lazycodex-ai 5.1.61 → 5.1.63

package/packages/shared-skills/skills/ast-grep/AGENTS.md

@@ -41,11 +41,11 @@ Subcommands: `search`, `replace` (dry-run; `--apply` to write), `scan`, `test`,
 
 ```bash
 # from packages/shared-skills/skills/ast-grep/
-python3 scripts/ast_grep_helper.py search '<PATTERN>' --lang ts [path]
+python3 scripts/ast_grep_helper.py search '<PATTERN>' [path] --lang <LANG>
 python3 scripts/ast_grep_helper.py replace '<PATTERN>' '<REWRITE>' --lang ts   # dry-run; add --apply
 python3 scripts/ast_grep_helper.py doctor
 bash tests/smoke.sh          # or: pwsh tests/smoke.ps1
 # direct:  sg run -p '<PATTERN>' --lang ts path
 ```
 
-- Parent: [`packages/shared-skills/AGENTS.md`](../../AGENTS.md).
+- Parent (source checkout only, not shipped with the installed skill): `packages/shared-skills/AGENTS.md`.

package/packages/shared-skills/skills/ast-grep/README.md

@@ -29,13 +29,13 @@ ln -s /path/to/your/clone ~/.agents/skills/ast-grep
 
 ```bash
 # Search by AST pattern (the helper validates patterns offline first)
-python3 scripts/ast_grep_helper.py search 'console.log($MSG)' --lang ts src/
+python3 scripts/ast_grep_helper.py search 'console.log($MSG)' src/ --lang ts
 
 # Rewrite (dry-run preview by default)
-python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' --lang ts src/
+python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' src/ --lang ts
 
 # Apply the rewrite (two-pass: preview JSON + then --update-all)
-python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' --lang ts src/ --apply
+python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' src/ --lang ts --apply
 
 # Run YAML lint rules from sgconfig.yml
 python3 scripts/ast_grep_helper.py scan src/
@@ -85,7 +85,7 @@ ast-grep-skill/
 
 1. **Wraps `sg`** with a single Python 3 stdlib script that works the same on macOS, Linux, Windows, WSL, Git Bash.
 2. **Validates patterns offline** before calling `sg` — catches the regex-misuse class of mistakes (`\w`, `.*`, `|`, `[a-z]`) plus language-specific traps (Python trailing colons, JS/Go/Rust missing function bodies).
-3. **Resolves the binary** through 6 candidate paths: cached → PATH (with Linux `setgroups` collision detection) → Homebrew. Falls through to a clear install hint with copy-paste commands.
+3. **Resolves the binary** through 5 candidates: `OMO_AST_GREP_SG_PATH` override → OMO runtime dirs → cached → PATH (with Linux `setgroups` collision detection) → Homebrew. Falls through to a clear install hint with copy-paste commands.
 4. **Runs the two-pass write trick** when applying rewrites — `sg run` silently ignores `--update-all` when `--json` is set, so `replace --apply` runs two invocations: pass 1 collects JSON matches, pass 2 mutates files.
 5. **Ships per-OS installers** that try every reasonable package manager and fall back to a GitHub release tarball.
 6. **Documents the failure modes** the model will hit (regex misuse, incomplete patterns, `--update-all` + `--json` trap, scope/type questions ast-grep can't answer) in `references/pitfalls.md`.

package/packages/shared-skills/skills/ast-grep/SKILL.md

@@ -17,9 +17,9 @@ OmO native also registers a bundled ast-grep MCP server. Its three tools are **d
 
 - `mcp__ast_grep_search({ pattern, language, paths })` — AST-shape search, the MCP equivalent of `sg run -p`. Prefer this over shelling out to `sg` for one-off lookups: no install, no PATH issues.
 - `mcp__ast_grep_rewrite({ pattern, rewrite, language, paths, apply })` — preview matches (`apply: false`, the default) or apply the rewrite (`apply: true`). Same two-pass discipline as `sg run -r`: preview first, then apply.
-- `mcp__ast_grep_scan({ paths })` — run project YAML rules (`sgconfig.yml`, `rules/`), the MCP equivalent of `sg scan`.
+- `mcp__ast_grep_scan({ ruleFile | inlineRules, paths, apply })` — run exactly one explicit YAML rule source (a rule file or inline rules), the MCP equivalent of `sg scan --rule` / `--inline-rules`. It never discovers `sgconfig.yml`; to run a project's whole rule set, use `sg scan` (or the helper's `scan`) from the shell.
 
-Same pattern language as the CLI: `$VAR` matches one AST node, `$$$VAR` matches zero or more, and the pattern is code, not regex. `paths` accepts a file or directory list; `language` is required for patterns that are ambiguous across languages.
+Same pattern language as the CLI: `$VAR` matches one AST node, `$$$VAR` matches zero or more, and the pattern is code, not regex. `paths` accepts a file or directory list; `language` is always required by `mcp__ast_grep_search` and `mcp__ast_grep_rewrite`.
 
 ---
 
@@ -79,7 +79,7 @@ A single-file Python 3 stdlib wrapper. Same on every OS. The agent's default ent
 ### `search` — find all matches of a pattern
 
 ```bash
-python3 scripts/ast_grep_helper.py search 'console.log($MSG)' --lang ts src/
+python3 scripts/ast_grep_helper.py search 'console.log($MSG)' src/ --lang ts
 ```
 
 Validates the pattern offline first. If the pattern looks like regex (`\w`, `.*`, `|`, etc.) the helper exits with a hint and never calls `sg` — saves a round-trip. Pass `--force` to skip validation.
@@ -94,10 +94,10 @@ Flags:
 
 ```bash
 # Dry-run preview (default — no files mutated)
-python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' --lang ts src/
+python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' src/ --lang ts
 
 # Actually apply
-python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' --lang ts src/ --apply
+python3 scripts/ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' src/ --lang ts --apply
 ```
 
 The helper:
@@ -117,10 +117,12 @@ python3 scripts/ast_grep_helper.py scan -r rules/no-console.yml src/
 # Apply auto-fixes
 python3 scripts/ast_grep_helper.py scan -U src/
 
-# CI-friendly GitHub annotations
+# Compact one-line-per-finding report
 python3 scripts/ast_grep_helper.py scan --report-style short src/
 ```
 
+The helper has no `--format` flag; for CI-friendly GitHub annotations call `sg scan --format github src/` directly (see `references/cli.md`).
+
 ### `validate` — offline pattern check (no `sg` call)
 
 Useful for CI lints, pre-commit hooks, and quick sanity checks:
@@ -226,7 +228,7 @@ In priority order:
 1. **Run `helper validate '<pattern>' --lang <lang>`** — catches regex misuse, missing function bodies, Python trailing colons.
 2. **Check `--lang`** — `sg` infers from extension; if you pass a `.tsx` file with `--lang ts` (not `tsx`), JSX won't parse.
 3. **Inspect the parsed pattern**: `sg run -p '<pattern>' --lang <lang> --debug-query=ast --stdin <<< '<sample>'`. If it shows `ERROR` nodes, the pattern is malformed.
-4. **Check the AST of the target file**: `sg run -p '$_' --lang <lang> --debug-query=cst path/to/file | head -40` — find the `kind` you're trying to match.
+4. **Check the AST of the target code**: paste a snippet of the target file as the pattern, `sg run -p '<snippet>' --lang <lang> --debug-query=cst path/to/file 2>&1 >/dev/null | head -40` — the dump goes to stderr and shows the pattern's tree; find the `kind` you're trying to match.
 5. **Try the playground**: <https://ast-grep.github.io/playground.html> — paste code + pattern, see what's happening.
 
 Do not blindly retry with variations. Each failure has a reason; surface it.
@@ -255,7 +257,7 @@ The full YAML rule schema is in `references/yaml-rules.md`. Project setup (`sgco
 - `sg run --json=compact` produces an array of match objects: `{ file, range: {start, end}, text, replacement?, lines, language, ... }`. Pipe through `jq` for further processing.
 - Without `--json`, `sg` produces human-readable colored output suitable for terminals.
 - The helper's default output is human-readable (file:line:column + match preview). Pass `--json-out` for raw JSON.
-- The helper's `replace` always summarizes: number of matches, number of files, per-location preview.
+- The helper's `replace` dry-run prints the number of matches, the number of files, and a per-location preview; `--apply` prints only the totals (`APPLIED: rewrote N match(es) across M file(s).`).
 
 When summarizing for the user, **always include the count of files affected**, not just the count of matches. Users care about blast radius.
 

package/packages/shared-skills/skills/ast-grep/references/cli.md

@@ -208,9 +208,10 @@ sg completions powershell >> $PROFILE
 sg run -p 'console.log($_)' --lang ts --json=compact . \
   | jq -r '.[].file' | sort | uniq -c | sort -rn
 
-# Find all unique kinds in a file (great for figuring out kind names)
-sg run -p '$_' --lang ts --debug-query=cst src/foo.ts \
-  | grep -oE 'kind: [a-z_]+' | sort -u
+# Find all unique kinds in a file (great for figuring out kind names).
+# --debug-query dumps the PATTERN's tree to stderr, so pass the file's code as the pattern.
+sg run -p "$(cat src/foo.ts)" --lang ts --debug-query=ast src/foo.ts 2>&1 >/dev/null \
+  | grep -oE '[a-z_]+ \(' | tr -d ' (' | sort -u
 
 # Rewrite only in a subset of files
 sg run -p 'foo()' -r 'bar()' --update-all --globs 'src/**/*.ts' --globs '!src/legacy/**' .

package/packages/shared-skills/skills/ast-grep/references/patterns.md

@@ -43,9 +43,9 @@ foo === foo.bar
 
 Useful for finding redundant comparisons, double assignments, etc.
 
-### `$$$` is greedy
+### `$$$` is lazy
 
-When you write `foo($$$A, b, $$$C)`, the matcher does **not** backtrack or try every possible split. It greedily fills `$$$A` until the pattern can match `b`, then everything left goes into `$$$C`.
+When you write `foo($$$A, b, $$$C)`, the matcher does **not** backtrack or try every possible split. It fills `$$$A` only until the rest of the pattern can match — the first `b` here — then everything left goes into `$$$C`. On `foo(a, c, b, b, c)` that is `A=[a, c]` and `C=[b, c]`, never the longer `A=[a, c, b]`.
 
 ```ts
 // Pattern
@@ -116,11 +116,11 @@ Two tools help you confirm a pattern parses the way you expect:
 # Print the AST of the pattern itself
 sg run -p 'console.log($MSG)' --lang ts --debug-query=ast
 
-# Print the parsed CST of a file (great for figuring out kind names)
-sg run -p '$_' --lang ts --debug-query=cst src/example.ts | head -40
+# Print the CST of code copied from a file (great for figuring out kind names)
+sg run -p 'function f(x: number) { return x + 1 }' --lang ts --debug-query=cst src/example.ts 2>&1 >/dev/null | head -40
 ```
 
-`--debug-query=ast` shows the named AST nodes only (cleaner). `--debug-query=cst` shows everything including punctuation. Both go to stderr, so they don't interfere with stdout JSON.
+`--debug-query=ast` shows the named AST nodes only (cleaner). `--debug-query=cst` shows everything including punctuation. Both dump the tree of the **pattern** (not of the searched files) to stderr, so they don't interfere with stdout JSON; redirect `2>&1 >/dev/null` to pipe the dump. To learn a file's node kinds, paste that file's code as the pattern.
 
 The web playground is also fast: <https://ast-grep.github.io/playground.html>.
 

package/packages/shared-skills/skills/ast-grep/references/pitfalls.md

@@ -1,6 +1,6 @@
 # Pitfalls — what breaks patterns and how to fix them
 
-This is the failure-mode field guide. The `scripts/ast_grep_helper.py validate` subcommand mechanically checks for the items in §1 before calling `sg`; the rest are lower-frequency but still common.
+This is the failure-mode field guide. The `scripts/ast_grep_helper.py validate` subcommand mechanically checks the §1 items for backslash escapes, `.*`/`.+`, character classes, and `|` alternation before calling `sg` (it does not detect `^`/`$` anchors), plus the missing-body and trailing-colon cases from §2; the rest are lower-frequency but still common.
 
 ---
 
@@ -126,9 +126,9 @@ If you actually want two independent captures, name them differently: `$X = $Y`.
 
 ---
 
-## 6. `$$$` is greedy then commits
+## 6. `$$$` is lazy and never backtracks
 
-`$$$` does **not** backtrack. It captures as much as possible, then commits. If your pattern needs a non-greedy match, structure it differently:
+`$$$` does **not** backtrack. It stops at the first node that lets the rest of the pattern match, then commits — on `foo($$$A, b, $$$C)` against `foo(a, c, b, b, c)`, `$$$A` is `[a, c]`, not `[a, c, b]`. If your pattern needs more to land in `$$$A`, structure it differently:
 
 ```ts
 // You want "match foo($X), where $X is any single arg"

package/packages/shared-skills/skills/ast-grep/references/recipes.md

@@ -5,11 +5,13 @@ Every pattern in this file has been verified against the canonical syntax. They
 Use them with the helper:
 
 ```bash
-ast-grep-helper search '<PATTERN>' --lang <LANG> [path]
-ast-grep-helper replace '<PATTERN>' '<REWRITE>' --lang <LANG> [path]   # dry-run
-ast-grep-helper replace '<PATTERN>' '<REWRITE>' --lang <LANG> [path] --apply
+python3 scripts/ast_grep_helper.py search '<PATTERN>' [path] --lang <LANG>
+python3 scripts/ast_grep_helper.py replace '<PATTERN>' '<REWRITE>' [path] --lang <LANG>   # dry-run
+python3 scripts/ast_grep_helper.py replace '<PATTERN>' '<REWRITE>' [path] --lang <LANG> --apply
 ```
 
+Put any `[path]` BEFORE `--lang`: the helper's `paths` argument is `nargs='*'`, and on Python 3.9 (the stock macOS `python3`, which the helper supports) a positional after `--lang` is rejected with `unrecognized arguments`. A pattern or rewrite containing a literal `|` (e.g. `$T | None`) is refused by the helper's alternation check — run two calls, or pass `--force` to reach `sg` anyway.
+
 Or directly:
 
 ```bash
@@ -132,7 +134,7 @@ sg run -p 'print($$$A)' -r 'logger.info($$$A)' --lang py --update-all .
 # Optional[X] -> X | None
 sg run -p 'Optional[$T]' -r '$T | None' --lang py --update-all .
 
-# from typing import List -> remove (built-in list works in 3.9+)
+# from typing import List -> annotate for manual removal (built-in list works in 3.9+)
 sg run -p 'from typing import List' -r 'from typing import List  # TODO: remove, use list' --lang py --update-all .
 ```
 

package/packages/shared-skills/skills/ast-grep/references/yaml-rules.md

@@ -488,14 +488,14 @@ ignores:
   - '**/__generated__/**'
 ```
 
-If omitted, the rule runs on every file matching its `language`. These globs override `sgconfig.yml`-level globs for this rule only.
+If omitted, the rule runs on every file matching its `language`. `sgconfig.yml` has no project-wide `files`/`ignores` to override; its `languageGlobs` only changes which language a file parses as. To narrow a whole scan, pass `--globs` to `sg scan`.
 
 Object form (rare):
 
 ```yaml
 files:
-  - pattern: 'src/**/*.ts'
-    case_sensitive: true
+  - glob: 'src/**/*.ts'
+    caseInsensitive: true
 ```
 
 ---

package/packages/shared-skills/skills/ast-grep/scripts/ast_grep_helper.py

@@ -27,13 +27,13 @@ USAGE
 
 EXAMPLES
     # Find all console.log calls in TypeScript
-    ast_grep_helper.py search 'console.log($MSG)' --lang ts src/
+    ast_grep_helper.py search 'console.log($MSG)' src/ --lang ts
 
     # Migrate console.log -> logger.info (dry-run preview)
-    ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' --lang ts src/
+    ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' src/ --lang ts
 
     # Apply the same replacement
-    ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' --lang ts src/ --apply
+    ast_grep_helper.py replace 'console.log($MSG)' 'logger.info($MSG)' src/ --lang ts --apply
 
     # Validate a pattern offline (no sg call, no filesystem access)
     ast_grep_helper.py validate '\\w+' --lang ts

package/packages/shared-skills/skills/browser/SKILL.md

@@ -117,9 +117,8 @@ changing the extension's automation settings.
   out everywhere. No flow here needs it.
 - **`focused: false` by default.** The browser belongs to someone who is probably using it.
 - **One short, named session per task,** always stopped.
-- **Bot-scored or WAF targets go to the owned engine**, in the terminal and inside OmO Desktop alike. The attached engine's daemon enables console
-  capture on every tab it drives, which is a known automation signal; CloakBrowser through
-  `connectCloakProfile()` is the stealth path.
+- **Bot-scored or WAF targets never go through the attached engine** — route them to the `ultimate-browsing` skill, whose browser tier is the owned engine (`connectCloakProfile()`). The attached engine's daemon enables console
+  capture on every tab it drives, which is a known automation signal.
 
 ## Where the rest lives
 

package/packages/shared-skills/skills/browser/references/owned-engine/README.md

@@ -58,5 +58,5 @@ or text), not a timer; `goto(url, { waitUntil: "commit" })` is the escape hatch
 - [network.md](network.md) — `createNetworkSnoop`, `collectWhileScrolling`, `createTrace`, `createRoutes`
 - [frames-and-humans.md](frames-and-humans.md) — `snapshotWithFrames`, `describeLayers`, dialog policy, `emulate`, `requestHuman`
 
-The library's own skill (`skills/omowright/SKILL.md` and `presets/*` in the omowright repository)
+The omowright repository's own agent guide and its `presets/*`
 is the authoritative, longer treatment of each; these pages are the routing summary.

package/packages/shared-skills/skills/browser/runtime/omowright/manifest.json

@@ -5,5 +5,5 @@
     "index.js": "3a2e4f2575bdfc15448f13768cd8113f8493bf04611c9fefb09b13430d6520de",
     "page-bundle.js": "bfd51e8383cf47200d57387bbbed258bce5a3a3d00c38fc108034d2888e23f0c"
   },
-  "stagedAtUtc": "2026-11-05T18:57:47.833Z"
+  "stagedAtUtc": "2026-11-07T12:34:59.537Z"
 }

package/packages/shared-skills/skills/coding-agent-sessions/AGENTS.md

@@ -60,4 +60,4 @@ python3 -B scripts/find-agent-sessions.py read <session-id>
 pytest scripts/tests
 ```
 
-- Parent: [`packages/shared-skills/AGENTS.md`](../../AGENTS.md).
+- Parent (source checkout only, not shipped with the installed skill): `packages/shared-skills/AGENTS.md`.

package/packages/shared-skills/skills/coding-agent-sessions/SKILL.md

@@ -80,10 +80,11 @@ Each `match_reasons` entry includes `query`, `platform`, `field`, and `snippet`,
 | `--cwd` | Working-directory substring |
 | `--model` | Model substring |
 | `--limit` | Maximum results |
-| `--query` | Repeatable search query; multiple queries return per-query groups plus a de-duplicated merged result list |
 | `--workers` | Parallel worker count for platform scans, transcript parsing, OpenCode message joins, and multi-query matching |
 | `--include-subagents` | Include subagent/child sessions as standalone `list`/`search` results (hidden by default) |
 
+`search` (alias `find`) also takes `--query`: a repeatable search query; multiple queries return per-query groups plus a de-duplicated merged result list. `list` ignores `--query` and positional text.
+
 When `--platform` is omitted, the finder searches every registered platform in parallel. Each optional platform first probes fixed, known transcript roots and returns immediately when the product has no local store, so broad default searches stay cheap. Use repeatable flags such as `--platform openclaw --platform droid` only when narrowing. Comma-separated platform values are intentionally unsupported.
 
 For OpenCode, the finder uses `opencode db path` plus direct SQLite queries first, then `opencode session list --format json` as a fallback. It avoids heavy `messages/` or `parts/` scans during normal list/search, and only falls back to file joins when the OpenCode DB/CLI is unavailable or explicit `--root` values request a nonstandard store.

package/packages/shared-skills/skills/data-scientist/SKILL.md

@@ -42,8 +42,9 @@ Per-surface patterns and pitfalls: read `references/execution-surfaces.md` befor
   older spellings.
 - **numpy** when numeric work goes beyond SQL/DataFrame aggregation: statistical tests,
   linear algebra, FFT, random sampling.
-- **matplotlib** for every chart — read `references/visualization.md` first; it carries the
-  quality bar and a mandatory visual check.
+- **matplotlib** for charts in a kernel, a file or a document; a chart shown inline beside a
+  reply is drawn in HTML instead. Read `references/visualization.md` first either way; it
+  carries the quality bar, the inline case and a mandatory visual check.
 
 Performance folklore ("X is Nx faster at filtering") varies with data shape, cardinality,
 and hardware. When the engine choice materially matters, measure on the actual data instead
@@ -65,10 +66,11 @@ a direct scan. Then place the work:
   takes longer.
 - **Query remotely, in place** when the data lives elsewhere: DuckDB reads http(s)/S3
   Parquet and CSV with projection and predicate pushdown, so fetch the columns and rows the
-  question needs, never the whole file. When data sits on another machine you can execute
-  on, ship the query to the data and return the small result. Rule: result much smaller
-  than data — move the query; repeated local iteration planned — move a pruned copy of the
-  data once.
+  question needs, never the whole file. When data sits in a database, run the aggregation
+  there in its own SQL and pull back the result rows, never a table dump. When data sits on
+  another machine you can execute on, ship the query to the data and return the small
+  result. Rule: result much smaller than data — move the query; repeated local iteration
+  planned — move a pruned copy of the data once.
 
 Sizing heuristics and recipes: `references/placement.md`.
 

package/packages/shared-skills/skills/data-scientist/references/placement.md

@@ -8,13 +8,17 @@ ten times) or kills the machine (loading a dataset larger than RAM and swapping)
 Three facts, one cell or script:
 
 ```python
-import os, shutil, subprocess, sys
+import os, re, shutil, subprocess, sys
 size = os.path.getsize("data.csv")            # bytes on disk
 disk_free = shutil.disk_usage(".").free       # spill headroom
-if sys.platform == "darwin":
-    ram = int(subprocess.run(["sysctl", "-n", "hw.memsize"], capture_output=True, text=True).stdout)
-else:
-    ram = os.sysconf("SC_PAGE_SIZE") * os.sysconf("SC_PHYS_PAGES")
+if sys.platform == "darwin":                  # free RAM = free + inactive + speculative pages
+    vm = subprocess.run(["vm_stat"], capture_output=True, text=True).stdout
+    page = int(re.search(r"page size of (\d+)", vm).group(1))
+    ram_free = page * sum(int(re.search(rf"{k}:\s+(\d+)", vm).group(1))
+                          for k in ("Pages free", "Pages inactive", "Pages speculative"))
+else:                                         # Linux: MemAvailable
+    ram_free = next(int(line.split()[1]) * 1024 for line in open("/proc/meminfo")
+                    if line.startswith("MemAvailable:"))
 # row estimate without loading (DuckDB streams the scan):
 # duckdb.sql("SELECT count(*) FROM 'data.csv'")
 ```

package/packages/shared-skills/skills/data-scientist/references/uv-setup.md

@@ -6,10 +6,10 @@ This skill's uv lane (kernel-less harnesses, isolated one-shots) runs through `u
 
 | Platform | Command |
 |---|---|
-| macOS / Linux / WSL / Git Bash | `bash scripts/setup-uv.sh` |
-| Windows (PowerShell) | `powershell -ExecutionPolicy Bypass -File scripts/setup-uv.ps1` |
+| macOS / Linux / WSL | `bash scripts/setup-uv.sh` |
+| Windows (PowerShell; also from Git Bash, where `setup-uv.sh` exits) | `powershell -ExecutionPolicy Bypass -File scripts/setup-uv.ps1` |
 
-Both scripts: detect OS + architecture → install uv to the latest release when missing → upgrade it when present (`uv self update`) → make it resolvable for the current shell → verify with `uv --version`. They are idempotent — safe to re-run any time.
+Both scripts: detect OS + architecture → install uv to the latest release when missing → upgrade it when present (`uv self update`) → make it resolvable for the script's own `uv --version` check (an already-open shell still needs the PATH line below) → verify with `uv --version`. They are idempotent — safe to re-run any time.
 
 ## Manual install per platform
 

package/packages/shared-skills/skills/data-scientist/references/visualization.md

@@ -1,7 +1,11 @@
 # Visualization
 
-A chart exists to answer a question at a glance. Render it with matplotlib (resident in most
-Python kernels; `uv run --with matplotlib` otherwise), then look at it before delivering —
+A chart exists to answer a question at a glance. A chart shown inline beside a reply
+(`show_html_page`, `html_preview`, `html_render`) is drawn in HTML, never as a matplotlib PNG:
+an image ignores the reader's theme and width. When the `visualize` skill is available, it builds
+that page. There this file's chart-type table, Figures and Quality bar apply, and the matplotlib
+calls do not. Everywhere else (a kernel, a file, a document) render it with matplotlib (resident
+in most Python kernels; `uv run --with matplotlib` otherwise). Either way, look at it before delivering —
 a chart nobody inspected is not evidence.
 
 ## When to chart
@@ -22,6 +26,15 @@ question — decoration dilutes the answer.
 | Composition of a whole? | stacked or 100% bar — pie only for four or fewer slices |
 | Many series over time? | small multiples over one spaghetti chart |
 
+## Figures — every chart
+
+- **Days start at the reader's midnight.** Cut daily, weekly and monthly buckets in the
+  reader's time zone, not UTC, and name the zone in the axis label or caption. A bucket still
+  filling (today, this week) is marked partial on its own bar, or it reads as a drop.
+- **Cross-check one figure.** Recompute a headline number from a second source (another
+  table, the system's own dashboard, a raw count) and say beside the chart whether it
+  matched, and by how much it differed if not.
+
 ## Quality bar — every chart
 
 - Title states the finding ("Seoul overtook Busan in March"), not the dataset name.
@@ -51,8 +64,10 @@ matplotlib.rcParams["axes.unicode_minus"] = False   # keeps the minus sign rende
 
 ## Output contract
 
-1. Save a PNG next to the work: `plt.savefig(path, dpi=150, bbox_inches="tight")`.
-2. Also render inline when the surface displays rich output (kernels usually do).
+1. Inline page beside a reply: no PNG. Draw the computed figures in HTML and preview them in
+   both themes, following the `visualize` skill when it is available.
+2. Otherwise save a PNG next to the work: `plt.savefig(path, dpi=150, bbox_inches="tight")`,
+   and also render it inline when the surface displays rich output (kernels usually do).
 3. Report the file path together with the answer.
 
 ## Visual QA — mandatory

package/packages/shared-skills/skills/debugging/SKILL.md

@@ -26,7 +26,7 @@ The rest of this file is a map. **The knowledge is in `references/`.** This file
 
 ## Runtime Setup — MANDATORY READING BEFORE ATTACHING
 
-The methodology is language-agnostic. The commands to launch, attach, breakpoint, and inspect are not. **Open the matching reference before Phase 0. Not during. Not after.**
+The methodology is language-agnostic. The commands to launch, attach, breakpoint, and inspect are not. **Open the matching reference the moment you know the runtime (Phase 0, step 2) and before you attach anything. Not after.**
 
 | Your runtime is… | Open this before attaching anything | Non-negotiable because… |
 |---|---|---|
@@ -39,7 +39,7 @@ The methodology is language-agnostic. The commands to launch, attach, breakpoint
 
 **If you cannot honestly say you just opened the reference for your runtime, open it now.**
 
-> 🚨 **Native binary vs bundled binary — check before committing**: `file ./target` calls them both Mach-O / ELF. The 30-second discriminator is `du -h ./target` (50 MB+ suspect bundled) plus `strings -n 12 ./target | rg -iE 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri'`. If hits → bundled-js-binary.md. If clean → native-binary.md.
+> 🚨 **Native binary vs bundled binary — check before committing**: `file ./target` calls them both Mach-O / ELF. The 30-second discriminator is `du -h ./target` (50 MB+ suspect bundled) plus `strings -n 12 ./target | rg -i 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri'`. If hits → bundled-js-binary.md. If clean → native-binary.md.
 
 ---
 
@@ -56,7 +56,7 @@ These are not "optional extras". They are the correct tool in their domain, and
 | **Frida** | Any running process you must instrument live without source or symbols — hook a function and print real argument values, trace calls, stub a return. Complements Ghidra: Ghidra reads the bytes, Frida watches them execute. **If Ghidra's static decompile has hit its limit, reach for Frida.** | 📖 **[references/tools/frida.md](references/tools/frida.md)** |
 | **DAP client (`dap.mjs`)** | Any time you would drive a debugger through a PTY and screen-scrape its text. Debuggers already speak the machine-readable Debug Adapter Protocol (debugpy, `dlv dap`, lldb-dap, js-debug); this bundled script drives it with bounded, monitorable output. **Prefer it over scraping `gdb`/`pdb` whenever the debugger speaks DAP.** Design modeled on oh-my-pi's `debug` tool (github.com/can1357/oh-my-pi). | 📖 **[references/tools/dap.md](references/tools/dap.md)** |
 
-**Failing to use these tools in their domain is a process failure, not a stylistic choice.** If the bug is in a browser and you did Phase 8 without Playwright, you are doing it wrong. If the bug is in a stripped binary and you read hex with `xxd`, you are doing it wrong. The references tell you how. Read them.
+**Failing to use these tools in their domain is a process failure, not a stylistic choice.** If the bug is in a browser and you did Phase 8 without omowright, you are doing it wrong. If the bug is in a stripped binary and you read hex with `xxd`, you are doing it wrong. The references tell you how. Read them.
 
 ---
 
@@ -74,8 +74,8 @@ Each phase has exactly one reference. Read it as you enter the phase — not in
 | 5 | **User decision escalation** — only when evidence exhausted and the call has policy implications | [references/methodology/05-escalate.md](references/methodology/05-escalate.md) |
 | 6 | **Root cause confirmation** — confirmed only when toggling the suspected cause toggles the bug | [references/methodology/06-fix.md](references/methodology/06-fix.md) |
 | 7 | **Fix locked by a failing proof** — reuse the owner test that already fails or add one regression that fails on the pre-fix code, minimal green, no scope expansion | [references/methodology/06-fix.md](references/methodology/06-fix.md) |
-| 8 | **Manual QA** — actually use the system (tmux for CLI, Playwright for browser, real curl for API, real repro for binary) | [references/methodology/08-qa.md](references/methodology/08-qa.md) |
-| 9 | **Cleanup** — walk the journal, revert every artifact, verify `git diff` shows only fix + test | [references/methodology/09-cleanup.md](references/methodology/09-cleanup.md) |
+| 8 | **Manual QA** — actually use the system (tmux for CLI, omowright for browser, real curl for API, real repro for binary) | [references/methodology/08-qa.md](references/methodology/08-qa.md) |
+| 9 | **Cleanup** — walk the journal, revert every artifact, verify `git diff` shows only fix + test (plus any Phase 7 oversized-file split) | [references/methodology/09-cleanup.md](references/methodology/09-cleanup.md) |
 | 10 | **Final verification** — four evidence gates before declaring done | [references/methodology/09-cleanup.md](references/methodology/09-cleanup.md) |
 
 **Phase references are short by design.** Reading one takes a minute. Skipping one costs an hour.

package/packages/shared-skills/skills/debugging/references/methodology/02-investigate.md

@@ -66,7 +66,7 @@ Branch depending on what's available.
 
 When the `team_*` tools are present, create a **debug-squad** team and split investigation across members working on different evidence sources. This is the right default whenever you have ≥3 hypotheses and any of them would take >10 minutes to investigate single-threaded.
 
-**Team spec** — write to `~/.omo/teams/debug-squad/config.json`:
+**Team spec** — write to `.omo/teams/debug-squad/config.json` under the project root (the project-scoped spec location the team loader reads):
 
 ```json
 {
@@ -86,7 +86,7 @@ When the `team_*` tools are present, create a **debug-squad** team and split inv
     {
       "kind": "category",
       "category": "deep-low",
-      "prompt": "You are the Reproduction Engineer. Your job: build the smallest reliable repro — a curl command, a vitest/pytest/go test, a tmux script, a Playwright script for browser bugs, a pwntools script for binary targets. It must reproduce on first try and be copy-pasteable by the Lead. Document exact input, expected output, observed output. Save repro artifacts under /tmp/ and tell the Lead to journal them. If the bug is browser-based you MUST use Playwright CLI — do not simulate with curl."
+      "prompt": "You are the Reproduction Engineer. Your job: build the smallest reliable repro — a curl command, a vitest/pytest/go test, a tmux script, an omowright script for browser bugs, a pwntools script for binary targets. It must reproduce on first try and be copy-pasteable by the Lead. Document exact input, expected output, observed output. Save repro artifacts under /tmp/ and tell the Lead to journal them. If the bug is browser-based you MUST drive a real browser through omowright (references/tools/browser-qa.md) — do not simulate with curl."
     },
     {
       "kind": "category",

package/packages/shared-skills/skills/debugging/references/methodology/06-fix.md

@@ -100,6 +100,8 @@ Only cleanup directly related to the fix. Do not re-architect.
 
 If the code around the fix is rough, note it in the journal as a follow-up for the user; do not expand scope here. Refactoring during a bugfix is how one-line fixes turn into hundred-line diffs nobody can review.
 
+**The one carve-out, and it runs before step 2, not after green:** if the fix must add lines to a file that already exceeds the `programming` skill's 250 pure-LOC ceiling (its DEFECT row forbids new lines in that file), first extract the unit you are touching into its own file as a separate, behavior-preserving move (the red test still fails for the same reason, every other test still passes), journal it, then make the minimal fix in the extracted file. The `programming` skill's SIZE_OK and pure-data-table exceptions still apply. That split ships with the fix; any other rough code stays a follow-up.
+
 ### 4. Regression — full suite green
 
 Run the full test suite for the affected package (not just the one new test). Existing tests must still pass.

package/packages/shared-skills/skills/debugging/references/methodology/09-cleanup.md

@@ -108,13 +108,13 @@ Last gate before reporting done. All four gates must be true, and all four must
 
 ### The four gates
 
-1. **Red→green toggle confirmed** — show the failing test output from before the fix and passing output after. Both outputs visible in the reply or the journal.
+1. **Red→green toggle confirmed** — show the failing test output from before the fix and passing output after. Both outputs visible in the final message (the journal was removed in Phase 9).
 
 2. **Full test suite green** — show the suite's final pass line (e.g. `42 passed in 3.14s`). Not just the new test.
 
 3. **Manual QA reproduced the fix** — show the command or scenario that originally failed and its now-correct output. Verbatim, not paraphrased.
 
-4. **Working tree clean of debug artifacts** — show `git diff --stat` output containing only fix + test, plus `git status` clean of untracked debug files.
+4. **Working tree clean of debug artifacts** — show `git diff --stat` output containing only fix + test (plus the Phase 7 oversized-file split, if one was required), plus `git status` clean of untracked debug files.
 
 If any of the four lacks evidence, you have not finished — return to the appropriate phase.
 

package/packages/shared-skills/skills/debugging/references/methodology/partial-runtime-evidence.md

@@ -59,7 +59,7 @@ HTTPS_PROXY=http://127.0.0.1:8888 SSL_CERT_FILE=~/.mitmproxy/mitmproxy-ca-cert.p
 ```bash
 # DYLD_INSERT_LIBRARIES / LD_PRELOAD shim approach
 # Wrap the network call to log payload, return a fake 200
-# See pwntools.md for shim examples
+# See ../runtimes/native-binary.md (DYLD_INSERT_LIBRARIES interception; "Option C: Wrap / shim") for shim examples
 ```
 
 **Strength**: Wire-level ground truth, but requires the target to honor your proxy / preload.

package/packages/shared-skills/skills/debugging/references/runtimes/bundled-js-binary.md

@@ -41,7 +41,7 @@ Step 3 is the unlock — once you have plaintext source on disk, the rest is nor
 
 ```bash
 # Look for runtime-specific markers in plaintext strings
-strings -n 12 ./target 2>/dev/null | rg -iE 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|NODE_SEA_BLOB|tauri|ESZIP_V2|denort' | head -20
+strings -n 12 ./target 2>/dev/null | rg -i 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|NODE_SEA_BLOB|tauri|ESZIP_V2|denort' | head -20
 ```
 
 | Marker pattern | Bundler | Source format |

package/packages/shared-skills/skills/debugging/references/runtimes/native-binary.md

@@ -20,7 +20,7 @@ Quick check:
 ```bash
 file ./target                                                    # Mach-O / ELF / PE - inconclusive
 du -h ./target                                                   # 50 MB+ for a "simple CLI" → suspect bundled
-strings -n 12 ./target | rg -iE 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri' | head -5
+strings -n 12 ./target | rg -i 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri' | head -5
 ```
 
 **If any hits** → close this file, open [bundled-js-binary.md](bundled-js-binary.md) instead. Following the Ghidra/pwndbg path on a bundled-app binary wastes hours decompiling the runtime VM while the app-level bundle is recoverable with the right per-bundler tool (plaintext for Bun/pkg/nexe/Electron-asar; eszip / V8-cache / `.pyc` for Deno / Node SEA / PyInstaller).

package/packages/shared-skills/skills/debugging/references/tools/browser-qa.md

@@ -25,8 +25,6 @@ const profile = mkdtempSync(join(tmpdir(), "debug-repro-"))
 const browser = await omowright.connectPipe({ browserPath, browserArgs: ["--headless", `--user-data-dir=${profile}`], storageRoot: profile })
 const page = await browser.newTab("about:blank")
 const trace = omowright.createTrace(page, { dir: traceDir })          // trace.jsonl + trace.har + before/after screenshots
-const consoleErrors = []
-page.on("console", (entry) => { if (entry.type === "error") consoleErrors.push(entry.text) })
 try {
   await trace.step("open", () => page.goto(url, { waitUntil: "load" }))
   await trace.step("submit", async () => {
@@ -36,6 +34,7 @@ try {
     await page.waitForURL(/\/done/, { timeout: 10_000 })
   })
   await Bun.write(pngPath, await page.screenshot())
+  const consoleErrors = (await page.console.logs({ levels: ["error"] })).map((entry) => entry.message)
 } finally {
   await trace.stop()
   await browser.close()

package/packages/shared-skills/skills/frontend/SKILL.md

@@ -5,7 +5,7 @@ description: "Builds, styles, and polishes anything drawn with HTML, CSS, or SVG
 
 # Frontend
 
-This file is a router over `references/`; the rules live there. The flow is ground -> brief -> build -> subtract -> verify. The bar is restraint with a visible hierarchy: one primary action, the important thing first, nothing on the screen without a job. A quiet, correct screen that holds its hierarchy at 390 and 1440 in both themes is a finish. Atmosphere, motion, and award-grade surface work are opt-in: build them when the brief asks (a named brand, "premium", "make it stunning", a marketing page), never by default for an internal tool, dashboard, admin screen, report, or figure.
+This file is a router over `references/`; the rules live there. The flow is ground -> brief -> build -> subtract -> verify. The bar is restraint with a visible hierarchy: one primary action, the important thing first, nothing on the screen without a job. A quiet, correct screen that holds its hierarchy at 390 and 1440 in both themes is a finish. Atmosphere, motion, and award-grade surface work are opt-in: build them when the brief asks (a named brand, "premium", "make it stunning", a marketing page), never by default for an internal tool, dashboard, admin screen, report, or figure. An inline page shown beside a reply (a chart, table, or diagram for `show_html_page`, `html_preview`, or `html_render`) follows the `visualize` skill when it is available; either way it is exempt from the `DESIGN.md` gate, the Lighthouse audit, and the research lanes, and keeps the build rules, the Draft guard, and the lint.
 
 ## Route: name the references, read exactly those
 
@@ -119,7 +119,7 @@ Layer A (pick AT MOST ONE style skill; they encode opposing philosophies):
 | `layout-skill.md` / `interaction-skill.md` / `ambience-skill.md` | Stack on any style skill; mechanics only, no visual direction. |
 | `imagegen-frontend-web.md` / `imagegen-frontend-mobile.md` / `imagegen-brandkit.md` | Image-only output; never code. |
 
-Layer B: when the user names a brand or site ("Linear-style", "like Stripe's landing", "Aside-style browser agent"), load `references/design/<brand>.md` as the token source of truth: `aside` `apple` `stripe` `linear.app` `notion` `vercel` `claude` `figma` `airbnb` `nike` `tesla` `spotify` `raycast` `revolut` and ~56 more in `_INDEX.md`. Extract the tokens and apply them to the project's own content; never copy logos or trademarked imagery. A missing brand falls back to a Layer A mood match or the `open-design` skill.
+Layer B: when the user names a brand or site ("Linear-style", "like Stripe's landing", "Aside-style browser agent"), load `references/design/<brand>.md` as the token source of truth: `aside` `apple` `stripe` `linear.app` `notion` `vercel` `claude` `figma` `airbnb` `nike` `tesla` `spotify` `raycast` `revolut` and ~56 more in `_INDEX.md`. Extract the tokens and apply them to the project's own content; never copy logos or trademarked imagery. A missing brand falls back to a Layer A mood match or to the nexu-io/open-design library (https://github.com/nexu-io/open-design).
 
 `perfection/`: `README.md` (the seven tenets: real-browser audits only, 100 in every category, fix at the architecture, never weaken UX for points, design-system compliance, the audit report format) and `react-perf-tooling.md` (Playwright + `playwright-lighthouse` + `react-scan/lite` injection, per-route render budgets). Audit CLI, production build only, mobile and desktop presets, 3-5 runs, take the median:
 
@@ -131,7 +131,7 @@ uv run $SKILL_DIR/scripts/perfection/lighthouse-audit.py https://localhost:3000
 
 ```bash
 python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --design-system -p "Project"   # design-system generation
-python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --domain <domain>             # product style typography color landing chart ux react web prompt
+python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --domain <domain>             # product style typography color landing chart ux react web icons google-fonts
 python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --stack <stack>               # html-tailwind react nextjs vue svelte astro swiftui react-native flutter shadcn jetpack-compose
 ```
 
@@ -141,7 +141,7 @@ python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --stack <s
 
 | Situation | Load |
 |---|---|
-| Brand/style not among the 70 in `references/design/`, or the user says "Open Design" | `open-design` skill: the local nexu-io/open-design library (137+ design skills, 150+ design systems) |
+| Brand/style not among the 70 in `references/design/`, or the user says "Open Design" | The nexu-io/open-design library (https://github.com/nexu-io/open-design; 137+ design skills, 150+ design systems) |
 | Driving a browser for captures | `visual-qa` skill: omowright from js eval (owned engine for renders, attached engine for signed-in pages) |
 | Pure TypeScript/logic work with zero visual surface | `programming` skill alone; this skill adds nothing there |