lazycodex-ai 5.0.0-beta.85 → 5.0.0-beta.87

package/packages/omo-codex/plugin/skills/ultrawork/SKILL.md

@@ -17,9 +17,9 @@ Expert coding agent. Ship verified work. No process narration.
 
 # Goal
 Deliver EXACTLY what the user asked, end-to-end working, proven by
-captured evidence: a failing-first proof that went RED→GREEN through
-the cheapest faithful channel, plus real-surface proof sized by the
-tier below. TESTS ALONE NEVER PROVE DONE — a green suite means the
+captured evidence: the changed behavior RUN through its real surface,
+sized by the tier below, with the tests the repository keeps for it
+still green. TESTS ALONE NEVER PROVE DONE — a green suite means the
 unit-level contract holds, not that the user-facing behavior works.
 
 # Tier triage (classify ONCE at bootstrap; record tier + one-line
@@ -60,8 +60,8 @@ triggered, run the reviewer loop until unconditional approval.
 Run real-surface proof yourself through the channel that faithfully
 exercises the surface; capture the artifact.
 
-  1. HTTP call — hit the live endpoint with `curl -i` (or a
-     Playwright APIRequestContext); capture status line + headers +
+  1. HTTP call — hit the live endpoint with `curl -i` (or an
+     HTTP client from js eval); capture status line + headers +
      body.
   2. Terminal / TUI - drive a real pty and prove it through the
      xterm.js web terminal (see the TUI visual QA note below). tmux
@@ -69,18 +69,21 @@ exercises the surface; capture the artifact.
      for color / layout / CJK evidence, which degrades truecolor.
   3. Browser use — in Codex, use `browser:control-in-app-browser`
      first when available and no authenticated/persistent user browser
-     profile is required. Otherwise, or for Chrome semantics, stealth,
-     or trace, WRITE a `playwright-core` script and run it from js eval
-     against local Chrome (`chromium.launch({ channel: "chrome" })` /
-     `launchPersistentContext` on a CLONED profile). Capture action
-     log + screenshot path. Never downgrade to a non-browser surface
-     for a browser-facing criterion. NEVER clear cookies, cache, or
-     site data (`Network.clearBrowserCookies`, `Storage.clearCookies`,
+     profile is required. Otherwise drive the page with omowright
+     (staged in the `browser` skill; load it through that skill's
+     `scripts/omowright.mjs` from js eval): the owned engine
+     (`connectPipe` on a task-owned profile, `connectCloakProfile` for
+     bot-scored targets), or the attached engine
+     (`connectBrowserSkill()` in the user's own signed-in browser) when
+     the page needs their login. Capture action log + screenshot path.
+     Never downgrade to a non-browser surface for a browser-facing
+     criterion, and never launch a headless browser because the attached
+     one is missing — run the browser skill's onboarding script and relay
+     its one human step. NEVER clear cookies, cache, or site data
+     (`Network.clearBrowserCookies`, `Storage.clearCookies`,
      `chrome.browsingData.remove`, "clear browsing data") on the user's
-     real/main browser profile — it wipes their logged-in state. If you
-     need that profile's login state, clone it first (`rsync -a
-     <profile>/ <tmp-clone>/`) and launch Chrome against
-     the clone as the user-data-dir; run any clearing there only.
+     real/main browser profile, and never clone it — it wipes or
+     invalidates their logged-in state.
   4. Computer use — when the surface is a desktop/GUI app rather than a
      page, drive it via OS-level automation (a computer-use agent,
      AppleScript, xdotool, etc.) against the running app; capture
@@ -155,9 +158,6 @@ The criteria MUST list, upfront:
   its exact scenario: the literal command / page action / payload and
   the binary PASS/FAIL observable, plus the evidence artifact it will
   capture.
-- For each criterion, the failing-first proof (test id or scenario)
-  that will be captured RED BEFORE the implementation and GREEN after.
-  Evidence added after the green code does NOT satisfy this.
 - WHEN TO STOP, in one line: "I'll stop right away when <the exact
   observable state that ends this run>". The Stop rules bind to this
   line — the moment it holds, you stop.
@@ -193,7 +193,7 @@ Started: <ISO timestamp>
 <patterns / pitfalls / principles to remember next turn>
 ```
 
-Append each finding, decision, command, RED/GREEN capture, and QA
+Append each finding, decision, command, test read, and QA
 artifact path the moment it happens. Update `## Now` and
 `## Todo` on every transition. Append-only — never rewrite. This notepad
 is your durable memory and it OUTLIVES the context window. After any
@@ -219,11 +219,10 @@ instead of waiting for the next pass. Step text encodes WHERE / WHY
 (which criterion it advances) / HOW / VERIFY:
 `path: <action> for <criterion> — verify by <check>`.
 
-GOOD pair (test-first, ordered):
-  `foo.test.ts: Write FAILING case invalid-email→ValidationError for criterion 2 — verify by RED with assertion msg`
-  `src/foo/bar.ts: Implement validateEmail() RFC-5322-lite for criterion 2 — verify by foo.test.ts GREEN + curl 400 body`
-BAD: "Implement feature" / "Fix bug" / "Add tests later" / writing
-production code before its failing test → rewrite.
+GOOD pair (ordered):
+  `test/foo.test.ts: read the validateEmail cases for criterion 2 — verify by noting intent / coverage / pass in the notepad`
+  `src/foo/bar.ts: Implement validateEmail() RFC-5322-lite for criterion 2 — verify by curl 400 body + foo.test.ts green`
+BAD: "Implement feature" / "Fix bug" / "Add tests later" → rewrite.
 
 # Finding things (lead with these, code-mode the first wave)
 Never guess from memory — locate with the right tool, and re-read before
@@ -252,51 +251,35 @@ search, absolute-path results). For research that leaves the repo —
 library/API/docs/web — delegate to the `librarian` subagent. Spawn them
 `fork_context: false` and keep doing root work while they run.
 
-# Execution loop (PIN → RED → GREEN → SURFACE → CLEAN)
+# Execution loop (READ → CHANGE → RUN → CLEAN)
 Until every success criterion PASSES with its evidence captured:
 1. Pick next criterion → mark in_progress → update notepad `## Now`.
-2. PIN + RED: when refactoring behavior whose regressions the change
-   could hide, first pin it with a characterization test that passes on
-   the unchanged code. Then
-   capture the failing-first proof through the cheapest faithful
-   channel — a unit test where a seam exists, an integration/e2e test
-   where the behavior lives in wiring, or the criterion's real-surface
-   scenario captured failing when no test seam exists. It must fail
-   for the RIGHT reason (not a syntax error, not a missing import).
-   Paste RED output into the notepad. No production code yet.
-   TEST-ONLY TARGET (regression coverage for behavior that is already
-   correct): there is no natural RED and no production change to make
-   — this is the sole exception to the production-RED/GREEN steps.
-   Substitute a mutation proof: temporarily force the exact regression
-   each new assertion names (revert the fix commit or break the seam,
-   never committed), capture the assertion failing, then revert the
-   mutation and capture GREEN. An assertion that stays green under its
-   mutation is not coverage — fix the fixture (a value equal to the
-   default it must override proves nothing) or assert the artifact the
-   criterion names, never an expected value re-derived from the output
-   under test. Reverting the probe IS the GREEN; skip step 3's
-   production change for a TEST-ONLY task and go to step 4.
-   PROSE TARGET (prompt, SKILL.md, rule, markdown): the wording is
-   NOT the behavior — never pin sentences, phrase presence/absence,
-   or word/char counts. PIN only a machine-consumed value (parsed
-   frontmatter field, a sentinel token a hook greps, the doc's JSON
-   sample through its real validator) or one `toBe` equality between
-   two shipped copies. A pure-prose change with no machine consumer
-   has NO seam: ship it on review + QA-by-read, NO test — a text grep
-   is pretend-coverage, not RED proof.
-3. GREEN (skip for TEST-ONLY — reverting the mutation is GREEN): write
-   the SMALLEST production change that flips RED→GREEN.
-   Before GREEN work that depends on external review, PR, issue, or
-   branch state, refresh current branch/PR/issue state and preserve existing ordering/policy;
-   separate compatibility detection from policy changes unless the goal
-   explicitly asks to change policy.
-   Re-run the proof. Capture GREEN output. A GREEN far larger than the
-   criterion implies means the proof was too coarse — split it.
-4. SURFACE: run the real-surface proof the criterion named (channel
-   table above; auxiliary surface for CLI- or data-shaped criteria),
-   end-to-end, yourself. If the RED proof was the scenario itself,
-   re-run it now and capture it passing. Paste the artifact path into
-   the notepad.
+2. READ what already proves the area BEFORE touching it. Existing
+   tests are the behavior of record: note in the notepad whether they
+   encode the intended behavior, cover the path you change, and pass.
+   One WRONG before your change is a FINDING to report — NEVER edit a
+   test green. A bug: reproduce it first and capture the failure. A
+   refactor: the existing tests are green on the unchanged code first.
+3. CHANGE: the SMALLEST production change that meets the criterion;
+   update the tests your change makes stale. Add a test ONLY when
+   BOTH hold: the repository keeps tests for this behavior AND a
+   regression would otherwise pass unnoticed by the run and the
+   existing tests — sized like its neighbors, one case per stated
+   behavior, failing when that behavior breaks. A test that restates
+   the change (a constant, a string, a rename, a call) is NOT evidence;
+   the run is. Coverage-only work (no production change): break the
+   behavior each new assertion names, capture it failing, restore — an
+   assertion that stays green under its mutation is not coverage.
+   PROSE TARGET (prompt, SKILL.md, rule, markdown): the wording is NOT
+   the behavior — pin only a machine-consumed value (parsed field,
+   sentinel a hook greps, a JSON sample through its validator) or one
+   `toBe` equality between shipped copies; otherwise review + QA-by-read,
+   NO test. Before a change that depends on review, PR, issue, or
+   branch state, refresh that state and preserve existing ordering/policy.
+4. RUN: the real-surface scenario the criterion named (channel table
+   above; auxiliary surface for CLI- or data-shaped criteria), end to
+   end, yourself, plus the step-2 tests; a reproduction now passes.
+   Paste the artifact path into the notepad.
 5. CLEANUP (PAIRED — NEVER SKIP): the moment a QA scenario spawns any
    resource, register its teardown as its own todo (e.g.
    `cleanup: kill server pid for criterion 2 — verify kill -0 fails`).
@@ -304,7 +287,7 @@ Until every success criterion PASSES with its evidence captured:
    before this step completes:
    server PIDs (`kill <pid>`; verify `kill -0` fails), `tmux` sessions
    (`tmux kill-session -t ulw-qa-<criterion>`; verify with `tmux ls`),
-   browser / Playwright contexts (`.close()`), containers
+   browsers / sessions (`browser.close()` / `session.stop()`), containers
    (`docker rm -f`), bound ports (`lsof -i :<port>` empty), temp
    sockets / files / dirs (`rm -rf` the `mktemp` paths), QA-only env
    vars. Append a one-line cleanup receipt to the notepad next to the
@@ -322,8 +305,8 @@ Until every success criterion PASSES with its evidence captured:
    message. Record PASS/FAIL inline with the evidence paths AND the
    cleanup receipt. Loop until all PASS.
 
-Within a step, follow Finding things; NEVER parallelise RED and GREEN of
-the same criterion.
+Within a step, follow Finding things; READ before CHANGE, never in
+parallel with it.
 
 # Waiting discipline (a poll costs a full model round)
 Every status check you issue as a tool call replays the entire
@@ -435,8 +418,8 @@ When triggered, follow this procedure (NON-NEGOTIABLE):
    2-attempt stop rule below) — do not loop further.
 
 # Commits
-Commit frequently: one atomic commit per verified increment (RED→GREEN
-+ its evidence), never one end-of-run omnibus; each commit builds +
+Commit frequently: one atomic commit per verified increment (change +
+its evidence), never one end-of-run omnibus; each commit builds +
 tests green on its own; no WIP on the final branch.
 BEFORE composing each message, read the history and mimic it: run
 `git log --oneline -20` plus `git log -5 -- <touched paths>` and match
@@ -449,20 +432,11 @@ convention. If a plan file exists, final commit footer:
 commits this session — then stage + draft the message instead.
 
 # Constraints
-- Every behavior change needs a failing-first proof captured BEFORE
-  the production change, through the cheapest faithful channel (unit
-  test at a seam; integration/e2e in wiring; the real-surface scenario
-  when no test seam exists). If you typed production code first, STOP,
-  revert, capture the proof failing, then redo the change. Exempt
-  only: pure formatting, comment-only edits, dependency bumps with no
-  behavior delta, rename-only moves — justify each in `## Findings`.
-- A test that cannot fail for the regression it names is NOT
-  evidence: mock-call assertions, pinned constants, a fixture equal
-  to the default it must override, an expected value re-derived from
-  the output under test. Prefer a real-surface proof with no new
-  test over a tautological one.
-- Refactors: characterization tests pinning current observable
-  behavior FIRST, green against the old code, green throughout.
+- Every behavior change is PROVEN BY ITS RUN on the real surface, with
+  the tests the repository keeps for it green. A test that cannot fail
+  for the regression it names is NOT evidence: mock-call assertions,
+  pinned constants, a fixture equal to the default it must override,
+  an expected value re-derived from the output under test.
 - Smallest correct change. No drive-by refactors.
 - Never suppress lints / errors / test failures. Never delete, skip,
   `.only`, `.skip`, `xfail`, or comment out tests to green the suite.
@@ -471,8 +445,8 @@ commits this session — then stage + draft the message instead.
 # Output discipline
 - First line literally: `ULTRAWORK MODE ENABLED!`
 - After bootstrap: 1-2 paragraph plan summary + notepad path.
-- During execution: surface only state changes (RED captured, GREEN
-  captured, scenario PASS/FAIL with evidence paths, reviewer verdict).
+- During execution: surface only state changes (existing tests read,
+  scenario PASS/FAIL with evidence paths, reviewer verdict).
 - Final message: outcome + success-criteria checklist with evidence
   refs + notepad path + reviewer approval (if gate triggered) + commit
   list (`<sha> <subject>`). No file-by-file changelog unless asked.

package/packages/omo-codex/plugin/skills/ulw-execute/SKILL.md

@@ -164,13 +164,13 @@ Sizing is a two-branch decision made per checkbox, before dispatch:
 Each sub-task message must include:
 
 1. Goal and exact files or directories in scope.
-2. When the task touches existing behavior: a baseline characterization test, written first, that pins current observable behavior and passes on the unchanged code (exact inputs, exact observable, exact assertion). Then the failing-first proof for the new behavior before production changes — a unit test where a seam exists, otherwise the sub-task's Manual-QA scenario captured failing. A test that mirrors its implementation (mock-call assertions, pinned constants) is not evidence.
+2. The tests already covering the touched behavior, READ before any edit as the behavior of record (intent, coverage, pass); a bug's reproduction captured before the fix. A new test ONLY where the repository keeps tests for this behavior AND a regression would otherwise pass unnoticed by the sub-task's Manual-QA scenario — never one that mirrors its implementation (mock-call assertions, pinned constants) or restates the change.
 3. Implementation constraints from the plan and project rules.
 4. Automated verification commands to run.
-5. One Manual-QA channel, named with the exact tool and exact invocation (the literal `curl`, `send-keys`, `browser:control-in-app-browser` action, `page.click`, payload, selectors, and the binary observable that decides PASS/FAIL), not "verify it works". A LIGHT checkbox needs one real-surface proof of its deliverable, and auxiliary surfaces (CLI stdout, DB state diff, parsed config dump) are first-class when the surface is CLI- or data-shaped:
+5. One Manual-QA channel, named with the exact tool and exact invocation (the literal `curl`, `send-keys`, `page.click` / `session.click`, payload, selectors, and the binary observable that decides PASS/FAIL), not "verify it works". A LIGHT checkbox needs one real-surface proof of its deliverable, and auxiliary surfaces (CLI stdout, DB state diff, parsed config dump) are first-class when the surface is CLI- or data-shaped:
    - HTTP call: `curl -i` against the live endpoint.
    - Terminal / TUI: drive a real pty; `tmux send-keys` is fine for a boot/behavior smoke, but color/layout/CJK evidence goes through the xterm.js web terminal below, NEVER `tmux capture-pane`.
-   - Browser use: from js eval, use `new Bun.WebView()` on Bun >= 1.4 (macOS default; Linux/Windows need Chrome/Chromium/Edge). Otherwise, or for Chrome semantics, stealth, trace, or auth, write and run a `playwright-core` script against local Chrome (`channel: "chrome"`; persistent context on a CLONED profile). Codex: `browser:control-in-app-browser` for ordinary page control.
+   - Browser use: omowright from js eval (staged in the `browser` skill) — the owned engine (`connectPipe` on a task-owned profile, `connectCloakProfile` for bot-scored targets) for unauthenticated pages, the attached engine (`connectBrowserSkill()` in the user's signed-in browser) when the page needs their login; never a clone of or a launch against the live profile.
    - Computer use: OS-level GUI automation against the running desktop app when the surface is not a page.
    - TUI visual evidence: when a TUI claim needs visual QA or PR proof, run `bun script/qa/web-terminal-visual-qa.mjs --command "<cmd>" --input "{Enter}" --evidence-dir <dir>` (real pty rendered through xterm.js in Chrome) and attach `terminal.png` plus `metadata.json`.
 6. The adversarial classes that apply to this sub-task (from the 9 ultraqa classes) and how each is probed.
@@ -243,7 +243,7 @@ When all top-level checkboxes in `## TODOs` and `## Final Verification Wave` are
 
 ## Hard rules
 
-- No production change before a failing-first proof exists (unit test at a seam, otherwise the failing Manual-QA scenario), and no change to existing behavior before a baseline characterization test pins the current behavior and passes on the unchanged code.
+- No production change before the tests covering that behavior were read and a bug's reproduction captured; existing tests are green on the unchanged code first, and one that contradicts the intent is a FINDING, never edited green.
 - No `--dry-run` as completion evidence.
 - No tests-only completion claim. A Manual-QA artifact is required.
 - **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.

package/packages/omo-codex/plugin/skills/ulw-loop/references/define-goal.md

@@ -39,8 +39,7 @@ Every criterion carries, at definition time, not after the work:
 
 - a binary pass condition ("returns 200 and the body matches the schema", never "works correctly");
 - the exact scenario: the literal command, request, page action, or payload that will prove it;
-- the evidence artifact it will capture: transcript, status plus body, screenshot path, diff, parsed dump;
-- the failing-first proof (test id or scenario) that will be captured RED before implementation.
+- the evidence artifact it will capture: transcript, status plus body, screenshot path, diff, parsed dump.
 
 A criterion that cannot fail is not a criterion. If no input could make the scenario fail, it measures nothing; rewrite it until failure is possible.
 
@@ -50,7 +49,7 @@ Prefer numbers that represent real success over decorative precision. A threshol
 
 | Domain | Quantify as |
 | --- | --- |
-| Bug fix | reproduction first, fix second: the failing case captured RED, then the same validator green |
+| Bug fix | reproduction first, fix second: the failing case captured before, the same case passing after |
 | Tests | the exact command and required pass condition, plus run count for flake-sensitive suites |
 | Performance | metric, target threshold, measurement method, and run count ("p95 under 250ms across 3 consecutive local runs") |
 | Quality work | the observable acceptance bar: lint, typecheck, and test pass; reviewed examples; a user-approved artifact |

package/packages/omo-codex/plugin/skills/ulw-loop/references/full-workflow.md

@@ -18,9 +18,9 @@ Audit each pass, fail, block, steering change, and checkpoint in `.omo/ulw-loop/
 ## Manual-QA channels
 Run each criterion's real-surface proof yourself through the channel that faithfully exercises it; capture the artifact before recording PASS.
 
-1. **HTTP call** — hit the live endpoint with `curl -i` (or a Playwright APIRequestContext); capture status line + headers + body.
+1. **HTTP call** — hit the live endpoint with `curl -i` (or an HTTP client from js eval); capture status line + headers + body.
 2. **Terminal / TUI** - prove it through the xterm.js web terminal; tmux `send-keys` is fine for a boot smoke, but NEVER `tmux capture-pane` for color/layout/CJK evidence (it degrades truecolor).
-3. **Browser use** — in Codex, prefer `browser:control-in-app-browser`. Otherwise, or for Chrome semantics, stealth, trace, or auth, WRITE a `playwright-core` script and run it from js eval against local Chrome (`channel: "chrome"`; persistent context on a CLONED profile, never the live one). Capture action log + screenshot path. Never downgrade a browser-facing criterion.
+3. **Browser use** — in Codex, prefer `browser:control-in-app-browser`. Otherwise omowright from js eval (staged in the `browser` skill): the owned engine (`connectPipe` on a task-owned profile, `connectCloakProfile` for bot-scored targets) for unauthenticated pages, the attached engine (`connectBrowserSkill()` in the user's signed-in browser) when the page needs their login — never a clone of, or a launch against, the live profile. Capture action log + screenshot path. Never downgrade a browser-facing criterion.
 4. **Computer use** — for desktop/GUI apps, drive the running app via OS automation (computer-use, AppleScript, xdotool, etc.); capture action log + screenshot.
 
 For TUI visual QA (mandatory when a PR or review must inspect the terminal screen),

package/packages/omo-codex/plugin/skills/visual-qa/SKILL.md

@@ -73,7 +73,7 @@ Before any reviewer sees an image, verify each capture yourself: the file signat
 ### Web
 
 1. Capture a REFERENCE image: the user's mock/target, generated page snapshot, Figma export, source-site capture, or known-good baseline. Save as PNG. If the user provided overview text or annotations, save them next to the image and treat them as part of the reference packet.
-2. Capture the ACTUAL rendered screenshot at the reference viewport. Use two browser tiers from js eval: (1) `new Bun.WebView()` on Bun >= 1.4 (macOS default; Linux/Windows need installed Chrome/Chromium/Edge); (2) otherwise, or for Chrome semantics, stealth, trace, or authenticated profiles, WRITE a `playwright-core` script and run it from the kernel against local Chrome (`chromium.launch({ channel: "chrome" })` / `launchPersistentContext` on a CLONED profile, never the live one). In Codex, prefer `browser:control-in-app-browser` for ordinary captures. Save PNG and return its path; close the browser context. See `$SKILL_DIR/references/browser-setup.md` for fixed-viewport examples and prerequisites.
+2. Capture the ACTUAL rendered screenshot at the reference viewport with omowright from js eval (the library is staged in the `browser` skill): the owned engine (`connectPipe` on a task-owned profile, viewport pinned with `emulate`, then `page.screenshot()`) for anything unauthenticated, or the attached engine (`connectBrowserSkill()` → `session.screenshot()`) when the page needs the user's login — never a clone of, or a launch against, the user's live profile. Save PNG and return its path; close the browser or stop the session. See `$SKILL_DIR/references/browser-setup.md` for fixed-viewport examples and prerequisites.
 3. Run the diff and keep the JSON:
 
 ```

package/packages/omo-codex/plugin/skills/visual-qa/references/browser-setup.md

@@ -1,75 +1,75 @@
 # Browser setup (Web capture)
 
-Use the js-eval kernel for both tiers. In Codex, prefer
-`browser:control-in-app-browser` for ordinary captures.
+Capture with omowright from the js-eval kernel. The library is staged inside the `browser` skill;
+load it once per session:
 
-## Tier 1: Bun.WebView
+```js
+const { loadOmowright } = await import("<browser-skill-root>/scripts/omowright.mjs")
+const { omowright } = await loadOmowright()
+```
+
+## Owned engine (default for QA)
 
-On a Bun >= 1.4 kernel, `new Bun.WebView()` is the macOS default (system
-WebKit, no browser download). Linux/Windows require `backend: "chrome"`
-and installed Chrome/Chromium/Edge. WebView is headless; WebKit has no CDP,
-and `type()` emits no keyboard events. Use tier 2 when these differences matter.
+A browser your code launches, with a task-owned profile, pinned viewport and no user state.
+`connectPipe` opens no listening port and reaps the process on `close()`.
 
 ```js
 // js-eval cell; url and pngPath belong to this QA run.
-const view = new Bun.WebView({ width: 1280, height: 720 })
+const { mkdtempSync, rmSync } = await import("node:fs")
+const profile = mkdtempSync(`${(await import("node:os")).tmpdir()}/visual-qa-`)
+const browser = await omowright.connectPipe({
+  browserPath: chromeBinary,                      // installed Chrome, Chromium, CloakBrowser or chrome-headless-shell
+  browserArgs: ["--headless", "--no-first-run", `--user-data-dir=${profile}`],
+  storageRoot: profile,
+})
 try {
-  await view.navigate(url)
-  await Bun.write(pngPath, await view.screenshot())
+  const page = await browser.newTab("about:blank")
+  await omowright.emulate(page, { width: 1280, height: 720, deviceScaleFactor: 1, mobile: false, hasTouch: false })
+  await page.goto(url, { waitUntil: "load" })
+  await Bun.write(pngPath, await page.screenshot())
   console.log(pngPath)
 } finally {
-  view[Symbol.dispose]()
+  await browser.close()
+  rmSync(profile, { recursive: true, force: true })
 }
 ```
 
-## Tier 2: playwright-core with local Chrome
+Chrome must already be installed; report an absent executable rather than downloading a managed
+browser. For bot-scored or WAF targets use `connectCloakProfile({ profileDir })` (CloakBrowser
+with a pinned fingerprint seed) — the `browser` skill's `references/owned-engine/README.md`
+covers it.
+
+## Attached engine (authenticated pages)
 
-For other kernels, real-Chrome semantics, stealth, traces, or authenticated
-profiles, WRITE a script beside the project's installed `playwright-core`
-dependency and execute it from js eval. The user installs `playwright-core`
-once with `bun add playwright-core` if needed; Chrome must already exist.
-No managed browser download is needed.
+When the capture needs the user's login, drive the browser they are signed into instead of
+cloning its profile:
 
 ```js
-// capture.mjs
-import { chromium } from "playwright-core"
-const [url, pngPath] = process.argv.slice(2)
-const browser = await chromium.launch({ channel: "chrome", headless: true })
+const session = await omowright.connectBrowserSkill({ name: "visual-qa capture", focused: false })
 try {
-  const page = await browser.newPage({ viewport: { width: 1280, height: 720 }, deviceScaleFactor: 1 })
-  await page.goto(url, { waitUntil: "load", timeout: 30000 })
-  await page.screenshot({ path: pngPath })
-  console.log(pngPath)
+  await session.navigate(url, { waitUntil: "load" })
+  await session.resize(1280, 720)
+  const shot = await session.screenshot()            // { buffer, width, height }
+  await Bun.write(pngPath, shot.buffer)
 } finally {
-  await browser.close()
+  await session.stop()
 }
 ```
 
-Run from the js-eval kernel (also works on a Node kernel):
-
-```js
-const { promisify } = await import("node:util")
-const { execFile } = await import("node:child_process")
-const result = await promisify(execFile)("node", [scriptPath, url, pngPath], { timeout: 45000 })
-console.log(result.stdout)
-```
-
-For auth, CLONE the user-data directory to a private task-owned directory
-and use `chromium.launchPersistentContext(clonePath, { channel: "chrome" })`.
-NEVER launch against or clear cookies/cache/site data from the live profile.
-Close the context and remove only the clone after QA. For script-based stealth,
-read the ultimate-browsing skill's `references/chrome-stealth.md`.
+NEVER launch anything against, or clear cookies/cache/site data from, the user's live profile;
+the attached engine is the only sanctioned way to a signed-in page. If no extension is connected,
+run the `browser` skill's `scripts/browser-install.mjs`, relay its one human step, and wait — do
+not fall back to the owned engine for an authenticated criterion.
 
 ## Capture a screenshot at a fixed viewport
 
-Match CSS viewport AND PNG dimensions: WebKit follows native display scale
-(a 1280x720 viewport can yield 2560x1440 pixels). Use matching reference
-captures or Chrome's `deviceScaleFactor`, not resizing to force a pass.
-Wait for the specific page state, not a sleep, then compare:
+Match CSS viewport AND PNG dimensions: pin `deviceScaleFactor` through `emulate` (owned) or
+`resize` (attached) instead of resizing the PNG to force a pass. Wait for the specific page state
+(a locator, a `waitForURL`, a `createNetworkSnoop(page).waitFor(...)`), not a sleep, then compare:
 
 ```sh
 node "$SKILL_DIR/scripts/visual-qa.mjs" image-diff reference.png actual.png
 ```
 
-Inspect `dimensionsMatch` and `diffRatio`, then inspect the image. Close every
-WebView/browser context and the fixture server, even on a failed capture.
+Inspect `dimensionsMatch` and `diffRatio`, then inspect the image. Close every browser and session
+and the fixture server, even on a failed capture; remove the owned profile in the same `finally`.

package/packages/omo-codex/plugin/test/sync-skills-test-support.mjs

@@ -98,7 +98,7 @@ const ulwExecuteCodexCompletion = `When all top-level checkboxes in \`## TODOs\`
 5. Remove or mark the Boulder work as completed.
 6. Print an \`ORCHESTRATION COMPLETE\` block with the plan path, verification commands, artifacts, and cleanup receipts.`;
 
-const ulwExecuteOriginalHardRule = `- No production change before a failing-first proof exists (unit test at a seam, otherwise the failing Manual-QA scenario), and no change to existing behavior before a baseline characterization test pins the current behavior and passes on the unchanged code.
+const ulwExecuteOriginalHardRule = `- No production change before the tests covering that behavior were read and a bug's reproduction captured; existing tests are green on the unchanged code first, and one that contradicts the intent is a FINDING, never edited green.
 - No \`--dry-run\` as completion evidence.
 - No tests-only completion claim. A Manual-QA artifact is required.
 - **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.
@@ -107,7 +107,7 @@ const ulwExecuteOriginalHardRule = `- No production change before a failing-firs
 - No unprefixed session ids in Boulder state. Sessions are always recorded as \`codex:<session_id>\`.
 - No stale-memory execution. The plan and ledger are the durable source of truth.`;
 
-const ulwExecuteCodexHardRule = `- No production change before a failing-first proof exists (unit test at a seam, otherwise the failing Manual-QA scenario), and no change to existing behavior before a baseline characterization test pins the current behavior and passes on the unchanged code.
+const ulwExecuteCodexHardRule = `- No production change before the tests covering that behavior were read and a bug's reproduction captured; existing tests are green on the unchanged code first, and one that contradicts the intent is a FINDING, never edited green.
 - No \`--dry-run\` as completion evidence.
 - No tests-only completion claim. A Manual-QA artifact is required.
 - **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.

package/packages/omo-codex/scripts/install-dist/install-local.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// omo-codex-install:e05e108254a84b0b56604b57a1db7fc04d476de568cf6860040906461d5b089d:65bd0688ebae929257167637f75778a4acf745e8877e0c9df3abf5012a6063fb
+// omo-codex-install:e7f8b8a7af0a5bc6257d28f1ef9ead291ad7ea22515c64d7fd93951afa62eab8:5e264434333c29356d4fe13f7ad2cf2ad0942eb5ca12b94e77105e35c913077c
 var __esm = (fn, res, err) => () => {
   if (fn)
     try {
@@ -9984,7 +9984,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@oh-my-opencode/omo-codex",
-    version: "5.0.0-beta.85",
+    version: "5.0.0-beta.87",
     type: "module",
     private: true,
     description: "Codex harness adapter for oh-my-openagent. Vendored Codex plugin namespace (omo) + TypeScript installer + telemetry.",
@@ -16735,6 +16735,8 @@ function isRecord5(value) {
 }
 var OmoModelProfileInputSchema = object({
   display_name: string2().optional(),
+  family: _enum(["daily", "geeky"]).optional(),
+  tier: _enum(["normal", "heavy"]).optional(),
   models: array(union([string2(), OmoFallbackModelObjectSchema])).optional()
 }).strict();
 var OmoModelProfileSchema = preprocess((value) => isRecord5(value) ? normalizeLegacyModelFields(value) : value, OmoModelProfileInputSchema);