lazycodex-ai 5.1.43 → 5.1.45

package/packages/omo-codex/plugin/hooks/user-prompt-submit-loading-project-rules.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/components/rules/dist/cli.js\" hook user-prompt-submit",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.1.43) Loading Project Rules",
+						"statusMessage": "(OmO 5.1.45) Loading Project Rules",
 						"commandWindows": "powershell -NoProfile -ExecutionPolicy Bypass -File \"${PLUGIN_ROOT}\\components\\bootstrap\\scripts\\node-dispatch.ps1\" \"${PLUGIN_ROOT}\\components\\rules\\dist\\cli.js\" hook user-prompt-submit"
 					}
 				]

package/packages/omo-codex/plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "@sisyphuslabs/omo-codex-plugin",
-	"version": "5.1.43",
+	"version": "5.1.45",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@sisyphuslabs/omo-codex-plugin",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"workspaces": [
 				"components/comment-checker",
 				"components/git-bash",
@@ -100,7 +100,7 @@
 		},
 		"components/comment-checker": {
 			"name": "@code-yeongyu/codex-comment-checker",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"bin": {
 				"omo-comment-checker": "dist/cli.js"
@@ -122,7 +122,7 @@
 		},
 		"components/git-bash": {
 			"name": "@sisyphuslabs/codex-git-bash-hook",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"bin": {
 				"omo-git-bash-hook": "dist/cli.js"
 			},
@@ -136,7 +136,7 @@
 		},
 		"components/lazycodex-executor-verify": {
 			"name": "@code-yeongyu/codex-lazycodex-executor-verify",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"bin": {
 				"lazycodex-executor-verify": "dist/cli.js"
@@ -154,7 +154,7 @@
 		},
 		"components/lsp": {
 			"name": "@code-yeongyu/codex-lsp",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"dependencies": {
 				"@code-yeongyu/lsp-daemon": "file:../../../../lsp-daemon",
@@ -176,7 +176,7 @@
 		},
 		"components/rules": {
 			"name": "@code-yeongyu/codex-rules",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"dependencies": {
 				"picomatch": "^4.0.7"
@@ -199,7 +199,7 @@
 		},
 		"components/teammode": {
 			"name": "@sisyphuslabs/codex-teammode",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"devDependencies": {
 				"@types/node": "^26.6.2",
 				"@vitest/coverage-v8": "5.0.1",
@@ -213,7 +213,7 @@
 		},
 		"components/telemetry": {
 			"name": "@code-yeongyu/codex-telemetry",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"bin": {
 				"omo-telemetry": "dist/cli.js"
@@ -232,7 +232,7 @@
 		},
 		"components/ultrawork": {
 			"name": "@code-yeongyu/codex-ultrawork",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"bin": {
 				"omo-ultrawork": "dist/cli.js"
@@ -251,7 +251,7 @@
 		},
 		"components/ulw-execute-continuation": {
 			"name": "@code-yeongyu/codex-ulw-execute-continuation",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"bin": {
 				"omo-ulw-execute-continuation": "dist/cli.js"
@@ -269,7 +269,7 @@
 		},
 		"components/ulw-loop": {
 			"name": "@code-yeongyu/codex-ulw-loop",
-			"version": "5.1.43",
+			"version": "5.1.45",
 			"license": "MIT",
 			"bin": {
 				"omo-ulw-loop": "dist/cli.js",

package/packages/omo-codex/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sisyphuslabs/omo-codex-plugin",
-  "version": "5.1.43",
+  "version": "5.1.45",
   "description": "Aggregate Codex plugin root for OMO components.",
   "type": "module",
   "packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/scripts/sync-skills.mjs

@@ -61,15 +61,15 @@ Codex exposes ONE of two subagent tool surfaces per session; check your own tool
 
 When translating \`load_skills=[...]\`, include the requested skill names in the spawned agent's \`message\`. If a code block below conflicts with this section, this section wins.
 
-Omit optional keys you do not set. Never send \`items: []\`, \`message: ""\`, \`model: ""\`, \`reasoning_effort: ""\`, or \`service_tier: ""\` — Codex rejects them (\`Items can't be empty\`, \`reasoning_effort must not be empty\`).
+Omit optional keys you do not set. Never send \`items: []\`, \`message: ""\`, \`model: ""\`, \`reasoning_effort: ""\`, or \`service_tier: ""\`. Codex rejects them (\`Items can't be empty\`, \`reasoning_effort must not be empty\`).
 
 For work likely to exceed one wait cycle, require the child to send \`WORKING: <task> - <current phase>\` before long passes and \`BLOCKED: <reason>\` only when progress stops. A \`multi_agent_v1.wait_agent\` timeout only means no new mailbox update arrived; back off between waits (double the timeout up to ~5 minutes) instead of spinning short cycles. Treat a running child as alive. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly \`BLOCKED:\`, or no longer running.
 
 `;
 
 const codexCompatibilityEndMarkers = [
-	"Omit optional keys you do not set. Never send `items: []`, `message: \"\"`, `model: \"\"`, `reasoning_effort: \"\"`, or `service_tier: \"\"` — Codex rejects them (`Items can't be empty`, `reasoning_effort must not be empty`).\n\nFor work likely to exceed one wait cycle, require the child to send `WORKING: <task> - <current phase>` before long passes and `BLOCKED: <reason>` only when progress stops. A `multi_agent_v1.wait_agent` timeout only means no new mailbox update arrived; back off between waits (double the timeout up to ~5 minutes) instead of spinning short cycles. Treat a running child as alive. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly `BLOCKED:`, or no longer running.\n\n",
-	"On the v2 surface `agent_type` may be ABSENT from the spawn schema (verified 2026-07-11: only `fork_turns`/`message`/`task_name`) — when absent, omit it and describe the role inside `message`; installed role TOMLs cannot be selected on that surface. If a code block below conflicts with this section, this section wins. `fork_context` is rejected on `multi_agent_v2` (`fork_context is not supported in MultiAgentV2; use fork_turns instead`).\n\n",
+	"Omit optional keys you do not set. Never send `items: []`, `message: \"\"`, `model: \"\"`, `reasoning_effort: \"\"`, or `service_tier: \"\"`. Codex rejects them (`Items can't be empty`, `reasoning_effort must not be empty`).\n\nFor work likely to exceed one wait cycle, require the child to send `WORKING: <task> - <current phase>` before long passes and `BLOCKED: <reason>` only when progress stops. A `multi_agent_v1.wait_agent` timeout only means no new mailbox update arrived; back off between waits (double the timeout up to ~5 minutes) instead of spinning short cycles. Treat a running child as alive. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly `BLOCKED:`, or no longer running.\n\n",
+	"On the v2 surface `agent_type` may be ABSENT from the spawn schema (verified 2026-07-11: only `fork_turns`/`message`/`task_name`). When absent, omit it and describe the role inside `message`; installed role TOMLs cannot be selected on that surface. If a code block below conflicts with this section, this section wins. `fork_context` is rejected on `multi_agent_v2` (`fork_context is not supported in MultiAgentV2; use fork_turns instead`).\n\n",
 	"For work likely to exceed one wait cycle, require the child to send `WORKING: <task> - <current phase>` before long passes and `BLOCKED: <reason>` only when progress stops. A `multi_agent_v1.wait_agent` timeout only means no new mailbox update arrived. Treat a running child as alive. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly `BLOCKED:`, or no longer running.\n\n",
 	"On `multi_agent_v2` sessions the same `agent_type` applies (the OMO installer exposes it) with `fork_turns` instead of `fork_context`. If a code block below conflicts with this section, this section wins.\n\n",
 	"Role-specific behavior must be described in a self-contained `message`. Use `fork_context: false` to start the child with only the initial prompt (no parent history); use `fork_context: true` only when full parent history is truly required. Include any required conversation context, files, diffs, constraints, and requested skill names directly in the spawned agent's `message`. If a code block below conflicts with this section, this section wins.\n\n",
@@ -154,7 +154,7 @@ compaction, re-read that record and require the exact lane/SHA pair. Memory,
 chat history, or an unstamped report is not coverage; a new commit requires
 fresh applicable lane records.
 
-A rejecting lane must name its blockers inline in its final message — each
+A rejecting lane must name its blockers inline in its final message; each
 blocker cites the violated goal criterion or requirement plus an evidence
 pointer. A bare REJECT/FAIL token without findings is not a verdict; treat it
 as an inconclusive lane (one bounded respawn, then record it inconclusive with
@@ -171,7 +171,7 @@ private logs, or PII; summarize with lengths, hashes, and short non-sensitive
 prefixes when identity is needed.
 `;
 
-const ulwResearchOriginalDeliveryGates = "Reading the source markup is not visual QA; inspect the pixels.\n4. **Proofread gate \u2014 `task(category=\"writing\", ...)`.** Hand the final text to a dedicated `writing` worker whose only job is language: grammar, spelling, punctuation, terminology consistency, and whether the prose reads NATIVELY in the report's own language. It proofreads only and never composes. It returns a defect list; fix every item and re-run the gate on the delta. Deliver only on a clean pass \u2014 this gate runs BEFORE the first delivery, not after the user finds the typo.";
+const ulwResearchOriginalDeliveryGates = "Reading the source markup is not visual QA; inspect the pixels.\n4. **Proofread gate: `task(category=\"writing\", ...)`.** Hand the final text to a dedicated `writing` worker whose only job is language: grammar, spelling, punctuation, terminology consistency, and whether the prose reads NATIVELY in the report's own language. It proofreads only and never composes. It returns a defect list; fix every item and re-run the gate on the delta. Deliver only on a clean pass. This gate runs BEFORE the first delivery, not after the user finds the typo.";
 const ulwResearchCodexDeliveryGate = "Reading the source markup is not visual QA; inspect the pixels.";
 
 export const ulwExecuteOriginalCompletion = [
@@ -186,7 +186,7 @@ export const ulwExecuteOriginalHardRule = [
 	"- No production change before the tests covering that behavior were read and a bug's reproduction captured; existing tests are green on the unchanged code first, and one that contradicts the intent is a FINDING, never edited green.",
 	"- No `--dry-run` as completion evidence.",
 	"- No tests-only completion claim. A Manual-QA artifact is required.",
-	"- **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.",
+	"- **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself; a spawned worker does.",
 	"- No completion claim while an applicable ultraqa adversarial class was never probed. Each applicable class needs a captured observable result; each skipped class needs a one-line not-applicable reason in the ledger.",
 	"- No implementation, review, or merge in the main checkout; every phase works in its task-owned worktree.",
 	"- No unprefixed session ids in Boulder state. Sessions are always recorded as `codex:<session_id>`.",
@@ -206,7 +206,7 @@ const ulwExecuteCodexHardRule = [
 	"- No production change before the tests covering that behavior were read and a bug's reproduction captured; existing tests are green on the unchanged code first, and one that contradicts the intent is a FINDING, never edited green.",
 	"- No `--dry-run` as completion evidence.",
 	"- No tests-only completion claim. A Manual-QA artifact is required.",
-	"- **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.",
+	"- **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself; a spawned worker does.",
 	"- No completion claim while an applicable ultraqa adversarial class was never probed. Each applicable class needs a captured observable result; each skipped class needs a one-line not-applicable reason in the ledger.",
 	"- No implementation, review, or merge in the main checkout; every phase works in a task-owned worktree.",
 	"- No unprefixed session ids in Boulder state. Sessions are always recorded as `codex:<session_id>`.",

package/packages/omo-codex/plugin/shared/test/config-loader.test.ts

@@ -7,6 +7,7 @@ import { parse } from "jsonc-parser"
 
 import { runMigrations, type MigrationBoundary } from "../../../../omo-config-core/src/index.ts"
 import { createLegacyConfigMigrationPlans } from "../../../../omo-opencode/src/config-migration/index.ts"
+import { doriSectionRename } from "../../../../omo-opencode/src/config-migration/dori-section-rename.ts"
 
 import { getCodexOmoConfig, runCodexStartupMigration } from "../src/config-loader.ts"
 
@@ -49,6 +50,7 @@ function writeOpenCodeConfig(homeDir: string): void {
 function runOpenCodeMigration(homeDir: string, cwd: string, onBoundary?: (boundary: MigrationBoundary) => void): void {
 	runMigrations({
 		discover: () => createLegacyConfigMigrationPlans({
+			doriSectionRename,
 			cwd,
 			environment: { HOME: homeDir, XDG_CONFIG_HOME: join(homeDir, ".config") },
 			homeDir,

package/packages/omo-codex/plugin/skills/browser/SKILL.md

@@ -18,29 +18,28 @@ one where a human is a single call away. Never substitute one engine for the oth
 the attached engine is not set up, run the onboarding script and tell the user its one remaining
 step.
 
-## Step 0 — which engine this session is allowed to use
+## Step 0 — inside OmO Desktop: everything above, plus the app's built-in browser
 
-When `OMO_BROWSER_ENGINE` is set (the OmO desktop app sets it for every session), it wins over the table above:
+When `OMO_BROWSER_ENGINE` is set (the OmO desktop app sets it for every session), everything above works exactly
+as in the terminal: `connectBrowserSkill()` for the user's own browser, `connectPipe()` / `connectCloakProfile()` /
+`connect()` for a browser of your own, with the same table to choose between them. The app adds one more option:
 
-| Value | What you do |
-|---|---|
-| `connected` | Use `connectBrowserSkill()` only. If the user's browser is not connected you get a "Connect your browser" error: relay it and stop. Never open another browser |
-| `builtin` | Do not call `connectBrowserSkill()`; use the app's in-app browser tools |
-| `none` | Do not do browser work. Say that agent browser access is off for this project |
-| unset | The table above, as before (terminal use) |
-
-While any engine is set, `loadOmowright()` returns a guarded library. The owned engine (`connectPipe`,
-`connectCloakProfile`, `connect`) and every other export that acts on a browser is refused, so the table above
-does not apply: do not look for a way around it, and tell the user what the session allows. Under `connected`
-the app sees what the browser is doing, and before a click, Enter or script that sends, posts, pays, orders,
-subscribes, deletes or closes an account, and before Enter in a message box, it asks the user first. A "No" fails the action with
-`BrowserActionDeclinedError`: report that, never retry it or go around it (`session.tool()` lets only reads
-through; `evaluate` is guarded too). If the user presses Stop, the next call throws `BrowserUserStoppedError`: tell
-the user browser use was stopped and start no new session this turn.
-
-The guard prevents mistakes by a cooperating agent. It is not a security boundary: code that imports the raw
-entry (`resolveOmowrightEntry()`) is not guarded, and a host without the `omo_browser_bridge` tool cannot show state or
-honor Stop, though questions are still asked.
+| Option | What it is | Use it when |
+|---|---|---|
+| `connectBuiltinBrowser()` | OmO's built-in browser for this thread: the tab the user sees beside the chat, which they can watch, take over and share | the user should see the page while you work, the task is QA of something in the app, or a sign-in the user should do themselves in a visible tab |
+
+```js
+const browser = await omowright.connectBuiltinBrowser()
+const [tab] = await browser.listTargets()
+const page = await browser.attachPage(tab.id)
+await page.goto(url)
+```
+
+It is an OmOWright connection like `connect()`. Work in few calls: take `page.snapshot()` once, act on its refs,
+and chain several actions in one eval cell (`page.locator(ref).fill()`, `.click()`, `.selectOption(value)`,
+`.setInputFiles(path)`), snapshotting again only after the page changed. It has one tab: navigate it rather than
+opening new ones. `BuiltinBrowserUnavailableError` permits another engine only for `unavailable`, `timeout`, or
+`invalid_grant`. For `user_stopped` or any other app refusal, stop browser work and report it; do not open another browser.
 
 ## Step 1 — load omowright and prove the stack
 
@@ -118,7 +117,7 @@ changing the extension's automation settings.
   out everywhere. No flow here needs it.
 - **`focused: false` by default.** The browser belongs to someone who is probably using it.
 - **One short, named session per task,** always stopped.
-- **Bot-scored or WAF targets go to the owned engine** (not while `OMO_BROWSER_ENGINE` is set: then say the site needs a browser the session does not allow). The attached engine's daemon enables console
+- **Bot-scored or WAF targets go to the owned engine**, in the terminal and inside OmO Desktop alike. The attached engine's daemon enables console
   capture on every tab it drives, which is a known automation signal; CloakBrowser through
   `connectCloakProfile()` is the stealth path.
 

package/packages/omo-codex/plugin/skills/browser/references/commands.md

@@ -98,17 +98,10 @@ Every refusal is a `BskRpcError` with the daemon's own `code`:
 | `invalid_params` | wrong option shape | fix the call, do not retry as-is |
 | `permission_denied` | `evaluate` on a tab outside the Agent Window, or a denied borrow | stop; the user said no |
 | `timeout` | the tool did not finish in its budget | read the page state before retrying once |
-| `user_aborted` | the user pressed Stop in the browser | stop the task and report; under `OMO_BROWSER_ENGINE` this surfaces as `BrowserUserStoppedError` and no session starts again this turn |
+| `user_aborted` | the user pressed Stop in the browser | stop the task and report |
 | `cdp_failed` | the page cannot be attached (restricted URL, DevTools open) | say which page and why |
 
-Typed errors under `OMO_BROWSER_ENGINE` (see SKILL.md Step 0):
-
-| Error | `code` | Meaning |
-|---|---|---|
-| `BrowserNotConnectedError` | `browser_not_connected` | the user's browser is not connected; ask them to connect it |
-| `BrowserEngineRefusal` | `browser_engine_none` / `browser_engine_builtin` / `browser_engine_unsupported` / `browser_tool_blocked` | this engine setting does not allow that call |
-| `BrowserActionDeclinedError` | `user_declined` | the user said no, or no question could be asked; do not retry |
-| `BrowserUserStoppedError` | `user_stopped` | the user stopped browser use |
+Inside OmO Desktop (`OMO_BROWSER_ENGINE` set), `connectBuiltinBrowser()` throws `BuiltinBrowserUnavailableError` (`code` `browser_builtin_unavailable`). Reasons `unavailable`, `timeout`, and `invalid_grant` mean the built-in browser is unavailable; `invalid_grant` includes a missing or unreadable token file. For `user_stopped` or any other app refusal, stop browser work and report it without opening another browser. Refresh uses the new grant's endpoint and token together; every other call behaves as in the terminal.
 
 Long calls can be cancelled: `const h = session.client.callWithHandle("tool.navigate", {...})`
 then `await session.client.cancel(h.rpcId)`.

package/packages/omo-codex/plugin/skills/browser/references/install.md

@@ -11,8 +11,7 @@ Three pieces. The onboarding script prepares all three; a human finishes exactly
 ## Inside the OmO desktop app
 
 The app installs the `bsk` CLI and starts its daemon itself, and keeps the daemon running when the app closes.
-Do not run `browser-install.mjs` there unless the doctor says the app's engine is missing; a session set to
-`OMO_BROWSER_ENGINE=builtin` or `none` never uses this skill's attached engine at all. `BSK_HOME` and `BSK_BIN`
+Do not run `browser-install.mjs` there unless the doctor says the app's engine is missing. `BSK_HOME` and `BSK_BIN`
 still decide where the CLI and daemon are found, here and everywhere else.
 
 ## Supported

package/packages/omo-codex/plugin/skills/browser/runtime/omowright/manifest.json

@@ -5,5 +5,5 @@
     "index.js": "d67d3a847fe0bbc43e824feded48b280890d31879538309e671cd5f671133995",
     "page-bundle.js": "bfd51e8383cf47200d57387bbbed258bce5a3a3d00c38fc108034d2888e23f0c"
   },
-  "stagedAtUtc": "2026-10-22T23:36:37.978Z"
+  "stagedAtUtc": "2026-10-24T12:04:38.003Z"
 }

package/packages/omo-codex/plugin/skills/browser/scripts/browser-doctor.mjs

@@ -19,7 +19,7 @@ const state = report.ready
 
 const REMEDIES = {
   ready: "Attached engine is live: const { connectBrowserSkill } = await import(omowrightEntry); const session = await connectBrowserSkill({ name: \"<task>\", focused: false })",
-  "no-cli": "Run node \"<skill-root>/scripts/browser-install.mjs\" — it installs the CLI, starts the daemon and registers the extension; then tell the user the single step it prints.",
+  "no-cli": "Run node \"<skill-root>/scripts/browser-install.mjs\". It installs the CLI, starts the daemon and registers the extension; then tell the user the single step it prints.",
   "no-daemon": "Run node \"<skill-root>/scripts/browser-install.mjs\" (it starts the daemon through `bsk status`), then re-run this doctor.",
   "no-extension": report.nextStep ?? "Register the extension with browser-install.mjs, then relay its human step to the user and re-run this doctor.",
   "choose-browser": `Do not install anything yet. First check your memory for the browser this user works in; if it names one of the candidates, re-run with --browser=<id>. Otherwise ask the user which browser they actually use (${report.identification.reason}), record the answer in memory, then run node "<skill-root>/scripts/browser-install.mjs" --browser=<id>.`,
@@ -47,7 +47,7 @@ if (process.argv.includes("--json")) {
   console.log(`state: ${state}`)
   console.log(`omowright: ${entry}`)
   console.log(`cli: ${report.cli.installed ? `${report.cli.bskBin} (${report.cli.version})` : "not installed"}`)
-  console.log(`daemon: ${report.daemon.running ? `running (${report.daemon.version}, protocol ${report.daemon.protocolVersion})` : `not running${report.daemon.error ? ` — ${report.daemon.error}` : ""}`}`)
+  console.log(`daemon: ${report.daemon.running ? `running (${report.daemon.version}, protocol ${report.daemon.protocolVersion})` : `not running${report.daemon.error ? ` - ${report.daemon.error}` : ""}`}`)
   console.log(`browser the user uses: ${summary.browser ? `${summary.browser.label} [${summary.browser.id}] (${summary.browser.reason})` : `not identified (${report.identification.reason})`}`)
   console.log(`candidates: ${summary.candidates.map((c) => `${c.id}${c.signals.length ? ` (${c.signals.join(", ")})` : ""}`).join(", ") || "none"}`)
   if (summary.registeredElsewhere.length > 0) console.log(`extension entries left in other browsers: ${summary.registeredElsewhere.join(", ")} (not removed automatically)`)