lazycodex-ai 4.16.0 → 4.16.1

package/docs/reference/web-terminal-visual-qa.md

@@ -1,81 +1,75 @@
 # Web Terminal Visual QA
 
-Use `script/qa/web-terminal-visual-qa.mjs` whenever QA needs TUI visual evidence. It turns a terminal or tmux transcript into browser-rendered evidence so PRs can carry the same artifacts as web UI visual QA.
+Use `script/qa/web-terminal-visual-qa.mjs` whenever QA needs TUI visual evidence. It runs the command in a real pty (node-pty), renders it through a **real xterm.js terminal in headless Chrome**, drives scripted interaction through that browser terminal, and screenshots it. The color path is xterm.js, so truecolor, 256-color, box-drawing, and CJK width are faithful. **NEVER use `tmux capture-pane` for color/visual/layout/CJK TUI evidence** - it degrades truecolor and misaligns wide glyphs. tmux stays useful only for boot smoke ("did it render, did it accept a key"), never for the pixel evidence a reviewer trusts.
 
 ## Evidence Contract
 
 Each run writes these files under the chosen evidence directory:
 
-- `terminal.txt`: redacted plain terminal text for review and assertions.
-- `terminal-ansi.txt`: redacted ANSI capture when available.
-- `terminal.html`: browser-renderable terminal frame that preserves ANSI colors and SGR styles.
-- `terminal.png`: Chrome/Chromium screenshot with the same ANSI styling, unless `--no-browser` is used.
-- `metadata.json`: connector, source, output paths, and cleanup receipt.
+- `terminal.png`: the xterm.js screenshot (true color). The primary artifact - cite and attach this.
+- `terminal.txt`: redacted rendered screen text (from the xterm.js buffer) for review and assertions.
+- `terminal-ansi.txt`: the redacted raw pty byte stream, for debugging.
+- `metadata.json`: connector, color path, source, interaction, output paths, and cleanup receipt.
 
-The PR should cite `metadata.json` and attach or link `terminal.png` for OpenCode/Codex TUI proof. For PR-body image hosting, use GitHub user attachments as documented in [docs/reference/github-attachment-upload.md](github-attachment-upload.md); do not commit temporary PNGs, use releases, or use external image hosts.
+The PR should cite `metadata.json` and attach `terminal.png` for OpenCode/Codex TUI proof. For PR-body image hosting, use GitHub user attachments as documented in [docs/reference/github-attachment-upload.md](github-attachment-upload.md); do not commit temporary PNGs, use releases, or use external image hosts.
 
-## Redaction Contract
-
-The helper redacts terminal content before writing `terminal.txt`, `terminal-ansi.txt`, `terminal.html`, or `terminal.png`. Built-in rules cover common authorization headers, token/password/key assignments, GitHub tokens, and OpenAI-style `sk-...` tokens.
-
-Add exact local values with `--redact <literal>` and project-specific patterns with `--redact-regex <expr>`:
+## Live Capture (default)
 
 ```bash
 node script/qa/web-terminal-visual-qa.mjs \
   --title "Codex TUI QA" \
-  --from-file .omo/evidence/run/capture.txt \
-  --evidence-dir .omo/evidence/run/codex-web-terminal \
-  --redact "$LOCAL_TOKEN" \
-  --redact-regex 'session_[A-Za-z0-9]+'
+  --command "codex --help" \
+  --source-label "codex help smoke" \
+  --cwd "$PWD" \
+  --evidence-dir .omo/evidence/run/codex-web-terminal
 ```
 
-Custom `--redact-regex` rules replace the full regex match, even when the expression contains capture groups. Prefix-preserving redaction is reserved for the built-in authorization and key-assignment rules.
+Drive an interactive TUI by scripting keystrokes with repeatable `--input`, applied in order through the browser terminal. Literal text is typed; `{Enter}`, `{Tab}`, `{Escape}`, `{ArrowDown}`, `{Ctrl+C}` and similar tokens are pressed as keys:
+
+```bash
+node script/qa/web-terminal-visual-qa.mjs --title "menu nav" --command "my-tui" \
+  --input "{ArrowDown}" --input "{ArrowDown}" --input "{Enter}" \
+  --dwell-ms 2000 --evidence-dir .omo/evidence/run/menu
+```
 
-Do not rely on screenshots to hide secrets. If a capture might include cookies, auth headers, raw env dumps, launchd environments, provider keys, or browser storage, redact first or summarize the run instead of storing the transcript.
+## Redaction Contract
 
-## Replay An Existing Capture
+The helper redacts terminal content before writing `terminal.txt`, `terminal-ansi.txt`, and - when a rule matches - re-renders the masked stream so `terminal.png` never shows the secret. Built-in rules cover common authorization headers, token/password/key assignments, GitHub tokens, and OpenAI-style `sk-...` tokens.
 
-Use this path for maximum OS compatibility, including Windows hosts without tmux:
+Add exact local values with `--redact <literal>` and project-specific patterns with `--redact-regex <expr>`:
 
 ```bash
 node script/qa/web-terminal-visual-qa.mjs \
-  --title "Codex TUI QA" \
-  --from-file .omo/evidence/run/capture.txt \
-  --evidence-dir .omo/evidence/run/codex-web-terminal
+  --title "Codex TUI QA" --command "codex --help" \
+  --evidence-dir .omo/evidence/run/codex-web-terminal \
+  --redact "$LOCAL_TOKEN" \
+  --redact-regex 'session_[A-Za-z0-9]+'
 ```
 
-Long terminal lines wrap by default for readable PR evidence. Pass `--no-wrap` only when horizontal scrolling is part of the behavior under test.
+The raw --command string is process data and may contain inline secrets, so it is never persisted to metadata; use `--source-label` for a reviewer-safe description. Do not rely on screenshots to hide secrets: if a capture might include cookies, auth headers, raw env dumps, or provider keys, redact first or summarize the run instead of storing the transcript.
 
-## Run Through The PTY Connector
+## Replay And Chrome-less Fallback
 
-Use this when `tmux` is available on macOS/Linux or a Windows environment that provides tmux, such as Git Bash/MSYS2:
+Render an existing raw terminal byte stream through xterm.js:
 
 ```bash
-node script/qa/web-terminal-visual-qa.mjs \
-  --title "OpenCode TUI QA" \
-  --command "opencode --help" \
-  --source-label "opencode help smoke" \
-  --cwd "$PWD" \
-  --evidence-dir .omo/evidence/run/opencode-web-terminal
+node script/qa/web-terminal-visual-qa.mjs --title "Replay" \
+  --from-file .omo/evidence/run/capture.ansi --evidence-dir .omo/evidence/run/replay
 ```
 
-`--command` starts a short-lived tmux-backed PTY connector, captures the pane, renders the web evidence, then records a `tmux kill-session` cleanup receipt in `metadata.json`. The raw --command string is process data and may contain inline secrets, so it is never persisted to metadata; use `--source-label` for a reviewer-safe description.
+`--no-browser` skips xterm.js/Chrome and writes only the text and raw-stream artifacts (no PNG). Use it on hosts without Chrome; it is text-only evidence, not color/visual proof.
 
 ## OS Notes
 
-- macOS/Linux: prefer `--command` when `tmux` is installed; otherwise replay a saved pane with `--from-file`.
-- Windows: prefer `--from-file` for native shells. Git Bash/MSYS2 environments with tmux may use `--command`.
-- Windows-native ConPTY live capture should plug into this same artifact and metadata contract before becoming required.
+- The harness needs `node-pty` (real pty) plus a system Chrome/Chromium (`--chrome-bin` or `CHROME_BIN` to override). `node-pty` ships prebuilds for macOS and Windows; Linux builds from source on install.
+- Windows: node-pty uses ConPTY, so live capture works natively - no tmux, no Git Bash PTY shim required.
 
 ## QA Guidance
 
-For OpenCode/Codex QA, pair the harness-specific smoke with this helper:
-
-1. Drive the TUI through the normal QA skill or script.
-2. Capture the pane or use the helper's `--command` mode.
-3. Store the output under `.omo/evidence/<YYYYMMDD>-<slug>/`.
-4. Review `terminal.txt`, `terminal-ansi.txt`, and `metadata.json` for accidental secrets before citing them.
-5. Include `terminal.png`, `terminal.txt`, and `metadata.json` in the evidence summary.
-6. Verify cleanup receipts: no leftover tmux sessions, PIDs, ports, or temp state.
+1. Drive the TUI with `--command` (plus `--input` for interactive flows), or replay a saved stream with `--from-file`.
+2. Store the output under `.omo/evidence/<YYYYMMDD>-<slug>/`.
+3. Review `terminal.txt` and `terminal-ansi.txt` for accidental secrets before citing them.
+4. Include `terminal.png`, `terminal.txt`, and `metadata.json` in the evidence summary.
+5. Verify the cleanup receipt in `metadata.json`: no leftover pty, Chrome, PIDs, ports, or temp state.
 
-Tests alone are not TUI visual QA. The passing artifact is the rendered terminal evidence plus a binary observation, such as expected text present, no overflow, and no obvious border misalignment.
+Tests alone are not TUI visual QA. The passing artifact is the xterm.js-rendered `terminal.png` plus a binary observation - expected text present, colors correct, no overflow, no border or CJK-width misalignment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lazycodex-ai",
-  "version": "4.16.0",
+  "version": "4.16.1",
   "description": "The Best AI Agent Harness - Batteries-Included OpenCode Plugin with Multi-Model Orchestration, Parallel Background Agents, and Crafted LSP/AST Tools",
   "main": "./dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,10 +41,11 @@
   "files": [
     "dist/cli",
     "dist/cli-node",
+    "script/qa/strip-ansi.mjs",
     "script/qa/web-terminal-redaction.d.mts",
     "script/qa/web-terminal-redaction.mjs",
-    "script/qa/web-terminal-renderer.mjs",
     "script/qa/web-terminal-visual-qa.mjs",
+    "script/qa/xterm-live-terminal.mjs",
     "docs/reference/github-attachment-upload.md",
     "docs/reference/web-terminal-visual-qa.md",
     "packages/omo-codex/scripts/install-local.mjs",

package/packages/omo-codex/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "omo",
-  "version": "4.16.0",
+  "version": "4.16.1",
   "description": "One Codex plugin namespace for Yeongyu's local Codex components.",
   "author": {
     "name": "Yeongyu Kim",

package/packages/omo-codex/plugin/components/bootstrap/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"command": "node \"${PLUGIN_ROOT}/components/bootstrap/dist/cli.js\" hook session-start",
 						"commandWindows": "powershell -NoProfile -ExecutionPolicy Bypass -File \"${PLUGIN_ROOT}\\components\\bootstrap\\scripts\\bootstrap.ps1\"",
 						"timeout": 30,
-						"statusMessage": "(OmO) Checking Bootstrap Provisioning"
+						"statusMessage": "(OmO 4.16.1) Checking Bootstrap Provisioning"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/bootstrap/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sisyphuslabs/codex-bootstrap",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex SessionStart bootstrap component that provisions LazyCodex runtime dependencies from a detached worker.",
 	"type": "module",
 	"private": true,

package/packages/omo-codex/plugin/components/codegraph/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sisyphuslabs/codex-codegraph",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex plugin MCP wrapper for CodeGraph.",
 	"type": "module",
 	"private": true,

package/packages/omo-codex/plugin/components/comment-checker/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use",
 						"timeout": 30,
-						"statusMessage": "(OmO) Checking Comments"
+						"statusMessage": "(OmO 4.16.1) Checking Comments"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/comment-checker/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-comment-checker",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex plugin that runs comment-checker after edit-like PostToolUse hooks.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/git-bash/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook pre-tool-use",
 						"timeout": 5,
-						"statusMessage": "(OmO) Recommending Git Bash MCP"
+						"statusMessage": "(OmO 4.16.1) Recommending Git Bash MCP"
 					}
 				]
 			}
@@ -20,7 +20,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-compact",
 						"timeout": 5,
-						"statusMessage": "(OmO) Resetting Git Bash MCP Reminder"
+						"statusMessage": "(OmO 4.16.1) Resetting Git Bash MCP Reminder"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/git-bash/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sisyphuslabs/codex-git-bash-hook",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex hook component that reminds Windows sessions to prefer the OMO git_bash MCP.",
 	"type": "module",
 	"private": true,

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/components/lazycodex-executor-verify/dist/cli.js\" hook subagent-stop",
 						"timeout": 10,
-						"statusMessage": "(OmO) Verifying LazyCodex Executor Evidence"
+						"statusMessage": "(OmO 4.16.1) Verifying LazyCodex Executor Evidence"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/lazycodex-executor-verify/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-lazycodex-executor-verify",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex SubagentStop evidence verifier for LazyCodex executor completions.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/lsp/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use",
 						"timeout": 60,
-						"statusMessage": "(OmO) Checking LSP Diagnostics"
+						"statusMessage": "(OmO 4.16.1) Checking LSP Diagnostics"
 					}
 				]
 			}
@@ -21,7 +21,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-compact",
 						"timeout": 5,
-						"statusMessage": "(OmO) Resetting LSP Diagnostics Cache"
+						"statusMessage": "(OmO 4.16.1) Resetting LSP Diagnostics Cache"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/lsp/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-lsp",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex plugin that exposes Language Server Protocol tools and post-edit diagnostics.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/rules/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook session-start",
 						"timeout": 10,
-						"statusMessage": "(OmO) Loading Project Rules"
+						"statusMessage": "(OmO 4.16.1) Loading Project Rules"
 					}
 				]
 			}
@@ -19,7 +19,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook user-prompt-submit",
 						"timeout": 10,
-						"statusMessage": "(OmO) Loading Project Rules"
+						"statusMessage": "(OmO 4.16.1) Loading Project Rules"
 					}
 				]
 			}
@@ -32,7 +32,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use",
 						"timeout": 10,
-						"statusMessage": "(OmO) Matching Project Rules"
+						"statusMessage": "(OmO 4.16.1) Matching Project Rules"
 					}
 				]
 			}
@@ -45,7 +45,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-compact",
 						"timeout": 10,
-						"statusMessage": "(OmO) Resetting Project Rule Cache"
+						"statusMessage": "(OmO 4.16.1) Resetting Project Rule Cache"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/rules/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-rules",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex plugin that injects project rule files into model context through lifecycle hooks.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/start-work-continuation/directive.md

@@ -20,7 +20,7 @@ You are mid-flight on a Prometheus work plan; this turn is an automatic continua
 3. Follow the `start-work` skill in full. The skill is already loaded from your earlier turn — re-read its file at `packages/omo-codex/plugin/skills/start-work/SKILL.md` if you have lost context.
 4. Apply the checkbox's tier from its ledger entry, or classify it now per the start-work skill: LIGHT (default — a narrow change inside existing layers) needs one real-surface proof of the deliverable, with auxiliary surfaces first-class for CLI- or data-shaped work, and only trigger-mapped adversarial classes; HEAVY (new module/abstraction, auth/security, external integration, schema/migration, concurrency, cross-domain refactor, care signals) takes the full per-criterion regime. When unsure, take HEAVY; never downgrade.
 5. Decompose the checkbox into atomic sub-tasks. Dispatch them in PARALLEL via `multi_agent_v1.spawn_agent` calls in this same response unless a sub-task has a NAMED blocking dependency (input from another sub-task or shared file). Use `fork_context: false` unless full history is truly required. Put role and specialty instructions inside `message`.
-6. Every sub-task message MUST be self-contained, executable, not a context handoff: start with `TASK: <imperative assignment>`, then name `DELIVERABLE`, `SCOPE`, and `VERIFY`. It must include all 7 sections and a Manual-QA channel with exact invocation (`curl`, `send-keys`, `browser:control-in-app-browser` action, `page.click`) and PASS/FAIL observable, plus ultraqa classes, artifact, and cleanup receipt. Channels: HTTP (`curl -i`); tmux (`send-keys` + `capture-pane`); browser (Codex: `browser:control-in-app-browser` first unless auth/persistent profile needed; else Chrome/agent-browser); computer use.
+6. Every sub-task message MUST be self-contained, executable, not a context handoff: start with `TASK: <imperative assignment>`, then name `DELIVERABLE`, `SCOPE`, and `VERIFY`. It must include all 7 sections and a Manual-QA channel with exact invocation (`curl`, `send-keys`, `browser:control-in-app-browser` action, `page.click`) and PASS/FAIL observable, plus ultraqa classes, artifact, and cleanup receipt. Channels: HTTP (`curl -i`); terminal/TUI (`send-keys` for boot smoke; xterm.js web terminal for color/visual evidence, never `tmux capture-pane`); browser (Codex: `browser:control-in-app-browser` first unless auth/persistent profile needed; else Chrome/agent-browser); computer use.
 7. Treat every worker DoneClaim as untrusted input. Run independent AdversarialVerify before any checkbox can become FullyDone; `confirmed` is the only pass verdict, while `false-positive`, `needs-fix`, and `needs-human-review` loop back to the executor with exact feedback.
 8. Use `multi_agent_v1.wait_agent` for mailbox signals, not proof of completion — a timeout only means no new mailbox update arrived; a running child is alive. For sub-tasks likely to exceed one wait cycle, require `WORKING: <task> - <current phase>` before long passes and `BLOCKED: <reason>` only when progress stops. Send `TASK STILL ACTIVE: return <deliverable> or BLOCKED: <reason>` only when the child is completed without the deliverable, ack-only, or no longer running. If that followup is still silent or ack-only, record inconclusive, do not count it as pass/review approval, close if safe, and respawn a smaller `fork_context: false` task with the missing deliverable.
 9. After verification of ALL sub-tasks under this checkbox: `apply_patch` the plan to change `- [ ]` → `- [x]`, re-read the plan to confirm the count decreased, append a `task-completed` line to the ledger, then continue.
@@ -30,7 +30,7 @@ You are mid-flight on a Prometheus work plan; this turn is an automatic continua
 
 - No production code before a failing-first proof exists: a unit test at a seam, otherwise the sub-task's Manual-QA scenario captured failing. A test that mirrors its implementation (mock-call assertions, pinned constants) is not evidence. When the change touches existing behavior, PIN it first: a baseline characterization test that passes on the unchanged code, with exact inputs, exact observable, and exact assertion. PIN → RED → GREEN → SURFACE.
 - No `--dry-run` as evidence. No "should work". No "tests pass" as completion proof.
-- TUI visual evidence MUST use the web terminal pattern when a task drives an OpenCode/Codex/terminal UI: capture the pane or run `node script/qa/web-terminal-visual-qa.mjs --title "<surface>" --from-file <capture.txt> --evidence-dir <dir>` (or `--command` when tmux is available), then cite `terminal.png`, `terminal.txt`, and `metadata.json`.
+- TUI visual evidence MUST render through the real xterm.js web terminal, never `tmux capture-pane`: run `node script/qa/web-terminal-visual-qa.mjs --title "<surface>" --command "<cmd>" --input "{Enter}" --evidence-dir <dir>` (live pty + xterm.js in Chrome; `--from-file <capture>` replays a raw stream), then cite `terminal.png`, `terminal.txt`, and `metadata.json`.
 - No `as any` / `@ts-ignore` / `@ts-expect-error`. No deleting failing tests.
 - Probe every ultraqa adversarial class whose trigger fact holds (malformed input, prompt injection, cancel/resume, stale state, dirty worktree, hung or long commands, flaky tests, misleading success output, repeated interruptions — trigger map in the start-work skill) and capture the observable for each. A clean happy-path artifact alone is NOT a PASS when an applicable class went unprobed; record skipped classes with a one-line not-applicable reason.
 - Cleanup receipt is mandatory. Register each QA teardown (scripts, tmux, browser contexts, PIDs, ports, containers, temp dirs) as a todo when it spawns, then execute it. Leftover QA state = BLOCKED, not PASS.

package/packages/omo-codex/plugin/components/start-work-continuation/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/components/start-work-continuation/dist/cli.js\" hook stop",
 						"timeout": 10,
-						"statusMessage": "(OmO) Checking Start-Work Continuation"
+						"statusMessage": "(OmO 4.16.1) Checking Start-Work Continuation"
 					}
 				]
 			}
@@ -19,7 +19,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/components/start-work-continuation/dist/cli.js\" hook subagent-stop",
 						"timeout": 10,
-						"statusMessage": "(OmO) Checking Start-Work Continuation"
+						"statusMessage": "(OmO 4.16.1) Checking Start-Work Continuation"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/start-work-continuation/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-start-work-continuation",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex Stop hook continuation injector for omo-codex start-work plans.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/teammode/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use",
 						"timeout": 10,
-						"statusMessage": "(OmO) Checking Thread Title Hygiene"
+						"statusMessage": "(OmO 4.16.1) Checking Thread Title Hygiene"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/teammode/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sisyphuslabs/codex-teammode",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex team-mode hook component that keeps background thread titles descriptive after create_thread.",
 	"type": "module",
 	"private": true,

package/packages/omo-codex/plugin/components/telemetry/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook session-start",
 						"timeout": 5,
-						"statusMessage": "(OmO) Recording Session Telemetry"
+						"statusMessage": "(OmO 4.16.1) Recording Session Telemetry"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/telemetry/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-telemetry",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex plugin component that emits omo-codex anonymous daily-active telemetry on SessionStart.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ultrawork/directive.md

@@ -49,9 +49,10 @@ exercises the surface; capture the artifact.
   1. HTTP call — hit the live endpoint with `curl -i` (or a
      Playwright APIRequestContext); capture status line + headers +
      body.
-  2. tmux — `tmux new-session -d -s ulw-qa-<criterion>`, drive with
-     `send-keys`, dump via `tmux capture-pane -pS -E -`; transcript
-     is the artifact.
+  2. Terminal / TUI - drive a real pty and prove it through the
+     xterm.js web terminal (see the TUI visual QA note below). tmux
+     `send-keys` is fine for a boot smoke; NEVER `tmux capture-pane`
+     for color / layout / CJK evidence, which degrades truecolor.
   3. Browser use — in Codex, use `browser:control-in-app-browser`
      first when available and no authenticated/persistent user browser
      profile is required. Otherwise use Chrome to drive the REAL page;
@@ -79,13 +80,13 @@ channel scenario when the behavior is user-facing. `--dry-run`,
 printing the command, "should respond", and "looks correct" never
 count.
 
-For TUI visual QA, terminal transcripts alone are not enough when a
-visual surface is being evaluated. In this repo, prefer
-`node script/qa/web-terminal-visual-qa.mjs --title "<surface>" --from-file <capture.txt> --evidence-dir <dir>`
-or the helper's `--command` tmux-backed PTY connector when available.
-Outside this repo, capture equivalent browser/computer-use rendered
-terminal evidence: screenshot, plain transcript, rendered HTML or action
-log, and cleanup receipt.
+For TUI visual QA, render the terminal through the real xterm.js web
+terminal and screenshot it - never a `tmux capture-pane` dump, which
+degrades color and wide-glyph width. In this repo:
+`node script/qa/web-terminal-visual-qa.mjs --title "<surface>" --command "<cmd>" --input "{Enter}" --evidence-dir <dir>`
+(live pty + xterm.js in Chrome; `--from-file <capture>` replays a raw
+stream). Outside this repo, capture equivalent browser-rendered terminal
+evidence: screenshot + plain transcript + cleanup receipt.
 
 # Bootstrap (DO ALL FOUR BEFORE ANY OTHER WORK — NO SKIPPING)
 
@@ -287,6 +288,13 @@ evidence for that step. Do not start dependent implementation until the
 audit, research, or review result is integrated or explicitly recorded
 as inconclusive. Do not generate a plan before spawned research lanes
 that feed the plan have returned or been closed as inconclusive.
+Spawn every independent child for the current wave first. After the wave
+is launched, run `multi_agent_v1.wait_agent` for each spawned child until
+each reaches terminal status (`completed`, `failed`, `blocked`, or
+explicitly recorded inconclusive) before any dependent `update_plan`
+transition, `create_goal` continuation, implementation tool call, plan
+drafting, approval-gate work, PR handoff, or final response. A timeout is
+not terminal status.
 Do not write the final answer, PR handoff, or completion summary while
 active child agents remain open. Use short `multi_agent_v1.wait_agent` cycles.
 After two silent waits send `TASK STILL ACTIVE: return <deliverable> or

package/packages/omo-codex/plugin/components/ultrawork/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook user-prompt-submit",
 						"timeout": 5,
-						"statusMessage": "(OmO) Checking Ultrawork Trigger"
+						"statusMessage": "(OmO 4.16.1) Checking Ultrawork Trigger"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/ultrawork/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-ultrawork",
-	"version": "4.16.0",
+	"version": "4.16.1",
 	"description": "Codex plugin that injects the ultrawork orchestration directive and ships LazyCodex planning, review, QA, and gate agent roles.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ultrawork/skills/ultrawork/SKILL.md

@@ -56,9 +56,10 @@ exercises the surface; capture the artifact.
   1. HTTP call — hit the live endpoint with `curl -i` (or a
      Playwright APIRequestContext); capture status line + headers +
      body.
-  2. tmux — `tmux new-session -d -s ulw-qa-<criterion>`, drive with
-     `send-keys`, dump via `tmux capture-pane -pS -E -`; transcript
-     is the artifact.
+  2. Terminal / TUI - drive a real pty and prove it through the
+     xterm.js web terminal (see the TUI visual QA note below). tmux
+     `send-keys` is fine for a boot smoke; NEVER `tmux capture-pane`
+     for color / layout / CJK evidence, which degrades truecolor.
   3. Browser use — in Codex, use `browser:control-in-app-browser`
      first when available and no authenticated/persistent user browser
      profile is required. Otherwise use Chrome to drive the REAL page;
@@ -86,13 +87,13 @@ channel scenario when the behavior is user-facing. `--dry-run`,
 printing the command, "should respond", and "looks correct" never
 count.
 
-For TUI visual QA, terminal transcripts alone are not enough when a
-visual surface is being evaluated. In this repo, prefer
-`node script/qa/web-terminal-visual-qa.mjs --title "<surface>" --from-file <capture.txt> --evidence-dir <dir>`
-or the helper's `--command` tmux-backed PTY connector when available.
-Outside this repo, capture equivalent browser/computer-use rendered
-terminal evidence: screenshot, plain transcript, rendered HTML or action
-log, and cleanup receipt.
+For TUI visual QA, render the terminal through the real xterm.js web
+terminal and screenshot it - never a `tmux capture-pane` dump, which
+degrades color and wide-glyph width. In this repo:
+`node script/qa/web-terminal-visual-qa.mjs --title "<surface>" --command "<cmd>" --input "{Enter}" --evidence-dir <dir>`
+(live pty + xterm.js in Chrome; `--from-file <capture>` replays a raw
+stream). Outside this repo, capture equivalent browser-rendered terminal
+evidence: screenshot + plain transcript + cleanup receipt.
 
 # Bootstrap (DO ALL FOUR BEFORE ANY OTHER WORK — NO SKIPPING)
 
@@ -294,6 +295,13 @@ evidence for that step. Do not start dependent implementation until the
 audit, research, or review result is integrated or explicitly recorded
 as inconclusive. Do not generate a plan before spawned research lanes
 that feed the plan have returned or been closed as inconclusive.
+Spawn every independent child for the current wave first. After the wave
+is launched, run `multi_agent_v1.wait_agent` for each spawned child until
+each reaches terminal status (`completed`, `failed`, `blocked`, or
+explicitly recorded inconclusive) before any dependent `update_plan`
+transition, `create_goal` continuation, implementation tool call, plan
+drafting, approval-gate work, PR handoff, or final response. A timeout is
+not terminal status.
 Do not write the final answer, PR handoff, or completion summary while
 active child agents remain open. Use short `multi_agent_v1.wait_agent` cycles.
 After two silent waits send `TASK STILL ACTIVE: return <deliverable> or

package/packages/omo-codex/plugin/components/ultrawork/skills/ulw-plan/SKILL.md

@@ -67,6 +67,17 @@ Fan out read-only research before deciding. Every spawn names DELIVERABLE / SCOP
 multi_agent_v1.spawn_agent({"message":"TASK: act as an explorer. DELIVERABLE: ... SCOPE: ... VERIFY: ...","agent_type":"explorer","fork_context":false})
 ```
 
+Spawn every independent child for the current wave first. After the wave
+is launched, use `multi_agent_v1.wait_agent` for each child until each
+reaches terminal status. A timeout is not terminal status. Do not start dependent planning, drafting, approval-gate work, or final handoff until each child result is integrated or recorded as inconclusive.
+
+For work likely to exceed one wait cycle, require the child to send
+`WORKING: <task> - <current phase>` before long passes and
+`BLOCKED: <reason>` only when progress stops. A `multi_agent_v1.wait_agent`
+timeout only means no new mailbox update arrived. Treat a running child as
+alive. Fallback only when the child is completed without the deliverable,
+ack-only after followup, explicitly `BLOCKED:`, or no longer running.
+
 Roles: `explorer` (internal patterns/conventions/tests), `librarian` (external docs/contracts), `metis` (gap analysis), `momus` (high-accuracy plan review). Full spawn/wait/fallback discipline is in `references/full-workflow.md`.
 
 ## Stop rules

package/packages/omo-codex/plugin/components/ultrawork/test/codex-hook.test.ts

@@ -190,7 +190,7 @@ describe("codex ultrawork hook", () => {
 		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/# Manual-QA channels/);
 		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/TESTS ALONE NEVER PROVE DONE/);
 		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/1\. HTTP call/);
-		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/2\. tmux/);
+		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/2\. Terminal \/ TUI/);
 		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/3\. Browser use/);
 		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/4\. Computer use/);
 		expect(parsed.hookSpecificOutput.additionalContext).toMatch(/CLEANUP \(PAIRED/);
@@ -244,6 +244,27 @@ describe("codex ultrawork hook", () => {
 		expect(directive).toMatch(/WORKING:/);
 	});
 
+	it("#given directive #when inspected #then blocks dependent work until spawned planners finish", () => {
+		// given
+		const payload = {
+			hook_event_name: "UserPromptSubmit",
+			prompt: "ulw",
+		};
+
+		// when
+		const output = runUserPromptSubmitHook(payload, { skillFilePath: null });
+		const parsed = parseHookOutput(output);
+
+		// then
+		const directive = parsed.hookSpecificOutput.additionalContext;
+		expect(directive).toMatch(/Subagent-dependent transition barrier/);
+		expect(directive).toMatch(/Spawn every independent child for the current wave first/);
+		expect(directive).toMatch(/After the wave\s+is launched[\s\S]{0,240}wait_agent[\s\S]{0,240}terminal status/);
+		expect(directive).not.toMatch(/Immediately after any `multi_agent_v1\.spawn_agent`/);
+		expect(directive).toMatch(/Do not start dependent implementation/);
+		expect(directive).toMatch(/Do not mark an `update_plan` step `completed`/);
+	});
+
 	it("#given directive #when inspected #then keeps impact-proportional sizing invariants", () => {
 		// given
 		const payload = {