lazycodex-ai 5.0.0-beta.8 → 5.0.0-beta.9

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/AGENTS.md

@@ -2,6 +2,116 @@
 
 **Generated:** 2026-08-10 / 38d268995
 
+## UPSTREAM BASELINE AND VERSION POLICY
+
+**READ THIS BEFORE TOUCHING `engine/**` OR PROPOSING AN UPSTREAM SYNC.**
+
+This engine is NOT project-original code. It is a vendored-and-modified snapshot of
+[fivetaku/insane-search](https://github.com/fivetaku/insane-search), and the version
+we run on is a deliberate choice, not an accident of neglect.
+
+### The pin
+
+| Fact | Value |
+|---|---|
+| Upstream project | `https://github.com/fivetaku/insane-search` |
+| Vendoring commit | `a4e4ed797` (2026-06-21) `feat(ultimate-browsing): vendor insane-search engine (junk-excluded)` |
+| De-personalization | `4743199a5` (2026-06-21) |
+| Pinned upstream baseline | upstream state as of 2026-06-21, **pre-0.7.0** (0.7.0 is dated 2026-06-22) |
+| Re-vendors since | none — every later change here is ours |
+
+We intentionally track a **pinned baseline plus local divergence**, not upstream HEAD.
+There is no submodule and no automated drift check for this engine (unlike the
+`frontend` skill's upstream submodules): the vendored files ARE the source of truth,
+and upstream is a reference we port FROM, deliberately, file by file.
+
+### Why we do not blind-rebase onto upstream HEAD
+
+1. **Upstream reset its public history.** On 2026-08-06 upstream published a single
+   squashed commit, `019ee16 refactor: reset public history at 0.14.0`, discarding the
+   prior public history through 0.13.x. There is no upstream commit graph to rebase onto and no
+   way to cherry-pick an individual upstream change by sha — only whole-file diffing
+   against a moving HEAD.
+2. **Upstream 0.14.0 REMOVED capability.** The endpoint-mining / internal-API
+   auto-derivation / site-recipe subsystems that upstream carried publicly between
+   0.12.0 and 0.14.0 are gone from upstream HEAD. Syncing to HEAD is therefore not
+   strictly an upgrade: parts of it are a downgrade relative to the intermediate
+   versions, and none of it is recoverable from the reset history.
+3. **Our tree diverged on purpose.** The KEEP list below is functionality upstream
+   never had. A wholesale overwrite with upstream HEAD would silently delete it.
+4. **Different threat model.** Our engine ships inside a published npm package and a
+   public marketplace mirror, under a CI no-site-name gate and a de-personalization
+   deny-list. Upstream carries neither constraint, so upstream code is not
+   drop-in-shippable here.
+
+### KEEP — our divergences a re-vendor MUST NOT regress
+
+These exist only in our tree. Any upstream sync that removes or bypasses one of them
+is a regression, not an upgrade:
+
+- **Phase 2.5 surrogate retrieval** (`surrogate.py`, `surrogates.yaml`) — archive /
+  reader / proxy routes tried before paying for a browser spin-up, with per-entry
+  `last_verified` staleness handling and `--allow-proxy` gating.
+- **Provenance / trust contract** (`result_schema.py`) — `Provenance` and `Trust`
+  literals on every result, so a snapshot can never be reported as the live page.
+- **Surrogate dead-end validation** (L1.5 in `validators.py`) — interstitial titles and
+  AMP-style redirect stubs rejected instead of returned as content.
+- **The no-site-name rule and its CI gate** (`bias_check.py`) — zero hard-coded site
+  names, brands, or target domains in `engine/**`.
+- **Module split of the fetch chain** — `curl_probe` / `referers` / `url_transforms` /
+  `waf_detector` / `validators` / `executor` / `summary` as separate modules rather than
+  one monolith.
+- **The Python test suite** under `engine/tests/` with its HTML/JSON fixtures.
+- **De-personalization** — no personal absolute paths, no personal auth token literals,
+  no personal browser choice; enforced by `depersonalization-gate.test.ts`.
+- **Skill-level layering** — the engine is Tier 1 under a router that also owns Tier 1.5
+  (agent-reach) and Tier 2 (CloakBrowser + agent-browser). Upstream has no such tiering.
+
+### WANT — upstream improvements worth porting forward
+
+Our snapshot predates these; they are wanted, and each must be ported as a reviewed,
+site-agnostic change that preserves every KEEP item above. Port individually; never as
+a tree overwrite:
+
+- **Content quality**: dedicated markdown conversion of fetched HTML, main-content
+  extraction, PDF text extraction, and JSON-LD rescue when the HTML body is thin.
+- **Transient-failure retry** and **render-merge** of statically fetched HTML with the
+  browser-rendered DOM.
+- **Differential block classification** — distinguishing a bot-detection block from an
+  infrastructure or authentication failure, instead of collapsing both into `challenge`.
+- **Additional stealth fetch backends** beyond the current Playwright templates, and
+  additional WAF vendor profiles.
+- **Per-host route learning** — remembering which route succeeded for a host, with a TTL
+  and a bounded store. Must stay runtime state, never committed site knowledge (R4).
+- **Engine-level Phase 0 routing** — the official-public-API preference is currently only
+  a documented rule (R5) the agent can skip; upstream moved it into code so it cannot be
+  skipped. Worth adopting.
+
+### OUT OF SCOPE
+
+- **The removed upstream endpoint-mining / internal-API auto-derivation / site-recipe
+  subsystems.** They are absent from upstream HEAD and are not reconstructed here. They
+  also sit against R3/R4 and R7's anti-bias rule: discovered internal endpoints are
+  runtime findings, never committed engine knowledge.
+- **Any upstream code carrying site-specific selectors, domains, or brand names.** It
+  fails `bias_check.py` at the door; re-derive it site-agnostically or leave it out.
+- **Automated upstream tracking.** No submodule, no drift check, no auto-bump. Syncing is
+  a deliberate, reviewed, human-initiated act.
+
+### THE SYNC RULE
+
+Any future upstream sync preserves BOTH sides. Concretely:
+
+1. Diff the specific upstream capability you want against our tree — do not overwrite
+   files wholesale, and never `git checkout` upstream over `engine/`.
+2. Port it as its own reviewed change, keeping every KEEP item intact.
+3. Re-run `python3 engine/bias_check.py` and the `engine/tests/` suite; a port that
+   introduces a site name or breaks a fixture does not ship.
+4. Update the pin table above (baseline, date, what was ported) in the same change, plus
+   the provenance section of [`../ATTRIBUTION.md`](../ATTRIBUTION.md).
+5. If a port must drop a KEEP item, say so explicitly in the PR and get it agreed first —
+   silent regressions of the KEEP list are the failure mode this policy exists to prevent.
+
 ## OVERVIEW
 
 A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -m engine URL`), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.

package/packages/omo-codex/plugin/test/aggregate-agents.test.mjs

@@ -15,103 +15,25 @@ const agentSchemaKeys = new Set([
 	"developer_instructions",
 ]);
 
+// `includes` entries below are machine-consumed tokens only: EVIDENCE_RECORDED is the sentinel the
+// lazycodex-executor-verify SubagentStop hook greps from worker messages; recommendation, blockers,
+// codeQualityStatus, not_applicable, surfaceEvidence, and adversarialCases are fields the ulw-loop
+// quality gate parses out of reviewer/QA reports; <attemptDir>/<goalId>-code-review.md and
+// -manual-qa.md are the artifact names the ulw-loop spawn guard requires before a gate-reviewer
+// spawn; currentAttemptDir is a field of `ulw-loop status --json`.
 const lazycodexAgentInvariants = new Map([
-	[
-		"explorer.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "low",
-			includes: [/Read-only/, /working tree/, /rg/],
-		},
-	],
-	[
-		"librarian.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "low",
-			includes: [/Read-only/, /SHA-pinned GitHub permalink/, /external/],
-		},
-	],
-	[
-		"metis.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "high",
-			includes: [/pre-planning analyst/i, /contradictions/, /Read-only/],
-		},
-	],
-	[
-		"momus.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "high",
-			includes: [/plan reviewer/i, /OKAY, ITERATE, or REJECT/, /Read-only/],
-		},
-	],
-	[
-		"plan.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "high",
-			includes: [/strategic planning consultant/i, /\.omo\/plans\/<slug>\.md/, /never implements/i],
-		},
-	],
-	[
-		"lazycodex-worker-low.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "high",
-			includes: [/EVIDENCE_RECORDED: <path>/, /low-difficulty/i, /smallest correct change/i],
-		},
-	],
-	[
-		"lazycodex-worker-medium.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "high",
-			includes: [/EVIDENCE_RECORDED: <path>/, /medium-difficulty/i, /smallest correct change/i],
-		},
-	],
-	[
-		"lazycodex-worker-high.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "medium",
-			includes: [/EVIDENCE_RECORDED: <path>/, /high-difficulty/i, /smallest correct change/i],
-		},
-	],
-	[
-		"lazycodex-clone-fidelity-reviewer.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "high",
-			includes: [/recommendation/, /blockers/, /\.omo\/evidence\/<goal>-clone-fidelity\.md/],
-		},
-	],
-	[
-		"lazycodex-code-reviewer.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "medium",
-			includes: [/codeQualityStatus/, /recommendation/, /<attemptDir>\/<goalId>-code-review\.md/, /currentAttemptDir/],
-		},
-	],
-	[
-		"lazycodex-qa-executor.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "high",
-			includes: [/not_applicable/, /surfaceEvidence/, /adversarialCases/, /<attemptDir>\/<goalId>-manual-qa\.md/],
-		},
-	],
-	[
-		"lazycodex-gate-reviewer.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "low",
-			includes: [/APPROVE\/REJECT/, /blockers/, /<attemptDir>\/<goalId>-gate-review\.md/, /currentAttemptDir/],
-		},
-	],
+	["explorer.toml", { model: "gpt-5.6-luna", effort: "low" }],
+	["librarian.toml", { model: "gpt-5.6-luna", effort: "low" }],
+	["metis.toml", { model: "gpt-5.6-sol", effort: "high" }],
+	["momus.toml", { model: "gpt-5.6-terra", effort: "high" }],
+	["plan.toml", { model: "gpt-5.6-sol", effort: "high" }],
+	["lazycodex-worker-low.toml", { model: "gpt-5.6-luna", effort: "high", includes: [/EVIDENCE_RECORDED: <path>/] }],
+	["lazycodex-worker-medium.toml", { model: "gpt-5.6-terra", effort: "high", includes: [/EVIDENCE_RECORDED: <path>/] }],
+	["lazycodex-worker-high.toml", { model: "gpt-5.6-sol", effort: "medium", includes: [/EVIDENCE_RECORDED: <path>/] }],
+	["lazycodex-clone-fidelity-reviewer.toml", { model: "gpt-5.6-terra", effort: "high", includes: [/recommendation/, /blockers/] }],
+	["lazycodex-code-reviewer.toml", { model: "gpt-5.6-terra", effort: "medium", includes: [/codeQualityStatus/, /recommendation/, /<attemptDir>\/<goalId>-code-review\.md/, /currentAttemptDir/] }],
+	["lazycodex-qa-executor.toml", { model: "gpt-5.6-luna", effort: "high", includes: [/not_applicable/, /surfaceEvidence/, /adversarialCases/, /<attemptDir>\/<goalId>-manual-qa\.md/] }],
+	["lazycodex-gate-reviewer.toml", { model: "gpt-5.6-sol", effort: "low", includes: [/blockers/, /currentAttemptDir/] }],
 ]);
 
 const externalSourceTokenPattern = new RegExp(
@@ -156,7 +78,6 @@ test("#given bundled Codex agents #when components/ultrawork/agents directory is
 		}
 	}
 });
-
 test("#given bundled agent TOMLs #when nickname_candidates are inspected #then they use only the codex-accepted charset", async () => {
 	// given: codex_app_server ignores a role whose nickname has characters outside
 	// ASCII letters, digits, spaces, hyphens, underscores (observed live in task-15 QA)
@@ -174,16 +95,6 @@ test("#given bundled agent TOMLs #when nickname_candidates are inspected #then t
 	}
 });
 
-test("#given planner agent prompt #when inspected #then generated artifacts stay under .omo", async () => {
-	const prompt = await readFile(join(root, "components", "ultrawork", "agents", "plan.toml"), "utf8");
-
-	assert.match(prompt, /\.omo\/plans\/<slug>\.md/);
-	assert.match(prompt, /<attemptDir>\/task-<N>-<slug>\.<ext>/);
-	assert.match(prompt, /\.omo\/evidence\/ulw\/<session>\/<goalId>\/a<attempt>/);
-	assert.doesNotMatch(prompt, /(?<!\.omo\/)plans\/<slug>\.md/);
-	assert.doesNotMatch(prompt, /(?<!\.omo\/)evidence\/task-/);
-});
-
 test("#given lazycodex agent prompts #when inspected #then each role pins model effort and evidence discipline", async () => {
 	const agentsDir = join(root, "components", "ultrawork", "agents");
 
@@ -197,73 +108,8 @@ test("#given lazycodex agent prompts #when inspected #then each role pins model
 		assert.doesNotMatch(prompt, /^blocking\s*=/m);
 		assert.doesNotMatch(prompt, externalSourceTokenPattern);
 
-		for (const pattern of invariant.includes) {
+		for (const pattern of invariant.includes ?? []) {
 			assert.match(prompt, pattern, `${fileName} must include ${pattern}`);
 		}
 	}
 });
-
-test("#given LazyCodex reviewer prompts #when inspected #then anti-slop review coverage is required", async () => {
-	const agentsDir = join(root, "components", "ultrawork", "agents");
-	const codeReviewer = await readFile(join(agentsDir, "lazycodex-code-reviewer.toml"), "utf8");
-	const gateReviewer = await readFile(join(agentsDir, "lazycodex-gate-reviewer.toml"), "utf8");
-
-	assert.match(codeReviewer, /remove-ai-slops/);
-	assert.match(codeReviewer, /programming/);
-	assert.match(codeReviewer, /load or consult/);
-	assert.match(codeReviewer, /documented criteria/);
-	assert.match(codeReviewer, /violates either skill perspective/);
-	assert.match(codeReviewer, /overfit\/slop review pass/);
-	assert.match(codeReviewer, /deletion-only tests/);
-	assert.match(codeReviewer, /tests that merely verify a requested removal/);
-	assert.match(codeReviewer, /tautological tests/);
-	assert.match(codeReviewer, /mirror implementation constants/);
-	assert.match(codeReviewer, /unnecessary production data extraction, parsing, or normalization/);
-	assert.match(codeReviewer, /false confidence/);
-
-	assert.match(gateReviewer, /remove-ai-slops/);
-	assert.match(gateReviewer, /programming/);
-	assert.match(gateReviewer, /load or consult/);
-	assert.match(gateReviewer, /documented criteria/);
-	assert.match(gateReviewer, /Run the `remove-ai-slops`/);
-	assert.match(gateReviewer, /Apply the `programming`/);
-	assert.match(gateReviewer, /overfit\/slop pass yourself/);
-	assert.match(gateReviewer, /tests that merely verify a requested removal/);
-	assert.match(gateReviewer, /deletion-only/);
-	assert.match(gateReviewer, /tautological/);
-	assert.match(gateReviewer, /implementation-mirroring tests/);
-	assert.match(gateReviewer, /unnecessary production extraction, parsing, or normalization/);
-
-	const directPassIndex = gateReviewer.indexOf("overfit/slop pass yourself");
-	const reportCoverageIndex = gateReviewer.indexOf("Then confirm the code review report");
-	assert.notEqual(directPassIndex, -1);
-	assert.notEqual(reportCoverageIndex, -1);
-	assert.ok(
-		directPassIndex < reportCoverageIndex,
-		"gate reviewer must perform the overfit/slop pass directly before checking report coverage",
-	);
-});
-
-test("#given done-gate reviewer prompts #when inspected #then burden of proof is approve-unless-cited and reject priors are gone", async () => {
-	const agentsDir = join(root, "components", "ultrawork", "agents");
-	const gateReviewer = await readFile(join(agentsDir, "lazycodex-gate-reviewer.toml"), "utf8");
-	const qaExecutor = await readFile(join(agentsDir, "lazycodex-qa-executor.toml"), "utf8");
-	const codeReviewer = await readFile(join(agentsDir, "lazycodex-code-reviewer.toml"), "utf8");
-
-	assert.match(gateReviewer, /APPROVE unless you can cite/);
-	assert.match(gateReviewer, /violatedCriterion/);
-	assert.match(gateReviewer, /evidencePointer/);
-	assert.match(gateReviewer, /top blockers inline/);
-	assert.match(gateReviewer, /is a NOTE, not a blocker/);
-	assert.match(gateReviewer, /You do NOT check/);
-	assert.doesNotMatch(gateReviewer, /Assume the work has already failed/);
-	assert.doesNotMatch(gateReviewer, /Return exactly one recommendation: APPROVE\/REJECT\./);
-
-	assert.match(qaExecutor, /one-line reason/);
-	assert.match(qaExecutor, /rejecting a legitimately untriggered class is itself an error/);
-	assert.doesNotMatch(qaExecutor, /Trust nothing\./);
-
-	assert.match(codeReviewer, /MEDIUM by default/);
-	assert.doesNotMatch(codeReviewer, /Treat useless tests or needless production complexity as CRITICAL\/HIGH/);
-});
-

package/packages/omo-codex/plugin/test/aggregate-hooks.test.mjs

@@ -84,7 +84,7 @@ test("#given aggregate SubagentStop hooks #when inspected #then start-work and L
 	assert.equal(verifierGroups.length, 1);
 	assert.equal(verifierGroups[0]?.groupIndex, 0);
 	assert.equal(verifierGroups[0]?.handler.timeout, 10);
-	assert.match(verifierGroups[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Verifying LazyCodex Executor Evidence$/);
+	assert.match(verifierGroups[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate PostCompact hooks #when hooks are inspected #then LSP diagnostics cache reset is registered", async () => {
@@ -100,7 +100,7 @@ test("#given aggregate PostCompact hooks #when hooks are inspected #then LSP dia
 
 	// then
 	assert.equal(lspPostCompactHooks.length, 1);
-	assert.match(lspPostCompactHooks[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Resetting LSP Diagnostics Cache$/);
+	assert.match(lspPostCompactHooks[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate hook commands #when inspected #then every command exposes a Codex status message", async () => {
@@ -142,23 +142,6 @@ test("#given component hook commands #when inspected #then standalone packages e
 	assert.deepEqual(missingStatusMessages, []);
 });
 
-test("#given hook status messages #when inspected #then labels describe OMO responsibilities instead of the hook runner", async () => {
-	// given
-	const componentHooks = await readComponentHookManifests();
-
-	// when
-	const commandHooks = [
-		...(await readAggregateCommandHooks()),
-		...componentHooks.flatMap(({ source, hooks }) => collectCommandHooks(hooks, source)),
-	];
-	const genericStatusMessages = commandHooks
-		.filter(({ handler }) => typeof handler.statusMessage !== "string" || /\bhook\b/i.test(handler.statusMessage))
-		.map(hookLocation);
-
-	// then
-	assert.deepEqual(genericStatusMessages, []);
-});
-
 test("#given aggregate OMO plugin is enabled #when hooks are inspected #then shell guidance and ulw-loop guard are registered", async () => {
 	// given
 	const manifests = await readAggregateHookManifests();
@@ -169,9 +152,7 @@ test("#given aggregate OMO plugin is enabled #when hooks are inspected #then she
 
 	// then
 	assert.match(text, /components\/git-bash\/dist\/cli\.js/);
-	assert.match(text, /Recommending Git Bash MCP/);
 	assert.match(text, /hook post-compact/);
-	assert.match(text, /Resetting Git Bash MCP Reminder/);
 	assert.match(text, /components\/ulw-loop\/dist\/cli\.js/);
 	assert.match(text, /hook pre-tool-use/);
 	assert.deepEqual(preToolUseGroups.map((group) => group.matcher), [
@@ -221,7 +202,6 @@ test("#given aggregate SessionStart hooks #when inspected #then LazyCodex auto-u
 	// then
 	assert.equal(autoUpdateGroup?.matcher, "^startup$");
 	assert.match(text, /scripts\/auto-update\.mjs/);
-	assert.match(text, /Checking Auto Update/);
 	assert(sessionStartCommands.some((command) => command.includes("scripts/auto-update.mjs")));
 });
 
@@ -265,7 +245,7 @@ test("#given aggregate PostToolUse hooks #when inspected #then CodeGraph init gu
 	// then
 	assert.equal(codegraphPostToolUseHooks.length, 1);
 	assert.equal(codegraphPostToolUseHooks[0]?.matcher, "^(codegraph[._].*|mcp__codegraph__.*)$");
-	assert.match(codegraphPostToolUseHooks[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Checking CodeGraph Init Guidance$/);
+	assert.match(codegraphPostToolUseHooks[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate PostToolUse hooks #when inspected #then thread title hygiene is registered for created Codex threads", async () => {
@@ -282,7 +262,7 @@ test("#given aggregate PostToolUse hooks #when inspected #then thread title hygi
 	// then
 	assert.equal(threadTitleHooks.length, 1);
 	assert.equal(threadTitleHooks[0]?.matcher, "^(create_thread|codex_app\\.create_thread)$");
-	assert.match(threadTitleHooks[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Checking Thread Title Hygiene$/);
+	assert.match(threadTitleHooks[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate plugin packaging #when inspected #then hooks and compatibility sentinels stay Python-free", async () => {

package/packages/omo-codex/plugin/test/aggregate-plugin-fixture.mjs

@@ -1,10 +1,8 @@
 import { readdir, readFile, stat } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-
 export const root = dirname(dirname(fileURLToPath(import.meta.url)));
 export const repoRoot = join(root, "..", "..", "..");
-
 export async function readJson(relativePath) {
 	return JSON.parse(await readFile(join(root, relativePath), "utf8"));
 }
@@ -79,18 +77,182 @@ export function hookLocation({ source, eventName, groupIndex, handlerIndex, hand
 	return `${source}:${eventName}:${groupIndex}:${handlerIndex}:${handler.command}`;
 }
 
-export function findInvalidSpawnAgentRoleParameters(content) {
-	return [...content.matchAll(/spawn_agent\([^)\n]*(?:agent_type|model|reasoning_effort)\s*=/g)].map((match) => match[0]);
+const SPAWN_AGENT_START = /(?:(?<receiver>\b[A-Za-z_]\w*)\s*\.\s*)?(?<callee>\bspawn_agent)\s*\(/g;
+
+async function collectFiles(directory, predicate) {
+	let entries;
+	try {
+		entries = await readdir(directory, { withFileTypes: true });
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return [];
+		throw error;
+	}
+
+	const files = [];
+	for (const entry of entries) {
+		const path = join(directory, entry.name);
+		if (entry.isDirectory()) files.push(...(await collectFiles(path, predicate)));
+		else if (entry.isFile() && predicate(path)) files.push(path);
+	}
+	return files;
 }
 
-export function findSpawnAgentCallsWithoutForkContextFalse(content) {
-	const missingForkContext = [];
-	const regex = /spawn_agent\(([^)]*)\)/g;
-	for (const match of content.matchAll(regex)) {
-		const call = match[0];
-		if (!/"fork_context"\s*:\s*false|fork_context:\s*false|fork_context=false|"fork_turns"\s*:\s*"none"|fork_turns:\s*"none"|fork_turns="none"/.test(call)) {
-			missingForkContext.push(call);
+export async function listShippedSpawnPromptFiles() {
+	const skillFiles = [
+		...(await collectFiles(join(root, "skills"), (path) => basename(path) === "SKILL.md")),
+		...(await collectFiles(
+			join(root, "components"),
+			(path) => path.includes(`${sep}skills${sep}`) && basename(path) === "SKILL.md",
+		)),
+	];
+	const hephaestusRules = await collectFiles(
+		join(root, "components", "rules", "bundled-rules", "hephaestus"),
+		(path) => path.endsWith(".md"),
+	);
+	return [...skillFiles, ...hephaestusRules].sort();
+}
+
+export function findSpawnAgentCalls(content) {
+	const calls = [];
+	for (const match of content.matchAll(SPAWN_AGENT_START)) {
+		const openingParenthesis = match.index + match[0].lastIndexOf("(");
+		let depth = 1;
+		let quote = null;
+		let escaped = false;
+
+		for (let index = openingParenthesis + 1; index < content.length; index += 1) {
+			const character = content[index];
+			if (quote !== null) {
+				if (escaped) escaped = false;
+				else if (character === "\\") escaped = true;
+				else if (character === quote) quote = null;
+				continue;
+			}
+			if (character === '"' || character === "'" || character === "`") {
+				quote = character;
+				continue;
+			}
+			if (character === "(") depth += 1;
+			else if (character === ")") depth -= 1;
+			if (depth !== 0) continue;
+
+			const { receiver = null, callee } = match.groups;
+			calls.push({ call: content.slice(match.index, index + 1), index: match.index, receiver, callee });
+			break;
 		}
 	}
-	return missingForkContext;
+	return calls;
 }
+
+function tokensForSpawnCall(call) {
+	const tokens = [];
+	let braceDepth = 0;
+	let bracketDepth = 0;
+	let parenthesisDepth = 0;
+
+	for (let index = call.indexOf("(") + 1; index < call.length - 1; ) {
+		const character = call[index];
+		if (/\s/.test(character)) {
+			index += 1;
+			continue;
+		}
+		if (character === '"' || character === "'" || character === "`") {
+			const start = index;
+			const quote = character;
+			let value = "";
+			index += 1;
+			while (index < call.length - 1) {
+				const current = call[index];
+				if (current === "\\" && index + 1 < call.length - 1) {
+					value += call[index + 1];
+					index += 2;
+					continue;
+				}
+				index += 1;
+				if (current === quote) break;
+				value += current;
+			}
+			tokens.push({ type: "string", value, start, end: index, braceDepth, bracketDepth, parenthesisDepth });
+			continue;
+		}
+		if (/[A-Za-z_]/.test(character)) {
+			const start = index;
+			while (/[A-Za-z0-9_]/.test(call[index] ?? "")) index += 1;
+			tokens.push({ type: "identifier", value: call.slice(start, index), start, end: index,
+				braceDepth, bracketDepth, parenthesisDepth });
+			continue;
+		}
+
+		if (character === "{") braceDepth += 1;
+		else if (character === "}") braceDepth -= 1;
+		else if (character === "[") bracketDepth += 1;
+		else if (character === "]") bracketDepth -= 1;
+		else if (character === "(") parenthesisDepth += 1;
+		else if (character === ")") parenthesisDepth -= 1;
+		else if (character === ":" || character === "=") {
+			tokens.push({ type: "separator", value: character, start: index, end: index + 1,
+				braceDepth, bracketDepth, parenthesisDepth });
+		}
+		index += 1;
+	}
+	return tokens;
+}
+
+function spawnParameters(call) {
+	const tokens = tokensForSpawnCall(call);
+	const parameters = [];
+	for (let index = 0; index < tokens.length - 2; index += 1) {
+		const key = tokens[index];
+		const separator = tokens[index + 1];
+		const value = tokens[index + 2];
+		const isArgumentScope = key.parenthesisDepth === 0 && key.bracketDepth === 0 && key.braceDepth <= 1;
+		const isSameScope =
+			separator.braceDepth === key.braceDepth && separator.bracketDepth === key.bracketDepth &&
+			separator.parenthesisDepth === key.parenthesisDepth && value.braceDepth === key.braceDepth &&
+			value.bracketDepth === key.bracketDepth &&
+			value.parenthesisDepth === key.parenthesisDepth;
+		const isAdjacent = /^\s*$/.test(call.slice(key.end, separator.start)) &&
+			/^\s*$/.test(call.slice(separator.end, value.start));
+		if (!isArgumentScope || !isSameScope || !isAdjacent || separator.type !== "separator") continue;
+		parameters.push({ name: key.value, value, direct: key.braceDepth === 0 });
+	}
+	return parameters;
+}
+
+export function hasSpawnIsolationArgument(call) {
+	return spawnParameters(call).some(
+		({ name, value }) => (name === "fork_context" && value.type === "identifier" && value.value === "false") ||
+			(name === "fork_turns" && value.type === "string" && value.value === "none"),
+	);
+}
+
+export function findSpawnAgentCallsWithoutIsolation(content) {
+	return findSpawnAgentCalls(content).filter(({ call }) => !hasSpawnIsolationArgument(call));
+}
+
+export function findSpawnAgentCallsWithUnsupportedParameters(content) {
+	return findSpawnAgentCalls(content).flatMap((entry) => {
+		const allowsObjectAgentType = entry.receiver === "multi_agent_v1";
+		const parameters = spawnParameters(entry.call)
+			.filter(({ name, direct }) => name === "model" || name === "reasoning_effort" ||
+				(name === "agent_type" && (direct || !allowsObjectAgentType)))
+			.map(({ name }) => name);
+		return parameters.length === 0 ? [] : [{ ...entry, parameters }];
+	});
+}
+
+async function findShippedSpawnViolations(findViolations) {
+	const violations = [];
+	for (const path of await listShippedSpawnPromptFiles()) {
+		const content = await readFile(path, "utf8");
+		for (const violation of findViolations(content)) {
+			const line = content.slice(0, violation.index).split("\n").length;
+			violations.push({ path, line, ...violation });
+		}
+	}
+	return violations;
+}
+
+export const findShippedSpawnIsolationViolations = () => findShippedSpawnViolations(findSpawnAgentCallsWithoutIsolation);
+export const findShippedUnsupportedSpawnParameterViolations = () =>
+	findShippedSpawnViolations(findSpawnAgentCallsWithUnsupportedParameters);