | Posts review and check-run using App credentials |
+
+The `post-review` job checks out the **base branch SHA**, not the PR head. This ensures the posting code is from the trusted base branch and cannot be tampered with by the PR author. App credentials (`OMG_APP_ID`, `OMG_APP_PRIVATE_KEY`, `OMG_APP_INSTALLATION_ID`) are only available in the trusted posting job.
+
+## Check-Run Conclusions
+
+The OMG PR Reviewer maps verdict statuses to GitHub check-run conclusions:
+
+| Verdict Status | GitHub Conclusion | PR UI Effect |
+|---|---|---|
+| `pass` | `success` | Green checkmark |
+| `fail` | `failure` | Red X |
+| `action_required` | `action_required` | "Take action" button |
+| `pending` | `neutral` | Grey dash |

package/hooks/_common.py

@@ -220,31 +220,54 @@ def log_hook_error(hook_name, error, context=None):
         pass
 
 
+_O_NOFOLLOW_HOOKS: int = getattr(os, "O_NOFOLLOW", 0)
+
+
+def _fsync_dir_hooks(dirpath):
+    fd = os.open(dirpath, os.O_RDONLY)
+    try:
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
 def atomic_json_write(path, data):
-    """Atomically write JSON data to a file using temp + rename.
-    
-    Args:
-        path: Target file path
-        data: Data to write as JSON
-    
-    Creates parent directories if needed. Silently fails on error.
-    """
     try:
-        # Create parent dirs
         parent = os.path.dirname(path)
         if parent:
             os.makedirs(parent, exist_ok=True)
-        
-        # Write to temp file
+
+        if os.path.islink(path):
+            raise OSError(f"Symlink target rejected: {path}")
+
         tmp_path = path + ".tmp"
-        with open(tmp_path, "w", encoding="utf-8") as f:
-            json.dump(data, f, separators=(",", ":"))
-        
-        # Atomic rename
-        os.rename(tmp_path, path)
+        if os.path.islink(tmp_path):
+            raise OSError(f"Symlink tmp path rejected: {tmp_path}")
+        if os.path.exists(tmp_path):
+            os.unlink(tmp_path)
+
+        content = json.dumps(data, separators=(",", ":")).encode("utf-8")
+        open_flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC | _O_NOFOLLOW_HOOKS
+        fd = os.open(tmp_path, open_flags, 0o600)
+        try:
+            written = 0
+            while written < len(content):
+                written += os.write(fd, content[written:])
+            os.fsync(fd)
+        except BaseException:
+            os.close(fd)
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
+            raise
+        else:
+            os.close(fd)
+
+        os.replace(tmp_path, path)
+        _fsync_dir_hooks(parent or ".")
     except Exception as e:
         print(f"[OMG] _common.py: {type(e).__name__}: {e}", file=sys.stderr)
-        pass
 
 
 # Feature flags cache — read settings.json once per hook invocation

package/hooks/budget_governor.py

@@ -50,10 +50,37 @@ def _safe_float(value, default: float) -> float:
         return default
 
 
-def _read_budget_config(project_dir: str) -> tuple[float, float, float]:
+def _read_budget_config(project_dir: str) -> tuple[float, float, float, dict[str, Any]]:
     session_limit = DEFAULT_SESSION_LIMIT_USD
     input_per_mtok = DEFAULT_INPUT_PER_MTOK
     output_per_mtok = DEFAULT_OUTPUT_PER_MTOK
+    tier_info: dict[str, Any] = {
+        "tier": "free",
+        "tier_limit_usd": DEFAULT_SESSION_LIMIT_USD,
+        "tier_provenance": "default",
+    }
+
+    try:
+        parent = os.path.dirname(HOOKS_DIR)
+        if parent not in sys.path:
+            sys.path.insert(0, parent)
+        from runtime.subscription_tiers import detect_tier
+
+        provider = os.environ.get("OMG_PROVIDER", "claude")
+        tier_result = detect_tier(provider, project_dir=project_dir)
+        session_limit = _safe_float(
+            tier_result.get("budget_usd_per_session"),
+            DEFAULT_SESSION_LIMIT_USD,
+        )
+        tier_info = {
+            "tier": tier_result.get("tier", "free"),
+            "tier_limit_usd": float(
+                tier_result.get("budget_usd_per_session", DEFAULT_SESSION_LIMIT_USD)
+            ),
+            "tier_provenance": tier_result.get("provenance", "default"),
+        }
+    except Exception:
+        pass
 
     settings_path = os.path.join(project_dir, "settings.json")
     try:
@@ -61,13 +88,13 @@ def _read_budget_config(project_dir: str) -> tuple[float, float, float]:
             settings = json.load(f)
         budget_cfg = settings.get("_omg", {}).get("cost_budget", {})
         pricing = budget_cfg.get("pricing", {})
-        session_limit = _safe_float(budget_cfg.get("session_limit_usd"), DEFAULT_SESSION_LIMIT_USD)
+        session_limit = _safe_float(budget_cfg.get("session_limit_usd"), session_limit)
         input_per_mtok = _safe_float(pricing.get("input_per_mtok"), DEFAULT_INPUT_PER_MTOK)
         output_per_mtok = _safe_float(pricing.get("output_per_mtok"), DEFAULT_OUTPUT_PER_MTOK)
     except Exception:
         pass
 
-    return session_limit, input_per_mtok, output_per_mtok
+    return session_limit, input_per_mtok, output_per_mtok, tier_info
 
 
 def _to_text(value) -> str:
@@ -218,7 +245,7 @@ def main() -> None:
         sys.exit(0)
 
     project_dir = get_project_dir()
-    session_limit_usd, input_per_mtok, output_per_mtok = _read_budget_config(project_dir)
+    session_limit_usd, input_per_mtok, output_per_mtok, tier_info = _read_budget_config(project_dir)
     summary = read_cost_summary(project_dir)
 
     estimated_current_cost = _estimate_call_cost(
@@ -228,8 +255,19 @@ def main() -> None:
         output_per_mtok,
     )
 
-    used_cost_usd = float(summary.get("total_cost_usd", 0.0)) + estimated_current_cost
-    used_calls = int(summary.get("entry_count", 0)) + 1
+    session_id = os.environ.get("CLAUDE_SESSION_ID", "")
+    by_session = summary.get("by_session", {})
+
+    if session_id and session_id in by_session:
+        session_data = by_session[session_id]
+        used_cost_usd = float(session_data.get("cost_usd", 0.0)) + estimated_current_cost
+        used_calls = int(session_data.get("count", 0)) + 1
+        provenance = "session"
+    else:
+        used_cost_usd = float(summary.get("total_cost_usd", 0.0)) + estimated_current_cost
+        used_calls = int(summary.get("entry_count", 0)) + 1
+        provenance = "default"
+
     projected_calls = _project_total_calls(used_cost_usd, used_calls, session_limit_usd)
 
     context = _build_context(
@@ -240,7 +278,6 @@ def main() -> None:
     )
 
     used_pct = (used_cost_usd / session_limit_usd * 100) if session_limit_usd > 0 else 0.0
-    session_id = os.environ.get("CLAUDE_SESSION_ID", "")
     threshold_alerts = _check_thresholds(used_pct, project_dir, session_id)
     if threshold_alerts:
         context += "\n" + "\n".join(threshold_alerts)
@@ -249,7 +286,39 @@ def main() -> None:
     if envelope_context:
         context += "\n" + envelope_context
 
-    json.dump({"additionalContext": context}, sys.stdout)
+    tier_limit_usd = tier_info["tier_limit_usd"]
+    near_limit = used_cost_usd > (0.80 * tier_limit_usd)
+    limit_reached = used_cost_usd >= tier_limit_usd
+
+    throttle_reason: str | None = None
+    if near_limit or limit_reached:
+        throttle_reason = (
+            f"tier={tier_info['tier']} limit={tier_limit_usd:.2f} "
+            f"used={used_cost_usd:.2f} provenance={tier_info['tier_provenance']}"
+        )
+
+    if limit_reached:
+        context += f"\n@tier-limit-reached: {throttle_reason}"
+    elif near_limit:
+        context += f"\n@tier-near-limit: {throttle_reason}"
+
+    output: dict[str, Any] = {
+        "additionalContext": context,
+        "provenance": provenance,
+        "tier": tier_info["tier"],
+        "tier_limit_usd": tier_limit_usd,
+        "near_limit": near_limit,
+        "limit_reached": limit_reached,
+        "throttle_reason": throttle_reason,
+    }
+
+    if tier_info["tier_provenance"] in ("cache", "default"):
+        output["tier_provenance_fallback"] = (
+            f"tier data from {tier_info['tier_provenance']} source "
+            "— may not reflect current subscription"
+        )
+
+    json.dump(output, sys.stdout)
     sys.exit(0)
 
 

package/hooks/setup_wizard.py

@@ -5,6 +5,7 @@ Feature-gated: requires OMG_SETUP_ENABLED=1 (default off).
 from __future__ import annotations
 
 import json
+import importlib
 import logging
 import os
 import re
@@ -27,16 +28,6 @@ from hooks._common import bootstrap_runtime_paths, get_feature_flag
 bootstrap_runtime_paths(__file__)
 
 from runtime.cli_provider import get_provider, list_available_providers  # noqa: E402
-from runtime.mcp_config_writers import (  # noqa: E402
-    write_claude_mcp_config,
-    write_claude_mcp_stdio_config,
-    write_codex_mcp_config,
-    write_codex_mcp_stdio_config,
-    write_gemini_mcp_config,
-    write_gemini_mcp_stdio_config,
-    write_kimi_mcp_config,
-    write_kimi_mcp_stdio_config,
-)
 
 # Trigger provider auto-registration on import
 import runtime.providers.codex_provider  # noqa: E402, F401
@@ -485,8 +476,6 @@ def check_auth() -> dict[str, Any]:
     return {"status": "pending", "results": {}}
 
 
-_HTTP_MEMORY_MIN_LEVEL: int = _PRESET_LEVEL["interop"]
-
 _PROFILE_ARCH_REQUEST_MAX = 8
 _PROFILE_TAG_MAX = 12
 _PROFILE_SUMMARY_MAX_CHARS = 240
@@ -541,100 +530,39 @@ def configure_mcp(
         - configured: List of CLI names that were successfully configured
         - errors: Dict of CLI name → error message for failures
     """
-    configured: list[str] = []
-    errors: dict[str, str] = {}
     resolved_control_args = list(control_args or OMG_CONTROL_ARGS)
-    http_memory_allowed = _PRESET_LEVEL.get(preset, 0) >= _HTTP_MEMORY_MIN_LEVEL
     selected_config = select_mcps(selected_ids=selected_ids, preset=preset)
     selected_servers = cast(
         dict[str, dict[str, Any]],
         selected_config.get("mcpServers", {}),
     )
+    install_planner = importlib.import_module("runtime.install_planner")
+    plan = install_planner.compute_install_plan(
+        project_dir=project_dir,
+        detected_clis=detected_clis,
+        preset=preset,
+        mode="focused",
+        selected_ids=selected_ids,
+        server_url=server_url,
+        server_name=server_name,
+        control_command=control_command,
+        control_args=resolved_control_args,
+        control_server_name=control_server_name,
+        selected_servers=selected_servers,
+        source_root=_PROJECT_ROOT,
+    )
+    install_result = cast(dict[str, Any], install_planner.execute_plan(plan))
 
-    try:
-        config_path = os.path.join(project_dir, ".mcp.json")
-        if os.path.exists(config_path):
-            with open(config_path, "r", encoding="utf-8") as f:
-                claude_config = json.load(f)
-            if not isinstance(claude_config, dict):
-                claude_config = {}
+    configured = [action.host for action in plan.actions if action.host != "claude"]
+    errors: dict[str, str] = {}
+    if install_result["errors"]:
+        joined = "; ".join(install_result["errors"])
+        if not configured:
+            errors["claude"] = joined
         else:
-            claude_config = {}
-
-        existing_servers = claude_config.get("mcpServers")
-        if not isinstance(existing_servers, dict):
-            existing_servers = {}
-
-        managed_server_ids = {cast(str, m["id"]) for m in MCP_CATALOG}
-        for managed_server_id in managed_server_ids:
-            existing_servers.pop(managed_server_id, None)
-        existing_servers.pop(server_name, None)
-        existing_servers.pop(control_server_name, None)
-
-        for selected_server_name, payload in selected_servers.items():
-            if selected_server_name == "omg-memory":
-                if not http_memory_allowed:
-                    continue
-                target_name = server_name
-                payload = {"type": "http", "url": server_url}
-            elif selected_server_name == OMG_CONTROL_SERVER_NAME:
-                target_name = control_server_name
-                payload = {
-                    "command": control_command,
-                    "args": resolved_control_args,
-                }
-            else:
-                target_name = selected_server_name
-            existing_servers[target_name] = payload
-
-        claude_config["mcpServers"] = existing_servers
-        with open(config_path, "w", encoding="utf-8") as f:
-            json.dump(claude_config, f, indent=2, ensure_ascii=True)
-            f.write("\n")
-    except Exception as exc:
-        _logger.warning("Failed to write Claude MCP config: %s", exc)
-        errors["claude"] = str(exc)
-
-    cli_writers = {
-        "codex": (write_codex_mcp_config, write_codex_mcp_stdio_config),
-        "gemini": (write_gemini_mcp_config, write_gemini_mcp_stdio_config),
-        "kimi": (write_kimi_mcp_config, write_kimi_mcp_stdio_config),
-    }
-
-    for cli_name, (http_writer, stdio_writer) in cli_writers.items():
-        cli_info = detected_clis.get(cli_name, {})
-        if not cli_info.get("detected", False):
-            continue
-
-        try:
-            for selected_server_name, payload in selected_servers.items():
-                if selected_server_name == "omg-memory":
-                    if not http_memory_allowed:
-                        continue
-                    http_writer(server_url, server_name)
-                    continue
-
-                if selected_server_name == OMG_CONTROL_SERVER_NAME:
-                    stdio_writer(
-                        command=control_command,
-                        args=resolved_control_args,
-                        server_name=control_server_name,
-                    )
-                    continue
-
-                if payload.get("type") == "http":
-                    http_writer(cast(str, payload["url"]), selected_server_name)
-                    continue
-
-                stdio_writer(
-                    command=cast(str, payload["command"]),
-                    args=[str(arg) for arg in cast(list[Any], payload.get("args", []))],
-                    server_name=selected_server_name,
-                )
-            configured.append(cli_name)
-        except Exception as exc:
-            _logger.warning("Failed to write %s MCP config: %s", cli_name, exc)
-            errors[cli_name] = str(exc)
+            for host in configured:
+                errors[host] = joined
+        configured = []
 
     return {
         "status": "ok",

package/hud/omg-hud.mjs

@@ -87,7 +87,7 @@ function readOmgVersion() {
     // fall through to static fallback
   }
 
-  return "2.2.4";
+  return "2.2.5";
 }
 
 const OMG_VERSION = readOmgVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trac3er/oh-my-god",
-  "version": "2.2.4",
+  "version": "2.2.5",
   "description": "OMG (Oh My God) — Multi-agent orchestration, evidence-backed verification, and durable session state for Claude Code, Codex, and supported agent hosts",
   "main": "OMG-setup.sh",
   "scripts": {

package/plugins/advanced/commands/OMG-code-review.md

@@ -0,0 +1,114 @@
+---
+description: Deep code review — reads file completely, checks line-by-line for issues, then analyzes whole-file structure. Enforces code hygiene.
+allowed-tools: Read, Bash(cat:*), Bash(grep:*), Bash(wc:*), Bash(head:*), Bash(find:*), Bash(rg:*), Grep, Glob
+argument-hint: "[file path or 'recent' for git-changed files]"
+---
+
+# /OMG:code-review — Line-by-Line + Structural Review
+
+## Philosophy
+Two passes: LINE-BY-LINE precision, then WHOLE-FILE understanding.
+Don't just scan — READ and UNDERSTAND every line.
+
+## Step 1: Determine Scope
+
+- If file specified: review that file
+- If "recent" or no argument: review uncommitted changes
+  ```bash
+  git diff --name-only HEAD 2>/dev/null
+  git diff --cached --name-only 2>/dev/null
+  ```
+
+## Step 2: Read the FULL File First
+
+Read the ENTIRE file. Not just the changed part. Not just a function.
+Understanding comes from seeing the whole context.
+
+Note:
+- What does this file DO? (its purpose in the system)
+- What are its DEPENDENCIES? (imports, calls)
+- What does it EXPORT? (public API)
+
+## Step 3: Line-by-Line Scan
+
+For each line, check:
+
+**Correctness:**
+- Logic errors (off-by-one, null checks, type mismatches)
+- Missing error handling (unhandled promises, bare except, no null check)
+- Race conditions (shared state, async without await, unchecked concurrent access)
+
+**Security (if auth/payment/database):**
+- Hardcoded secrets → CRITICAL
+- SQL injection (string concatenation in queries) → CRITICAL
+- XSS (innerHTML, dangerouslySetInnerHTML) → HIGH
+- Missing input validation → MEDIUM
+- Overly permissive CORS/cookies → MEDIUM
+
+**Hygiene:**
+- Dead code (unused imports, variables, unreachable branches)
+- Noise comments ("increment i", "return result", "constructor")
+- console.log/print left in production code
+- TODO/FIXME/HACK without tracking
+- Overly complex functions (>40 lines → suggest extract)
+- Duplicated logic (same pattern in 2+ places → suggest DRY)
+
+## Step 4: Whole-File Structure Analysis
+
+After line-by-line:
+- Does the file do ONE thing well, or is it a dumping ground?
+- Are functions ordered logically? (public first, helpers after, or lifecycle order)
+- Is naming consistent? (camelCase throughout? PascalCase for classes?)
+- Does it follow the project's domain pattern? (check .omg/knowledge/domain-patterns/)
+- Any circular dependencies?
+- Is error handling consistent across all functions?
+
+## Step 5: Report
+
+```
+Code Review — [file]
+━━━━━━━━━━━━━━━━━━━━
+
+Structure: [CLEAN | NEEDS_WORK | MESSY]
+Security:  [SAFE | REVIEW_NEEDED | CRITICAL]
+Hygiene:   [CLEAN | NEEDS_CLEANUP]
+
+Issues:
+  [line:col] CRITICAL: [description]
+  [line:col] HIGH: [description]
+  [line:col] MEDIUM: [description]
+  [line:col] LOW: [description]
+
+Dead Code:
+  [line] unused import: [name]
+  [line] unreachable after return
+
+Noise Comments (remove these):
+  [line] "// increment counter"
+  [line] "// return the value"
+
+Structural:
+  - [function] is [N] lines — consider extracting [suggestion]
+  - [pattern] duplicated at lines [X] and [Y]
+
+Recommendation: [summary of what to fix, in priority order]
+```
+
+## Step 6: For Security-Critical Files
+
+If the file touches auth, payment, or database:
+```
+/OMG:escalate codex "Line-by-line security review of [file]. Check:
+1. Every input validation point
+2. Every database query for injection
+3. Every auth check for bypass
+4. Every secret reference for hardcoding
+Report: line numbers + severity + fix suggestion"
+```
+
+## Anti-patterns
+- DON'T skim and say "looks good" — read every line
+- DON'T only check the diff — read the full file for context
+- DON'T ignore test files — they can have real issues too
+- DON'T add more noise comments as "fixes" — remove them instead
+- DON'T suggest unnecessary code as improvements