@cmetech/otto 1.2.4 → 1.2.6

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-fe239844559e7ca1
+4baa0132ee073a5c

package/dist/resources/extensions/coworker-memory/index.js

@@ -6,7 +6,7 @@ import { runRecall } from './recall-tool.js';
 import { runMemoryCommand } from './memory-command.js';
 import { onSessionShutdown } from './session-hooks.js';
 import { createCurrentScratchpadProvider } from '../coworker-scratchpad/sp-command.js';
-import { getCoworkerGlobalDir, getScratchpadsRoot } from '../_coworker-paths.js';
+import { getCoworkerGlobalDir, getScratchpadsRoot } from '../shared/coworker-paths.js';
 export { createMemoryBundle };
 // Cross-pillar export. Scratchpad's onDataLoad closure imports this and calls
 // it lazily — returns null before session_start or after session_shutdown,

package/dist/resources/extensions/coworker-scratchpad/index.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import { ScratchpadManager } from '@otto/coworker-scratchpad';
-import { getScratchpadsRoot } from '../_coworker-paths.js';
+import { getScratchpadsRoot } from '../shared/coworker-paths.js';
 import { getMemoryRecorder } from '../coworker-memory/index.js';
 import { getArtifactStore } from '../coworker-artifacts/index.js';
 import { registerSpCommand } from './sp-command.js';

package/dist/resources/extensions/coworker-scratchpad/scratchpad-tool.js

@@ -44,17 +44,17 @@ export function registerScratchpadTool(pi, deps) {
     pi.registerTool({
         name: 'cw_scratchpad',
         label: 'Co-worker scratchpad',
-        description: 'USE FOR: loading or analyzing files (CSV, Excel, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
+        description: 'USE FOR: loading or analyzing files (CSV, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
             'DO NOT USE FOR: simple arithmetic, lookups answerable from reasoning alone, pure prose, code review, or one-off calculations with no file or data source involved. ' +
             'IF the user explicitly names this tool ("use cw_scratchpad", "run this in the scratchpad", "exec a cell"), use it regardless of the rules above. ' +
             'IF UNSURE whether a request belongs here, ASK the user once: "Do you want me to run this in cw_scratchpad so you can inspect the cells via /sp view, or answer inline?" Wait for their reply before deciding. ' +
             'Runs TypeScript cells in a persistent JS kernel scoped to a named scratchpad. State persists across cells via globalThis.* and across Otto sessions via on-disk kernel.db + namespace.json. ' +
-            'Pre-bound libs in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
+            'Pre-bound libs in every cell: polars, DuckDB, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
             'Actions: exec (run a TypeScript cell), view (return the last N cells). ' +
             'Distinct from the analyst extension\'s SQL-only `scratchpad` tool — this one runs arbitrary TypeScript.',
-        promptSnippet: 'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/Excel/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
+        promptSnippet: 'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
         promptGuidelines: [
-            'Trigger criteria: the request involves loading a file (CSV/Excel/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
+            'Trigger criteria: the request involves loading a file (CSV/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
             'Skip the tool for: trivial arithmetic, lookups you can answer from reasoning, prose generation, code review, and pure-explanation tasks.',
             'If the user names the tool explicitly (e.g. "use cw_scratchpad", "in the scratchpad", "exec a cell"), always honor that request and skip the unsure-prompt.',
             'IF UNSURE whether a request fits the trigger criteria, ask the user once before deciding: "Do you want me to run this in cw_scratchpad (you can inspect the cells via /sp view) or answer inline?" Wait for the user\'s reply before either calling the tool or answering inline.',
@@ -62,7 +62,7 @@ export function registerScratchpadTool(pi, deps) {
             'The cell body is wrapped in (async () => { ... })(). let/const/var are local to the cell. To persist, assign to globalThis.foo = ...',
             'For DuckDB tables that survive across Otto sessions, use `await otto.duckdb.connect()`. For ephemeral in-memory, use `DuckDB.DuckDBInstance.create(":memory:")`.',
             'For polars→DuckDB: prefer `otto.duckdb.registerDf(name, df)` over manual API discovery. If inference picks the wrong column type, pass `{ schema: { col: \'TYPE\' } }` as the third argument. Falls back to polars\' own SQL (`df.sql(...)`) for one-off aggregations.',
-            'Pre-bound libs available in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. No imports needed.',
+            'Pre-bound libs available in every cell: polars, DuckDB, dateFns, lodash, zod, axios. No imports needed.',
             'Use otto.collectors.list() to discover data sources and otto.collectors.open(uri) to load one.',
             'The `name` parameter defaults to the currently attached scratchpad. Omit it unless you want to operate on a different one (this does NOT switch the user attachment).',
             'A returned string that looks markdown-shaped will appear in the response as text/markdown automatically. Return a markdown table or heading to render it.',

package/dist/resources/extensions/coworker-vault/index.js

@@ -2,7 +2,7 @@ import { createVaultBundle } from './vault-singleton.js';
 import { runConnect } from './connect-command.js';
 import { runDatasourceList, runDatasourceRemove, runDatasourceTest, } from './datasource-command.js';
 import { runAudit } from './audit-command.js';
-import { getCoworkerGlobalDir } from '../_coworker-paths.js';
+import { getCoworkerGlobalDir } from '../shared/coworker-paths.js';
 export { createVaultBundle };
 export default function coworkerVaultExtension(api) {
     let bundle = null;

package/dist/resources/extensions/otto/commands/release-notes/_data.js

@@ -9,12 +9,35 @@
 // runtime command surfaces a link when a requested version isn't bundled.
 export const RELEASE_NOTES_MANIFEST = {
     truncated: false,
-    total: 13,
+    total: 15,
     oldestBundled: '1.0.0',
-    newestBundled: '1.2.4',
+    newestBundled: '1.2.6',
     historyUrl: 'https://github.com/cmetech/otto-cli/blob/main/CHANGELOG.md',
 };
 export const RELEASE_NOTES = [
+    {
+        version: '1.2.6',
+        date: '2026-06-03',
+        headline: 'Second Windows-install hotfix on top of 1.2.5: better-sqlite3 native install no longer requires Visual Studio on Node 24, and the entire exceljs transitive-dep chain (glob@7 / inflight / rimraf@2 / fstream / lodash.isequal) is removed at the source by dropping the library itself.',
+        fixed: [
+            '**`better-sqlite3` install fails on Windows + Node 24** with `gyp ERR! find VS / Could not find any Visual Studio installation to use`. The pinned `^11.7.0` from 1.2.5 has no prebuilt binary for `NODE_MODULE_VERSION 137` (Node 24), so npm fell through to `node-gyp rebuild`, which requires a C++ toolchain. Bumped to `^12.10.0` in both root `dependencies` and `packages/coworker-memory/package.json`; v12.10.0 ships a `v137-win32-x64` prebuild that installs cleanly.',
+        ],
+        changed: [
+            '**`exceljs@4.4.0` dropped from the scratchpad data-lib bindings.** Upstream is dormant (last commit Jan 2024) and the package\'s transitive deps generate eight `npm warn deprecated` messages on every install — `glob@7.2.3` (CVE), `inflight@1.0.6` (memory leak), `rimraf@2.7.1`, `fstream@1.0.12`, `lodash.isequal@4.5.0`, plus old `uuid@8/9` chains. Removed from `package.json`, `packages/coworker-scratchpad/src/kernel-bindings.ts` import + spread, `kernel-entry.ts` binding-names list, and both test files; the LLM-facing tool description in `src/resources/extensions/coworker-scratchpad/scratchpad-tool.ts` no longer claims `ExcelJS` as a pre-bound lib. Cell code that depended on `new ExcelJS.Workbook()` now throws `ReferenceError`. xlsx-capability replacement (likely `xlsx-populate@1.21.0`) is tracked in `docs/superpowers/notes/2026-06-01-coworker-roadmap.md` § Out-of-scope.',
+        ],
+    },
+    {
+        version: '1.2.5',
+        date: '2026-06-03',
+        headline: 'Windows-install hotfix: silences three startup errors that fired the first time `otto` launched after a global npm install, and stops the otto extension from racing the TUI welcome banner with raw stderr writes.',
+        fixed: [
+            '**`_coworker-paths.js` "Extension does not export a valid factory function".** The shared helper module sat at the top of `src/resources/extensions/` so the pi-coding-agent extension discovery (`discoverExtensionsInDir`) walked it as an extension candidate. Moved to `src/resources/extensions/shared/coworker-paths.{ts,test.ts}` (subdir is skipped by `resolveExtensionEntries` because it has no `index.ts`/`package.json`). The three coworker-{memory,scratchpad,vault}/index.ts importers were updated in lockstep.',
+            '**`Cannot find module \'better-sqlite3\'` on global install.** `better-sqlite3` was declared only in `packages/coworker-memory/package.json`. Because npm only resolves the root manifest for end users of a published tarball, the native module was never installed and `@otto/coworker-memory`\'s eager re-export of `local-sqlite-backend.js` blew up at first import. Hoisted `better-sqlite3@^11.7.0` into root `dependencies`.',
+            '**`/audit` slash-command conflict between coworker-vault and slash-commands.** Both extensions registered the same id; the vault command (the real Phase 2 reader) supersedes, but the conflict warning fired every launch. Renamed the slash-commands command to `/audit-codebase` (file + manifest + dispatch updated).',
+            '**Otto session_start bled raw stderr into the TUI welcome banner.** The gateway + langflow probes wrote ANSI-colored status lines directly to `process.stderr` while the pi TUI was still painting; on Windows the rendered output collided with the yellow `─` rule and overwrote the prompt area. Now routes status through `ctx.ui.setStatus("otto-gateway"|"otto-langflow", ...)` when `ctx.hasUI` is true; falls back to stderr only in headless/RPC modes.',
+            '**Duplicate "OTTO" brand on the no-project landing.** The `gsd-health` widget\'s no-project line began with `"  OTTO  No project loaded — …"`, which appeared alongside the ASCII OTTO logo in the welcome header — looking like the brand was loading twice. Dropped the `OTTO ` prefix; the header already brands the session.',
+        ],
+    },
     {
         version: '1.2.4',
         date: '2026-06-02',

package/dist/resources/extensions/otto/index.js

@@ -108,6 +108,10 @@ export default function Otto(pi) {
         const green = ANSI_BRAND_GREEN;
         const dim = ANSI_DIM;
         const reset = ANSI_RESET;
+        // When a TUI is rendering, raw stderr writes race with the welcome banner
+        // and overwrite the prompt area. Route status through `ctx.ui.setStatus`
+        // instead, and only fall back to stderr for headless/RPC modes.
+        const hasUI = ctx?.hasUI === true;
         // ── Gateway connection probe (preserved from Phase 1 Task 6) ──
         const gwUrl = process.env.OTTO_GATEWAY_URL?.trim();
         if (gwUrl) {
@@ -118,15 +122,30 @@ export default function Otto(pi) {
                 clearTimeout(timer);
                 const ok = r.ok;
                 const host = new URL(gwUrl).host;
-                process.stderr.write(`  ${yellow}gateway:${reset} ${ok ? green : dim}routed → ${host}${reset}\n`);
+                if (hasUI) {
+                    ctx?.ui.setStatus("otto-gateway", ok ? `Gateway → ${host}` : `Gateway → ${host} (down)`);
+                }
+                else {
+                    process.stderr.write(`  ${yellow}gateway:${reset} ${ok ? green : dim}routed → ${host}${reset}\n`);
+                }
             }
             catch {
                 const host = new URL(gwUrl).host;
-                process.stderr.write(`  ${yellow}gateway:${reset} ${dim}routed → ${host} (unreachable)${reset}\n`);
+                if (hasUI) {
+                    ctx?.ui.setStatus("otto-gateway", `Gateway → ${host} (unreachable)`);
+                }
+                else {
+                    process.stderr.write(`  ${yellow}gateway:${reset} ${dim}routed → ${host} (unreachable)${reset}\n`);
+                }
             }
         }
         else {
-            process.stderr.write(`  ${yellow}gateway:${reset} ${dim}direct (no OTTO_GATEWAY_URL set)${reset}\n`);
+            if (hasUI) {
+                ctx?.ui.setStatus("otto-gateway", undefined);
+            }
+            else {
+                process.stderr.write(`  ${yellow}gateway:${reset} ${dim}direct (no OTTO_GATEWAY_URL set)${reset}\n`);
+            }
         }
         // ── LangFlow connection probe ──
         const cfg = effectiveLangFlowConfig();
@@ -135,18 +154,24 @@ export default function Otto(pi) {
         const lfHost = new URL(lfUrl).host;
         if (langflowDisabled) {
             ctx?.ui.setStatus("otto-langflow", undefined);
-            process.stderr.write(`  ${yellow}langflow:${reset} ${dim}disabled (${lfHost})${reset}\n`);
+            if (!hasUI) {
+                process.stderr.write(`  ${yellow}langflow:${reset} ${dim}disabled (${lfHost})${reset}\n`);
+            }
         }
         else {
             const lfClient = getLangFlowClient();
             const lfVersion = await lfClient.getVersion();
             if (lfVersion) {
                 ctx?.ui.setStatus("otto-langflow", `LangFlow ok v${lfVersion.version}`);
-                process.stderr.write(`  ${yellow}langflow:${reset} ${green}connected${reset} ${dim}(v${lfVersion.version} @ ${lfHost})${reset}\n`);
+                if (!hasUI) {
+                    process.stderr.write(`  ${yellow}langflow:${reset} ${green}connected${reset} ${dim}(v${lfVersion.version} @ ${lfHost})${reset}\n`);
+                }
             }
             else {
                 ctx?.ui.setStatus("otto-langflow", "LangFlow offline");
-                process.stderr.write(`  ${yellow}langflow:${reset} ${dim}offline (${lfHost})${reset}\n`);
+                if (!hasUI) {
+                    process.stderr.write(`  ${yellow}langflow:${reset} ${dim}offline (${lfHost})${reset}\n`);
+                }
             }
         }
     });

package/dist/resources/extensions/slash-commands/{audit.js → audit-codebase.js}

@@ -1,6 +1,6 @@
 import { mkdirSync } from "node:fs";
-export default function auditCommand(pi) {
-    pi.registerCommand("audit", {
+export default function auditCodebaseCommand(pi) {
+    pi.registerCommand("audit-codebase", {
         description: "Audit the current codebase against a specific goal and write a structured report to .gsd/audits/",
         async handler(args, ctx) {
             // ── Step 1: Get the audit goal ────────────────────────────────────────
@@ -8,7 +8,7 @@ export default function auditCommand(pi) {
             if (!goal) {
                 const input = await ctx.ui.input("What is the audit goal?", "e.g. understand performance bottlenecks before planning a roadmap");
                 if (!input?.trim()) {
-                    ctx.ui.notify("audit: No goal provided — cancelled.", "error");
+                    ctx.ui.notify("audit-codebase: No goal provided — cancelled.", "error");
                     return;
                 }
                 goal = input.trim();
@@ -62,7 +62,7 @@ ${goal}
 
 ---
 
-*Generated by /audit — read-only recce, no code was modified.*
+*Generated by /audit-codebase — read-only recce, no code was modified.*
 \`\`\`
 
 After writing the file, confirm with: "✅ Audit complete — report saved to \`${outputPath}\`"`;

package/dist/resources/extensions/slash-commands/extension-manifest.json

@@ -6,6 +6,6 @@
   "tier": "bundled",
   "requires": { "platform": ">=2.29.0" },
   "provides": {
-    "commands": ["create-slash-command", "create-extension", "audit", "clear"]
+    "commands": ["create-slash-command", "create-extension", "audit-codebase", "clear"]
   }
 }

package/dist/resources/extensions/slash-commands/index.js

@@ -1,10 +1,10 @@
 import createSlashCommand from "./create-slash-command.js";
 import createExtension from "./create-extension.js";
-import auditCommand from "./audit.js";
+import auditCodebaseCommand from "./audit-codebase.js";
 import clearCommand from "./clear.js";
 export default function slashCommands(pi) {
     createSlashCommand(pi);
     createExtension(pi);
-    auditCommand(pi);
+    auditCodebaseCommand(pi);
     clearCommand(pi);
 }

package/dist/resources/extensions/workflow/health-widget-core.js

@@ -50,7 +50,7 @@ function truncateMessage(msg, maxLen) {
  */
 export function buildHealthLines(data, width) {
     if (data.projectState === "none") {
-        return ["  OTTO  No project loaded — cd into a project, then run /otto init"];
+        return ["  No project loaded — cd into a project, then run /otto init"];
     }
     if (data.projectState === "initialized") {
         return [`  ${BRAND}  Project Initialized`];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmetech/otto",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Terminal-based developer chat assistant. Permanent hard fork of gsd-pi with LangFlow flow triggers, a flow builder, and optional gateway routing for compliance environments.",
   "keywords": [
     "ai",
@@ -156,12 +156,12 @@
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "axios": "^1.16.1",
+    "better-sqlite3": "^12.10.0",
     "chalk": "^5.6.2",
     "chokidar": "^5.0.0",
     "date-fns": "^4.4.0",
     "diff": "^8.0.2",
     "echarts": "^5.6.0",
-    "exceljs": "^4.4.0",
     "extract-zip": "^2.0.1",
     "file-type": "^21.1.1",
     "glob": "^13.0.1",
@@ -196,11 +196,11 @@
   },
   "optionalDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.2.83",
-    "@cmetech/otto-engine-darwin-arm64": "1.2.4",
-    "@cmetech/otto-engine-darwin-x64": "1.2.4",
-    "@cmetech/otto-engine-linux-arm64-gnu": "1.2.4",
-    "@cmetech/otto-engine-linux-x64-gnu": "1.2.4",
-    "@cmetech/otto-engine-win32-x64-msvc": "1.2.4",
+    "@cmetech/otto-engine-darwin-arm64": "1.2.6",
+    "@cmetech/otto-engine-darwin-x64": "1.2.6",
+    "@cmetech/otto-engine-linux-arm64-gnu": "1.2.6",
+    "@cmetech/otto-engine-linux-x64-gnu": "1.2.6",
+    "@cmetech/otto-engine-win32-x64-msvc": "1.2.6",
     "fsevents": "~2.3.3",
     "koffi": "^2.9.0"
   },

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/contracts",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Shared public contracts for OTTO workspace boundaries",
   "license": "MIT",
   "otto": {

package/packages/coworker-memory/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@otto/coworker-utils": "*",
-    "better-sqlite3": "^11.7.0",
+    "better-sqlite3": "^12.10.0",
     "uuid": "^11.0.0",
     "yaml": "^2.8.2"
   },

package/packages/coworker-scratchpad/dist/kernel-bindings.d.ts

@@ -3,6 +3,11 @@ import { type AuditLog } from '@otto/coworker-utils';
 /**
  * The data libraries pre-bound into every scratchpad cell's vm sandbox.
  * DuckDB is bound as an in-memory-capable lib here; on-disk kernel.db wiring is 1d2.
+ *
+ * Note: ExcelJS was removed in 1.2.6 — its transitive deps (glob@7, inflight,
+ * rimraf@2, fstream, lodash.isequal) are deprecated with known vulnerabilities
+ * and exceljs is no longer maintained upstream. xlsx-populate is the candidate
+ * replacement; tracked in docs/superpowers/notes/2026-06-01-coworker-roadmap.md.
  */
 export declare function buildDataLibBindings(): Record<string, unknown>;
 /** SQL column type string passed straight into CREATE TABLE (e.g. VARCHAR, BIGINT). */

package/packages/coworker-scratchpad/dist/kernel-bindings.js

@@ -1,5 +1,4 @@
 import pl from 'nodejs-polars';
-import ExcelJS from 'exceljs';
 import lodash from 'lodash';
 import axios from 'axios';
 import { z } from 'zod';
@@ -9,12 +8,16 @@ import { SecretScanner } from '@otto/coworker-utils';
 /**
  * The data libraries pre-bound into every scratchpad cell's vm sandbox.
  * DuckDB is bound as an in-memory-capable lib here; on-disk kernel.db wiring is 1d2.
+ *
+ * Note: ExcelJS was removed in 1.2.6 — its transitive deps (glob@7, inflight,
+ * rimraf@2, fstream, lodash.isequal) are deprecated with known vulnerabilities
+ * and exceljs is no longer maintained upstream. xlsx-populate is the candidate
+ * replacement; tracked in docs/superpowers/notes/2026-06-01-coworker-roadmap.md.
  */
 export function buildDataLibBindings() {
     return {
         polars: pl,
         DuckDB,
-        ExcelJS,
         dateFns,
         lodash,
         zod: z,

package/packages/coworker-scratchpad/dist/kernel-entry.js

@@ -22,7 +22,6 @@ const KNOWN_BOUND_KEYS = new Set([
     'clearInterval',
     'polars',
     'DuckDB',
-    'ExcelJS',
     'dateFns',
     'lodash',
     'zod',

package/packages/coworker-scratchpad/src/child-process-runtime.test.ts

@@ -160,14 +160,13 @@ describe('data-lib bindings inside a live kernel', () => {
     await rm(ws, { recursive: true, force: true });
   });
 
-  it('polars / lodash / zod / date-fns / exceljs / axios / DuckDB are bound', async () => {
+  it('polars / lodash / zod / date-fns / axios / DuckDB are bound', async () => {
     rt = new ChildProcessRuntime({ workspace: ws, inactivityTimeoutMs: 20_000, cellTimeoutMs: 20_000 });
     await rt.start();
     assert.equal((await rt.runCell('return polars.DataFrame({ a: [1, 2, 3] }).height;')).value, 3);
     assert.equal((await rt.runCell('return lodash.chunk([1, 2, 3, 4], 2).length;')).value, 2);
     assert.equal((await rt.runCell('return zod.string().parse("hi");')).value, 'hi');
     assert.equal((await rt.runCell('return dateFns.format(new Date(1970, 0, 1), "yyyy");')).value, '1970');
-    assert.equal((await rt.runCell('const wb = new ExcelJS.Workbook(); wb.addWorksheet("s"); const buf = await wb.xlsx.writeBuffer(); return buf.byteLength > 0;')).value, true);
     assert.equal((await rt.runCell('return typeof axios.get;')).value, 'function');
     assert.equal((await rt.runCell('return typeof DuckDB.DuckDBInstance;')).value, 'function');
   });

package/packages/coworker-scratchpad/src/kernel-bindings.test.ts

@@ -9,9 +9,9 @@ import { buildDataLibBindings, redactForJournal } from './kernel-bindings.js';
 import { ChildProcessRuntime } from './child-process-runtime.js';
 
 describe('kernel-bindings', () => {
-  it('exposes all seven pre-bound data libraries', () => {
+  it('exposes all six pre-bound data libraries', () => {
     const b = buildDataLibBindings();
-    for (const key of ['polars', 'DuckDB', 'ExcelJS', 'dateFns', 'lodash', 'zod', 'axios']) {
+    for (const key of ['polars', 'DuckDB', 'dateFns', 'lodash', 'zod', 'axios']) {
       assert.ok(key in b, `missing binding: ${key}`);
       assert.notEqual(b[key], undefined, `binding is undefined: ${key}`);
     }
@@ -24,7 +24,6 @@ describe('kernel-bindings', () => {
     assert.equal(typeof b.dateFns.format, 'function');
     assert.equal(typeof b.lodash.chunk, 'function');
     assert.equal(typeof b.axios.get, 'function');
-    assert.equal(typeof b.ExcelJS.Workbook, 'function');
   });
 });
 

package/packages/coworker-scratchpad/src/kernel-bindings.ts

@@ -1,5 +1,4 @@
 import pl from 'nodejs-polars';
-import ExcelJS from 'exceljs';
 import lodash from 'lodash';
 import axios from 'axios';
 import { z } from 'zod';
@@ -11,12 +10,16 @@ import { SecretScanner, type AuditLog, type AuditRecord } from '@otto/coworker-u
 /**
  * The data libraries pre-bound into every scratchpad cell's vm sandbox.
  * DuckDB is bound as an in-memory-capable lib here; on-disk kernel.db wiring is 1d2.
+ *
+ * Note: ExcelJS was removed in 1.2.6 — its transitive deps (glob@7, inflight,
+ * rimraf@2, fstream, lodash.isequal) are deprecated with known vulnerabilities
+ * and exceljs is no longer maintained upstream. xlsx-populate is the candidate
+ * replacement; tracked in docs/superpowers/notes/2026-06-01-coworker-roadmap.md.
  */
 export function buildDataLibBindings(): Record<string, unknown> {
   return {
     polars: pl,
     DuckDB,
-    ExcelJS,
     dateFns,
     lodash,
     zod: z,

package/packages/coworker-scratchpad/src/kernel-entry.ts

@@ -38,7 +38,6 @@ const KNOWN_BOUND_KEYS = new Set([
   'clearInterval',
   'polars',
   'DuckDB',
-  'ExcelJS',
   'dateFns',
   'lodash',
   'zod',

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/daemon",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "OTTO daemon — background process for project monitoring and Discord integration",
   "license": "MIT",
   "repository": {
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.52.0",
-    "@otto-build/contracts": "^1.2.0",
-    "@otto-build/rpc-client": "^1.2.0",
+    "@otto-build/contracts": "^1.2.6",
+    "@otto-build/rpc-client": "^1.2.6",
     "discord.js": "^14.25.1",
     "yaml": "^2.8.0",
     "zod": "^3.24.0"

package/packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/mcp-server",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "MCP server exposing OTTO orchestration tools for compatible clients",
   "license": "MIT",
   "otto": {
@@ -34,8 +34,8 @@
     "test": "npm run build:test && node --test dist/mcp-server.test.js dist/remote-questions.test.js"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.2.0",
-    "@otto-build/rpc-client": "^1.2.0",
+    "@otto-build/contracts": "^1.2.6",
+    "@otto-build/rpc-client": "^1.2.6",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.0.0"
   },

package/packages/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/native",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Native Rust bindings for OTTO — high-performance native modules via N-API",
   "type": "commonjs",
   "otto": {

package/packages/pi-agent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-agent-core",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "General-purpose agent core (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/pi-ai/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-ai",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Unified LLM API (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/pi-coding-agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-coding-agent",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Coding agent CLI (vendored from pi-mono)",
   "type": "module",
   "otto": {
@@ -28,7 +28,7 @@
     "copy-assets": "node scripts/copy-assets.cjs"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.2.0",
+    "@otto-build/contracts": "^1.2.6",
     "@mariozechner/jiti": "^2.6.2",
     "@silvia-odwyer/photon-node": "^0.3.4",
     "chalk": "^5.5.0",

package/packages/pi-tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto/pi-tui",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Terminal User Interface library (vendored from pi-mono)",
   "type": "module",
   "otto": {

package/packages/rpc-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-build/rpc-client",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "Standalone RPC client SDK for OTTO — zero internal dependencies",
   "license": "MIT",
   "otto": {
@@ -34,7 +34,7 @@
     "test": "node --test dist/rpc-client.test.js"
   },
   "dependencies": {
-    "@otto-build/contracts": "^1.2.0"
+    "@otto-build/contracts": "^1.2.6"
   },
   "engines": {
     "node": ">=22.0.0"

package/pkg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loop24/client",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "piConfig": {
     "_comment": "AUTO-SYNCED from root package.json by scripts/sync-piconfig.mjs (runs on prebuild). Do not edit this block directly — edit root package.json and re-run `npm run build` or `npm run sync-piconfig`.",
     "name": "otto",

package/src/resources/extensions/coworker-memory/index.ts

@@ -22,7 +22,7 @@ import { runRecall, type RecallToolArgs } from './recall-tool.js';
 import { runMemoryCommand } from './memory-command.js';
 import { onSessionShutdown } from './session-hooks.js';
 import { createCurrentScratchpadProvider } from '../coworker-scratchpad/sp-command.js';
-import { getCoworkerGlobalDir, getScratchpadsRoot } from '../_coworker-paths.js';
+import { getCoworkerGlobalDir, getScratchpadsRoot } from '../shared/coworker-paths.js';
 
 export { createMemoryBundle };
 export type { MemoryBundle, MemoryBundleOptions };

package/src/resources/extensions/coworker-scratchpad/index.ts

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join, basename } from 'node:path';
 import type { ExtensionAPI, ExtensionContext } from '@otto/pi-coding-agent';
 import { ScratchpadManager, type DataLoadDrawer, type ArtifactCreateDrawer } from '@otto/coworker-scratchpad';
-import { getScratchpadsRoot } from '../_coworker-paths.js';
+import { getScratchpadsRoot } from '../shared/coworker-paths.js';
 import { getMemoryRecorder } from '../coworker-memory/index.js';
 import { getArtifactStore } from '../coworker-artifacts/index.js';
 import { registerSpCommand } from './sp-command.js';

package/src/resources/extensions/coworker-scratchpad/scratchpad-tool.ts

@@ -90,18 +90,18 @@ export function registerScratchpadTool(pi: ExtensionAPI, deps: ScratchpadToolDep
     name: 'cw_scratchpad',
     label: 'Co-worker scratchpad',
     description:
-      'USE FOR: loading or analyzing files (CSV, Excel, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
+      'USE FOR: loading or analyzing files (CSV, JSON, Parquet), tabular data manipulation with polars or DuckDB, multi-step data exploration where state should persist across turns, or anything that calls otto.collectors. ' +
       'DO NOT USE FOR: simple arithmetic, lookups answerable from reasoning alone, pure prose, code review, or one-off calculations with no file or data source involved. ' +
       'IF the user explicitly names this tool ("use cw_scratchpad", "run this in the scratchpad", "exec a cell"), use it regardless of the rules above. ' +
       'IF UNSURE whether a request belongs here, ASK the user once: "Do you want me to run this in cw_scratchpad so you can inspect the cells via /sp view, or answer inline?" Wait for their reply before deciding. ' +
       'Runs TypeScript cells in a persistent JS kernel scoped to a named scratchpad. State persists across cells via globalThis.* and across Otto sessions via on-disk kernel.db + namespace.json. ' +
-      'Pre-bound libs in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
+      'Pre-bound libs in every cell: polars, DuckDB, dateFns, lodash, zod, axios. otto.collectors.{list,open} enumerates and loads data sources. ' +
       'Actions: exec (run a TypeScript cell), view (return the last N cells). ' +
       'Distinct from the analyst extension\'s SQL-only `scratchpad` tool — this one runs arbitrary TypeScript.',
     promptSnippet:
-      'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/Excel/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
+      'cw_scratchpad — run TypeScript cells in a persistent JS kernel. USE for files (CSV/JSON/Parquet), polars/DuckDB analysis, otto.collectors, or multi-step data work. NOT for arithmetic or pure prose. If unsure, ASK the user first.',
     promptGuidelines: [
-      'Trigger criteria: the request involves loading a file (CSV/Excel/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
+      'Trigger criteria: the request involves loading a file (CSV/JSON/Parquet/etc.), querying tabular data via polars or DuckDB, calling otto.collectors, or building state that must survive across turns.',
       'Skip the tool for: trivial arithmetic, lookups you can answer from reasoning, prose generation, code review, and pure-explanation tasks.',
       'If the user names the tool explicitly (e.g. "use cw_scratchpad", "in the scratchpad", "exec a cell"), always honor that request and skip the unsure-prompt.',
       'IF UNSURE whether a request fits the trigger criteria, ask the user once before deciding: "Do you want me to run this in cw_scratchpad (you can inspect the cells via /sp view) or answer inline?" Wait for the user\'s reply before either calling the tool or answering inline.',
@@ -109,7 +109,7 @@ export function registerScratchpadTool(pi: ExtensionAPI, deps: ScratchpadToolDep
       'The cell body is wrapped in (async () => { ... })(). let/const/var are local to the cell. To persist, assign to globalThis.foo = ...',
       'For DuckDB tables that survive across Otto sessions, use `await otto.duckdb.connect()`. For ephemeral in-memory, use `DuckDB.DuckDBInstance.create(":memory:")`.',
       'For polars→DuckDB: prefer `otto.duckdb.registerDf(name, df)` over manual API discovery. If inference picks the wrong column type, pass `{ schema: { col: \'TYPE\' } }` as the third argument. Falls back to polars\' own SQL (`df.sql(...)`) for one-off aggregations.',
-      'Pre-bound libs available in every cell: polars, DuckDB, ExcelJS, dateFns, lodash, zod, axios. No imports needed.',
+      'Pre-bound libs available in every cell: polars, DuckDB, dateFns, lodash, zod, axios. No imports needed.',
       'Use otto.collectors.list() to discover data sources and otto.collectors.open(uri) to load one.',
       'The `name` parameter defaults to the currently attached scratchpad. Omit it unless you want to operate on a different one (this does NOT switch the user attachment).',
       'A returned string that looks markdown-shaped will appear in the response as text/markdown automatically. Return a markdown table or heading to render it.',

package/src/resources/extensions/coworker-vault/index.ts

@@ -14,7 +14,7 @@ import {
   runDatasourceTest,
 } from './datasource-command.js';
 import { runAudit, type AuditQuery } from './audit-command.js';
-import { getCoworkerGlobalDir } from '../_coworker-paths.js';
+import { getCoworkerGlobalDir } from '../shared/coworker-paths.js';
 
 export { createVaultBundle };
 export type { VaultBundle, VaultBundleOptions };

package/src/resources/extensions/otto/commands/release-notes/_data.ts

@@ -33,13 +33,36 @@ export interface ReleaseNotesManifest {
 
 export const RELEASE_NOTES_MANIFEST: ReleaseNotesManifest = {
 	truncated: false,
-	total: 13,
+	total: 15,
 	oldestBundled: '1.0.0',
-	newestBundled: '1.2.4',
+	newestBundled: '1.2.6',
 	historyUrl: 'https://github.com/cmetech/otto-cli/blob/main/CHANGELOG.md',
 };
 
 export const RELEASE_NOTES: ReleaseNote[] = [
+	{
+		version: '1.2.6',
+		date: '2026-06-03',
+		headline: 'Second Windows-install hotfix on top of 1.2.5: better-sqlite3 native install no longer requires Visual Studio on Node 24, and the entire exceljs transitive-dep chain (glob@7 / inflight / rimraf@2 / fstream / lodash.isequal) is removed at the source by dropping the library itself.',
+		fixed: [
+			'**`better-sqlite3` install fails on Windows + Node 24** with `gyp ERR! find VS / Could not find any Visual Studio installation to use`. The pinned `^11.7.0` from 1.2.5 has no prebuilt binary for `NODE_MODULE_VERSION 137` (Node 24), so npm fell through to `node-gyp rebuild`, which requires a C++ toolchain. Bumped to `^12.10.0` in both root `dependencies` and `packages/coworker-memory/package.json`; v12.10.0 ships a `v137-win32-x64` prebuild that installs cleanly.',
+		],
+		changed: [
+			'**`exceljs@4.4.0` dropped from the scratchpad data-lib bindings.** Upstream is dormant (last commit Jan 2024) and the package\'s transitive deps generate eight `npm warn deprecated` messages on every install — `glob@7.2.3` (CVE), `inflight@1.0.6` (memory leak), `rimraf@2.7.1`, `fstream@1.0.12`, `lodash.isequal@4.5.0`, plus old `uuid@8/9` chains. Removed from `package.json`, `packages/coworker-scratchpad/src/kernel-bindings.ts` import + spread, `kernel-entry.ts` binding-names list, and both test files; the LLM-facing tool description in `src/resources/extensions/coworker-scratchpad/scratchpad-tool.ts` no longer claims `ExcelJS` as a pre-bound lib. Cell code that depended on `new ExcelJS.Workbook()` now throws `ReferenceError`. xlsx-capability replacement (likely `xlsx-populate@1.21.0`) is tracked in `docs/superpowers/notes/2026-06-01-coworker-roadmap.md` § Out-of-scope.',
+		],
+	},
+	{
+		version: '1.2.5',
+		date: '2026-06-03',
+		headline: 'Windows-install hotfix: silences three startup errors that fired the first time `otto` launched after a global npm install, and stops the otto extension from racing the TUI welcome banner with raw stderr writes.',
+		fixed: [
+			'**`_coworker-paths.js` "Extension does not export a valid factory function".** The shared helper module sat at the top of `src/resources/extensions/` so the pi-coding-agent extension discovery (`discoverExtensionsInDir`) walked it as an extension candidate. Moved to `src/resources/extensions/shared/coworker-paths.{ts,test.ts}` (subdir is skipped by `resolveExtensionEntries` because it has no `index.ts`/`package.json`). The three coworker-{memory,scratchpad,vault}/index.ts importers were updated in lockstep.',
+			'**`Cannot find module \'better-sqlite3\'` on global install.** `better-sqlite3` was declared only in `packages/coworker-memory/package.json`. Because npm only resolves the root manifest for end users of a published tarball, the native module was never installed and `@otto/coworker-memory`\'s eager re-export of `local-sqlite-backend.js` blew up at first import. Hoisted `better-sqlite3@^11.7.0` into root `dependencies`.',
+			'**`/audit` slash-command conflict between coworker-vault and slash-commands.** Both extensions registered the same id; the vault command (the real Phase 2 reader) supersedes, but the conflict warning fired every launch. Renamed the slash-commands command to `/audit-codebase` (file + manifest + dispatch updated).',
+			'**Otto session_start bled raw stderr into the TUI welcome banner.** The gateway + langflow probes wrote ANSI-colored status lines directly to `process.stderr` while the pi TUI was still painting; on Windows the rendered output collided with the yellow `─` rule and overwrote the prompt area. Now routes status through `ctx.ui.setStatus("otto-gateway"|"otto-langflow", ...)` when `ctx.hasUI` is true; falls back to stderr only in headless/RPC modes.',
+			'**Duplicate "OTTO" brand on the no-project landing.** The `gsd-health` widget\'s no-project line began with `"  OTTO  No project loaded — …"`, which appeared alongside the ASCII OTTO logo in the welcome header — looking like the brand was loading twice. Dropped the `OTTO ` prefix; the header already brands the session.',
+		],
+	},
 	{
 		version: '1.2.4',
 		date: '2026-06-02',

package/src/resources/extensions/otto/index.ts

@@ -112,6 +112,11 @@ export default function Otto(pi: ExtensionAPI): void {
     const dim    = ANSI_DIM;
     const reset  = ANSI_RESET;
 
+    // When a TUI is rendering, raw stderr writes race with the welcome banner
+    // and overwrite the prompt area. Route status through `ctx.ui.setStatus`
+    // instead, and only fall back to stderr for headless/RPC modes.
+    const hasUI = ctx?.hasUI === true;
+
     // ── Gateway connection probe (preserved from Phase 1 Task 6) ──
     const gwUrl = process.env.OTTO_GATEWAY_URL?.trim();
     if (gwUrl) {
@@ -122,13 +127,25 @@ export default function Otto(pi: ExtensionAPI): void {
         clearTimeout(timer);
         const ok = r.ok;
         const host = new URL(gwUrl).host;
-        process.stderr.write(`  ${yellow}gateway:${reset} ${ok ? green : dim}routed → ${host}${reset}\n`);
+        if (hasUI) {
+          ctx?.ui.setStatus("otto-gateway", ok ? `Gateway → ${host}` : `Gateway → ${host} (down)`);
+        } else {
+          process.stderr.write(`  ${yellow}gateway:${reset} ${ok ? green : dim}routed → ${host}${reset}\n`);
+        }
       } catch {
         const host = new URL(gwUrl).host;
-        process.stderr.write(`  ${yellow}gateway:${reset} ${dim}routed → ${host} (unreachable)${reset}\n`);
+        if (hasUI) {
+          ctx?.ui.setStatus("otto-gateway", `Gateway → ${host} (unreachable)`);
+        } else {
+          process.stderr.write(`  ${yellow}gateway:${reset} ${dim}routed → ${host} (unreachable)${reset}\n`);
+        }
       }
     } else {
-      process.stderr.write(`  ${yellow}gateway:${reset} ${dim}direct (no OTTO_GATEWAY_URL set)${reset}\n`);
+      if (hasUI) {
+        ctx?.ui.setStatus("otto-gateway", undefined);
+      } else {
+        process.stderr.write(`  ${yellow}gateway:${reset} ${dim}direct (no OTTO_GATEWAY_URL set)${reset}\n`);
+      }
     }
 
     // ── LangFlow connection probe ──
@@ -138,16 +155,22 @@ export default function Otto(pi: ExtensionAPI): void {
     const lfHost = new URL(lfUrl).host;
     if (langflowDisabled) {
       ctx?.ui.setStatus("otto-langflow", undefined);
-      process.stderr.write(`  ${yellow}langflow:${reset} ${dim}disabled (${lfHost})${reset}\n`);
+      if (!hasUI) {
+        process.stderr.write(`  ${yellow}langflow:${reset} ${dim}disabled (${lfHost})${reset}\n`);
+      }
     } else {
       const lfClient = getLangFlowClient();
       const lfVersion = await lfClient.getVersion();
       if (lfVersion) {
         ctx?.ui.setStatus("otto-langflow", `LangFlow ok v${lfVersion.version}`);
-        process.stderr.write(`  ${yellow}langflow:${reset} ${green}connected${reset} ${dim}(v${lfVersion.version} @ ${lfHost})${reset}\n`);
+        if (!hasUI) {
+          process.stderr.write(`  ${yellow}langflow:${reset} ${green}connected${reset} ${dim}(v${lfVersion.version} @ ${lfHost})${reset}\n`);
+        }
       } else {
         ctx?.ui.setStatus("otto-langflow", "LangFlow offline");
-        process.stderr.write(`  ${yellow}langflow:${reset} ${dim}offline (${lfHost})${reset}\n`);
+        if (!hasUI) {
+          process.stderr.write(`  ${yellow}langflow:${reset} ${dim}offline (${lfHost})${reset}\n`);
+        }
       }
     }
   });

package/src/resources/extensions/{_coworker-paths.test.ts → shared/coworker-paths.test.ts}

@@ -2,12 +2,12 @@ import { describe, it, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { getCoworkerGlobalDir, getScratchpadsRoot } from './_coworker-paths.js';
+import { getCoworkerGlobalDir, getScratchpadsRoot } from './coworker-paths.js';
 
 const ORIGINAL_GLOBAL = process.env.OTTO_COWORKER_GLOBAL_DIR;
 const ORIGINAL_SCRATCH = process.env.OTTO_SCRATCHPAD_ROOT;
 
-describe('_coworker-paths', () => {
+describe('coworker-paths', () => {
   before(() => {
     delete process.env.OTTO_COWORKER_GLOBAL_DIR;
     delete process.env.OTTO_SCRATCHPAD_ROOT;

package/src/resources/extensions/slash-commands/{audit.ts → audit-codebase.ts}

@@ -1,8 +1,8 @@
 import type { ExtensionAPI, ExtensionCommandContext } from "@otto/pi-coding-agent";
 import { mkdirSync } from "node:fs";
 
-export default function auditCommand(pi: ExtensionAPI) {
-	pi.registerCommand("audit", {
+export default function auditCodebaseCommand(pi: ExtensionAPI) {
+	pi.registerCommand("audit-codebase", {
 		description: "Audit the current codebase against a specific goal and write a structured report to .gsd/audits/",
 		async handler(args: string, ctx: ExtensionCommandContext) {
 			// ── Step 1: Get the audit goal ────────────────────────────────────────
@@ -15,7 +15,7 @@ export default function auditCommand(pi: ExtensionAPI) {
 					"e.g. understand performance bottlenecks before planning a roadmap",
 				);
 				if (!input?.trim()) {
-					ctx.ui.notify("audit: No goal provided — cancelled.", "error");
+					ctx.ui.notify("audit-codebase: No goal provided — cancelled.", "error");
 					return;
 				}
 				goal = input.trim();
@@ -77,7 +77,7 @@ ${goal}
 
 ---
 
-*Generated by /audit — read-only recce, no code was modified.*
+*Generated by /audit-codebase — read-only recce, no code was modified.*
 \`\`\`
 
 After writing the file, confirm with: "✅ Audit complete — report saved to \`${outputPath}\`"`;

package/src/resources/extensions/slash-commands/extension-manifest.json

@@ -6,6 +6,6 @@
   "tier": "bundled",
   "requires": { "platform": ">=2.29.0" },
   "provides": {
-    "commands": ["create-slash-command", "create-extension", "audit", "clear"]
+    "commands": ["create-slash-command", "create-extension", "audit-codebase", "clear"]
   }
 }

package/src/resources/extensions/slash-commands/index.ts

@@ -1,12 +1,12 @@
 import type { ExtensionAPI } from "@otto/pi-coding-agent";
 import createSlashCommand from "./create-slash-command.js";
 import createExtension from "./create-extension.js";
-import auditCommand from "./audit.js";
+import auditCodebaseCommand from "./audit-codebase.js";
 import clearCommand from "./clear.js";
 
 export default function slashCommands(pi: ExtensionAPI) {
   createSlashCommand(pi);
   createExtension(pi);
-  auditCommand(pi);
+  auditCodebaseCommand(pi);
   clearCommand(pi);
 }

package/src/resources/extensions/workflow/health-widget-core.ts

@@ -68,7 +68,7 @@ function truncateMessage(msg: string, maxLen: number): string {
  */
 export function buildHealthLines(data: HealthWidgetData, width?: number): string[] {
   if (data.projectState === "none") {
-    return ["  OTTO  No project loaded — cd into a project, then run /otto init"];
+    return ["  No project loaded — cd into a project, then run /otto init"];
   }
 
   if (data.projectState === "initialized") {