
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@r3dlex/oh-my-auggie
Advanced tools
Multi-agent orchestration for Augment Code's
auggieCLI — the "oh-my-*" experience for auggie. OMA remains the plugin/workflow layer, andsuper-omais being shipped as an optional tmux/HUD supervisor shell on top without rewriting existing OMA semantics.
auggie >= 0.22.0 — install docsnode >= 18 (for the MCP state server)auggie plugin marketplace add r3dlex/oh-my-auggie
auggie plugin install oma@oh-my-auggie
Then initialize OMA in your project:
/oma:setup
Optionally configure MCP servers (adds state persistence and advanced tooling):
/oma:mcp-setup
super-oma is being delivered as an additive wrapper around Auggie + OMA:
/oma:* workflows stay intact..oma state even when tmux is unavailable.OMA remains the stable entrypoint and compatibility layer while super-oma rollout continues.
git clone https://github.com/r3dlex/oh-my-auggie.git
cd oh-my-auggie
auggie plugin install --source ./plugins/oma oma@oh-my-auggie
Then initialize OMA in your project:
/oma:setup
Optionally configure MCP servers (adds state persistence and advanced tooling):
/oma:mcp-setup
OMA — installed and ready. What do you want to build?
Once installed, these slash commands are available:
| Command | Description |
|---|---|
/oma:autopilot | Full autonomous pipeline — expand, plan, implement, QA, validate |
/oma:ralph | Persistence loop — keeps working until all acceptance criteria pass |
/oma:ultrawork | High-throughput parallel execution via concurrent subagents |
/oma:team | Coordinated team of N agents |
/oma:ultraqa | QA cycling: test, verify, fix, repeat |
/oma:ralplan | Consensus planning with Architect + Critic review |
/oma:plan | Strategic planning with analyst/architect review |
/oma:cancel | Cancel active mode and clear state |
/oma:status | Show current mode and state |
/oma:ask <model> | Query with a specific model |
/oma:note | Write to notepad (priority, working, manual) |
/oma:doctor | Diagnose installation issues |
Drop the /oma: prefix — these activate automatically when detected in conversation:
| Keyword | Activates |
|---|---|
autopilot | /oma:autopilot |
ralph, "don't stop" | /oma:ralph |
ulw, ultrawork | /oma:ultrawork |
ultraqa | /oma:ultraqa |
ralplan | /oma:ralplan |
team N:agent | /oma:team |
canceloma | /oma:cancel |
deslop, "anti-slop" | /oma:deslop |
ccg | /oma:ccg |
deep interview | /oma:interview |
OMA — parallel agents, persistent state, zero dependency overhead
oh-my-auggie/
├── plugins/oma/
│ ├── agents/ # 19 agents: architect, executor, explorer, planner, verifier, etc.
│ ├── commands/ # 44 commands: autopilot, ralph, ultrawork, team, ultraqa, etc.
│ ├── hooks/ # 10 hooks: session-start, delegation-enforce, stop-gate, cost-track, keyword-detect, etc.
│ ├── skills/ # 36 skills: ralph, ultrawork, ultraqa, ralplan, ccg, etc.
│ └── mcp/
│ └── state-server.mjs # MCP state server (12 tools: state, notepad, skill, intent)
└── .augment-plugin/
└── plugin.json # Auggie plugin manifest
State files (stored in .oma/ — git-ignored):
| File | Purpose |
|---|---|
.oma/state.json | mode, active, iteration |
.oma/notepad.json | priority, working, manual sections |
.oma/task.log.json | architect/executor verdict history |
| Profile | Description |
|---|---|
| Community (default) | Full parallelization, no approval gates |
| Enterprise | Cost-aware model routing, ADR requirements, approval gates |
Enterprise is activated by creating .oma/config.json with { "profile": "enterprise" }. Enterprise only adds rules — it never removes community features.
Two hooks can inject context into the agent after each tool call. Both are disabled by default:
| Key | Default | Description |
|---|---|---|
hooks.costTracking | false | Per-tool credit/cost estimates logged to .oma/cost-log.json |
hooks.statusMessages | false | OMA mode, task progress, and notepad injected into agent context |
Enable via /oma:config set hooks.costTracking true or in .oma/config.json:
{ "hooks": { "costTracking": true, "statusMessages": true } }
# Run typecheck, build, unit+coverage, and CLI e2e
npm run typecheck
npm run build
npm run test:coverage
bats e2e/oma-cli.bats e2e/super-oma-cli.bats
# Validate all manifests
node -e "
const fs = require('fs');
const files = [
'.augment-plugin/marketplace.json',
'plugins/oma/.augment-plugin/plugin.json',
'plugins/oma/.augment-plugin/.mcp.json',
'plugins/oma/hooks/hooks.json',
'.claude-plugin/plugin.json'
];
for (const f of files) {
try { JSON.parse(fs.readFileSync(f)); console.log('OK: ' + f); }
catch(e) { console.error('FAIL: ' + f + ' - ' + e.message); process.exit(1); }
}
"
Please review our Security Policy for supported versions and vulnerability reporting guidelines.
| Resource | URL |
|---|---|
| Augment Code | https://www.augmentcode.com |
| auggie CLI docs | https://www.augmentcode.com/docs/cli |
| Plugin docs | https://www.augmentcode.com/docs/cli/plugins |
| Hooks docs | https://www.augmentcode.com/docs/cli/hooks |
| MCP docs | https://www.augmentcode.com/docs/cli/integrations |
| oh-my-auggie | https://github.com/r3dlex/oh-my-auggie |
:heart: Love oh-my-auggie? Consider sponsoring its development.
Your sponsorship directly funds the time and energy poured into making multi-agent orchestration accessible to every developer on the Augment Code platform. Every contribution — no matter the size — helps keep the project alive, responsive, and improving.
One-time and recurring options available. Sponsors get recognized in the project README and release notes.
oh-my-auggie is not affiliated with Augment Code. "auggie" and "Augment Code" are trademarks of their respective owners.
FAQs
OMA plugin with TypeScript hooks -- Windows-compatible
We found that @r3dlex/oh-my-auggie demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.