@litfamily/lithermes 1.0.26 → 1.0.28

package/assets/lithermes-plugin/skills/lit-typographic-motion/references/runtime.md

@@ -26,7 +26,7 @@ Hermes session runs npm, pip or a download. Run the pre-warm in a normal shell,
 outside any sandboxed session, with the same `HOME`, `HERMES_HOME` and
 `XDG_CACHE_HOME` the session will use.
 
-## Status (five probes)
+## Status (six probes)
 
 `lithermes motion-runtime status` and `lithermes doctor` report, every time:
 
@@ -41,6 +41,9 @@ outside any sandboxed session, with the same `HOME`, `HERMES_HOME` and
 5. **Pre-warm**: READY with the cache path, or exactly which dependencies and
    fonts are missing or hash-mismatched and the command that fixes them; plus
    the state of the optional audio venv.
+6. **Cover encoder**: img2webp and dwebp (libwebp) with their version, the
+   gifski fallback, or not found (cover renders then stop with exit 21). These
+   are host tools, never bundled or installed by this product.
 
 ## Chrome launch
 
@@ -71,6 +74,8 @@ the render with exit 10 and that line. The engine never adds `--no-sandbox`.
 | 13 | GATE_FAIL_QA | the gate or the pre-flight failed; the report names the rules; fix and rerun the next round |
 | 14 | BLOCKED_DEPS_NOT_PREWARMED | the cache is not warm (or word-timing models are absent): run `lithermes motion-runtime install` outside this session |
 | 15 | BLOCKED_FONT_FETCH | a pinned font or licence is missing or its sha256 differs: rerun `lithermes motion-runtime install`; never accept or re-fetch it inside a session |
+| 21 | BLOCKED_NO_COVER_ENCODER | cover mode found neither img2webp with dwebp nor gifski; install libwebp (or gifski) on the host |
+| 22 | BLOCKED_ASSET_MISSING | cover mode: an asset listed in `assets.json` is missing; supply or generate it, never a stand-in |
 | 2 | usage | a missing or invalid brief or flag |
 
 Pre-flight order: brief, word-timing request, dependencies (14), fonts (15),
@@ -82,10 +87,13 @@ glyph coverage and timeline floors (13, nothing rendered), ffmpeg for `video`
 `lithermes motion-runtime install --audio` creates a Python venv in the cache
 from `runtime/requirements.lock` with
 `pip install --require-hashes --only-binary=:all:` (librosa and its pinned
-dependencies; Python 3.11 to 3.13; set `LITHERMES_MOTION_PYTHON` to choose the
-interpreter). When a brief names an `audio` file and the venv is ready and still
-matches its pins, `bin/audio.py` analyses that file once into
-`<out>/audio-grid.json` and the beats replace the fixed grid. If the venv is
+dependencies; the newest Python from 3.14 down to 3.11 on PATH, picked the way the
+Office runtime picks, so a python3 that is 3.15 is passed over; the lock pins
+numpy 2.4, which starts at 3.11, and carries audioread's extra dependencies
+for 3.13 and newer; set `LITHERMES_MOTION_PYTHON` to choose
+the interpreter). When a brief names an
+`audio` file and the venv is ready and still matches its pins, `bin/audio.py`
+analyses that file once into `<out>/audio-grid.json` and the beats replace the fixed grid. If the venv is
 missing, drifted, or the analysis fails, the cuts use text timing and the
 manifest and report carry the warning. Either way the audio itself is always
 muxed into the MP4 (AAC 256k), padded or trimmed to the film with a 50 ms

package/assets/lithermes-plugin/skills/lit-typographic-motion/references/stage.md

@@ -69,8 +69,10 @@ or prefetch link, anywhere in the stage files.
 `font-display: block`, served from the pre-warmed cache and the reused lit-pptx
 Pretendard pair: `Pretendard` (400, 700), `Archivo` (500, 700, 900 at
 `font-stretch` 75 %, 100 %, 125 %), `Galmuri9`, `VT323`, `Silkscreen` (400,
-700) and `MesloLGS NF`. Use Pretendard for Hangul. Any other family falls back
-to a system face; the QA reports it and fails it on copy.
+700) and `MesloLGS NF`, plus `JetBrains Mono` (a variable `wght` axis from 100
+to 800 with a fixed advance, pinned in the same pre-warmed cache, so weight
+motion never reflows a line). Use Pretendard for Hangul. Any other family falls
+back to a system face; the QA reports it and fails it on copy.
 
 ### Text the QA can read
 

package/assets/lithermes-plugin/skills/lit-typographic-motion/references/treatment.md

@@ -10,6 +10,12 @@ where, how it is shaped over time, what is drawn on screen, how it sounds, and
 what would make it excellent. Write it from the request, not from the example
 below.
 
+A README, hero, banner or cover loop is not a film. Its treatment sets
+`"mode": "cover"` and follows `cover.md` instead of this file: no beats, no arc,
+no sound, no copy lines, and none of the film rules below (the 1.2 s beat, the
+10 s floor, the 16:9 and 9:16 formats, the genre arcs). `stage` and `run` refuse
+a cover treatment, and `cover` refuses a film treatment, each with exit 16.
+
 ## Load order
 
 1. This file, always first.

package/assets/lithermes-plugin/skills/lit-typographic-motion/runtime/fonts.json

@@ -115,6 +115,12 @@
       "sha256": "7b5a420d4e16285213e7e2b1d187d086835c2dd7a7f64c5b8057434f082fc46f",
       "license": "licenses/EMS-OFL.txt"
     },
+    {
+      "path": "fonts/JetBrainsMono-wght-latin.woff2",
+      "url": "https://cdn.jsdelivr.net/npm/@fontsource-variable/jetbrains-mono@5.3.0/files/jetbrains-mono-latin-wght-normal.woff2",
+      "sha256": "18be452724bfdc236c074ca94a249a7f41a86752c7d04ab258ce9ed5651f6a7e",
+      "license": "licenses/JetBrainsMono-OFL.txt"
+    },
     {
       "path": "licenses/Galmuri-OFL.md",
       "url": "https://raw.githubusercontent.com/quiple/galmuri/v2.40.4/ofl.md",
@@ -149,6 +155,11 @@
       "path": "licenses/Archivo-OFL.txt",
       "url": "https://raw.githubusercontent.com/mexicat/pdoom-video/ca251e3dddda422b364385eb484b5a3593a0990d/app/public/fonts/src/OFL.txt",
       "sha256": "108b4e57c9c796d3d38d0428ca7ee39de47ad93187302718d9b2d8864b9b716b"
+    },
+    {
+      "path": "licenses/JetBrainsMono-OFL.txt",
+      "url": "https://cdn.jsdelivr.net/npm/@fontsource-variable/jetbrains-mono@5.3.0/LICENSE",
+      "sha256": "403581b69dac5cff4079205e01c6b467e56af449ecbd7247693ddb1baafa005b"
     }
   ]
 }

package/assets/lithermes-plugin/skills/lit-typographic-motion/runtime/requirements.lock

@@ -1,5 +1,61 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile --python-version 3.11 --generate-hashes --only-binary :all: packages/lithermes-installer/assets/lithermes-plugin/skills/lit-typographic-motion/runtime/requirements.in --output-file packages/lithermes-installer/assets/lithermes-plugin/skills/lit-typographic-motion/runtime/requirements.lock
+# Hand-merged after the uv header above: audioop-lts, standard-aifc, standard-chunk and standard-sunau, with their hashes and
+# the python_full_version >= '3.13' marker, taken from `uv pip compile --universal --python-version 3.11` of requirements.in.
+# audioread needs them from Python 3.13; every other pin is the original 3.11 resolution.
+audioop-lts==0.2.2 ; python_full_version >= '3.13' \
+    --hash=sha256:0337d658f9b81f4cd0fdb1f47635070cc084871a3d4646d9de74fdf4e7c3d24a \
+    --hash=sha256:03f061a1915538fd96272bac9551841859dbb2e3bf73ebe4a23ef043766f5449 \
+    --hash=sha256:068aa17a38b4e0e7de771c62c60bbca2455924b67a8814f3b0dee92b5820c0b3 \
+    --hash=sha256:088327f00488cdeed296edd9215ca159f3a5a5034741465789cad403fcf4bec0 \
+    --hash=sha256:0d9385e96f9f6da847f4d571ce3cb15b5091140edf3db97276872647ce37efd7 \
+    --hash=sha256:106753a83a25ee4d6f473f2be6b0966fc1c9af7e0017192f5531a3e7463dce58 \
+    --hash=sha256:143fad0311e8209ece30a8dbddab3b65ab419cbe8c0dde6e8828da25999be911 \
+    --hash=sha256:15ab25dd3e620790f40e9ead897f91e79c0d3ce65fe193c8ed6c26cffdd24be7 \
+    --hash=sha256:167d3b62586faef8b6b2275c3218796b12621a60e43f7e9d5845d627b9c9b80e \
+    --hash=sha256:2b267b70747d82125f1a021506565bdc5609a2b24bcb4773c16d79d2bb260bbd \
+    --hash=sha256:3bcddaaf6cc5935a300a8387c99f7a7fbbe212a11568ec6cf6e4bc458c048636 \
+    --hash=sha256:3fc38008969796f0f689f1453722a0f463da1b8a6fbee11987830bfbb664f623 \
+    --hash=sha256:47eba38322370347b1c47024defbd36374a211e8dd5b0dcbce7b34fdb6f8847b \
+    --hash=sha256:48159d96962674eccdca9a3df280e864e8ac75e40a577cc97c5c42667ffabfc5 \
+    --hash=sha256:49ee1a41738a23e98d98b937a0638357a2477bc99e61b0f768a8f654f45d9b7a \
+    --hash=sha256:4a53aa7c16a60a6857e6b0b165261436396ef7293f8b5c9c828a3a203147ed4a \
+    --hash=sha256:4b4cd51a57b698b2d06cb9993b7ac8dfe89a3b2878e96bc7948e9f19ff51dba6 \
+    --hash=sha256:51c916108c56aa6e426ce611946f901badac950ee2ddaf302b7ed35d9958970d \
+    --hash=sha256:550c114a8df0aafe9a05442a1162dfc8fec37e9af1d625ae6060fed6e756f303 \
+    --hash=sha256:58cf54380c3884fb49fdd37dfb7a772632b6701d28edd3e2904743c5e1773602 \
+    --hash=sha256:5b00be98ccd0fc123dcfad31d50030d25fcf31488cde9e61692029cd7394733b \
+    --hash=sha256:5f93a5db13927a37d2d09637ccca4b2b6b48c19cd9eda7b17a2e9f77edee6a6f \
+    --hash=sha256:64d0c62d88e67b98a1a5e71987b7aa7b5bcffc7dcee65b635823dbdd0a8dbbd0 \
+    --hash=sha256:73f80bf4cd5d2ca7814da30a120de1f9408ee0619cc75da87d0641273d202a09 \
+    --hash=sha256:752d76472d9804ac60f0078c79cdae8b956f293177acd2316cd1e15149aee132 \
+    --hash=sha256:83c381767e2cc10e93e40281a04852facc4cd9334550e0f392f72d1c0a9c5753 \
+    --hash=sha256:8fefe5868cd082db1186f2837d64cfbfa78b548ea0d0543e9b28935ccce81ce9 \
+    --hash=sha256:9191d68659eda01e448188f60364c7763a7ca6653ed3f87ebb165822153a8547 \
+    --hash=sha256:96f19de485a2925314f5020e85911fb447ff5fbef56e8c7c6927851b95533a1c \
+    --hash=sha256:9a13dc409f2564de15dd68be65b462ba0dde01b19663720c68c1140c782d1d75 \
+    --hash=sha256:a2c2a947fae7d1062ef08c4e369e0ba2086049a5e598fda41122535557012e9e \
+    --hash=sha256:a2d4f1513d63c795e82948e1305f31a6d530626e5f9f2605408b300ae6095093 \
+    --hash=sha256:a5bf613e96f49712073de86f20dbdd4014ca18efd4d34ed18c75bd808337851b \
+    --hash=sha256:a6d2e0f9f7a69403e388894d4ca5ada5c47230716a03f2847cfc7bd1ecb589d6 \
+    --hash=sha256:b492c3b040153e68b9fdaff5913305aaaba5bb433d8a7f73d5cf6a64ed3cc1dd \
+    --hash=sha256:ba7c3a7e5f23e215cb271516197030c32aef2e754252c4c70a50aaff7031a2c8 \
+    --hash=sha256:c0022283e9556e0f3643b7c3c03f05063ca72b3063291834cca43234f20c60bb \
+    --hash=sha256:c174e322bb5783c099aaf87faeb240c8d210686b04bd61dfd05a8e5a83d88969 \
+    --hash=sha256:c9c8e68d8b4a56fda8c025e538e639f8c5953f5073886b596c93ec9b620055e7 \
+    --hash=sha256:cfcac6aa6f42397471e4943e0feb2244549db5c5d01efcd02725b96af417f3fe \
+    --hash=sha256:d5e73fa573e273e4f2e5ff96f9043858a5e9311e94ffefd88a3186a910c70917 \
+    --hash=sha256:def246fe9e180626731b26e89816e79aae2276f825420a07b4a647abaa84becc \
+    --hash=sha256:dfbbc74ec68a0fd08cfec1f4b5e8cca3d3cd7de5501b01c4b5d209995033cde9 \
+    --hash=sha256:e160bf9df356d841bb6c180eeeea1834085464626dc1b68fa4e1d59070affdc3 \
+    --hash=sha256:e541c3ef484852ef36545f66209444c48b28661e864ccadb29daddb6a4b8e5f5 \
+    --hash=sha256:f9b0b8a03ef474f56d1a842af1a2e01398b8f7654009823c6d9e0ecff4d5cfbf \
+    --hash=sha256:f9ee9b52f5f857fbaf9d605a360884f034c92c1c23021fb90b2e39b8e64bede6 \
+    --hash=sha256:fbdd522624141e40948ab3e8cdae6e04c748d78710e9f0f8d4dae2750831de19 \
+    --hash=sha256:fd3d4602dc64914d462924a08c1a9816435a2155d74f325853c1f1ac3b2d9800
+    # via
+    #   standard-aifc
+    #   standard-sunau
 audioread==3.1.0 \
     --hash=sha256:1c4ab2f2972764c896a8ac61ac53e261c8d29f0c6ccd652f84e18f08a4cab190 \
     --hash=sha256:b30d1df6c5d3de5dcef0fb0e256f6ea17bdcf5f979408df0297d8a408e2971b4
@@ -711,6 +767,22 @@ soxr==1.1.0 \
     --hash=sha256:f4977323ef9c3aa3c2a26ff5fe0191c84b8fd759daf7afb1f25a91a55ad8b730 \
     --hash=sha256:feebcba99ac99adb8009d46c8f4c1956b8c167576b0ae8a6fb47502e9a6f78e7
     # via librosa
+standard-aifc==3.13.0 ; python_full_version >= '3.13' \
+    --hash=sha256:64e249c7cb4b3daf2fdba4e95721f811bde8bdfc43ad9f936589b7bb2fae2e43 \
+    --hash=sha256:f7ae09cc57de1224a0dd8e3eb8f73830be7c3d0bc485de4c1f82b4a7f645ac66
+    # via
+    #   audioread
+    #   librosa
+standard-chunk==3.13.0 ; python_full_version >= '3.13' \
+    --hash=sha256:17880a26c285189c644bd5bd8f8ed2bdb795d216e3293e6dbe55bbd848e2982c \
+    --hash=sha256:4ac345d37d7e686d2755e01836b8d98eda0d1a3ee90375e597ae43aaf064d654
+    # via standard-aifc
+standard-sunau==3.13.0 ; python_full_version >= '3.13' \
+    --hash=sha256:53af624a9529c41062f4c2fd33837f297f3baa196b0cfceffea6555654602622 \
+    --hash=sha256:b319a1ac95a09a2378a8442f403c66f4fd4b36616d6df6ae82b8e536ee790908
+    # via
+    #   audioread
+    #   librosa
 threadpoolctl==3.7.0 \
     --hash=sha256:61348cfb77d53b9242e0017029244b559b810c142ced65b4e21eeca1843959a7 \
     --hash=sha256:cd8b60b5641b45c67bbf73c64c843235fc2d8a480c87389f52f5dbee893b86be

package/assets/lithermes-plugin/skills/litgoal/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: litgoal
-description: Durable repo-native goal runtime with embedded success criteria, evidence ledger, checkpoints, steering, and an evidence-gated completion contract.
+description: Sets and keeps the finish line: a durable repo-native goal runtime with embedded success criteria, evidence ledger, checkpoints, steering, and an evidence-gated completion contract that lit-loop and start-work run toward.
 ---
 
 ## #contract.activation
@@ -115,6 +115,24 @@ limitations_channel: inline
 | broaden scope while editing | keep changes tied to the user request and preserve unrelated worktree state |
 | skip payload sync | run `sync-plugin -- --in-place` and report the hash-manifest change |
 
+## What litgoal is for
+
+litgoal sets and keeps the finish line; lit-loop and start-work run toward it.
+
+| Question | Owner |
+|---|---|
+| What counts as done, and what proves it? | `litgoal`: objective, success criteria, evidence, checkpoints, the completion gate |
+| Do the work toward that finish line in one go | `lit-loop` (bare `lit <task>` or `/lit-loop`) |
+| Execute an approved plan row by row toward it | `start-work` (`/start-work <approved-plan>`) |
+| Is the plan, or the finished work, any good? | `review-work` |
+
+litgoal never does the work itself. It records the finish line, keeps it across
+turns and sessions, injects the unmet criteria into every turn, and refuses
+`goal_complete` until the evidence is there. The route name is the skill name:
+`litgoal <objective>`, `lit goal <objective>`, `/litgoal`, and
+`lithermes:litgoal` all open this skill. Hermes' own native `/goal` stays
+user-managed and unobserved; litgoal never mutates it.
+
 ## LitHermes durable runtime (authoritative — overrides any legacy examples below)
 
 LitHermes ships litgoal as a **real durable runtime**, not prose. State persists under

package/assets/lithermes-plugin/skills/lsp-setup/scripts/verify-lsp.ts

@@ -118,6 +118,19 @@ function makeReader(onMessage: (message: JsonRpcMessage) => void): (chunk: Buffe
 	}
 }
 
+// Windows installs npm language servers as .cmd shims, which Node refuses to spawn without a
+// shell (EINVAL). A shell line is built only from the configured command, each part quoted;
+// a quote, percent sign or line break in it is refused rather than escaped.
+function launch(bin: string, args: string[]) {
+	const stdio: ["pipe", "pipe", "pipe"] = ["pipe", "pipe", "pipe"]
+	if (process.platform !== "win32") return spawn(bin, args, { stdio })
+	const quote = (part: string): string => {
+		if (/["%\r\n\0]/.test(part)) throw new Error(`refusing language server argument with a quote, percent sign or line break: ${part.slice(0, 40)}`)
+		return /^[\w@+=:,./\\-]+$/.test(part) ? part : `"${part.replace(/\\+$/, (run) => run + run)}"`
+	}
+	return spawn([bin, ...args].map(quote).join(" "), { stdio, shell: true })
+}
+
 function languageId(ext: string): string {
 	const server = LANGUAGES.find((entry) => entry.extensions.includes(ext))
 	return server?.language ?? ext.replace(/^\./, "")
@@ -145,9 +158,9 @@ async function run(filePath: string, timeoutMs: number, configPath: string): Pro
 	return await new Promise<number>((resolveResult) => {
 		let child
 		try {
-			child = spawn(bin, binArgs, { stdio: ["pipe", "pipe", "pipe"] })
-		} catch {
-			process.stdout.write(`FAIL ${absolute}: language server not installed (${bin})\n`)
+			child = launch(bin, binArgs)
+		} catch (error) {
+			process.stdout.write(`FAIL ${absolute}: language server could not start (${bin}): ${error instanceof Error ? error.message : String(error)}\n`)
 			resolveResult(1)
 			return
 		}

package/assets/lithermes-plugin/skills/review-work/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: review-work
-description: Hermes-native draft-plan and post-implementation review: objective-achievability audit for plans, or five delegate_task completion lanes with DoneClaim skepticism.
+description: Hermes-native plan review (after lit-plan, before start-work) and work review (after lit-loop or start-work), auto-picked from what exists or forced with lit review plan|work: an objective-achievability audit for plans, or five delegate_task lanes with DoneClaim skepticism for work.
 ---
 
 ## #contract.activation
@@ -117,28 +117,48 @@ limitations_channel: methodology_paragraph
 
 # Review Work
 
-`review-work` has two read-only modes. **Plan-review mode** audits a draft before
-execution. Completion-review mode is the existing five-lane gate used after
-meaningful implementation work and before claiming done, preparing a release, or
-asking for a commit. Select from the evidence supplied; do not force a draft plan
-through implementation lanes or treat a completed diff as a plan.
+`review-work` has two read-only modes, named for what is under review.
+
+- **Plan review** runs after `lit-plan` and before `start-work`: is the plan
+  complete, ordered, and verifiable, so that execution never has to invent scope,
+  evidence, or a success path?
+- **Work review** runs after `lit-loop` or `start-work`: do the diff, the tests, and
+  the evidence back the claim that the work is done?
 
 In both modes, reviewers **never implement** production work. A parent may revise
 only plan text after an `ITERATE` verdict; it must **revise only when needed**, keep
-the approved objective unchanged, and re-run the affected plan-review lanes.
+the approved objective unchanged, and re-run the affected plan review lanes.
 
 ## Mode Selection
 
-| Mode | Select when | Output |
+The mode is forced by the user or auto-picked from what exists. Say which mode was
+picked on the first line of the report, before any finding:
+
+```text
+Review mode: plan (forced by the user)
+Review mode: work (auto-picked: changed files outside plans/)
+```
+
+**Forcing a mode.** `lit review plan <target>` and `/review-work plan <target>` run
+plan review; `lit review work <target>` and `/review-work work <target>` run work
+review. A forced mode is never overridden by what exists.
+
+**Auto-pick.** When no mode is forced, decide in this order and stop at the first
+rule that matches:
+
+| Evidence present | Mode | Output |
 |---|---|---|
-| `plan-review` | A draft plan or checklist is the object under review and implementation evidence is not claimed. | `PASS`, `ITERATE`, or `NEEDS-CONTEXT`; findings and, only for `ITERATE`, bounded replacement plan text. |
-| `completion-review` | A diff, tests, real-surface evidence, or DoneClaim is under review. | Existing five-lane `REVIEW PASSED|FAILED|BLOCKED` receipt. |
+| a named PR, branch or diff; changed files outside `plans/`; or a plan with ticked rows (work signals) | work | five-lane `REVIEW PASSED|FAILED|BLOCKED` receipt |
+| a plan with no ticked rows and no changed files outside `plans/` | plan | `PLAN REVIEW PASS|ITERATE|NEEDS-CONTEXT`; findings and, only for `ITERATE`, bounded replacement plan text |
+| neither a plan nor a diff | ask | ask the user one short question: review a plan (which one) or work (which diff, branch or PR)? Do not guess a target and do not dispatch a lane |
 
-If both a plan and completed work are supplied, audit the implementation against
-the approved plan in completion-review mode. If the mode cannot be determined,
-return `NEEDS-CONTEXT` with the one missing input instead of guessing.
+If both a plan and finished work are supplied, audit the implementation against
+the approved plan in work review. The `/review-work` command applies this same
+rule over the real worktree; the natural `lit review` route states it in its
+wrapper and the model applies it. Never force a draft plan through the
+implementation lanes, and never treat a finished diff as a plan.
 
-## Plan-Review Mode
+## Plan Review Mode
 
 Plan review asks whether execution can begin and end without the implementer
 inventing scope, evidence, or a success path. It does not reward checklist length.
@@ -186,6 +206,7 @@ aggregate. Otherwise any `ITERATE` controls it; all lanes must pass for `PASS`.
 ### Plan Verdict Contract
 
 ```text
+Review mode: plan (<forced by the user | auto-picked: reason>)
 PLAN REVIEW PASS|ITERATE|NEEDS-CONTEXT
 Objective achievable: yes|no|unknown
 Lane verdicts: scope-objective=<...>; dependencies-gates=<...>; atomic-checklist=<...>; acceptance-evidence=<...>; failure-decision-cleanup=<...>
@@ -200,9 +221,9 @@ the objective is sound but one or more bounded plan defects need correction.
 Never mutate production files, run execution tasks, publish, bump a version,
 commit, push, tag, or start a gateway while reviewing a plan.
 
-## Completion-Review Mode
+## Work Review Mode
 
-This remains the LitHermes completion gate. It is intentionally skeptical: a
+Work review is the LitHermes completion gate, used after `lit-loop` or `start-work`. It is intentionally skeptical: a
 green test suite is useful evidence, not a delivery claim.
 
 ## Contract
@@ -375,6 +396,7 @@ Before saying work is done, try to falsify the DoneClaim:
 Required final review wording:
 
 ```text
+Review mode: work (<forced by the user | auto-picked: reason>)
 REVIEW PASSED|FAILED|BLOCKED
 DoneClaim: <one sentence>
 Lane verdicts: scope-diff=<...>; tests-evidence=<...>; package-payload=<...>; security-provenance=<...>; real-surface-docs=<...>

package/assets/lithermes-plugin/skills/visual-qa/references/complete-contract.md

@@ -485,7 +485,7 @@ isolated Hermes home. Use `--hermes-home`; never `--home`.
 
 ```text
 $ node packages/lithermes-installer/bin/lithermes.js install --yes --offline --no-hud --hermes-home "$ISOLATED"
-Installed LitHermes 1.0.26
+Installed LitHermes 1.0.28
 plugin: $ISOLATED/plugins/lithermes
 model config: updated
 
@@ -502,8 +502,8 @@ installed payload: PASS
 enabled config: PASS
 
 $ hermes lithermes doctor
-[OK] plugin.yaml readable (version 1.0.26)
-[OK] skills bundled: 36
+[OK] plugin.yaml readable (version 1.0.28)
+[OK] skills bundled: 37
 [OK] litgoal durable runtime importable
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litfamily/lithermes",
-  "version": "1.0.26",
+  "version": "1.0.28",
   "description": "Hermes Agent plugin that plans, builds, checks and hands off your work when you add one word, lit, to a request.",
   "keywords": [
     "hermes-agent",
@@ -56,6 +56,7 @@
     "qa:negative-control": "node qa/negative-gate-matrix.js --self-check",
     "qa:behaviors": "node qa/behavior-replacement-probe.js",
     "qa:real-surface": "npm run qa:negative-matrix && npm run qa:behaviors && npm run qa:negative-control",
+    "qa:cover-recipes": "node qa/cover-recipes.js",
     "sync-plugin": "node scripts/sync-plugin.js",
     "pack:dry": "npm run clean:payload && npm pack --dry-run --ignore-scripts --json",
     "clean:payload": "find assets -name __pycache__ -type d -prune -exec rm -rf {} + && find assets -name '*.py[co]' -delete",

package/readme-assets/badge-version.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="146" height="20" role="img" aria-label="release: 1.0.26"><title>release: 1.0.26</title><g shape-rendering="crispEdges"><rect width="49" height="20" fill="#080d14"/><rect x="49" width="97" height="20" fill="#ff6337"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text x="255" y="140" textLength="390" transform="scale(.1)">release</text><text x="965" y="140" textLength="870" transform="scale(.1)" fill="#080D14">1.0.26</text></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="146" height="20" role="img" aria-label="release: 1.0.28"><title>release: 1.0.28</title><g shape-rendering="crispEdges"><rect width="49" height="20" fill="#080d14"/><rect x="49" width="97" height="20" fill="#ff6337"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text x="255" y="140" textLength="390" transform="scale(.1)">release</text><text x="965" y="140" textLength="870" transform="scale(.1)" fill="#080D14">1.0.28</text></g></svg>

package/src/cli.js

@@ -538,8 +538,8 @@ async function main(argv, runtime = {}) {
         else {
           const warm = motionRuntime('install', flags);
           receipt = warm.status === 0
-            ? `Motion runtime: ${warm.output.split('\n')[0]}`
-            : `Motion runtime: pre-warm incomplete (${warm.output.split('\n').filter(Boolean).at(-1)}); run \`lithermes motion-runtime install\` before rendering a film.`;
+            ? `Motion runtime: ${warm.output.split(/\r?\n/)[0]}`
+            : `Motion runtime: pre-warm incomplete (${warm.output.split(/\r?\n/).filter(Boolean).at(-1)}); run \`lithermes motion-runtime install\` before rendering a film.`;
         }
         (flags.json ? console.error : console.log)(receipt);
       }

package/src/lib/check.js

@@ -1,6 +1,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { spawnSync } = require("node:child_process");
+const { spawnTool } = require("./hostExec");
 const { configHasLitHermes, formatConcurrencyCapability, inspectHermesCapabilities, readConfig, readExternalSkillDirsConfig, readStatusBarFields, suggestStatusBarFields } = require("./config");
 const { detectHermesRuntimeRepo, detectHermesVersion, ensureHermesHome, expandHome, inspectHermesHostCapabilities, LitHermesError } = require("./hermesDiscovery");
 const { formatManagedRoute } = require("./modelRoutePolicy");
@@ -205,7 +206,8 @@ function checkLitHermes(flags = {}) {
 }
 
 // MO-A-44: the motion runtime's five probes (Chrome, ffmpeg and preview rung,
-// WebGL2 renderer, software-GL warning, pre-warm state) on every doctor run.
+// WebGL2 renderer, software-GL warning, pre-warm state) and the cover encoder,
+// on every doctor run.
 // They report; they never change the doctor's pass/fail.
 function motionProbeLines(pluginPath, hermesHome) {
   const installed = path.join(pluginPath, "skills", "lit-typographic-motion", "bin", "runtime.mjs");
@@ -214,13 +216,14 @@ function motionProbeLines(pluginPath, hermesHome) {
   const result = spawnSync(process.execPath, [script, "status"], {
     encoding: "utf8", timeout: 60000, env: { ...process.env, HERMES_HOME: hermesHome },
   });
-  const lines = String(result.stdout || "").split("\n").filter(Boolean);
-  if (result.status === 0 && lines.length === 5) return lines.map((line) => `motion ${line}`);
-  const reason = (result.stderr || result.error?.message || "no output").split("\n")[0];
+  const lines = String(result.stdout || "").split(/\r?\n/).filter(Boolean);
+  if (result.status === 0 && lines.length === 6) return lines.map((line) => `motion ${line}`);
+  const reason = (result.stderr || result.error?.message || "no output").split(/\r?\n/)[0];
   return [
     "motion Chrome: unknown (status failed)", "motion ffmpeg: unknown (status failed)",
     "motion WebGL2 renderer: unknown (status failed)", "motion software GL: unknown (status failed)",
     `motion pre-warm: status failed (${reason}); run \`lithermes motion-runtime status\``,
+    "motion cover encoder: unknown (status failed)",
   ];
 }
 
@@ -257,7 +260,7 @@ function doctorLitHermes(flags = {}) {
   let loaded = { status: "PARTIAL", reason: "offline mode did not query hermes plugins list" };
   if (!flags.offline) {
     const env = { ...process.env, HERMES_HOME: hermesHome };
-    const result = spawnSync("hermes", ["plugins", "list", "--json", "--enabled", "--user"], {
+    const result = spawnTool("hermes", ["plugins", "list", "--json", "--enabled", "--user"], {
       encoding: "utf8",
       env,
       timeout: 15000,
@@ -266,7 +269,7 @@ function doctorLitHermes(flags = {}) {
       && !String(result.stderr || "").trim()
       && enabledUserJsonIncludesPlugin(result.stdout, "lithermes");
     const command = enabledUser
-      ? spawnSync("hermes", ["lithermes", "status"], { encoding: "utf8", env, timeout: 15000 })
+      ? spawnTool("hermes", ["lithermes", "status"], { encoding: "utf8", env, timeout: 15000 })
       : null;
     const provenLoaded = enabledUser
       && command.status === 0

package/src/lib/hermesDiscovery.js

@@ -1,7 +1,7 @@
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
-const { spawnSync } = require("node:child_process");
+const { spawnTool } = require("./hostExec");
 
 class LitHermesError extends Error {
   constructor(message, exitCode = 1) {
@@ -124,7 +124,7 @@ function ensureHermesHome(flags = {}, { forInstall = false } = {}) {
 }
 
 function detectHermesVersion() {
-  const result = spawnSync("hermes", ["--version"], { encoding: "utf8", timeout: 15000 });
+  const result = spawnTool("hermes", ["--version"], { encoding: "utf8", timeout: 15000 });
   return result.status === 0 ? (result.stdout || result.stderr || "") : "";
 }
 

package/src/lib/hostExec.js

@@ -0,0 +1,81 @@
+"use strict";
+
+// Child processes that survive Windows. Since the CVE-2024-27980 fix, Node refuses to spawn a
+// .cmd or .bat file without a shell (spawnSync npm.cmd EINVAL), and PATH lookups there depend on
+// PATHEXT. Everything takes its platform, env and fs probes as arguments so tests can simulate
+// win32 without touching globals. The payload skills carry the same logic as hostexec.mjs.
+
+const childProcess = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const SHELL_SCRIPT = /\.(?:cmd|bat)$/i;
+const SAFE_ARG = /^[\w@+=:,./\\-]+$/;
+
+function whichSync(name, { platform = process.platform, env = process.env, exists = fs.existsSync } = {}) {
+  const win = platform === "win32";
+  const p = win ? path.win32 : path.posix;
+  const exts = win ? String(env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim().toLowerCase()).filter(Boolean) : [""];
+  const hasExt = win && exts.some((e) => name.toLowerCase().endsWith(e.toLowerCase()));
+  // A bare name never matches on Windows: npm leaves an extensionless sh script beside npm.cmd.
+  const names = win ? (hasExt ? [name] : exts.map((e) => name + e)) : [name];
+  const dirs = p.isAbsolute(name) || /[\\/]/.test(name) ? [""] : String(env.PATH ?? env.Path ?? "").split(win ? ";" : ":").map((d) => d.trim().replace(/^"|"$/g, "")).filter(Boolean);
+  for (const dir of dirs) {
+    for (const candidate of names) {
+      const full = dir ? p.join(dir, candidate) : candidate;
+      if (exists(full)) return full;
+    }
+  }
+  return null;
+}
+
+// Quoted for cmd.exe, which still expands %VAR% inside quotes, so those are refused, never escaped.
+function quoteCmdArg(arg) {
+  const text = String(arg);
+  if (/["%\r\n\0]/.test(text)) throw new Error(`refusing an argument with a quote, percent sign or line break on a Windows shell: ${JSON.stringify(text.slice(0, 40))}`);
+  if (text !== "" && SAFE_ARG.test(text)) return text;
+  return `"${text.replace(/\\+$/, (run) => run + run)}"`;
+}
+
+// Where an npm or npx shim's JavaScript entry lives, so Windows can run it with node directly.
+function npmCli(name, resolved, { env, execPath, exists }) {
+  const cli = `${name}-cli.js`;
+  const dirs = [];
+  if (typeof env.npm_execpath === "string" && /\.js$/i.test(env.npm_execpath)) dirs.push(path.win32.dirname(env.npm_execpath));
+  dirs.push(path.win32.join(path.win32.dirname(resolved), "node_modules", "npm", "bin"));
+  dirs.push(path.win32.join(path.win32.dirname(execPath), "node_modules", "npm", "bin"));
+  return dirs.map((dir) => path.win32.join(dir, cli)).find((file) => exists(file)) || null;
+}
+
+function prepareSpawn(command, args = [], options = {}, ctx = {}) {
+  const { platform = process.platform, execPath = process.execPath, exists = fs.existsSync } = ctx;
+  if (platform !== "win32") return { command, args, options };
+  const env = ctx.env || options.env || process.env;
+  const resolved = whichSync(command, { platform, env, exists });
+  if (!resolved || !SHELL_SCRIPT.test(resolved)) return { command: resolved || command, args, options };
+  const base = path.win32.basename(resolved).replace(SHELL_SCRIPT, "").toLowerCase();
+  if (base === "npm" || base === "npx") {
+    const cli = npmCli(base, resolved, { env, execPath, exists });
+    if (cli) return { command: execPath, args: [cli, ...args], options };
+  }
+  const line = [resolved, ...args].map(quoteCmdArg).join(" ");
+  return { command: line, args: [], options: { ...options, shell: true } };
+}
+
+function spawnTool(command, args, options, ctx = {}) {
+  const run = ctx.spawnSync || childProcess.spawnSync;
+  const prepared = prepareSpawn(command, args, options, ctx);
+  return run(prepared.command, prepared.args, prepared.options);
+}
+
+// One line naming the real cause: the spawn error, the exit status and the last stderr line.
+function describeSpawnFailure(label, result, { limit = 200 } = {}) {
+  if (!result) return `${label} returned no result`;
+  const tail = String(result.stderr || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean).at(-1) || "";
+  const clean = tail.replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, limit);
+  if (result.error) return `${label} could not run: ${result.error.code || "error"} ${result.error.message}${clean ? ` (${clean})` : ""}`;
+  if (result.signal) return `${label} stopped by ${result.signal}${clean ? ` (${clean})` : ""}`;
+  return `${label} exited ${result.status}${clean ? `: ${clean}` : ""}`;
+}
+
+module.exports = { describeSpawnFailure, prepareSpawn, quoteCmdArg, spawnTool, whichSync };

package/src/lib/skillPayload.js

@@ -16,7 +16,7 @@ const MAX_PAYLOAD_TOTAL_BYTES = 24 * 1024 * 1024;
 const requiredSkills = [
   "lit-burnoff-file", "autoconference", "autoresearch", "browser-drive", "comment-checker", "debugging",
   "deep-interview",
-  "frontend-ui-ux", "readme-studio", "lit-commit", "lit-crucible", "lit-init",
+  "frontend-ui-ux", "readme-studio", "lit-commit", "lit-brainstorm", "lit-crucible", "lit-init",
   "lit-humanizer", "lit-comprehend", "lit-handoff", "lit-plan", "lit-recap",
   "lit-scientific-visualization", "lit-diagram-drawer", "lit-pptx", "lit-docx", "lit-typographic-motion", "litgoal", "litresearch", "litwork", "lsp",
   "lsp-setup", "lit-code", "refactor", "lit-burnoff", "review-work",