oh-my-codex 0.1.1

package/skills/code-review/SKILL.md

@@ -0,0 +1,208 @@
+---
+name: code-review
+description: Run a comprehensive code review
+---
+
+# Code Review Skill
+
+Conduct a thorough code review for quality, security, and maintainability with severity-rated feedback.
+
+## When to Use
+
+This skill activates when:
+- User requests "review this code", "code review"
+- Before merging a pull request
+- After implementing a major feature
+- User wants quality assessment
+
+## What It Does
+
+Delegates to the `code-reviewer` agent (Opus model) for deep analysis:
+
+1. **Identify Changes**
+   - Run `git diff` to find changed files
+   - Determine scope of review (specific files or entire PR)
+
+2. **Review Categories**
+   - **Security** - Hardcoded secrets, injection risks, XSS, CSRF
+   - **Code Quality** - Function size, complexity, nesting depth
+   - **Performance** - Algorithm efficiency, N+1 queries, caching
+   - **Best Practices** - Naming, documentation, error handling
+   - **Maintainability** - Duplication, coupling, testability
+
+3. **Severity Rating**
+   - **CRITICAL** - Security vulnerability (must fix before merge)
+   - **HIGH** - Bug or major code smell (should fix before merge)
+   - **MEDIUM** - Minor issue (fix when possible)
+   - **LOW** - Style/suggestion (consider fixing)
+
+4. **Specific Recommendations**
+   - File:line locations for each issue
+   - Concrete fix suggestions
+   - Code examples where applicable
+
+## Agent Delegation
+
+```
+spawn_sub_agent(
+  subagent_type="oh-my-codex:code-reviewer",
+  model="opus",
+  prompt="CODE REVIEW TASK
+
+Review code changes for quality, security, and maintainability.
+
+Scope: [git diff or specific files]
+
+Review Checklist:
+- Security vulnerabilities (OWASP Top 10)
+- Code quality (complexity, duplication)
+- Performance issues (N+1, inefficient algorithms)
+- Best practices (naming, documentation, error handling)
+- Maintainability (coupling, testability)
+
+Output: Code review report with:
+- Files reviewed count
+- Issues by severity (CRITICAL, HIGH, MEDIUM, LOW)
+- Specific file:line locations
+- Fix recommendations
+- Approval recommendation (APPROVE / REQUEST CHANGES / COMMENT)"
+)
+```
+
+## External Model Consultation (Preferred)
+
+The code-reviewer agent SHOULD consult Codex for cross-validation.
+
+### Protocol
+1. **Form your OWN review FIRST** - Complete the review independently
+2. **Consult for validation** - Cross-check findings with Codex
+3. **Critically evaluate** - Never blindly adopt external findings
+4. **Graceful fallback** - Never block if tools unavailable
+
+### When to Consult
+- Security-sensitive code changes
+- Complex architectural patterns
+- Unfamiliar codebases or languages
+- High-stakes production code
+
+### When to Skip
+- Simple refactoring
+- Well-understood patterns
+- Time-critical reviews
+- Small, isolated changes
+
+### Tool Usage
+Before first MCP tool use, call `ToolSearch("mcp")` to discover deferred MCP tools.
+Use `mcp__x__ask_codex` with `agent_role: "code-reviewer"`.
+If ToolSearch finds no MCP tools, fall back to the `code-reviewer` Claude agent.
+
+**Note:** Codex calls can take up to 1 hour. Consider the review timeline before consulting.
+
+## Output Format
+
+```
+CODE REVIEW REPORT
+==================
+
+Files Reviewed: 8
+Total Issues: 15
+
+CRITICAL (0)
+-----------
+(none)
+
+HIGH (3)
+--------
+1. src/api/auth.ts:42
+   Issue: User input not sanitized before SQL query
+   Risk: SQL injection vulnerability
+   Fix: Use parameterized queries or ORM
+
+2. src/components/UserProfile.tsx:89
+   Issue: Password displayed in plain text in logs
+   Risk: Credential exposure
+   Fix: Remove password from log statements
+
+3. src/utils/validation.ts:15
+   Issue: Email regex allows invalid formats
+   Risk: Accepts malformed emails
+   Fix: Use proven email validation library
+
+MEDIUM (7)
+----------
+...
+
+LOW (5)
+-------
+...
+
+RECOMMENDATION: REQUEST CHANGES
+
+Critical security issues must be addressed before merge.
+```
+
+## Review Checklist
+
+The code-reviewer agent checks:
+
+### Security
+- [ ] No hardcoded secrets (API keys, passwords, tokens)
+- [ ] All user inputs sanitized
+- [ ] SQL/NoSQL injection prevention
+- [ ] XSS prevention (escaped outputs)
+- [ ] CSRF protection on state-changing operations
+- [ ] Authentication/authorization properly enforced
+
+### Code Quality
+- [ ] Functions < 50 lines (guideline)
+- [ ] Cyclomatic complexity < 10
+- [ ] No deeply nested code (> 4 levels)
+- [ ] No duplicate logic (DRY principle)
+- [ ] Clear, descriptive naming
+
+### Performance
+- [ ] No N+1 query patterns
+- [ ] Appropriate caching where applicable
+- [ ] Efficient algorithms (avoid O(n²) when O(n) possible)
+- [ ] No unnecessary re-renders (React/Vue)
+
+### Best Practices
+- [ ] Error handling present and appropriate
+- [ ] Logging at appropriate levels
+- [ ] Documentation for public APIs
+- [ ] Tests for critical paths
+- [ ] No commented-out code
+
+## Approval Criteria
+
+**APPROVE** - No CRITICAL or HIGH issues, minor improvements only
+**REQUEST CHANGES** - CRITICAL or HIGH issues present
+**COMMENT** - Only LOW/MEDIUM issues, no blocking concerns
+
+## Use with Other Skills
+
+**With Pipeline:**
+```
+/pipeline review "implement user authentication"
+```
+Includes code review as part of implementation workflow.
+
+**With Ralph:**
+```
+/ralph code-review then fix all issues
+```
+Review code, get feedback, fix until approved.
+
+**With Ultrawork:**
+```
+/ultrawork review all files in src/
+```
+Parallel code review across multiple files.
+
+## Best Practices
+
+- **Review early** - Catch issues before they compound
+- **Review often** - Small, frequent reviews better than huge ones
+- **Address CRITICAL/HIGH first** - Fix security and bugs immediately
+- **Consider context** - Some "issues" may be intentional trade-offs
+- **Learn from reviews** - Use feedback to improve coding practices

package/skills/configure-discord/SKILL.md

@@ -0,0 +1,256 @@
+---
+name: configure-discord
+description: Configure Discord webhook/bot notifications via natural language
+triggers:
+  - "configure discord"
+  - "setup discord"
+  - "discord notifications"
+  - "discord webhook"
+---
+
+# Configure Discord Notifications
+
+Set up Discord notifications so OMX can ping you when sessions end, need input, or complete background tasks.
+
+## How This Skill Works
+
+This is an interactive, natural-language configuration skill. Walk the user through setup by asking questions with AskUserQuestion. Write the result to `~/.claude/.omx-config.json`.
+
+## Step 1: Detect Existing Configuration
+
+```bash
+CONFIG_FILE="$HOME/.claude/.omx-config.json"
+
+if [ -f "$CONFIG_FILE" ]; then
+  # Check for existing discord config
+  HAS_DISCORD=$(jq -r '.notifications.discord.enabled // false' "$CONFIG_FILE" 2>/dev/null)
+  HAS_DISCORD_BOT=$(jq -r '.notifications["discord-bot"].enabled // false' "$CONFIG_FILE" 2>/dev/null)
+  WEBHOOK_URL=$(jq -r '.notifications.discord.webhookUrl // empty' "$CONFIG_FILE" 2>/dev/null)
+  MENTION=$(jq -r '.notifications.discord.mention // empty' "$CONFIG_FILE" 2>/dev/null)
+
+  if [ "$HAS_DISCORD" = "true" ] || [ "$HAS_DISCORD_BOT" = "true" ]; then
+    echo "EXISTING_CONFIG=true"
+    echo "WEBHOOK_CONFIGURED=$HAS_DISCORD"
+    echo "BOT_CONFIGURED=$HAS_DISCORD_BOT"
+    [ -n "$WEBHOOK_URL" ] && echo "WEBHOOK_URL=$WEBHOOK_URL"
+    [ -n "$MENTION" ] && echo "MENTION=$MENTION"
+  else
+    echo "EXISTING_CONFIG=false"
+  fi
+else
+  echo "NO_CONFIG_FILE"
+fi
+```
+
+If existing config is found, show the user what's currently configured and ask if they want to update or reconfigure.
+
+## Step 2: Choose Discord Method
+
+Use AskUserQuestion:
+
+**Question:** "How would you like to send Discord notifications?"
+
+**Options:**
+1. **Webhook (Recommended)** - Create a webhook in your Discord channel. Simple, no bot needed. Just paste the URL.
+2. **Bot API** - Use a Discord bot token + channel ID. More flexible, requires a bot application.
+
+## Step 3A: Webhook Setup
+
+If user chose Webhook:
+
+Use AskUserQuestion:
+
+**Question:** "Paste your Discord webhook URL. To create one: Server Settings > Integrations > Webhooks > New Webhook > Copy URL"
+
+The user will type their webhook URL in the "Other" field.
+
+**Validate** the URL:
+- Must start with `https://discord.com/api/webhooks/` or `https://discordapp.com/api/webhooks/`
+- If invalid, explain the format and ask again
+
+## Step 3B: Bot API Setup
+
+If user chose Bot API:
+
+Ask two questions:
+
+1. **"Paste your Discord bot token"** - From discord.com/developers > Your App > Bot > Token
+2. **"Paste the channel ID"** - Right-click channel > Copy Channel ID (requires Developer Mode)
+
+## Step 4: Configure Mention (User Ping)
+
+Use AskUserQuestion:
+
+**Question:** "Would you like notifications to mention (ping) someone?"
+
+**Options:**
+1. **Yes, mention a user** - Tag a specific user by their Discord user ID
+2. **Yes, mention a role** - Tag a role by its role ID
+3. **No mentions** - Just post the message without pinging anyone
+
+### If user wants to mention a user:
+
+Ask: "What is the Discord user ID to mention? (Right-click user > Copy User ID, requires Developer Mode)"
+
+The mention format is: `<@USER_ID>` (e.g., `<@1465264645320474637>`)
+
+### If user wants to mention a role:
+
+Ask: "What is the Discord role ID to mention? (Server Settings > Roles > right-click role > Copy Role ID)"
+
+The mention format is: `<@&ROLE_ID>` (e.g., `<@&123456789>`)
+
+## Step 5: Configure Events
+
+Use AskUserQuestion with multiSelect:
+
+**Question:** "Which events should trigger Discord notifications?"
+
+**Options (multiSelect: true):**
+1. **Session end (Recommended)** - When a Claude session finishes
+2. **Input needed** - When Claude is waiting for your response (great for long-running tasks)
+3. **Session start** - When a new session begins
+4. **Session continuing** - When a persistent mode keeps the session alive
+
+Default selection: session-end + ask-user-question.
+
+## Step 6: Optional Username Override
+
+Use AskUserQuestion:
+
+**Question:** "Custom bot display name? (Shows as the webhook sender name in Discord)"
+
+**Options:**
+1. **OMX (default)** - Display as "OMX"
+2. **Codex CLI** - Display as "Codex CLI"
+3. **Custom** - Enter a custom name
+
+## Step 7: Write Configuration
+
+Read the existing config, merge the new Discord settings, and write back:
+
+```bash
+CONFIG_FILE="$HOME/.claude/.omx-config.json"
+mkdir -p "$(dirname "$CONFIG_FILE")"
+
+if [ -f "$CONFIG_FILE" ]; then
+  EXISTING=$(cat "$CONFIG_FILE")
+else
+  EXISTING='{}'
+fi
+```
+
+### For Webhook method:
+
+Build the notifications object with the collected values and merge into `.omx-config.json` using jq:
+
+```bash
+# WEBHOOK_URL, MENTION, USERNAME are collected from user
+# EVENTS is the list of enabled events
+
+echo "$EXISTING" | jq \
+  --arg url "$WEBHOOK_URL" \
+  --arg mention "$MENTION" \
+  --arg username "$USERNAME" \
+  '.notifications = (.notifications // {enabled: true}) |
+   .notifications.enabled = true |
+   .notifications.discord = {
+     enabled: true,
+     webhookUrl: $url,
+     mention: (if $mention == "" then null else $mention end),
+     username: (if $username == "" then null else $username end)
+   }' > "$CONFIG_FILE"
+```
+
+### For Bot API method:
+
+```bash
+echo "$EXISTING" | jq \
+  --arg token "$BOT_TOKEN" \
+  --arg channel "$CHANNEL_ID" \
+  --arg mention "$MENTION" \
+  '.notifications = (.notifications // {enabled: true}) |
+   .notifications.enabled = true |
+   .notifications["discord-bot"] = {
+     enabled: true,
+     botToken: $token,
+     channelId: $channel,
+     mention: (if $mention == "" then null else $mention end)
+   }' > "$CONFIG_FILE"
+```
+
+### Add event-specific config if user didn't select all events:
+
+For each event NOT selected, disable it:
+
+```bash
+# Example: disable session-start if not selected
+echo "$(cat "$CONFIG_FILE")" | jq \
+  '.notifications.events = (.notifications.events // {}) |
+   .notifications.events["session-start"] = {enabled: false}' > "$CONFIG_FILE"
+```
+
+## Step 8: Test the Configuration
+
+After writing config, offer to send a test notification:
+
+Use AskUserQuestion:
+
+**Question:** "Send a test notification to verify the setup?"
+
+**Options:**
+1. **Yes, test now (Recommended)** - Send a test message to your Discord channel
+2. **No, I'll test later** - Skip testing
+
+### If testing:
+
+```bash
+# For webhook:
+curl -s -o /dev/null -w "%{http_code}" \
+  -H "Content-Type: application/json" \
+  -d "{\"content\": \"${MENTION:+$MENTION\\n}OMX test notification - Discord is configured!\"}" \
+  "$WEBHOOK_URL"
+```
+
+Report success or failure. If it fails, help the user debug (check URL, permissions, etc.).
+
+## Step 9: Confirm
+
+Display the final configuration summary:
+
+```
+Discord Notifications Configured!
+
+  Method:   Webhook / Bot API
+  Mention:  <@1465264645320474637> (or "none")
+  Events:   session-end, ask-user-question
+  Username: OMX
+
+Config saved to: ~/.claude/.omx-config.json
+
+You can also set these via environment variables:
+  OMX_DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
+  OMX_DISCORD_MENTION=<@1465264645320474637>
+
+To reconfigure: /configure-discord
+To configure Telegram: /configure-telegram
+```
+
+## Environment Variable Alternative
+
+Users can skip this wizard entirely by setting env vars in their shell profile:
+
+**Webhook method:**
+```bash
+export OMX_DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/..."
+export OMX_DISCORD_MENTION="<@1465264645320474637>"  # optional
+```
+
+**Bot API method:**
+```bash
+export OMX_DISCORD_NOTIFIER_BOT_TOKEN="your-bot-token"
+export OMX_DISCORD_NOTIFIER_CHANNEL="your-channel-id"
+export OMX_DISCORD_MENTION="<@1465264645320474637>"  # optional
+```
+
+Env vars are auto-detected by the notification system without needing `.omx-config.json`.

package/skills/configure-telegram/SKILL.md

@@ -0,0 +1,232 @@
+---
+name: configure-telegram
+description: Configure Telegram bot notifications via natural language
+triggers:
+  - "configure telegram"
+  - "setup telegram"
+  - "telegram notifications"
+  - "telegram bot"
+---
+
+# Configure Telegram Notifications
+
+Set up Telegram notifications so OMX can message you when sessions end, need input, or complete background tasks.
+
+## How This Skill Works
+
+This is an interactive, natural-language configuration skill. Walk the user through setup by asking questions with AskUserQuestion. Write the result to `~/.claude/.omx-config.json`.
+
+## Step 1: Detect Existing Configuration
+
+```bash
+CONFIG_FILE="$HOME/.claude/.omx-config.json"
+
+if [ -f "$CONFIG_FILE" ]; then
+  HAS_TELEGRAM=$(jq -r '.notifications.telegram.enabled // false' "$CONFIG_FILE" 2>/dev/null)
+  CHAT_ID=$(jq -r '.notifications.telegram.chatId // empty' "$CONFIG_FILE" 2>/dev/null)
+  PARSE_MODE=$(jq -r '.notifications.telegram.parseMode // "Markdown"' "$CONFIG_FILE" 2>/dev/null)
+
+  if [ "$HAS_TELEGRAM" = "true" ]; then
+    echo "EXISTING_CONFIG=true"
+    echo "CHAT_ID=$CHAT_ID"
+    echo "PARSE_MODE=$PARSE_MODE"
+  else
+    echo "EXISTING_CONFIG=false"
+  fi
+else
+  echo "NO_CONFIG_FILE"
+fi
+```
+
+If existing config is found, show the user what's currently configured and ask if they want to update or reconfigure.
+
+## Step 2: Create a Telegram Bot
+
+Guide the user through creating a bot if they don't have one:
+
+```
+To set up Telegram notifications, you need a Telegram bot token and your chat ID.
+
+CREATE A BOT (if you don't have one):
+1. Open Telegram and search for @BotFather
+2. Send /newbot
+3. Choose a name (e.g., "My OMX Notifier")
+4. Choose a username (e.g., "my_omc_bot")
+5. BotFather will give you a token like: 123456789:ABCdefGHIjklMNOpqrsTUVwxyz
+
+GET YOUR CHAT ID:
+1. Start a chat with your new bot (send /start)
+2. Visit: https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates
+3. Look for "chat":{"id":YOUR_CHAT_ID}
+   - Personal chat IDs are positive numbers (e.g., 123456789)
+   - Group chat IDs are negative numbers (e.g., -1001234567890)
+```
+
+## Step 3: Collect Bot Token
+
+Use AskUserQuestion:
+
+**Question:** "Paste your Telegram bot token (from @BotFather)"
+
+The user will type their token in the "Other" field.
+
+**Validate** the token:
+- Must match pattern: `digits:alphanumeric` (e.g., `123456789:ABCdefGHI...`)
+- If invalid, explain the format and ask again
+
+## Step 4: Collect Chat ID
+
+Use AskUserQuestion:
+
+**Question:** "Paste your Telegram chat ID (the number from getUpdates API)"
+
+The user will type their chat ID in the "Other" field.
+
+**Validate** the chat ID:
+- Must be a number (positive for personal, negative for groups)
+- If invalid, offer to help them find it:
+
+```bash
+# Help user find their chat ID
+BOT_TOKEN="USER_PROVIDED_TOKEN"
+echo "Fetching recent messages to find your chat ID..."
+curl -s "https://api.telegram.org/bot${BOT_TOKEN}/getUpdates" | jq '.result[-1].message.chat.id // .result[-1].message.from.id // "No messages found - send /start to your bot first"'
+```
+
+## Step 5: Choose Parse Mode
+
+Use AskUserQuestion:
+
+**Question:** "Which message format do you prefer?"
+
+**Options:**
+1. **Markdown (Recommended)** - Bold, italic, code blocks with Markdown syntax
+2. **HTML** - Bold, italic, code with HTML tags
+
+## Step 6: Configure Events
+
+Use AskUserQuestion with multiSelect:
+
+**Question:** "Which events should trigger Telegram notifications?"
+
+**Options (multiSelect: true):**
+1. **Session end (Recommended)** - When a Claude session finishes
+2. **Input needed** - When Claude is waiting for your response (great for long-running tasks)
+3. **Session start** - When a new session begins
+4. **Session continuing** - When a persistent mode keeps the session alive
+
+Default selection: session-end + ask-user-question.
+
+## Step 7: Write Configuration
+
+Read the existing config, merge the new Telegram settings, and write back:
+
+```bash
+CONFIG_FILE="$HOME/.claude/.omx-config.json"
+mkdir -p "$(dirname "$CONFIG_FILE")"
+
+if [ -f "$CONFIG_FILE" ]; then
+  EXISTING=$(cat "$CONFIG_FILE")
+else
+  EXISTING='{}'
+fi
+
+# BOT_TOKEN, CHAT_ID, PARSE_MODE are collected from user
+echo "$EXISTING" | jq \
+  --arg token "$BOT_TOKEN" \
+  --arg chatId "$CHAT_ID" \
+  --arg parseMode "$PARSE_MODE" \
+  '.notifications = (.notifications // {enabled: true}) |
+   .notifications.enabled = true |
+   .notifications.telegram = {
+     enabled: true,
+     botToken: $token,
+     chatId: $chatId,
+     parseMode: $parseMode
+   }' > "$CONFIG_FILE"
+```
+
+### Add event-specific config if user didn't select all events:
+
+For each event NOT selected, disable it:
+
+```bash
+# Example: disable session-start if not selected
+echo "$(cat "$CONFIG_FILE")" | jq \
+  '.notifications.events = (.notifications.events // {}) |
+   .notifications.events["session-start"] = {enabled: false}' > "$CONFIG_FILE"
+```
+
+## Step 8: Test the Configuration
+
+After writing config, offer to send a test notification:
+
+Use AskUserQuestion:
+
+**Question:** "Send a test notification to verify the setup?"
+
+**Options:**
+1. **Yes, test now (Recommended)** - Send a test message to your Telegram chat
+2. **No, I'll test later** - Skip testing
+
+### If testing:
+
+```bash
+BOT_TOKEN="USER_PROVIDED_TOKEN"
+CHAT_ID="USER_PROVIDED_CHAT_ID"
+PARSE_MODE="Markdown"
+
+RESPONSE=$(curl -s -w "\n%{http_code}" \
+  "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
+  -d "chat_id=${CHAT_ID}" \
+  -d "parse_mode=${PARSE_MODE}" \
+  -d "text=OMX test notification - Telegram is configured!")
+
+HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+BODY=$(echo "$RESPONSE" | head -1)
+
+if [ "$HTTP_CODE" = "200" ]; then
+  echo "Test notification sent successfully!"
+else
+  echo "Failed (HTTP $HTTP_CODE):"
+  echo "$BODY" | jq -r '.description // "Unknown error"' 2>/dev/null || echo "$BODY"
+fi
+```
+
+Report success or failure. Common issues:
+- **401 Unauthorized**: Bot token is invalid
+- **400 Bad Request: chat not found**: Chat ID is wrong, or user hasn't sent `/start` to the bot
+- **Network error**: Check connectivity to api.telegram.org
+
+## Step 9: Confirm
+
+Display the final configuration summary:
+
+```
+Telegram Notifications Configured!
+
+  Bot:        @your_bot_username
+  Chat ID:    123456789
+  Format:     Markdown
+  Events:     session-end, ask-user-question
+
+Config saved to: ~/.claude/.omx-config.json
+
+You can also set these via environment variables:
+  OMX_TELEGRAM_BOT_TOKEN=123456789:ABCdefGHI...
+  OMX_TELEGRAM_CHAT_ID=123456789
+
+To reconfigure: /configure-telegram
+To configure Discord: /configure-discord
+```
+
+## Environment Variable Alternative
+
+Users can skip this wizard entirely by setting env vars in their shell profile:
+
+```bash
+export OMX_TELEGRAM_BOT_TOKEN="123456789:ABCdefGHIjklMNOpqrsTUVwxyz"
+export OMX_TELEGRAM_CHAT_ID="123456789"
+```
+
+Env vars are auto-detected by the notification system without needing `.omx-config.json`.