{
  "markdown": "# mypowers\n\n`mypowers – Zero-Trust AI Co-Founder OS` is a focused, shared-content plugin for Claude Code and OpenAI Codex that combines zero-trust orchestration, bridge-import verification, progressive security scanning, and Fortress Bible attestation into one portable workflow. It stays radically honest about what the local machine can actually enforce: `FULL` when the recommended stack is present, `PARTIAL` when some tools are missing, and `BASIC` when only built-in checks are available.\n\n## Status\n\n`Initial public release`\n\n## Quick Start\n\n### Claude Code\n\n```bash\n/plugin load --dir .\n/mypowers:forge test-project\n/mypowers:security-oracle\n```\n\n### Codex\n\n```bash\ncodex plugin load --dir .\n/mypowers:setup-hooks\n/mypowers:forge test-project\n/mypowers:security-oracle\n```\n\n## Installation\n\n### Claude Code\n\n1. Load the plugin from the repository root with `/plugin load --dir .`\n2. Claude Code registers two native `PreToolUse` hooks directly from `.claude-plugin/plugin.json`: a fast edit-time secret scan (`Edit|Write|MultiEdit`) and a commit gate (`Bash`)\n3. Run `/mypowers:forge test-project` or `/mypowers:security-oracle`\n4. Use `/mypowers:setup-hooks` only if you want to inspect the native Claude registration or print the manual Codex snippet\n\n### Codex\n\n1. Load the plugin from the repository root with `codex plugin load --dir .`\n2. Run `/mypowers:setup-hooks` to print the latest hook status and guidance for this checkout\n3. Enable `[features] codex_hooks = true` in `~/.codex/config.toml` before expecting any Codex hooks to run\n4. Keep `.codex/hooks.json` wired only if you want the currently supported Codex hook coverage\n5. If you cannot edit Codex config from the app UI, start from the repo-managed samples in `templates/codex/config.toml` and `templates/codex/hooks.json`\n6. Start with `/mypowers:forge test-project` or `/mypowers:security-oracle`\n\n## Philosophy\n\n`mypowers` is a focused zero-trust A-Z forge, not a general config pack. It stays narrow on purpose: shared skills, shared scripts, and a truthful progressive security model that says exactly how much local enforcement is available.\n\n- `FULL`: the recommended security stack is present and the shared workflows can run at full strength\n- `PARTIAL`: some optional tools are missing, so `mypowers` hard-blocks only what it can verify honestly and reports the missing tooling\n- `BASIC`: no recommended SCA/security tools are available, so `mypowers` falls back to local checks and clear upgrade guidance\n\n## What Ships In v1\n\n- dual manifests in `.codex-plugin/` and `.claude-plugin/`\n- shared skills, hooks, scripts, templates, agents, and commands\n- posture-aware scanning and attestation scripts\n- truthful `FULL`, `PARTIAL`, and `BASIC` reporting\n\n## Superpowers Integration (Optional)\n\nmypowers remains the primary zero-trust orchestrator. When `scripts/check-superpowers.sh` detects a standard-path Superpowers installation, `mypowers` can optionally delegate brainstorming, implementation planning, and TDD scaffolding to Superpowers while keeping security gates and posture reporting in-house.\n\n- detection is path-based and truthful: `scripts/check-superpowers.sh` only checks standard skill locations such as `~/.claude/skills`, `~/.codex/skills`, and common plugin-managed skill directories like `$CODEX_HOME/superpowers/skills`\n- arbitrary cloned repositories are ignored, so a local reference checkout does not count as an active Superpowers install\n- when available, `mypowers` can borrow Superpowers `brainstorming`, `writing-plans`, and `test-driven-development` for structured workflow help\n- when unavailable, `mypowers` falls back to its own built-in logic and remains fully functional\n- Security Oracle, bridge-import verification, posture reporting, attestation, and final go or no-go decisions stay inside `mypowers`\n\n## Hook Setup (One-Time per Tool)\n\n### Claude Code\n\nClaude Code is now a first-class native target for `mypowers`. When you load the plugin, Claude reads the hook registrations directly from `.claude-plugin/plugin.json`, so you do not need to edit `.claude/settings.json` just to enable the default zero-trust path.\n\nNative Claude hook registrations:\n\n- `PreToolUse` on `Edit|Write|MultiEdit` runs a fast secret-scan gate before edit tools are accepted\n- `PreToolUse` on `Bash` runs the commit gate before commit-producing git commands, then performs posture-aware scan + batch attestation\n\nOptional project-level overrides still belong in `.claude/settings.json` if you want to add your own extra hooks around the native `mypowers` ones.\n\n### Codex\n\nCodex Desktop uses Claude-style hook event names, but hooks are feature-gated. Enable them first in `~/.codex/config.toml`:\n\n```toml\n[features]\ncodex_hooks = true\n```\n\nCurrent Codex Desktop behavior confirmed on March 31, 2026 with `Codex Desktop/0.118.0-alpha.2`:\n\n- `SessionStart` fires when the first turn starts\n- `PreToolUse` fires for shell tool calls such as `Bash`\n- direct desktop file writes land as `fileChange` items after the tool phase, so the Claude-style pre/post edit wrappers do not receive a file path for those writes yet\n\nThat means `mypowers` cannot truthfully promise hook-backed edit enforcement for direct Codex desktop file changes in this build. Keep `.codex/hooks.json` wired if you want future compatibility, but rely on `/mypowers:security-oracle`, `/mypowers:forge ...`, or the native Claude plugin flow when you need enforced edit-time gating today.\n\n`mypowers` never auto-edits either configuration file. Use `/mypowers:setup-hooks` to print the latest status and guidance for the current tool and checkout.\n\nRepository-managed Codex starter files are also provided for teams that want these settings tracked in Git:\n\n- `templates/codex/config.toml`\n- `templates/codex/hooks.json`\n\n## Tooling Posture\n\n- `FULL`: full recommended security stack detected\n- `PARTIAL`: some recommended tools missing\n- `BASIC`: no recommended SCA/security tools detected\n\nUse `/mypowers:setup-tools` to print platform-specific install commands.\n\n## Optimized for Claude Code\n\n`mypowers` is designed to feel native in Claude Code: the plugin now registers the two-phase hook model directly through the plugin manifest (`Edit|Write|MultiEdit` fast gate plus `Bash` commit gate), reads Claude's `permission_mode` signal inside hook payloads, and still respects local `CLAUDE.md` and `AGENTS.md` guardrails before the shared script layer enforces posture or attestation.\n\nUse `/mypowers:setup-hooks` to print the latest Claude Code snippet for your current checkout whenever the hook wrappers change.\n\n## Native Integration\n\nThe Claude Code source reference clarified three native integration points that `mypowers` can use honestly today:\n\n- Claude passes `permission_mode` into hook payloads, so Security Oracle can report Claude's real mode without guessing\n- Claude supports native plugin hook registration, so `mypowers` can register the fast gate and commit gate directly instead of pretending they are just documentation\n- plugin agents can use supported frontmatter such as descriptions, effort, and skill preload hints, but they cannot silently add privileged per-agent hooks or permission modes\n\nThis improves native behavior without changing the core contract. `mypowers` still reports `FULL`, `PARTIAL`, or `BASIC` strictly from local verification, still blocks only on zero-trust conditions it can actually prove, and still keeps Fortress Bible updates transparent instead of hidden behind private runtime state.\n\n## Final Verification\n\nRun the full local verification suite before publishing changes:\n\n```bash\nsh tests/run-all.sh\n```\n\n## License\n\n`mypowers` is released under the MIT license. See `LICENSE`.\n\n## Security\n\nSecurity disclosure and response guidance lives in `SECURITY.md`.\n\n## Contributing\n\nIssues and pull requests are welcome. See `CONTRIBUTING.md` for the contribution checklist and release expectations.\n\n## Built with Superpowers in Codex\n\nThis plugin was built with Superpowers in Codex using TDD, review checkpoints, and portable shared scripts.\n",
  "bytes": 8072,
  "sha": "5f90ee1f01c499b5a82598e04b70b4970bed30410742d6d1d275955ffd83b533",
  "repo_slug": "poulrohan23/mypowers",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_poulrohan23_mypowers_mypowers_45639fe3/readme"
}