@trac3er/oh-my-god 2.2.4 → 2.2.5

package/scripts/omg.py

@@ -47,6 +47,7 @@ from runtime.data_lineage import build_lineage_manifest
 from runtime.eval_gate import evaluate_trace
 from runtime.incident_replay import build_incident_pack
 from runtime.domain_packs import get_domain_pack_contract
+from runtime.doc_generator import generate_docs
 from runtime.preflight import run_preflight
 from runtime.remote_supervisor import issue_local_supervisor_session, verify_local_supervisor_token
 from runtime.security_check import run_security_check
@@ -67,10 +68,12 @@ from runtime.compat import (
     list_compat_skill_contracts,
     list_compat_skills,
     run_doctor,
+    run_doctor_fix,
 )
 from runtime.validate import run_validate, format_text as validate_format_text
 from runtime.plugin_diagnostics import approve_plugin, run_plugin_diagnostics
 from runtime.adoption import CANONICAL_VERSION, VALID_PRESETS
+from runtime.install_planner import compute_install_plan, execute_plan, InstallAction
 from runtime.canonical_surface import get_canonical_hosts
 from runtime.ecosystem import ecosystem_status, list_ecosystem_repos, sync_ecosystem_repos
 from runtime.team_router import TeamDispatchRequest, dispatch_team, execute_ccg_mode, execute_crazy_mode
@@ -1159,6 +1162,29 @@ def cmd_profile_review(args: argparse.Namespace) -> int:
 
 def cmd_doctor(args: argparse.Namespace) -> int:
     fmt = getattr(args, "format", "text")
+    fix_mode = getattr(args, "fix", False)
+    dry_run = getattr(args, "dry_run", False)
+
+    if fix_mode:
+        result = run_doctor_fix(root_dir=ROOT_DIR, dry_run=dry_run)
+        if fmt == "json":
+            print(json.dumps(result, indent=2))
+        else:
+            mode_label = "DRY RUN" if dry_run else "FIX"
+            print(f"Doctor ({mode_label})")
+            for check in result["checks"]:
+                marker = "PASS" if check["status"] == "ok" else ("BLOCKER" if check["status"] == "blocker" else "WARN")
+                fix_tag = " [fixable]" if check.get("fixable") else ""
+                req_tag = "" if check["required"] else " (optional)"
+                print(f"  {marker:>7} {check['name']}: {check['message']}{req_tag}{fix_tag}")
+            for receipt in result.get("fix_receipts", []):
+                executed_tag = "applied" if receipt["executed"] else "planned"
+                print(f"  FIX [{executed_tag}] {receipt['check']}: {receipt['action']}")
+            blockers = sum(1 for c in result["checks"] if c["status"] == "blocker")
+            fixes = len(result.get("fix_receipts", []))
+            print(f"\nBLOCKER [{blockers}] | FIXES [{fixes}]")
+        return 0 if result["status"] == "pass" else 1
+
     result = run_doctor(root_dir=ROOT_DIR)
     if fmt == "json":
         print(json.dumps(result, indent=2))
@@ -1174,6 +1200,126 @@ def cmd_doctor(args: argparse.Namespace) -> int:
     return 0 if result["status"] == "pass" else 1
 
 
+def _detect_clis() -> dict[str, Any]:
+    """Detect which host CLIs are available on PATH."""
+    import shutil
+
+    hosts = {"codex": "codex", "gemini": "gemini", "kimi": "kimi"}
+    result: dict[str, Any] = {}
+    for host, binary in hosts.items():
+        result[host] = {"detected": shutil.which(binary) is not None}
+    return result
+
+
+def _install_action_to_dict(action: InstallAction) -> dict[str, Any]:
+    return {
+        "host": action.host,
+        "target_path": action.target_path,
+        "description": action.description,
+        "kind": action.kind,
+    }
+
+
+def _format_install_plan_text(plan_data: dict[str, Any]) -> str:
+    lines: list[str] = ["Install Plan"]
+    blockers = plan_data.get("integrity_errors", [])
+    if blockers:
+        lines.append(f"  BLOCKERS ({len(blockers)}):")
+        for b in blockers:
+            lines.append(f"    - {b}")
+    actions = plan_data.get("actions", [])
+    lines.append(f"  Actions ({len(actions)}):")
+    for a in actions:
+        lines.append(f"    [{a['host']}] {a['description']} -> {a['target_path']}")
+    lines.append(f"  Pre-checks: {', '.join(plan_data.get('pre_checks', []))}")
+    lines.append(f"  Post-checks: {', '.join(plan_data.get('post_checks', []))}")
+    return "\n".join(lines)
+
+
+def _format_install_dryrun_text(result_data: dict[str, Any]) -> str:
+    lines: list[str] = ["Install Dry-Run Result"]
+    lines.append(f"  Executed: {result_data.get('executed', False)}")
+    errors = result_data.get("errors", [])
+    if errors:
+        lines.append(f"  Errors ({len(errors)}):")
+        for e in errors:
+            lines.append(f"    - {e}")
+    completed = result_data.get("actions_completed", [])
+    skipped = result_data.get("actions_skipped", [])
+    lines.append(f"  Actions completed: {len(completed)}")
+    lines.append(f"  Actions skipped: {len(skipped)}")
+    for s in skipped:
+        lines.append(f"    skipped: {s}")
+    return "\n".join(lines)
+
+
+def cmd_install(args: argparse.Namespace) -> int:
+    fmt = getattr(args, "format", "text")
+    preset = getattr(args, "preset", "balanced")
+    mode = getattr(args, "mode", "omg-only")
+    do_plan = getattr(args, "plan", False)
+    do_dry_run = getattr(args, "dry_run", False)
+
+    if not do_plan and not do_dry_run:
+        if fmt == "json":
+            print(json.dumps({"error": "specify --plan or --dry-run"}, indent=2))
+        else:
+            print("Error: specify --plan or --dry-run")
+        return 1
+
+    detected_clis = _detect_clis()
+    plan = compute_install_plan(
+        project_dir=str(ROOT_DIR),
+        detected_clis=detected_clis,
+        preset=preset,
+        mode=mode,
+        selected_ids=None,
+    )
+
+    from runtime.install_planner import _verify_install_integrity
+    integrity_errors = _verify_install_integrity(Path(plan.source_root))
+
+    if do_plan:
+        plan_data: dict[str, Any] = {
+            "schema": "InstallPlan",
+            "actions": [_install_action_to_dict(a) for a in plan.actions],
+            "pre_checks": plan.pre_checks,
+            "post_checks": plan.post_checks,
+            "source_root": plan.source_root,
+            "integrity_errors": integrity_errors,
+        }
+        if integrity_errors:
+            plan_data["status"] = "blocked"
+            if fmt == "json":
+                print(json.dumps(plan_data, indent=2))
+            else:
+                print(_format_install_plan_text(plan_data))
+            return 1
+        plan_data["status"] = "ok"
+        if fmt == "json":
+            print(json.dumps(plan_data, indent=2))
+        else:
+            print(_format_install_plan_text(plan_data))
+        return 0
+
+    result = execute_plan(plan, dry_run=True)
+    result_data: dict[str, Any] = {
+        "schema": "InstallResult",
+        "executed": result["executed"],
+        "actions_completed": result["actions_completed"],
+        "actions_skipped": result["actions_skipped"],
+        "receipt": result["receipt"],
+        "errors": result["errors"],
+        "integrity_errors": integrity_errors,
+        "actions": [_install_action_to_dict(a) for a in plan.actions],
+    }
+    has_errors = bool(result["errors"]) or bool(integrity_errors)
+    if fmt == "json":
+        print(json.dumps(result_data, indent=2, default=str))
+    else:
+        print(_format_install_dryrun_text(result_data))
+    return 1 if has_errors else 0
+
 
 def cmd_validate(args: argparse.Namespace) -> int:
     fmt = getattr(args, "format", "text")
@@ -1237,6 +1383,77 @@ def _add_release_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> N
     release_readiness.set_defaults(func=cmd_release_readiness)
 
 
+def cmd_docs_generate(args: argparse.Namespace) -> int:
+    output_root = Path(args.output_root) if args.output_root else ROOT_DIR / ".sisyphus" / "tmp" / "generated-docs"
+    
+    if args.check:
+        import tempfile
+        import shutil
+        with tempfile.TemporaryDirectory() as tmp_dir:
+            tmp_path = Path(tmp_dir)
+            result = generate_docs(tmp_path)
+            if result["status"] != "ok":
+                print(f"Failed to generate docs for check: {result.get('error', 'Unknown error')}")
+                return 1
+            
+            drift = []
+            # We check artifacts that are supposed to be at the repo root if output_root was not specified
+            # The task says: "regenerates INSTALL-VERIFICATION-INDEX.md and QUICK-REFERENCE.md at the repo root"
+            # But generate_docs writes to output_root.
+            # If output_root is specified, we should probably check against that.
+            # If not, we check against ROOT_DIR for the root docs.
+            
+            check_targets = [
+                ("INSTALL-VERIFICATION-INDEX.md", ROOT_DIR / "INSTALL-VERIFICATION-INDEX.md"),
+                ("QUICK-REFERENCE.md", ROOT_DIR / "QUICK-REFERENCE.md"),
+            ]
+            
+            for name, on_disk_path in check_targets:
+                generated_content = (tmp_path / name).read_text(encoding="utf-8")
+                if not on_disk_path.exists():
+                    drift.append(f"Missing on disk: {name}")
+                    continue
+                on_disk_content = on_disk_path.read_text(encoding="utf-8")
+                if generated_content != on_disk_content:
+                    drift.append(f"Content drift: {name}")
+            
+            if drift:
+                print("Doc check FAILED. Drift detected:")
+                for d in drift:
+                    print(f"  - {d}")
+                print("\nRun 'python3 scripts/omg.py docs generate' to fix.")
+                return 1
+            
+            print("Doc check PASSED. No drift detected.")
+            return 0
+
+    result = generate_docs(output_root)
+    if result["status"] == "ok":
+        # If output_root was default, we also copy the root docs to ROOT_DIR
+        if not args.output_root:
+            for name in ["INSTALL-VERIFICATION-INDEX.md", "QUICK-REFERENCE.md"]:
+                src = output_root / name
+                dst = ROOT_DIR / name
+                dst.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
+                print(f"Updated root doc: {name}")
+
+        print(f"Successfully generated docs at: {result['output_root']}")
+        for artifact in result["artifacts"]:
+            print(f"  - {artifact}")
+        return 0
+    print(f"Failed to generate docs: {result.get('error', 'Unknown error')}")
+    return 1
+
+
+def _add_docs_subcommands(parent: argparse.ArgumentParser, *, dest: str) -> None:
+    sub = parent.add_subparsers(dest=dest)
+
+    generate = sub.add_parser("generate", help="Generate machine-readable and human-readable docs")
+    generate.add_argument("--output-root", default="", help="Output directory for generated docs")
+    generate.add_argument("--check", action="store_true", help="Exit non-zero if generated docs differ from disk")
+    generate.set_defaults(func=cmd_docs_generate)
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="omg", description=f"OMG {CANONICAL_VERSION} CLI")
     sub = parser.add_subparsers(dest="command", required=True)
@@ -1503,6 +1720,8 @@ def build_parser() -> argparse.ArgumentParser:
 
     doctor = sub.add_parser("doctor", help="Canonical install and runtime verification")
     doctor.add_argument("--format", default="text", choices=["text", "json"], dest="format")
+    doctor.add_argument("--fix", action="store_true", default=False, help="Attempt to fix failing checks")
+    doctor.add_argument("--dry-run", action="store_true", default=False, dest="dry_run", help="Plan fixes without applying (requires --fix)")
     doctor.set_defaults(func=cmd_doctor)
 
     validate = sub.add_parser("validate", help="Canonical validation — doctor + contract + profile + install")
@@ -1526,6 +1745,17 @@ def build_parser() -> argparse.ArgumentParser:
     profile_review.add_argument("--format", default="json", choices=["json", "text"], dest="format")
     profile_review.set_defaults(func=cmd_profile_review)
 
+    docs = sub.add_parser("docs", help="OMG documentation generator")
+    _add_docs_subcommands(docs, dest="docs_command")
+
+    install = sub.add_parser("install", help="Compute or dry-run an install plan via install_planner")
+    install.add_argument("--plan", action="store_true", help="Emit structured action plan without mutations")
+    install.add_argument("--dry-run", action="store_true", help="Compute actions and emit receipts without mutations")
+    install.add_argument("--format", default="text", choices=["text", "json"], dest="format")
+    install.add_argument("--preset", default="balanced", choices=list(VALID_PRESETS))
+    install.add_argument("--mode", default="omg-only", choices=["omg-only", "coexist"])
+    install.set_defaults(func=cmd_install)
+
     return parser
 
 

package/scripts/settings-merge.py

@@ -16,7 +16,13 @@ import sys
 import os
 import re
 import shutil
+import tempfile
 from datetime import datetime
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+from runtime.config_transaction import ConfigTransaction
+from runtime.mcp_config_writers import _atomic_write_text_safe
 
 def load_json(path):
     if not os.path.exists(path):
@@ -258,16 +264,16 @@ def main():
                 print(f"permissions.{cat} to add: {len(added)} rules", file=sys.stderr)
         return
 
-    # Backup existing
-    if os.path.exists(existing_path):
-        ts = datetime.now().strftime("%Y%m%d_%H%M%S")
-        backup = f"{existing_path}.bak.{ts}"
-        shutil.copy2(existing_path, backup)
-        print(f"📦 Backed up: {backup}")
-
-    with open(existing_path, "w") as f:
-        json.dump(merged, f, indent=2)
-        f.write("\n")
+    tx_lock_dir = Path(tempfile.mkdtemp(prefix="omg-merge-"))
+    tx = ConfigTransaction(lock_path=tx_lock_dir / "tx.lock")
+    tx.plan(Path(existing_path), json.dumps(merged, indent=2) + "\n", mode=0o644)
+    receipt = tx.execute()
+    try:
+        (tx_lock_dir / "tx.lock").unlink(missing_ok=True)
+        tx_lock_dir.rmdir()
+    except OSError:
+        pass
+    print(f"📦 Backed up: {receipt['backup_path']}")
 
     print(f"✅ Merged into: {existing_path}")
 

package/settings.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "_comment": "OMG 2.2.4 - project-level config with hook registrations, presets, and feature flags.",
+  "_comment": "OMG 2.2.5 - project-level config with hook registrations, presets, and feature flags.",
   "permissions": {
     "allow": [
       "Agent",
@@ -208,16 +208,6 @@
         ],
         "matcher": "Read|Write|Edit|MultiEdit"
       },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$HOME/.claude/omg-runtime/.venv/bin/python\" \"$HOME/.claude/hooks/terms-guard.py\"",
-            "timeout": 10
-          }
-        ],
-        "matcher": "Write|Edit|MultiEdit"
-      },
       {
         "hooks": [
           {
@@ -316,7 +306,7 @@
     ]
   },
   "_omg": {
-    "_version": "2.2.4",
+    "_version": "2.2.5",
     "preset": "safe",
     "omgMode": "focused",
     "default_mode": "ulw+ralph",
@@ -376,7 +366,7 @@
       "NOTEBOOKLM": false
     },
     "generated": {
-      "contract_version": "2.2.4",
+      "contract_version": "2.2.5",
       "channel": "enterprise",
       "required_bundles": [
         "control-plane",
@@ -615,8 +605,22 @@
       },
       "subagents": [
         {
-          "name": "security-reviewer",
-          "description": "Read-only security review subagent with scoped tool access.",
+          "name": "architect-planner",
+          "description": "Read-only planning subagent. Analyses structure, proposes plans, produces evidence. No mutations.",
+          "tools": [
+            "Read",
+            "Grep",
+            "Glob",
+            "Bash(git log *)",
+            "Bash(git diff *)",
+            "Bash(python3 scripts/omg.py *)",
+            "WebSearch"
+          ],
+          "bypassPermissions": false
+        },
+        {
+          "name": "explorer-indexer",
+          "description": "Read-only codebase exploration subagent. Searches, indexes, and answers structural questions.",
           "tools": [
             "Read",
             "Grep",
@@ -629,16 +633,18 @@
           "bypassPermissions": false
         },
         {
-          "name": "release-manager",
-          "description": "Release management subagent with write access governed by protected-path policy.",
+          "name": "implementer",
+          "description": "Write-capable implementation subagent governed by protected-path policy and mutation gate.",
           "tools": [
             "Read",
             "Write",
             "Edit",
+            "MultiEdit",
             "Grep",
             "Glob",
             "Bash(git *)",
-            "Bash(python3 scripts/omg.py *)"
+            "Bash(python3 *)",
+            "Bash(pytest *)"
           ],
           "bypassPermissions": false,
           "protectedPaths": [
@@ -647,6 +653,47 @@
             ".codex/**",
             ".claude/**"
           ]
+        },
+        {
+          "name": "security-reviewer",
+          "description": "Read-only security review subagent with scoped tool access.",
+          "tools": [
+            "Read",
+            "Grep",
+            "Glob",
+            "Bash(grep *)",
+            "Bash(find *)",
+            "Bash(git log *)",
+            "Bash(git diff *)"
+          ],
+          "bypassPermissions": false
+        },
+        {
+          "name": "verifier",
+          "description": "Read-only verification subagent. Runs tests, lints, and produces evidence without mutations.",
+          "tools": [
+            "Read",
+            "Grep",
+            "Glob",
+            "Bash(python3 -m pytest *)",
+            "Bash(python3 scripts/omg.py *)",
+            "Bash(git diff *)"
+          ],
+          "bypassPermissions": false
+        },
+        {
+          "name": "causal-tracer",
+          "description": "Read-only causal analysis subagent. Traces errors, diffs, and logs to root causes.",
+          "tools": [
+            "Read",
+            "Grep",
+            "Glob",
+            "Bash(git log *)",
+            "Bash(git diff *)",
+            "Bash(git blame *)",
+            "Bash(grep *)"
+          ],
+          "bypassPermissions": false
         }
       ],
       "skills": [