oh-my-codex 0.15.3 → 0.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/Cargo.lock +10 -7
- package/Cargo.toml +1 -1
- package/README.md +3 -0
- package/crates/omx-explore/Cargo.toml +3 -0
- package/crates/omx-explore/src/main.rs +517 -16
- package/dist/autoresearch/goal.d.ts +90 -0
- package/dist/autoresearch/goal.d.ts.map +1 -0
- package/dist/autoresearch/goal.js +237 -0
- package/dist/autoresearch/goal.js.map +1 -0
- package/dist/autoresearch/skill-validation.d.ts +1 -0
- package/dist/autoresearch/skill-validation.d.ts.map +1 -1
- package/dist/autoresearch/skill-validation.js +10 -3
- package/dist/autoresearch/skill-validation.js.map +1 -1
- package/dist/catalog/__tests__/generator.test.js +9 -4
- package/dist/catalog/__tests__/generator.test.js.map +1 -1
- package/dist/catalog/__tests__/plugin-bundle-ssot.test.js +20 -1
- package/dist/catalog/__tests__/plugin-bundle-ssot.test.js.map +1 -1
- package/dist/catalog/__tests__/schema.test.js +14 -3
- package/dist/catalog/__tests__/schema.test.js.map +1 -1
- package/dist/catalog/schema.js +1 -1
- package/dist/catalog/schema.js.map +1 -1
- package/dist/cli/__tests__/autoresearch-goal.test.d.ts +2 -0
- package/dist/cli/__tests__/autoresearch-goal.test.d.ts.map +1 -0
- package/dist/cli/__tests__/autoresearch-goal.test.js +194 -0
- package/dist/cli/__tests__/autoresearch-goal.test.js.map +1 -0
- package/dist/cli/__tests__/cleanup.test.js +82 -1
- package/dist/cli/__tests__/cleanup.test.js.map +1 -1
- package/dist/cli/__tests__/codex-plugin-layout.test.js +7 -4
- package/dist/cli/__tests__/codex-plugin-layout.test.js.map +1 -1
- package/dist/cli/__tests__/doctor-warning-copy.test.js +23 -0
- package/dist/cli/__tests__/doctor-warning-copy.test.js.map +1 -1
- package/dist/cli/__tests__/explore.test.js +8 -1
- package/dist/cli/__tests__/explore.test.js.map +1 -1
- package/dist/cli/__tests__/index.test.js +82 -3
- package/dist/cli/__tests__/index.test.js.map +1 -1
- package/dist/cli/__tests__/launch-fallback.test.js +58 -0
- package/dist/cli/__tests__/launch-fallback.test.js.map +1 -1
- package/dist/cli/__tests__/native-assets.test.js +26 -1
- package/dist/cli/__tests__/native-assets.test.js.map +1 -1
- package/dist/cli/__tests__/package-bin-contract.test.js +2 -2
- package/dist/cli/__tests__/package-bin-contract.test.js.map +1 -1
- package/dist/cli/__tests__/performance-goal.test.d.ts +2 -0
- package/dist/cli/__tests__/performance-goal.test.d.ts.map +1 -0
- package/dist/cli/__tests__/performance-goal.test.js +144 -0
- package/dist/cli/__tests__/performance-goal.test.js.map +1 -0
- package/dist/cli/__tests__/question.test.js +8 -0
- package/dist/cli/__tests__/question.test.js.map +1 -1
- package/dist/cli/__tests__/ralph-goal-mode-contract.test.d.ts +2 -0
- package/dist/cli/__tests__/ralph-goal-mode-contract.test.d.ts.map +1 -0
- package/dist/cli/__tests__/ralph-goal-mode-contract.test.js +31 -0
- package/dist/cli/__tests__/ralph-goal-mode-contract.test.js.map +1 -0
- package/dist/cli/__tests__/ralph-prd-deep-interview.test.js +5 -4
- package/dist/cli/__tests__/ralph-prd-deep-interview.test.js.map +1 -1
- package/dist/cli/__tests__/ralph-prd-smoke.test.js +7 -0
- package/dist/cli/__tests__/ralph-prd-smoke.test.js.map +1 -1
- package/dist/cli/__tests__/setup-install-mode.test.js +57 -21
- package/dist/cli/__tests__/setup-install-mode.test.js.map +1 -1
- package/dist/cli/__tests__/setup-refresh.test.js +27 -8
- package/dist/cli/__tests__/setup-refresh.test.js.map +1 -1
- package/dist/cli/__tests__/setup-scope.test.js +18 -9
- package/dist/cli/__tests__/setup-scope.test.js.map +1 -1
- package/dist/cli/__tests__/setup-skill-validation.test.js +11 -11
- package/dist/cli/__tests__/setup-skill-validation.test.js.map +1 -1
- package/dist/cli/__tests__/setup-skills-overwrite.test.js +12 -12
- package/dist/cli/__tests__/setup-skills-overwrite.test.js.map +1 -1
- package/dist/cli/__tests__/team.test.js +187 -0
- package/dist/cli/__tests__/team.test.js.map +1 -1
- package/dist/cli/__tests__/ultragoal.test.d.ts +2 -0
- package/dist/cli/__tests__/ultragoal.test.d.ts.map +1 -0
- package/dist/cli/__tests__/ultragoal.test.js +106 -0
- package/dist/cli/__tests__/ultragoal.test.js.map +1 -0
- package/dist/cli/__tests__/uninstall.test.js +11 -0
- package/dist/cli/__tests__/uninstall.test.js.map +1 -1
- package/dist/cli/autoresearch-goal.d.ts +3 -0
- package/dist/cli/autoresearch-goal.d.ts.map +1 -0
- package/dist/cli/autoresearch-goal.js +175 -0
- package/dist/cli/autoresearch-goal.js.map +1 -0
- package/dist/cli/cleanup.d.ts +3 -1
- package/dist/cli/cleanup.d.ts.map +1 -1
- package/dist/cli/cleanup.js +42 -2
- package/dist/cli/cleanup.js.map +1 -1
- package/dist/cli/doctor.d.ts.map +1 -1
- package/dist/cli/doctor.js +49 -0
- package/dist/cli/doctor.js.map +1 -1
- package/dist/cli/explore.d.ts.map +1 -1
- package/dist/cli/explore.js +10 -2
- package/dist/cli/explore.js.map +1 -1
- package/dist/cli/index.d.ts +6 -2
- package/dist/cli/index.d.ts.map +1 -1
- package/dist/cli/index.js +145 -18
- package/dist/cli/index.js.map +1 -1
- package/dist/cli/native-assets.js +1 -1
- package/dist/cli/native-assets.js.map +1 -1
- package/dist/cli/performance-goal.d.ts +3 -0
- package/dist/cli/performance-goal.d.ts.map +1 -0
- package/dist/cli/performance-goal.js +186 -0
- package/dist/cli/performance-goal.js.map +1 -0
- package/dist/cli/ralph.d.ts.map +1 -1
- package/dist/cli/ralph.js +8 -0
- package/dist/cli/ralph.js.map +1 -1
- package/dist/cli/setup.d.ts.map +1 -1
- package/dist/cli/setup.js +13 -6
- package/dist/cli/setup.js.map +1 -1
- package/dist/cli/team.d.ts +2 -0
- package/dist/cli/team.d.ts.map +1 -1
- package/dist/cli/team.js +72 -17
- package/dist/cli/team.js.map +1 -1
- package/dist/cli/tmux-hook.d.ts.map +1 -1
- package/dist/cli/tmux-hook.js +2 -1
- package/dist/cli/tmux-hook.js.map +1 -1
- package/dist/cli/ultragoal.d.ts +3 -0
- package/dist/cli/ultragoal.d.ts.map +1 -0
- package/dist/cli/ultragoal.js +191 -0
- package/dist/cli/ultragoal.js.map +1 -0
- package/dist/cli/uninstall.d.ts.map +1 -1
- package/dist/cli/uninstall.js +4 -2
- package/dist/cli/uninstall.js.map +1 -1
- package/dist/config/__tests__/generator-idempotent.test.js +12 -1
- package/dist/config/__tests__/generator-idempotent.test.js.map +1 -1
- package/dist/config/__tests__/generator-notify.test.js +5 -0
- package/dist/config/__tests__/generator-notify.test.js.map +1 -1
- package/dist/config/commit-lore-guard.d.ts +3 -0
- package/dist/config/commit-lore-guard.d.ts.map +1 -0
- package/dist/config/commit-lore-guard.js +9 -0
- package/dist/config/commit-lore-guard.js.map +1 -0
- package/dist/config/generator.d.ts +3 -2
- package/dist/config/generator.d.ts.map +1 -1
- package/dist/config/generator.js +52 -8
- package/dist/config/generator.js.map +1 -1
- package/dist/config/omx-first-party-mcp.d.ts +1 -0
- package/dist/config/omx-first-party-mcp.d.ts.map +1 -1
- package/dist/config/omx-first-party-mcp.js +4 -1
- package/dist/config/omx-first-party-mcp.js.map +1 -1
- package/dist/goal-workflows/__tests__/artifacts.test.d.ts +2 -0
- package/dist/goal-workflows/__tests__/artifacts.test.d.ts.map +1 -0
- package/dist/goal-workflows/__tests__/artifacts.test.js +96 -0
- package/dist/goal-workflows/__tests__/artifacts.test.js.map +1 -0
- package/dist/goal-workflows/__tests__/codex-goal-snapshot.test.d.ts +2 -0
- package/dist/goal-workflows/__tests__/codex-goal-snapshot.test.d.ts.map +1 -0
- package/dist/goal-workflows/__tests__/codex-goal-snapshot.test.js +54 -0
- package/dist/goal-workflows/__tests__/codex-goal-snapshot.test.js.map +1 -0
- package/dist/goal-workflows/artifacts.d.ts +62 -0
- package/dist/goal-workflows/artifacts.d.ts.map +1 -0
- package/dist/goal-workflows/artifacts.js +132 -0
- package/dist/goal-workflows/artifacts.js.map +1 -0
- package/dist/goal-workflows/codex-goal-snapshot.d.ts +28 -0
- package/dist/goal-workflows/codex-goal-snapshot.d.ts.map +1 -0
- package/dist/goal-workflows/codex-goal-snapshot.js +110 -0
- package/dist/goal-workflows/codex-goal-snapshot.js.map +1 -0
- package/dist/goal-workflows/handoff.d.ts +10 -0
- package/dist/goal-workflows/handoff.d.ts.map +1 -0
- package/dist/goal-workflows/handoff.js +31 -0
- package/dist/goal-workflows/handoff.js.map +1 -0
- package/dist/goal-workflows/validation.d.ts +13 -0
- package/dist/goal-workflows/validation.d.ts.map +1 -0
- package/dist/goal-workflows/validation.js +36 -0
- package/dist/goal-workflows/validation.js.map +1 -0
- package/dist/hooks/__tests__/anti-slop-workflow.test.js +3 -3
- package/dist/hooks/__tests__/anti-slop-workflow.test.js.map +1 -1
- package/dist/hooks/__tests__/keyword-detector.test.js +45 -32
- package/dist/hooks/__tests__/keyword-detector.test.js.map +1 -1
- package/dist/hooks/__tests__/notify-fallback-watcher.test.js +3 -3
- package/dist/hooks/__tests__/notify-fallback-watcher.test.js.map +1 -1
- package/dist/hooks/__tests__/notify-hook-team-dispatch.test.js +2 -1
- package/dist/hooks/__tests__/notify-hook-team-dispatch.test.js.map +1 -1
- package/dist/hooks/__tests__/notify-hook-team-leader-nudge.test.js +17 -24
- package/dist/hooks/__tests__/notify-hook-team-leader-nudge.test.js.map +1 -1
- package/dist/hooks/__tests__/prompt-guidance-wave-two.test.js +3 -3
- package/dist/hooks/__tests__/prompt-guidance-wave-two.test.js.map +1 -1
- package/dist/hooks/__tests__/task-size-detector.test.js +1 -1
- package/dist/hooks/__tests__/task-size-detector.test.js.map +1 -1
- package/dist/hooks/__tests__/visual-ralph-skill.test.js +3 -3
- package/dist/hooks/__tests__/visual-ralph-skill.test.js.map +1 -1
- package/dist/hooks/__tests__/visual-verdict-loop.test.js +7 -11
- package/dist/hooks/__tests__/visual-verdict-loop.test.js.map +1 -1
- package/dist/hooks/agents-overlay.d.ts.map +1 -1
- package/dist/hooks/agents-overlay.js +2 -2
- package/dist/hooks/agents-overlay.js.map +1 -1
- package/dist/hooks/keyword-detector.d.ts.map +1 -1
- package/dist/hooks/keyword-detector.js +12 -13
- package/dist/hooks/keyword-detector.js.map +1 -1
- package/dist/hooks/keyword-registry.d.ts.map +1 -1
- package/dist/hooks/keyword-registry.js +2 -10
- package/dist/hooks/keyword-registry.js.map +1 -1
- package/dist/hooks/prompt-guidance-contract.d.ts.map +1 -1
- package/dist/hooks/prompt-guidance-contract.js +0 -4
- package/dist/hooks/prompt-guidance-contract.js.map +1 -1
- package/dist/hooks/session.js +2 -2
- package/dist/hooks/session.js.map +1 -1
- package/dist/hooks/task-size-detector.d.ts.map +1 -1
- package/dist/hooks/task-size-detector.js +1 -0
- package/dist/hooks/task-size-detector.js.map +1 -1
- package/dist/hud/__tests__/reconcile.test.js +29 -7
- package/dist/hud/__tests__/reconcile.test.js.map +1 -1
- package/dist/hud/reconcile.d.ts +2 -1
- package/dist/hud/reconcile.d.ts.map +1 -1
- package/dist/hud/reconcile.js +12 -0
- package/dist/hud/reconcile.js.map +1 -1
- package/dist/mcp/__tests__/bootstrap.test.js +15 -2
- package/dist/mcp/__tests__/bootstrap.test.js.map +1 -1
- package/dist/mcp/__tests__/state-paths.test.js +54 -0
- package/dist/mcp/__tests__/state-paths.test.js.map +1 -1
- package/dist/mcp/__tests__/state-server.test.js +36 -0
- package/dist/mcp/__tests__/state-server.test.js.map +1 -1
- package/dist/mcp/bootstrap.d.ts +1 -1
- package/dist/mcp/bootstrap.d.ts.map +1 -1
- package/dist/mcp/bootstrap.js +9 -7
- package/dist/mcp/bootstrap.js.map +1 -1
- package/dist/mcp/state-paths.d.ts +17 -0
- package/dist/mcp/state-paths.d.ts.map +1 -1
- package/dist/mcp/state-paths.js +36 -2
- package/dist/mcp/state-paths.js.map +1 -1
- package/dist/modes/__tests__/base-session-scope.test.js +26 -0
- package/dist/modes/__tests__/base-session-scope.test.js.map +1 -1
- package/dist/modes/base.d.ts +1 -0
- package/dist/modes/base.d.ts.map +1 -1
- package/dist/modes/base.js +35 -5
- package/dist/modes/base.js.map +1 -1
- package/dist/notifications/__tests__/http-client.test.d.ts +2 -0
- package/dist/notifications/__tests__/http-client.test.d.ts.map +1 -0
- package/dist/notifications/__tests__/http-client.test.js +90 -0
- package/dist/notifications/__tests__/http-client.test.js.map +1 -0
- package/dist/notifications/__tests__/notifier.test.js +22 -60
- package/dist/notifications/__tests__/notifier.test.js.map +1 -1
- package/dist/notifications/dispatcher.d.ts.map +1 -1
- package/dist/notifications/dispatcher.js +35 -60
- package/dist/notifications/dispatcher.js.map +1 -1
- package/dist/notifications/http-client.d.ts +22 -0
- package/dist/notifications/http-client.d.ts.map +1 -0
- package/dist/notifications/http-client.js +298 -0
- package/dist/notifications/http-client.js.map +1 -0
- package/dist/notifications/notifier.d.ts +3 -2
- package/dist/notifications/notifier.d.ts.map +1 -1
- package/dist/notifications/notifier.js +17 -22
- package/dist/notifications/notifier.js.map +1 -1
- package/dist/openclaw/__tests__/dispatcher.test.js +62 -1
- package/dist/openclaw/__tests__/dispatcher.test.js.map +1 -1
- package/dist/openclaw/dispatcher.d.ts.map +1 -1
- package/dist/openclaw/dispatcher.js +3 -2
- package/dist/openclaw/dispatcher.js.map +1 -1
- package/dist/performance-goal/artifacts.d.ts +76 -0
- package/dist/performance-goal/artifacts.d.ts.map +1 -0
- package/dist/performance-goal/artifacts.js +221 -0
- package/dist/performance-goal/artifacts.js.map +1 -0
- package/dist/pipeline/__tests__/stages.test.js +30 -5
- package/dist/pipeline/__tests__/stages.test.js.map +1 -1
- package/dist/pipeline/stages/team-exec.d.ts.map +1 -1
- package/dist/pipeline/stages/team-exec.js +2 -19
- package/dist/pipeline/stages/team-exec.js.map +1 -1
- package/dist/planning/__tests__/artifacts.test.js +16 -1
- package/dist/planning/__tests__/artifacts.test.js.map +1 -1
- package/dist/planning/artifacts.d.ts +1 -0
- package/dist/planning/artifacts.d.ts.map +1 -1
- package/dist/planning/artifacts.js +9 -12
- package/dist/planning/artifacts.js.map +1 -1
- package/dist/ralplan/__tests__/runtime.test.js +2 -0
- package/dist/ralplan/__tests__/runtime.test.js.map +1 -1
- package/dist/ralplan/runtime.d.ts.map +1 -1
- package/dist/ralplan/runtime.js +6 -0
- package/dist/ralplan/runtime.js.map +1 -1
- package/dist/scripts/__tests__/codex-native-hook.test.js +1516 -205
- package/dist/scripts/__tests__/codex-native-hook.test.js.map +1 -1
- package/dist/scripts/__tests__/hook-derived-watcher.test.js +33 -1
- package/dist/scripts/__tests__/hook-derived-watcher.test.js.map +1 -1
- package/dist/scripts/__tests__/run-test-files.test.js +36 -0
- package/dist/scripts/__tests__/run-test-files.test.js.map +1 -1
- package/dist/scripts/codex-native-hook.d.ts.map +1 -1
- package/dist/scripts/codex-native-hook.js +497 -51
- package/dist/scripts/codex-native-hook.js.map +1 -1
- package/dist/scripts/codex-native-pre-post.d.ts +7 -0
- package/dist/scripts/codex-native-pre-post.d.ts.map +1 -1
- package/dist/scripts/codex-native-pre-post.js +222 -19
- package/dist/scripts/codex-native-pre-post.js.map +1 -1
- package/dist/scripts/hook-derived-watcher.js +2 -1
- package/dist/scripts/hook-derived-watcher.js.map +1 -1
- package/dist/scripts/notify-fallback-watcher.js +2 -1
- package/dist/scripts/notify-fallback-watcher.js.map +1 -1
- package/dist/scripts/notify-hook/orchestration-intent.d.ts +1 -2
- package/dist/scripts/notify-hook/orchestration-intent.d.ts.map +1 -1
- package/dist/scripts/notify-hook/orchestration-intent.js +2 -3
- package/dist/scripts/notify-hook/orchestration-intent.js.map +1 -1
- package/dist/scripts/notify-hook/team-leader-nudge.d.ts +0 -2
- package/dist/scripts/notify-hook/team-leader-nudge.d.ts.map +1 -1
- package/dist/scripts/notify-hook/team-leader-nudge.js +8 -60
- package/dist/scripts/notify-hook/team-leader-nudge.js.map +1 -1
- package/dist/scripts/notify-hook/team-worker-stop.d.ts +15 -0
- package/dist/scripts/notify-hook/team-worker-stop.d.ts.map +1 -0
- package/dist/scripts/notify-hook/team-worker-stop.js +224 -0
- package/dist/scripts/notify-hook/team-worker-stop.js.map +1 -0
- package/dist/scripts/notify-hook/team-worker.d.ts.map +1 -1
- package/dist/scripts/notify-hook/team-worker.js +26 -18
- package/dist/scripts/notify-hook/team-worker.js.map +1 -1
- package/dist/scripts/run-test-files.js +17 -1
- package/dist/scripts/run-test-files.js.map +1 -1
- package/dist/scripts/sync-plugin-mirror.js +2 -2
- package/dist/scripts/sync-plugin-mirror.js.map +1 -1
- package/dist/state/__tests__/operations.test.js +26 -0
- package/dist/state/__tests__/operations.test.js.map +1 -1
- package/dist/state/__tests__/skill-active.test.js +35 -0
- package/dist/state/__tests__/skill-active.test.js.map +1 -1
- package/dist/state/operations.d.ts +3 -1
- package/dist/state/operations.d.ts.map +1 -1
- package/dist/state/operations.js +8 -4
- package/dist/state/operations.js.map +1 -1
- package/dist/state/skill-active.d.ts +1 -0
- package/dist/state/skill-active.d.ts.map +1 -1
- package/dist/state/skill-active.js +54 -13
- package/dist/state/skill-active.js.map +1 -1
- package/dist/team/__tests__/api-interop.test.js +59 -0
- package/dist/team/__tests__/api-interop.test.js.map +1 -1
- package/dist/team/__tests__/approved-execution.test.d.ts +2 -0
- package/dist/team/__tests__/approved-execution.test.d.ts.map +1 -0
- package/dist/team/__tests__/approved-execution.test.js +124 -0
- package/dist/team/__tests__/approved-execution.test.js.map +1 -0
- package/dist/team/__tests__/delivery-e2e-smoke.test.js +2 -4
- package/dist/team/__tests__/delivery-e2e-smoke.test.js.map +1 -1
- package/dist/team/__tests__/delivery-log.test.d.ts +2 -0
- package/dist/team/__tests__/delivery-log.test.d.ts.map +1 -0
- package/dist/team/__tests__/delivery-log.test.js +44 -0
- package/dist/team/__tests__/delivery-log.test.js.map +1 -0
- package/dist/team/__tests__/role-router.test.js +4 -4
- package/dist/team/__tests__/role-router.test.js.map +1 -1
- package/dist/team/__tests__/runtime-boxed-state.test.d.ts +2 -0
- package/dist/team/__tests__/runtime-boxed-state.test.d.ts.map +1 -0
- package/dist/team/__tests__/runtime-boxed-state.test.js +39 -0
- package/dist/team/__tests__/runtime-boxed-state.test.js.map +1 -0
- package/dist/team/__tests__/runtime.test.js +118 -6
- package/dist/team/__tests__/runtime.test.js.map +1 -1
- package/dist/team/__tests__/state-root.test.js +13 -0
- package/dist/team/__tests__/state-root.test.js.map +1 -1
- package/dist/team/__tests__/tmux-session.test.js +3 -0
- package/dist/team/__tests__/tmux-session.test.js.map +1 -1
- package/dist/team/__tests__/worker-bootstrap.test.js +50 -0
- package/dist/team/__tests__/worker-bootstrap.test.js.map +1 -1
- package/dist/team/api-interop.d.ts.map +1 -1
- package/dist/team/api-interop.js +4 -3
- package/dist/team/api-interop.js.map +1 -1
- package/dist/team/approved-execution.d.ts +37 -0
- package/dist/team/approved-execution.d.ts.map +1 -0
- package/dist/team/approved-execution.js +136 -0
- package/dist/team/approved-execution.js.map +1 -0
- package/dist/team/delivery-log.d.ts.map +1 -1
- package/dist/team/delivery-log.js +2 -1
- package/dist/team/delivery-log.js.map +1 -1
- package/dist/team/followup-planner.js +2 -2
- package/dist/team/followup-planner.js.map +1 -1
- package/dist/team/goal-workflow.d.ts +20 -0
- package/dist/team/goal-workflow.d.ts.map +1 -0
- package/dist/team/goal-workflow.js +57 -0
- package/dist/team/goal-workflow.js.map +1 -0
- package/dist/team/orchestrator.js +2 -2
- package/dist/team/orchestrator.js.map +1 -1
- package/dist/team/role-router.js +5 -5
- package/dist/team/role-router.js.map +1 -1
- package/dist/team/runtime.d.ts +6 -0
- package/dist/team/runtime.d.ts.map +1 -1
- package/dist/team/runtime.js +46 -6
- package/dist/team/runtime.js.map +1 -1
- package/dist/team/scaling.d.ts.map +1 -1
- package/dist/team/scaling.js +2 -0
- package/dist/team/scaling.js.map +1 -1
- package/dist/team/tmux-session.d.ts.map +1 -1
- package/dist/team/tmux-session.js +4 -2
- package/dist/team/tmux-session.js.map +1 -1
- package/dist/team/worker-bootstrap.d.ts +2 -0
- package/dist/team/worker-bootstrap.d.ts.map +1 -1
- package/dist/team/worker-bootstrap.js +19 -2
- package/dist/team/worker-bootstrap.js.map +1 -1
- package/dist/ultragoal/__tests__/artifacts.test.d.ts +2 -0
- package/dist/ultragoal/__tests__/artifacts.test.d.ts.map +1 -0
- package/dist/ultragoal/__tests__/artifacts.test.js +93 -0
- package/dist/ultragoal/__tests__/artifacts.test.js.map +1 -0
- package/dist/ultragoal/artifacts.d.ts +89 -0
- package/dist/ultragoal/artifacts.d.ts.map +1 -0
- package/dist/ultragoal/artifacts.js +233 -0
- package/dist/ultragoal/artifacts.js.map +1 -0
- package/dist/utils/__tests__/agents-model-table.test.js +3 -1
- package/dist/utils/__tests__/agents-model-table.test.js.map +1 -1
- package/dist/utils/__tests__/paths.test.js +31 -1
- package/dist/utils/__tests__/paths.test.js.map +1 -1
- package/dist/utils/agents-model-table.d.ts.map +1 -1
- package/dist/utils/agents-model-table.js +12 -1
- package/dist/utils/agents-model-table.js.map +1 -1
- package/dist/utils/paths.d.ts +2 -0
- package/dist/utils/paths.d.ts.map +1 -1
- package/dist/utils/paths.js +23 -7
- package/dist/utils/paths.js.map +1 -1
- package/dist/verification/__tests__/ci-rust-gates.test.js +30 -19
- package/dist/verification/__tests__/ci-rust-gates.test.js.map +1 -1
- package/package.json +5 -5
- package/plugins/oh-my-codex/.codex-plugin/plugin.json +1 -1
- package/plugins/oh-my-codex/skills/ask/SKILL.md +58 -0
- package/plugins/oh-my-codex/skills/autoresearch-goal/SKILL.md +36 -0
- package/plugins/oh-my-codex/skills/omx-setup/SKILL.md +2 -2
- package/plugins/oh-my-codex/skills/performance-goal/SKILL.md +65 -0
- package/plugins/oh-my-codex/skills/plan/SKILL.md +1 -1
- package/plugins/oh-my-codex/skills/ralph/SKILL.md +22 -3
- package/plugins/oh-my-codex/skills/team/SKILL.md +6 -2
- package/plugins/oh-my-codex/skills/ultragoal/SKILL.md +49 -0
- package/plugins/oh-my-codex/skills/visual-ralph/SKILL.md +9 -9
- package/prompts/api-reviewer.md +1 -1
- package/prompts/code-reviewer.md +2 -0
- package/prompts/performance-reviewer.md +1 -1
- package/prompts/quality-reviewer.md +1 -1
- package/prompts/quality-strategist.md +2 -2
- package/prompts/style-reviewer.md +1 -1
- package/prompts/test-engineer.md +1 -1
- package/skills/ask/SKILL.md +58 -0
- package/skills/ask-claude/SKILL.md +3 -54
- package/skills/ask-gemini/SKILL.md +3 -54
- package/skills/autoresearch-goal/SKILL.md +36 -0
- package/skills/build-fix/SKILL.md +4 -139
- package/skills/deepsearch/SKILL.md +4 -32
- package/skills/ecomode/SKILL.md +4 -108
- package/skills/help/SKILL.md +4 -196
- package/skills/note/SKILL.md +4 -56
- package/skills/omx-setup/SKILL.md +2 -2
- package/skills/performance-goal/SKILL.md +65 -0
- package/skills/plan/SKILL.md +1 -1
- package/skills/ralph/SKILL.md +22 -3
- package/skills/ralph-init/SKILL.md +4 -40
- package/skills/review/SKILL.md +4 -32
- package/skills/security-review/SKILL.md +4 -294
- package/skills/swarm/SKILL.md +4 -19
- package/skills/tdd/SKILL.md +4 -100
- package/skills/team/SKILL.md +6 -2
- package/skills/trace/SKILL.md +4 -27
- package/skills/ultragoal/SKILL.md +49 -0
- package/skills/visual-ralph/SKILL.md +9 -9
- package/skills/visual-verdict/SKILL.md +4 -70
- package/skills/web-clone/SKILL.md +4 -18
- package/src/scripts/__tests__/codex-native-hook.test.ts +1654 -157
- package/src/scripts/__tests__/hook-derived-watcher.test.ts +45 -1
- package/src/scripts/__tests__/run-test-files.test.ts +46 -0
- package/src/scripts/codex-native-hook.ts +592 -52
- package/src/scripts/codex-native-pre-post.ts +252 -20
- package/src/scripts/hook-derived-watcher.ts +2 -1
- package/src/scripts/notify-fallback-watcher.ts +2 -1
- package/src/scripts/notify-hook/orchestration-intent.ts +1 -3
- package/src/scripts/notify-hook/team-leader-nudge.ts +7 -63
- package/src/scripts/notify-hook/team-worker-stop.ts +246 -0
- package/src/scripts/notify-hook/team-worker.ts +23 -14
- package/src/scripts/run-test-files.ts +20 -1
- package/src/scripts/sync-plugin-mirror.ts +2 -2
- package/templates/catalog-manifest.json +45 -27
- package/plugins/oh-my-codex/skills/ask-claude/SKILL.md +0 -61
- package/plugins/oh-my-codex/skills/ask-gemini/SKILL.md +0 -61
- package/plugins/oh-my-codex/skills/help/SKILL.md +0 -202
- package/plugins/oh-my-codex/skills/note/SKILL.md +0 -62
- package/plugins/oh-my-codex/skills/security-review/SKILL.md +0 -300
- package/plugins/oh-my-codex/skills/trace/SKILL.md +0 -33
- package/plugins/oh-my-codex/skills/visual-verdict/SKILL.md +0 -76
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: performance-goal
|
|
3
|
+
description: "Run an evaluator-gated performance optimization workflow over Codex goal mode with durable OMX artifacts and safe goal handoffs."
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Performance Goal Workflow
|
|
7
|
+
|
|
8
|
+
Use this skill when a user asks OMX to optimize performance and wants a goal-oriented loop rather than a one-off review.
|
|
9
|
+
|
|
10
|
+
## Contract
|
|
11
|
+
|
|
12
|
+
- OMX owns durable workflow state under `.omx/goals/performance/<slug>/`.
|
|
13
|
+
- Codex goal mode owns only the active-thread focus/accounting primitive.
|
|
14
|
+
- Shell commands do **not** mutate hidden Codex goal state. They write artifacts and emit model-facing handoff text.
|
|
15
|
+
- No optimization work may start until an evaluator command and pass/fail contract exist.
|
|
16
|
+
- Do not call `update_goal({status: "complete"})` until the evaluator has a passing checkpoint and a completion audit proves the objective is done; then call `get_goal` again and pass that fresh snapshot to `omx performance-goal complete --codex-goal-json`.
|
|
17
|
+
|
|
18
|
+
## CLI
|
|
19
|
+
|
|
20
|
+
Create the workflow and evaluator contract:
|
|
21
|
+
|
|
22
|
+
```sh
|
|
23
|
+
omx performance-goal create \
|
|
24
|
+
--objective "Reduce CLI startup latency by 20%" \
|
|
25
|
+
--evaluator-command "npm run perf:startup" \
|
|
26
|
+
--evaluator-contract "PASS when p95 latency improves by 20% and regression tests pass" \
|
|
27
|
+
--slug startup-latency
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
Emit the Codex goal handoff:
|
|
31
|
+
|
|
32
|
+
```sh
|
|
33
|
+
omx performance-goal start --slug startup-latency
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
Record evaluator evidence:
|
|
37
|
+
|
|
38
|
+
```sh
|
|
39
|
+
omx performance-goal checkpoint --slug startup-latency --status pass --evidence "benchmark + tests passed"
|
|
40
|
+
omx performance-goal checkpoint --slug startup-latency --status fail --evidence "benchmark regressed"
|
|
41
|
+
omx performance-goal checkpoint --slug startup-latency --status blocked --evidence "missing fixture"
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
Complete only after a passing checkpoint:
|
|
45
|
+
|
|
46
|
+
```sh
|
|
47
|
+
omx performance-goal complete --slug startup-latency --evidence "final evaluator evidence" --codex-goal-json <get_goal-json-or-path>
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
## Agent Loop
|
|
51
|
+
|
|
52
|
+
1. Run `omx performance-goal create` if no workflow exists.
|
|
53
|
+
2. Run `omx performance-goal start` and follow the handoff:
|
|
54
|
+
- call `get_goal`;
|
|
55
|
+
- call `create_goal` only when no active goal exists and the objective is explicit;
|
|
56
|
+
- work only against the evaluator contract;
|
|
57
|
+
- after evaluator pass and completion audit, call `update_goal({status: "complete"})`, call `get_goal` again, and pass that snapshot to `omx performance-goal complete --codex-goal-json`;
|
|
58
|
+
3. Optimize in small reversible patches.
|
|
59
|
+
4. Run the evaluator and related regression tests.
|
|
60
|
+
5. Record each pass/fail/blocker with `checkpoint`.
|
|
61
|
+
6. Complete only when the pass artifact exists and no required work remains.
|
|
62
|
+
|
|
63
|
+
## Completion Gate
|
|
64
|
+
|
|
65
|
+
A performance goal is incomplete unless `.omx/goals/performance/<slug>/state.json` contains a `lastValidation.status` of `pass` and `omx performance-goal complete` receives a matching complete Codex `get_goal` snapshot via `--codex-goal-json`. Passing ordinary tests alone is not sufficient unless they are the declared evaluator contract.
|
package/skills/plan/SKILL.md
CHANGED
|
@@ -114,7 +114,7 @@ Jumping into code without understanding requirements leads to rework, scope cree
|
|
|
114
114
|
2. Evaluate via Critic using `ask_codex` with `agent_role: "critic"`
|
|
115
115
|
3. For cleanup/refactor/anti-slop work, verify that the artifact includes a cleanup plan, regression tests or an explicit test gap, smell-by-smell passes, and quality gates.
|
|
116
116
|
4. Return verdict: APPROVED, REVISE (with specific feedback), or REJECT (replanning required)
|
|
117
|
-
5. If the current context authored the artifact, hand the review to
|
|
117
|
+
5. If the current context authored the artifact, hand the review to `$code-review`, `critic`, `quality-reviewer`, or `verifier` as appropriate.
|
|
118
118
|
|
|
119
119
|
### Plan Output Format
|
|
120
120
|
|
package/skills/ralph/SKILL.md
CHANGED
|
@@ -36,6 +36,7 @@ Complex tasks often fail silently: partial implementations get declared "done",
|
|
|
36
36
|
- Read `docs/shared/agent-tiers.md` before first delegation to select correct agent tiers
|
|
37
37
|
- Deliver the full implementation: no scope reduction, no partial completion, no deleting tests to make them pass
|
|
38
38
|
- Apply the shared workflow guidance pattern: outcome-first framing, concise visible updates for multi-step execution, local overrides for the active workflow branch, validation proportional to risk, explicit stop rules, and automatic continuation for safe reversible steps. Ask only for material, destructive, credentialed, external-production, or preference-dependent branches.
|
|
39
|
+
- Integrate with Codex goal mode when goal tools are available: inspect the active thread goal with `get_goal`, preserve it as the top-level stop condition, and only call `update_goal({status: "complete"})` after a Ralph completion audit proves the objective is actually achieved.
|
|
39
40
|
</Execution_Policy>
|
|
40
41
|
|
|
41
42
|
<Steps>
|
|
@@ -60,12 +61,13 @@ Complex tasks often fail silently: partial implementations get declared "done",
|
|
|
60
61
|
- When Ralph is entered as a ralplan follow-up, start from the approved **available-agent-types roster** and make the delegation plan explicit: implementation lane, evidence/regression lane, and final sign-off lane using only known agent types
|
|
61
62
|
4. **Run long operations in background**: Builds, installs, test suites use `run_in_background: true`
|
|
62
63
|
5. **Visual task gate (when screenshot/reference images are present)**:
|
|
63
|
-
- Run
|
|
64
|
+
- Run the Visual Ralph verdict step **before every next edit**.
|
|
64
65
|
- Require structured JSON output: `score`, `verdict`, `category_match`, `differences[]`, `suggestions[]`, `reasoning`.
|
|
65
66
|
- Persist verdict to `.omx/state/{scope}/ralph-progress.json` including numeric + qualitative feedback.
|
|
66
67
|
- Default pass threshold: `score >= 90`.
|
|
67
|
-
- **URL-based visual cloning tasks**: When the task description contains a target URL (e.g., "clone https://example.com"), route the work through `$visual-ralph`. `$web-clone` is hard-deprecated; Visual Ralph owns the migrated live-URL visual implementation use case and uses
|
|
68
|
+
- **URL-based visual cloning tasks**: When the task description contains a target URL (e.g., "clone https://example.com"), route the work through `$visual-ralph`. `$web-clone` is hard-deprecated; Visual Ralph owns the migrated live-URL visual implementation use case and uses its built-in visual verdict step for measured visual scoring.
|
|
68
69
|
6. **Verify completion with fresh evidence**:
|
|
70
|
+
- If Codex goal mode is available, call `get_goal` before final verification to restate the active objective and include it in the evidence checklist.
|
|
69
71
|
a. Identify what command proves the task is complete
|
|
70
72
|
b. Run verification (test, build, lint)
|
|
71
73
|
c. Read the output -- confirm it actually passed
|
|
@@ -84,7 +86,7 @@ Complex tasks often fail silently: partial implementations get declared "done",
|
|
|
84
86
|
- After the deslop pass, re-run all tests/build/lint and read the output to confirm they still pass.
|
|
85
87
|
- If post-deslop regression fails, roll back cleaner changes or fix and retry. Then rerun Step 7.5 and Step 7.6 until the regression is green.
|
|
86
88
|
- Do not proceed to completion until post-deslop regression is green (unless `--no-deslop` explicitly skipped the deslop pass).
|
|
87
|
-
8. **On approval**:
|
|
89
|
+
8. **On approval**: If Codex goal mode is active, call `update_goal({status: "complete"})` before `/cancel`; report final elapsed time and token-budget usage when the tool returns it. Then run `/cancel` to cleanly exit and clean up all state files.
|
|
88
90
|
9. **On rejection**: Fix the issues raised, then re-verify at the same tier
|
|
89
91
|
</Steps>
|
|
90
92
|
|
|
@@ -94,10 +96,26 @@ Complex tasks often fail silently: partial implementations get declared "done",
|
|
|
94
96
|
- Skip Codex consultation for simple feature additions, well-tested changes, or time-critical verification
|
|
95
97
|
- If ToolSearch finds no MCP tools or Codex is unavailable, proceed with architect agent verification alone -- never block on external tools
|
|
96
98
|
- Use `state_write` / `state_read` for ralph mode state persistence between iterations
|
|
99
|
+
- Use Codex goal tools when present: `get_goal` to discover or re-check the active objective, `create_goal` only when the user/system explicitly requested a new goal and no active goal exists, and `update_goal` only after the audited objective is fully achieved.
|
|
97
100
|
- Persist context snapshot path in Ralph mode state so later phases and agents share the same grounding context
|
|
98
101
|
- If an `omx_state` MCP tool call reports that its stdio transport is unavailable/closed, do **not** retry the same MCP call. Retry once through the supported CLI parity surface with the same payload, preserving `workingDirectory` and `session_id`: `omx state write --input '<json>' --json`, `omx state read --input '<json>' --json`, or `omx state clear --input '<json>' --json`. If the CLI path also fails, continue with `.omx/context` / `.omx/plans` file-backed artifacts and report the state persistence blocker.
|
|
99
102
|
</Tool_Usage>
|
|
100
103
|
|
|
104
|
+
## Goal Mode Integration
|
|
105
|
+
|
|
106
|
+
Codex goal mode is the thread-level completion contract for long-running Ralph work. Ralph state tracks workflow mechanics; goal mode tracks whether the user objective is truly done. When the goal tools are available:
|
|
107
|
+
|
|
108
|
+
1. Call `get_goal` during intake or before the first execution loop when the prompt/hook says an active thread goal exists.
|
|
109
|
+
2. If no goal exists, call `create_goal` only when the user or system explicitly asked for goal tracking; otherwise continue with Ralph state alone.
|
|
110
|
+
3. Treat `goal.objective` as binding acceptance scope. Newer user updates can refine the current branch, but do not silently narrow the goal.
|
|
111
|
+
4. Before completion, perform a prompt-to-artifact checklist and completion audit against real evidence:
|
|
112
|
+
- restate the objective as deliverables/success criteria
|
|
113
|
+
- map every prompt requirement, named workflow (`$ralplan`, `$ralph`), file, command, test, gate, and deliverable to evidence
|
|
114
|
+
- inspect the actual files, command output, state, and tests behind each checklist item
|
|
115
|
+
- identify missing, weakly verified, or uncovered requirements and continue if any remain
|
|
116
|
+
5. Call `update_goal({status: "complete"})` only when the audit shows no required work remains. Do not use passing tests, Ralph state, or architect approval as proxy proof unless they cover the whole goal.
|
|
117
|
+
6. If goal tools are unavailable, keep working through Ralph state and mention the missing goal-mode evidence in the final report.
|
|
118
|
+
|
|
101
119
|
## State Management
|
|
102
120
|
|
|
103
121
|
Use the `omx_state` MCP server tools (`state_write`, `state_read`, `state_clear`) for Ralph lifecycle state.
|
|
@@ -177,6 +195,7 @@ Why bad: These are independent tasks that should run in parallel, not sequential
|
|
|
177
195
|
- [ ] Fresh build output shows success
|
|
178
196
|
- [ ] lsp_diagnostics shows 0 errors on affected files
|
|
179
197
|
- [ ] Architect verification passed (STANDARD tier minimum)
|
|
198
|
+
- [ ] Codex goal-mode completion audit passed, and `update_goal({status: "complete"})` was called when an active goal exists
|
|
180
199
|
- [ ] ai-slop-cleaner pass completed on changed files (or --no-deslop specified)
|
|
181
200
|
- [ ] Post-deslop regression tests pass
|
|
182
201
|
- [ ] `/cancel` run for clean state cleanup
|
|
@@ -1,46 +1,10 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: ralph-init
|
|
3
|
-
description:
|
|
3
|
+
description: Ralph Init deprecated skill
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
# Ralph Init
|
|
6
|
+
# Ralph Init deprecated
|
|
7
7
|
|
|
8
|
-
|
|
8
|
+
Hard-deprecated. Do not invoke or route this skill. Use `$ralph` directly after PRD/test-spec planning is complete.
|
|
9
9
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
```
|
|
13
|
-
/ralph-init "project or feature description"
|
|
14
|
-
```
|
|
15
|
-
|
|
16
|
-
## Behavior
|
|
17
|
-
|
|
18
|
-
1. **Gather requirements** via interactive interview or from the provided description
|
|
19
|
-
2. **Create PRD** at `.omx/plans/prd-{slug}.md` with:
|
|
20
|
-
- Problem statement
|
|
21
|
-
- Goals and non-goals
|
|
22
|
-
- Acceptance criteria (testable)
|
|
23
|
-
- Technical constraints
|
|
24
|
-
- Implementation phases
|
|
25
|
-
3. **Link to Ralph** so that `/ralph` can use the PRD as its completion criteria
|
|
26
|
-
4. **Initialize/ensure canonical progress ledger** at `.omx/state/{scope}/ralph-progress.json` (session scope if active session exists)
|
|
27
|
-
|
|
28
|
-
### Canonical source contract
|
|
29
|
-
|
|
30
|
-
- Canonical PRD source of truth is `.omx/plans/prd-{slug}.md`.
|
|
31
|
-
- Ralph progress source of truth is `.omx/state/{scope}/ralph-progress.json` (session scope when available).
|
|
32
|
-
- During the current compatibility window, Ralph `--prd` startup still validates machine-readable story state from `.omx/prd.json`.
|
|
33
|
-
- Legacy `.omx/prd.json` / `.omx/progress.txt` inputs migrate one-way into canonical artifacts, but canonical PRD markdown is not yet the startup validation source for `omx ralph --prd ...`.
|
|
34
|
-
|
|
35
|
-
## Output
|
|
36
|
-
|
|
37
|
-
A structured PRD file saved to `.omx/plans/` that serves as the definition of done for Ralph execution.
|
|
38
|
-
|
|
39
|
-
## Next Steps
|
|
40
|
-
|
|
41
|
-
After creating the PRD, start execution with:
|
|
42
|
-
```
|
|
43
|
-
/ralph "implement the PRD"
|
|
44
|
-
```
|
|
45
|
-
|
|
46
|
-
Ralph will iterate until all acceptance criteria in the PRD are met and architect-verified.
|
|
10
|
+
Task: {{ARGUMENTS}}
|
package/skills/review/SKILL.md
CHANGED
|
@@ -1,38 +1,10 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: review
|
|
3
|
-
description:
|
|
3
|
+
description: Deprecated standalone review skill
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
# Review
|
|
6
|
+
# Review deprecated
|
|
7
7
|
|
|
8
|
-
|
|
8
|
+
Hard-deprecated. Do not invoke or route this skill. Use `$code-review` directly for implementation review, or `$plan --review` only when explicitly reviewing an existing planning artifact.
|
|
9
9
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
```
|
|
13
|
-
/review
|
|
14
|
-
/review "path/to/plan.md"
|
|
15
|
-
```
|
|
16
|
-
|
|
17
|
-
## Behavior
|
|
18
|
-
|
|
19
|
-
This skill invokes the Plan skill in review mode:
|
|
20
|
-
|
|
21
|
-
```
|
|
22
|
-
/plan --review <arguments>
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
The review workflow:
|
|
26
|
-
1. Treat review as a reviewer-only pass. The authoring context may write the plan or cleanup proposal, but a separate reviewer context must issue the verdict.
|
|
27
|
-
2. Read plan file from `.omx/plans/` (or specified path)
|
|
28
|
-
3. Evaluate via Critic agent
|
|
29
|
-
4. For cleanup/refactor/anti-slop work, confirm the artifact includes a cleanup plan, regression-test coverage or an explicit test gap, bounded smell-by-smell passes, and quality gates.
|
|
30
|
-
5. Return verdict: APPROVED, REVISE (with specific feedback), or REJECT (replanning required)
|
|
31
|
-
|
|
32
|
-
## Guardrails
|
|
33
|
-
|
|
34
|
-
- Never write and approve in the same context.
|
|
35
|
-
- If the current context authored the artifact, hand review to Critic or another reviewer role.
|
|
36
|
-
- Approval must cite concrete evidence, not author claims.
|
|
37
|
-
|
|
38
|
-
Follow the Plan skill's full documentation for review mode details.
|
|
10
|
+
Task: {{ARGUMENTS}}
|
|
@@ -1,300 +1,10 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: security-review
|
|
3
|
-
description:
|
|
3
|
+
description: Deprecated standalone security review skill
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
# Security Review
|
|
6
|
+
# Security Review deprecated
|
|
7
7
|
|
|
8
|
-
|
|
8
|
+
Hard-deprecated. Do not invoke or route this skill. Use `$code-review` directly for new review workflows when security concerns are in scope.
|
|
9
9
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
This skill activates when:
|
|
13
|
-
- User requests "security review", "security audit"
|
|
14
|
-
- After writing code that handles user input
|
|
15
|
-
- After adding new API endpoints
|
|
16
|
-
- After modifying authentication/authorization logic
|
|
17
|
-
- Before deploying to production
|
|
18
|
-
- After adding external dependencies
|
|
19
|
-
|
|
20
|
-
## What It Does
|
|
21
|
-
|
|
22
|
-
## GPT-5.5 Guidance Alignment
|
|
23
|
-
|
|
24
|
-
- Default to outcome-first progress and completion reporting: state the target result, evidence, validation status, and stop condition before adding process detail.
|
|
25
|
-
- Treat newer user task updates as local overrides for the active workflow branch while preserving earlier non-conflicting constraints.
|
|
26
|
-
- If correctness depends on additional inspection, retrieval, execution, or verification, keep using the relevant tools until the security review is grounded; stop once enough evidence exists.
|
|
27
|
-
- Continue through clear, low-risk, reversible next steps automatically; ask only when the next step is materially branching, destructive, credentialed, external-production, or preference-dependent.
|
|
28
|
-
|
|
29
|
-
Delegates to the `security-reviewer` agent (THOROUGH tier) for deep security analysis:
|
|
30
|
-
|
|
31
|
-
1. **OWASP Top 10 Scan**
|
|
32
|
-
- A01: Broken Access Control
|
|
33
|
-
- A02: Cryptographic Failures
|
|
34
|
-
- A03: Injection (SQL, NoSQL, Command, XSS)
|
|
35
|
-
- A04: Insecure Design
|
|
36
|
-
- A05: Security Misconfiguration
|
|
37
|
-
- A06: Vulnerable and Outdated Components
|
|
38
|
-
- A07: Identification and Authentication Failures
|
|
39
|
-
- A08: Software and Data Integrity Failures
|
|
40
|
-
- A09: Security Logging and Monitoring Failures
|
|
41
|
-
- A10: Server-Side Request Forgery (SSRF)
|
|
42
|
-
|
|
43
|
-
2. **Secrets Detection**
|
|
44
|
-
- Hardcoded API keys
|
|
45
|
-
- Passwords in source code
|
|
46
|
-
- Private keys in repo
|
|
47
|
-
- Tokens and credentials
|
|
48
|
-
- Connection strings with secrets
|
|
49
|
-
|
|
50
|
-
3. **Input Validation**
|
|
51
|
-
- All user inputs sanitized
|
|
52
|
-
- SQL/NoSQL injection prevention
|
|
53
|
-
- Command injection prevention
|
|
54
|
-
- XSS prevention (output escaping)
|
|
55
|
-
- Path traversal prevention
|
|
56
|
-
|
|
57
|
-
4. **Authentication/Authorization**
|
|
58
|
-
- Proper password hashing (bcrypt, argon2)
|
|
59
|
-
- Session management security
|
|
60
|
-
- Access control enforcement
|
|
61
|
-
- JWT implementation security
|
|
62
|
-
|
|
63
|
-
5. **Dependency Security**
|
|
64
|
-
- Run `npm audit` for known vulnerabilities
|
|
65
|
-
- Check for outdated dependencies
|
|
66
|
-
- Identify high-severity CVEs
|
|
67
|
-
|
|
68
|
-
## Agent Delegation
|
|
69
|
-
|
|
70
|
-
```
|
|
71
|
-
delegate(
|
|
72
|
-
role="security-reviewer",
|
|
73
|
-
tier="THOROUGH",
|
|
74
|
-
prompt="SECURITY REVIEW TASK
|
|
75
|
-
|
|
76
|
-
Conduct comprehensive security audit of codebase.
|
|
77
|
-
|
|
78
|
-
Scope: [specific files or entire codebase]
|
|
79
|
-
|
|
80
|
-
Security Checklist:
|
|
81
|
-
1. OWASP Top 10 scan
|
|
82
|
-
2. Hardcoded secrets detection
|
|
83
|
-
3. Input validation review
|
|
84
|
-
4. Authentication/authorization review
|
|
85
|
-
5. Dependency vulnerability scan (npm audit)
|
|
86
|
-
|
|
87
|
-
Output: Security review report with:
|
|
88
|
-
- Summary of findings by severity (CRITICAL, HIGH, MEDIUM, LOW)
|
|
89
|
-
- Specific file:line locations
|
|
90
|
-
- CVE references where applicable
|
|
91
|
-
- Remediation guidance for each issue
|
|
92
|
-
- Overall security posture assessment"
|
|
93
|
-
)
|
|
94
|
-
```
|
|
95
|
-
|
|
96
|
-
## External Model Consultation (Preferred)
|
|
97
|
-
|
|
98
|
-
The security-reviewer agent SHOULD consult Codex for cross-validation.
|
|
99
|
-
|
|
100
|
-
### Protocol
|
|
101
|
-
1. **Form your OWN security analysis FIRST** - Complete the review independently
|
|
102
|
-
2. **Consult for validation** - Cross-check findings with Codex
|
|
103
|
-
3. **Critically evaluate** - Never blindly adopt external findings
|
|
104
|
-
4. **Graceful fallback** - Never block if tools unavailable
|
|
105
|
-
|
|
106
|
-
### When to Consult
|
|
107
|
-
- Authentication/authorization code
|
|
108
|
-
- Cryptographic implementations
|
|
109
|
-
- Input validation for untrusted data
|
|
110
|
-
- High-risk vulnerability patterns
|
|
111
|
-
- Production deployment code
|
|
112
|
-
|
|
113
|
-
### When to Skip
|
|
114
|
-
- Low-risk utility code
|
|
115
|
-
- Well-audited patterns
|
|
116
|
-
- Time-critical security assessments
|
|
117
|
-
- Code with existing security tests
|
|
118
|
-
|
|
119
|
-
### Tool Usage
|
|
120
|
-
Before first MCP tool use, call `ToolSearch("mcp")` to discover deferred MCP tools.
|
|
121
|
-
Use `mcp__x__ask_codex` with `agent_role: "security-reviewer"`.
|
|
122
|
-
If ToolSearch finds no MCP tools, fall back to the `security-reviewer` agent.
|
|
123
|
-
|
|
124
|
-
**Note:** Security second opinions are high-value. Consider consulting for CRITICAL/HIGH findings.
|
|
125
|
-
|
|
126
|
-
## Output Format
|
|
127
|
-
|
|
128
|
-
```
|
|
129
|
-
SECURITY REVIEW REPORT
|
|
130
|
-
======================
|
|
131
|
-
|
|
132
|
-
Scope: Entire codebase (42 files scanned)
|
|
133
|
-
Scan Date: 2026-01-24T14:30:00Z
|
|
134
|
-
|
|
135
|
-
CRITICAL (2)
|
|
136
|
-
------------
|
|
137
|
-
1. src/api/auth.ts:89 - Hardcoded API Key
|
|
138
|
-
Finding: AWS API key hardcoded in source code
|
|
139
|
-
Impact: Credential exposure if code is public or leaked
|
|
140
|
-
Remediation: Move to environment variables, rotate key immediately
|
|
141
|
-
Reference: OWASP A02:2021 – Cryptographic Failures
|
|
142
|
-
|
|
143
|
-
2. src/db/query.ts:45 - SQL Injection Vulnerability
|
|
144
|
-
Finding: User input concatenated directly into SQL query
|
|
145
|
-
Impact: Attacker can execute arbitrary SQL commands
|
|
146
|
-
Remediation: Use parameterized queries or ORM
|
|
147
|
-
Reference: OWASP A03:2021 – Injection
|
|
148
|
-
|
|
149
|
-
HIGH (5)
|
|
150
|
-
--------
|
|
151
|
-
3. src/auth/password.ts:22 - Weak Password Hashing
|
|
152
|
-
Finding: Passwords hashed with MD5 (cryptographically broken)
|
|
153
|
-
Impact: Passwords can be reversed via rainbow tables
|
|
154
|
-
Remediation: Use bcrypt or argon2 with appropriate work factor
|
|
155
|
-
Reference: OWASP A02:2021 – Cryptographic Failures
|
|
156
|
-
|
|
157
|
-
4. src/components/UserInput.tsx:67 - XSS Vulnerability
|
|
158
|
-
Finding: User input rendered with dangerouslySetInnerHTML
|
|
159
|
-
Impact: Cross-site scripting attack vector
|
|
160
|
-
Remediation: Sanitize HTML or use safe rendering
|
|
161
|
-
Reference: OWASP A03:2021 – Injection (XSS)
|
|
162
|
-
|
|
163
|
-
5. src/api/upload.ts:34 - Path Traversal Vulnerability
|
|
164
|
-
Finding: User-controlled filename used without validation
|
|
165
|
-
Impact: Attacker can read/write arbitrary files
|
|
166
|
-
Remediation: Validate and sanitize filenames, use allowlist
|
|
167
|
-
Reference: OWASP A01:2021 – Broken Access Control
|
|
168
|
-
|
|
169
|
-
...
|
|
170
|
-
|
|
171
|
-
MEDIUM (8)
|
|
172
|
-
----------
|
|
173
|
-
...
|
|
174
|
-
|
|
175
|
-
LOW (12)
|
|
176
|
-
--------
|
|
177
|
-
...
|
|
178
|
-
|
|
179
|
-
DEPENDENCY VULNERABILITIES
|
|
180
|
-
--------------------------
|
|
181
|
-
Found 3 vulnerabilities via npm audit:
|
|
182
|
-
|
|
183
|
-
CRITICAL: axios@0.21.0 - Server-Side Request Forgery (CVE-2021-3749)
|
|
184
|
-
Installed: axios@0.21.0
|
|
185
|
-
Fix: npm install axios@0.21.2
|
|
186
|
-
|
|
187
|
-
HIGH: lodash@4.17.19 - Prototype Pollution (CVE-2020-8203)
|
|
188
|
-
Installed: lodash@4.17.19
|
|
189
|
-
Fix: npm install lodash@4.17.21
|
|
190
|
-
|
|
191
|
-
...
|
|
192
|
-
|
|
193
|
-
OVERALL ASSESSMENT
|
|
194
|
-
------------------
|
|
195
|
-
Security Posture: POOR (2 CRITICAL, 5 HIGH issues)
|
|
196
|
-
|
|
197
|
-
Immediate Actions Required:
|
|
198
|
-
1. Rotate exposed AWS API key
|
|
199
|
-
2. Fix SQL injection in db/query.ts
|
|
200
|
-
3. Upgrade password hashing to bcrypt
|
|
201
|
-
4. Update vulnerable dependencies
|
|
202
|
-
|
|
203
|
-
Recommendation: DO NOT DEPLOY until CRITICAL and HIGH issues resolved.
|
|
204
|
-
```
|
|
205
|
-
|
|
206
|
-
## Security Checklist
|
|
207
|
-
|
|
208
|
-
The security-reviewer agent verifies:
|
|
209
|
-
|
|
210
|
-
### Authentication & Authorization
|
|
211
|
-
- [ ] Passwords hashed with strong algorithm (bcrypt/argon2)
|
|
212
|
-
- [ ] Session tokens cryptographically random
|
|
213
|
-
- [ ] JWT tokens properly signed and validated
|
|
214
|
-
- [ ] Access control enforced on all protected resources
|
|
215
|
-
- [ ] No authentication bypass vulnerabilities
|
|
216
|
-
|
|
217
|
-
### Input Validation
|
|
218
|
-
- [ ] All user inputs validated and sanitized
|
|
219
|
-
- [ ] SQL queries use parameterization (no string concatenation)
|
|
220
|
-
- [ ] NoSQL queries prevent injection
|
|
221
|
-
- [ ] File uploads validated (type, size, content)
|
|
222
|
-
- [ ] URLs validated to prevent SSRF
|
|
223
|
-
|
|
224
|
-
### Output Encoding
|
|
225
|
-
- [ ] HTML output escaped to prevent XSS
|
|
226
|
-
- [ ] JSON responses properly encoded
|
|
227
|
-
- [ ] No user data in error messages
|
|
228
|
-
- [ ] Content-Security-Policy headers set
|
|
229
|
-
|
|
230
|
-
### Secrets Management
|
|
231
|
-
- [ ] No hardcoded API keys
|
|
232
|
-
- [ ] No passwords in source code
|
|
233
|
-
- [ ] No private keys in repo
|
|
234
|
-
- [ ] Environment variables used for secrets
|
|
235
|
-
- [ ] Secrets not logged or exposed in errors
|
|
236
|
-
|
|
237
|
-
### Cryptography
|
|
238
|
-
- [ ] Strong algorithms used (AES-256, RSA-2048+)
|
|
239
|
-
- [ ] Proper key management
|
|
240
|
-
- [ ] Random number generation cryptographically secure
|
|
241
|
-
- [ ] TLS/HTTPS enforced for sensitive data
|
|
242
|
-
|
|
243
|
-
### Dependencies
|
|
244
|
-
- [ ] No known vulnerabilities in dependencies
|
|
245
|
-
- [ ] Dependencies up to date
|
|
246
|
-
- [ ] No CRITICAL or HIGH CVEs
|
|
247
|
-
- [ ] Dependency sources verified
|
|
248
|
-
|
|
249
|
-
## Severity Definitions
|
|
250
|
-
|
|
251
|
-
**CRITICAL** - Exploitable vulnerability with severe impact (data breach, RCE, credential theft)
|
|
252
|
-
**HIGH** - Vulnerability requiring specific conditions but serious impact
|
|
253
|
-
**MEDIUM** - Security weakness with limited impact or difficult exploitation
|
|
254
|
-
**LOW** - Best practice violation or minor security concern
|
|
255
|
-
|
|
256
|
-
## Remediation Priority
|
|
257
|
-
|
|
258
|
-
1. **Rotate exposed secrets** - Immediate (within 1 hour)
|
|
259
|
-
2. **Fix CRITICAL** - Urgent (within 24 hours)
|
|
260
|
-
3. **Fix HIGH** - Important (within 1 week)
|
|
261
|
-
4. **Fix MEDIUM** - Planned (within 1 month)
|
|
262
|
-
5. **Fix LOW** - Backlog (when convenient)
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
## Scenario Examples
|
|
266
|
-
|
|
267
|
-
**Good:** The user says `continue` after the workflow already has a clear next step. Continue the current branch of work instead of restarting or re-asking the same question.
|
|
268
|
-
|
|
269
|
-
**Good:** The user changes only the output shape or downstream delivery step (for example `make a PR`). Preserve earlier non-conflicting workflow constraints and apply the update locally.
|
|
270
|
-
|
|
271
|
-
**Bad:** The user says `continue`, and the workflow restarts discovery or stops before the missing verification/evidence is gathered.
|
|
272
|
-
|
|
273
|
-
## Use with Other Skills
|
|
274
|
-
|
|
275
|
-
**With Team:**
|
|
276
|
-
```
|
|
277
|
-
/team "run security review on authentication module"
|
|
278
|
-
```
|
|
279
|
-
Uses: explore → security-reviewer → executor → security-reviewer (re-verify)
|
|
280
|
-
|
|
281
|
-
**With Swarm:**
|
|
282
|
-
```
|
|
283
|
-
/swarm 4:security-reviewer "audit all API endpoints"
|
|
284
|
-
```
|
|
285
|
-
Parallel security review across multiple endpoints.
|
|
286
|
-
|
|
287
|
-
**With Ralph:**
|
|
288
|
-
```
|
|
289
|
-
/ralph security-review then fix all issues
|
|
290
|
-
```
|
|
291
|
-
Review, fix, re-review until all issues resolved.
|
|
292
|
-
|
|
293
|
-
## Best Practices
|
|
294
|
-
|
|
295
|
-
- **Review early** - Security by design, not afterthought
|
|
296
|
-
- **Review often** - Every major feature or API change
|
|
297
|
-
- **Automate** - Run security scans in CI/CD pipeline
|
|
298
|
-
- **Fix immediately** - Don't accumulate security debt
|
|
299
|
-
- **Educate** - Learn from findings to prevent future issues
|
|
300
|
-
- **Verify fixes** - Re-run security review after remediation
|
|
10
|
+
Task: {{ARGUMENTS}}
|
package/skills/swarm/SKILL.md
CHANGED
|
@@ -1,25 +1,10 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: swarm
|
|
3
|
-
description:
|
|
3
|
+
description: Swarm deprecated shim
|
|
4
4
|
---
|
|
5
5
|
|
|
6
|
-
# Swarm
|
|
6
|
+
# Swarm deprecated
|
|
7
7
|
|
|
8
|
-
|
|
8
|
+
Hard-deprecated. Do not invoke or route this skill. Use `$team` directly for coordinated multi-agent execution.
|
|
9
9
|
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
```
|
|
13
|
-
/swarm N:agent-type "task description"
|
|
14
|
-
/swarm "task description"
|
|
15
|
-
```
|
|
16
|
-
|
|
17
|
-
## Behavior
|
|
18
|
-
|
|
19
|
-
This skill is identical to `/team`. Invoke the Team skill with the same arguments:
|
|
20
|
-
|
|
21
|
-
```
|
|
22
|
-
/team <arguments>
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
Follow the Team skill's full documentation for staged pipeline, agent routing, and coordination semantics.
|
|
10
|
+
Task: {{ARGUMENTS}}
|