lazycodex-ai 5.1.13 → 5.1.15

package/packages/omo-codex/plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "@sisyphuslabs/omo-codex-plugin",
-	"version": "5.1.13",
+	"version": "5.1.15",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@sisyphuslabs/omo-codex-plugin",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"workspaces": [
 				"components/comment-checker",
 				"components/git-bash",
@@ -95,7 +95,7 @@
 		},
 		"components/comment-checker": {
 			"name": "@code-yeongyu/codex-comment-checker",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"bin": {
 				"omo-comment-checker": "dist/cli.js"
@@ -117,7 +117,7 @@
 		},
 		"components/git-bash": {
 			"name": "@sisyphuslabs/codex-git-bash-hook",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"bin": {
 				"omo-git-bash-hook": "dist/cli.js"
 			},
@@ -131,7 +131,7 @@
 		},
 		"components/lazycodex-executor-verify": {
 			"name": "@code-yeongyu/codex-lazycodex-executor-verify",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"bin": {
 				"lazycodex-executor-verify": "dist/cli.js"
@@ -149,7 +149,7 @@
 		},
 		"components/lsp": {
 			"name": "@code-yeongyu/codex-lsp",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"dependencies": {
 				"@code-yeongyu/lsp-daemon": "file:../../../../lsp-daemon",
@@ -171,7 +171,7 @@
 		},
 		"components/rules": {
 			"name": "@code-yeongyu/codex-rules",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"dependencies": {
 				"picomatch": "^4.0.7"
@@ -194,7 +194,7 @@
 		},
 		"components/teammode": {
 			"name": "@sisyphuslabs/codex-teammode",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"devDependencies": {
 				"@types/node": "^26.6.2",
 				"@vitest/coverage-v8": "5.0.1",
@@ -208,7 +208,7 @@
 		},
 		"components/telemetry": {
 			"name": "@code-yeongyu/codex-telemetry",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"bin": {
 				"omo-telemetry": "dist/cli.js"
@@ -227,7 +227,7 @@
 		},
 		"components/ultrawork": {
 			"name": "@code-yeongyu/codex-ultrawork",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"bin": {
 				"omo-ultrawork": "dist/cli.js"
@@ -246,7 +246,7 @@
 		},
 		"components/ulw-execute-continuation": {
 			"name": "@code-yeongyu/codex-ulw-execute-continuation",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"bin": {
 				"omo-ulw-execute-continuation": "dist/cli.js"
@@ -264,7 +264,7 @@
 		},
 		"components/ulw-loop": {
 			"name": "@code-yeongyu/codex-ulw-loop",
-			"version": "5.1.13",
+			"version": "5.1.15",
 			"license": "MIT",
 			"bin": {
 				"omo-ulw-loop": "dist/cli.js",

package/packages/omo-codex/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sisyphuslabs/omo-codex-plugin",
-  "version": "5.1.13",
+  "version": "5.1.15",
   "description": "Aggregate Codex plugin root for OMO components.",
   "type": "module",
   "packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/skills/browser/SKILL.md

@@ -18,7 +18,31 @@ one where a human is a single call away. Never substitute one engine for the oth
 the attached engine is not set up, run the onboarding script and tell the user its one remaining
 step.
 
-## Step 0 — load omowright and prove the stack
+## Step 0 — which engine this session is allowed to use
+
+When `OMO_BROWSER_ENGINE` is set (the OmO desktop app sets it for every session), it wins over the table above:
+
+| Value | What you do |
+|---|---|
+| `connected` | Use `connectBrowserSkill()` only. If the user's browser is not connected you get a "Connect your browser" error: relay it and stop. Never open another browser |
+| `builtin` | Do not call `connectBrowserSkill()`; use the app's in-app browser tools |
+| `none` | Do not do browser work. Say that agent browser access is off for this project |
+| unset | The table above, as before (terminal use) |
+
+While any engine is set, `loadOmowright()` returns a guarded library. The owned engine (`connectPipe`,
+`connectCloakProfile`, `connect`) and every other export that acts on a browser is refused, so the table above
+does not apply: do not look for a way around it, and tell the user what the session allows. Under `connected`
+the app sees what the browser is doing, and before a click, Enter or script that sends, posts, pays, orders,
+subscribes, deletes or closes an account, and before Enter in a message box, it asks the user first. A "No" fails the action with
+`BrowserActionDeclinedError`: report that, never retry it or go around it (`session.tool()` lets only reads
+through; `evaluate` is guarded too). If the user presses Stop, the next call throws `BrowserUserStoppedError`: tell
+the user browser use was stopped and start no new session this turn.
+
+The guard prevents mistakes by a cooperating agent. It is not a security boundary: code that imports the raw
+entry (`resolveOmowrightEntry()`) is not guarded, and a host without the `omo_browser_bridge` tool cannot show state or
+honor Stop, though questions are still asked.
+
+## Step 1 — load omowright and prove the stack
 
 ```js
 const { loadOmowright } = await import("<skill-root>/scripts/omowright.mjs")
@@ -94,7 +118,7 @@ changing the extension's automation settings.
   out everywhere. No flow here needs it.
 - **`focused: false` by default.** The browser belongs to someone who is probably using it.
 - **One short, named session per task,** always stopped.
-- **Bot-scored or WAF targets go to the owned engine.** The attached engine's daemon enables console
+- **Bot-scored or WAF targets go to the owned engine** (not while `OMO_BROWSER_ENGINE` is set: then say the site needs a browser the session does not allow). The attached engine's daemon enables console
   capture on every tab it drives, which is a known automation signal; CloakBrowser through
   `connectCloakProfile()` is the stealth path.
 

package/packages/omo-codex/plugin/skills/browser/references/commands.md

@@ -98,8 +98,17 @@ Every refusal is a `BskRpcError` with the daemon's own `code`:
 | `invalid_params` | wrong option shape | fix the call, do not retry as-is |
 | `permission_denied` | `evaluate` on a tab outside the Agent Window, or a denied borrow | stop; the user said no |
 | `timeout` | the tool did not finish in its budget | read the page state before retrying once |
-| `user_aborted` | the user pressed Stop in the browser | stop the task and report |
+| `user_aborted` | the user pressed Stop in the browser | stop the task and report; under `OMO_BROWSER_ENGINE` this surfaces as `BrowserUserStoppedError` and no session starts again this turn |
 | `cdp_failed` | the page cannot be attached (restricted URL, DevTools open) | say which page and why |
 
+Typed errors under `OMO_BROWSER_ENGINE` (see SKILL.md Step 0):
+
+| Error | `code` | Meaning |
+|---|---|---|
+| `BrowserNotConnectedError` | `browser_not_connected` | the user's browser is not connected; ask them to connect it |
+| `BrowserEngineRefusal` | `browser_engine_none` / `browser_engine_builtin` / `browser_engine_unsupported` / `browser_tool_blocked` | this engine setting does not allow that call |
+| `BrowserActionDeclinedError` | `user_declined` | the user said no, or no question could be asked; do not retry |
+| `BrowserUserStoppedError` | `user_stopped` | the user stopped browser use |
+
 Long calls can be cancelled: `const h = session.client.callWithHandle("tool.navigate", {...})`
 then `await session.client.cancel(h.rpcId)`.

package/packages/omo-codex/plugin/skills/browser/references/install.md

@@ -8,6 +8,13 @@ Three pieces. The onboarding script prepares all three; a human finishes exactly
 | Browser extension | registered from the Web Store listing through Chrome's external-extension mechanism | **yes, up to one click** — the browser asks the user to enable it |
 | Daemon process | auto-starts on the first call | nothing to do |
 
+## Inside the OmO desktop app
+
+The app installs the `bsk` CLI and starts its daemon itself, and keeps the daemon running when the app closes.
+Do not run `browser-install.mjs` there unless the doctor says the app's engine is missing; a session set to
+`OMO_BROWSER_ENGINE=builtin` or `none` never uses this skill's attached engine at all. `BSK_HOME` and `BSK_BIN`
+still decide where the CLI and daemon are found, here and everywhere else.
+
 ## Supported
 
 | | |

package/packages/omo-codex/plugin/skills/browser/runtime/omowright/manifest.json

@@ -5,5 +5,5 @@
     "index.js": "b6b064fab277031c6c51f5a58b84b31040f9960bf767bf646adc0540c1d25c1b",
     "page-bundle.js": "bfd51e8383cf47200d57387bbbed258bce5a3a3d00c38fc108034d2888e23f0c"
   },
-  "stagedAtUtc": "2026-10-03T10:05:36.975Z"
+  "stagedAtUtc": "2026-10-04T05:23:33.182Z"
 }