lazycodex-ai 5.1.62 → 5.1.63

package/packages/shared-skills/skills/data-scientist/SKILL.md

@@ -42,8 +42,9 @@ Per-surface patterns and pitfalls: read `references/execution-surfaces.md` befor
   older spellings.
 - **numpy** when numeric work goes beyond SQL/DataFrame aggregation: statistical tests,
   linear algebra, FFT, random sampling.
-- **matplotlib** for every chart — read `references/visualization.md` first; it carries the
-  quality bar and a mandatory visual check.
+- **matplotlib** for charts in a kernel, a file or a document; a chart shown inline beside a
+  reply is drawn in HTML instead. Read `references/visualization.md` first either way; it
+  carries the quality bar, the inline case and a mandatory visual check.
 
 Performance folklore ("X is Nx faster at filtering") varies with data shape, cardinality,
 and hardware. When the engine choice materially matters, measure on the actual data instead
@@ -65,10 +66,11 @@ a direct scan. Then place the work:
   takes longer.
 - **Query remotely, in place** when the data lives elsewhere: DuckDB reads http(s)/S3
   Parquet and CSV with projection and predicate pushdown, so fetch the columns and rows the
-  question needs, never the whole file. When data sits on another machine you can execute
-  on, ship the query to the data and return the small result. Rule: result much smaller
-  than data — move the query; repeated local iteration planned — move a pruned copy of the
-  data once.
+  question needs, never the whole file. When data sits in a database, run the aggregation
+  there in its own SQL and pull back the result rows, never a table dump. When data sits on
+  another machine you can execute on, ship the query to the data and return the small
+  result. Rule: result much smaller than data — move the query; repeated local iteration
+  planned — move a pruned copy of the data once.
 
 Sizing heuristics and recipes: `references/placement.md`.
 

package/packages/shared-skills/skills/data-scientist/references/placement.md

@@ -8,13 +8,17 @@ ten times) or kills the machine (loading a dataset larger than RAM and swapping)
 Three facts, one cell or script:
 
 ```python
-import os, shutil, subprocess, sys
+import os, re, shutil, subprocess, sys
 size = os.path.getsize("data.csv")            # bytes on disk
 disk_free = shutil.disk_usage(".").free       # spill headroom
-if sys.platform == "darwin":
-    ram = int(subprocess.run(["sysctl", "-n", "hw.memsize"], capture_output=True, text=True).stdout)
-else:
-    ram = os.sysconf("SC_PAGE_SIZE") * os.sysconf("SC_PHYS_PAGES")
+if sys.platform == "darwin":                  # free RAM = free + inactive + speculative pages
+    vm = subprocess.run(["vm_stat"], capture_output=True, text=True).stdout
+    page = int(re.search(r"page size of (\d+)", vm).group(1))
+    ram_free = page * sum(int(re.search(rf"{k}:\s+(\d+)", vm).group(1))
+                          for k in ("Pages free", "Pages inactive", "Pages speculative"))
+else:                                         # Linux: MemAvailable
+    ram_free = next(int(line.split()[1]) * 1024 for line in open("/proc/meminfo")
+                    if line.startswith("MemAvailable:"))
 # row estimate without loading (DuckDB streams the scan):
 # duckdb.sql("SELECT count(*) FROM 'data.csv'")
 ```

package/packages/shared-skills/skills/data-scientist/references/uv-setup.md

@@ -6,10 +6,10 @@ This skill's uv lane (kernel-less harnesses, isolated one-shots) runs through `u
 
 | Platform | Command |
 |---|---|
-| macOS / Linux / WSL / Git Bash | `bash scripts/setup-uv.sh` |
-| Windows (PowerShell) | `powershell -ExecutionPolicy Bypass -File scripts/setup-uv.ps1` |
+| macOS / Linux / WSL | `bash scripts/setup-uv.sh` |
+| Windows (PowerShell; also from Git Bash, where `setup-uv.sh` exits) | `powershell -ExecutionPolicy Bypass -File scripts/setup-uv.ps1` |
 
-Both scripts: detect OS + architecture → install uv to the latest release when missing → upgrade it when present (`uv self update`) → make it resolvable for the current shell → verify with `uv --version`. They are idempotent — safe to re-run any time.
+Both scripts: detect OS + architecture → install uv to the latest release when missing → upgrade it when present (`uv self update`) → make it resolvable for the script's own `uv --version` check (an already-open shell still needs the PATH line below) → verify with `uv --version`. They are idempotent — safe to re-run any time.
 
 ## Manual install per platform
 

package/packages/shared-skills/skills/data-scientist/references/visualization.md

@@ -1,7 +1,11 @@
 # Visualization
 
-A chart exists to answer a question at a glance. Render it with matplotlib (resident in most
-Python kernels; `uv run --with matplotlib` otherwise), then look at it before delivering —
+A chart exists to answer a question at a glance. A chart shown inline beside a reply
+(`show_html_page`, `html_preview`, `html_render`) is drawn in HTML, never as a matplotlib PNG:
+an image ignores the reader's theme and width. When the `visualize` skill is available, it builds
+that page. There this file's chart-type table, Figures and Quality bar apply, and the matplotlib
+calls do not. Everywhere else (a kernel, a file, a document) render it with matplotlib (resident
+in most Python kernels; `uv run --with matplotlib` otherwise). Either way, look at it before delivering —
 a chart nobody inspected is not evidence.
 
 ## When to chart
@@ -22,6 +26,15 @@ question — decoration dilutes the answer.
 | Composition of a whole? | stacked or 100% bar — pie only for four or fewer slices |
 | Many series over time? | small multiples over one spaghetti chart |
 
+## Figures — every chart
+
+- **Days start at the reader's midnight.** Cut daily, weekly and monthly buckets in the
+  reader's time zone, not UTC, and name the zone in the axis label or caption. A bucket still
+  filling (today, this week) is marked partial on its own bar, or it reads as a drop.
+- **Cross-check one figure.** Recompute a headline number from a second source (another
+  table, the system's own dashboard, a raw count) and say beside the chart whether it
+  matched, and by how much it differed if not.
+
 ## Quality bar — every chart
 
 - Title states the finding ("Seoul overtook Busan in March"), not the dataset name.
@@ -51,8 +64,10 @@ matplotlib.rcParams["axes.unicode_minus"] = False   # keeps the minus sign rende
 
 ## Output contract
 
-1. Save a PNG next to the work: `plt.savefig(path, dpi=150, bbox_inches="tight")`.
-2. Also render inline when the surface displays rich output (kernels usually do).
+1. Inline page beside a reply: no PNG. Draw the computed figures in HTML and preview them in
+   both themes, following the `visualize` skill when it is available.
+2. Otherwise save a PNG next to the work: `plt.savefig(path, dpi=150, bbox_inches="tight")`,
+   and also render it inline when the surface displays rich output (kernels usually do).
 3. Report the file path together with the answer.
 
 ## Visual QA — mandatory

package/packages/shared-skills/skills/debugging/SKILL.md

@@ -26,7 +26,7 @@ The rest of this file is a map. **The knowledge is in `references/`.** This file
 
 ## Runtime Setup — MANDATORY READING BEFORE ATTACHING
 
-The methodology is language-agnostic. The commands to launch, attach, breakpoint, and inspect are not. **Open the matching reference before Phase 0. Not during. Not after.**
+The methodology is language-agnostic. The commands to launch, attach, breakpoint, and inspect are not. **Open the matching reference the moment you know the runtime (Phase 0, step 2) and before you attach anything. Not after.**
 
 | Your runtime is… | Open this before attaching anything | Non-negotiable because… |
 |---|---|---|
@@ -39,7 +39,7 @@ The methodology is language-agnostic. The commands to launch, attach, breakpoint
 
 **If you cannot honestly say you just opened the reference for your runtime, open it now.**
 
-> 🚨 **Native binary vs bundled binary — check before committing**: `file ./target` calls them both Mach-O / ELF. The 30-second discriminator is `du -h ./target` (50 MB+ suspect bundled) plus `strings -n 12 ./target | rg -iE 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri'`. If hits → bundled-js-binary.md. If clean → native-binary.md.
+> 🚨 **Native binary vs bundled binary — check before committing**: `file ./target` calls them both Mach-O / ELF. The 30-second discriminator is `du -h ./target` (50 MB+ suspect bundled) plus `strings -n 12 ./target | rg -i 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri'`. If hits → bundled-js-binary.md. If clean → native-binary.md.
 
 ---
 
@@ -56,7 +56,7 @@ These are not "optional extras". They are the correct tool in their domain, and
 | **Frida** | Any running process you must instrument live without source or symbols — hook a function and print real argument values, trace calls, stub a return. Complements Ghidra: Ghidra reads the bytes, Frida watches them execute. **If Ghidra's static decompile has hit its limit, reach for Frida.** | 📖 **[references/tools/frida.md](references/tools/frida.md)** |
 | **DAP client (`dap.mjs`)** | Any time you would drive a debugger through a PTY and screen-scrape its text. Debuggers already speak the machine-readable Debug Adapter Protocol (debugpy, `dlv dap`, lldb-dap, js-debug); this bundled script drives it with bounded, monitorable output. **Prefer it over scraping `gdb`/`pdb` whenever the debugger speaks DAP.** Design modeled on oh-my-pi's `debug` tool (github.com/can1357/oh-my-pi). | 📖 **[references/tools/dap.md](references/tools/dap.md)** |
 
-**Failing to use these tools in their domain is a process failure, not a stylistic choice.** If the bug is in a browser and you did Phase 8 without Playwright, you are doing it wrong. If the bug is in a stripped binary and you read hex with `xxd`, you are doing it wrong. The references tell you how. Read them.
+**Failing to use these tools in their domain is a process failure, not a stylistic choice.** If the bug is in a browser and you did Phase 8 without omowright, you are doing it wrong. If the bug is in a stripped binary and you read hex with `xxd`, you are doing it wrong. The references tell you how. Read them.
 
 ---
 
@@ -74,8 +74,8 @@ Each phase has exactly one reference. Read it as you enter the phase — not in
 | 5 | **User decision escalation** — only when evidence exhausted and the call has policy implications | [references/methodology/05-escalate.md](references/methodology/05-escalate.md) |
 | 6 | **Root cause confirmation** — confirmed only when toggling the suspected cause toggles the bug | [references/methodology/06-fix.md](references/methodology/06-fix.md) |
 | 7 | **Fix locked by a failing proof** — reuse the owner test that already fails or add one regression that fails on the pre-fix code, minimal green, no scope expansion | [references/methodology/06-fix.md](references/methodology/06-fix.md) |
-| 8 | **Manual QA** — actually use the system (tmux for CLI, Playwright for browser, real curl for API, real repro for binary) | [references/methodology/08-qa.md](references/methodology/08-qa.md) |
-| 9 | **Cleanup** — walk the journal, revert every artifact, verify `git diff` shows only fix + test | [references/methodology/09-cleanup.md](references/methodology/09-cleanup.md) |
+| 8 | **Manual QA** — actually use the system (tmux for CLI, omowright for browser, real curl for API, real repro for binary) | [references/methodology/08-qa.md](references/methodology/08-qa.md) |
+| 9 | **Cleanup** — walk the journal, revert every artifact, verify `git diff` shows only fix + test (plus any Phase 7 oversized-file split) | [references/methodology/09-cleanup.md](references/methodology/09-cleanup.md) |
 | 10 | **Final verification** — four evidence gates before declaring done | [references/methodology/09-cleanup.md](references/methodology/09-cleanup.md) |
 
 **Phase references are short by design.** Reading one takes a minute. Skipping one costs an hour.

package/packages/shared-skills/skills/debugging/references/methodology/02-investigate.md

@@ -66,7 +66,7 @@ Branch depending on what's available.
 
 When the `team_*` tools are present, create a **debug-squad** team and split investigation across members working on different evidence sources. This is the right default whenever you have ≥3 hypotheses and any of them would take >10 minutes to investigate single-threaded.
 
-**Team spec** — write to `~/.omo/teams/debug-squad/config.json`:
+**Team spec** — write to `.omo/teams/debug-squad/config.json` under the project root (the project-scoped spec location the team loader reads):
 
 ```json
 {
@@ -86,7 +86,7 @@ When the `team_*` tools are present, create a **debug-squad** team and split inv
     {
       "kind": "category",
       "category": "deep-low",
-      "prompt": "You are the Reproduction Engineer. Your job: build the smallest reliable repro — a curl command, a vitest/pytest/go test, a tmux script, a Playwright script for browser bugs, a pwntools script for binary targets. It must reproduce on first try and be copy-pasteable by the Lead. Document exact input, expected output, observed output. Save repro artifacts under /tmp/ and tell the Lead to journal them. If the bug is browser-based you MUST use Playwright CLI — do not simulate with curl."
+      "prompt": "You are the Reproduction Engineer. Your job: build the smallest reliable repro — a curl command, a vitest/pytest/go test, a tmux script, an omowright script for browser bugs, a pwntools script for binary targets. It must reproduce on first try and be copy-pasteable by the Lead. Document exact input, expected output, observed output. Save repro artifacts under /tmp/ and tell the Lead to journal them. If the bug is browser-based you MUST drive a real browser through omowright (references/tools/browser-qa.md) — do not simulate with curl."
     },
     {
       "kind": "category",

package/packages/shared-skills/skills/debugging/references/methodology/06-fix.md

@@ -100,6 +100,8 @@ Only cleanup directly related to the fix. Do not re-architect.
 
 If the code around the fix is rough, note it in the journal as a follow-up for the user; do not expand scope here. Refactoring during a bugfix is how one-line fixes turn into hundred-line diffs nobody can review.
 
+**The one carve-out, and it runs before step 2, not after green:** if the fix must add lines to a file that already exceeds the `programming` skill's 250 pure-LOC ceiling (its DEFECT row forbids new lines in that file), first extract the unit you are touching into its own file as a separate, behavior-preserving move (the red test still fails for the same reason, every other test still passes), journal it, then make the minimal fix in the extracted file. The `programming` skill's SIZE_OK and pure-data-table exceptions still apply. That split ships with the fix; any other rough code stays a follow-up.
+
 ### 4. Regression — full suite green
 
 Run the full test suite for the affected package (not just the one new test). Existing tests must still pass.

package/packages/shared-skills/skills/debugging/references/methodology/09-cleanup.md

@@ -108,13 +108,13 @@ Last gate before reporting done. All four gates must be true, and all four must
 
 ### The four gates
 
-1. **Red→green toggle confirmed** — show the failing test output from before the fix and passing output after. Both outputs visible in the reply or the journal.
+1. **Red→green toggle confirmed** — show the failing test output from before the fix and passing output after. Both outputs visible in the final message (the journal was removed in Phase 9).
 
 2. **Full test suite green** — show the suite's final pass line (e.g. `42 passed in 3.14s`). Not just the new test.
 
 3. **Manual QA reproduced the fix** — show the command or scenario that originally failed and its now-correct output. Verbatim, not paraphrased.
 
-4. **Working tree clean of debug artifacts** — show `git diff --stat` output containing only fix + test, plus `git status` clean of untracked debug files.
+4. **Working tree clean of debug artifacts** — show `git diff --stat` output containing only fix + test (plus the Phase 7 oversized-file split, if one was required), plus `git status` clean of untracked debug files.
 
 If any of the four lacks evidence, you have not finished — return to the appropriate phase.
 

package/packages/shared-skills/skills/debugging/references/methodology/partial-runtime-evidence.md

@@ -59,7 +59,7 @@ HTTPS_PROXY=http://127.0.0.1:8888 SSL_CERT_FILE=~/.mitmproxy/mitmproxy-ca-cert.p
 ```bash
 # DYLD_INSERT_LIBRARIES / LD_PRELOAD shim approach
 # Wrap the network call to log payload, return a fake 200
-# See pwntools.md for shim examples
+# See ../runtimes/native-binary.md (DYLD_INSERT_LIBRARIES interception; "Option C: Wrap / shim") for shim examples
 ```
 
 **Strength**: Wire-level ground truth, but requires the target to honor your proxy / preload.

package/packages/shared-skills/skills/debugging/references/runtimes/bundled-js-binary.md

@@ -41,7 +41,7 @@ Step 3 is the unlock — once you have plaintext source on disk, the rest is nor
 
 ```bash
 # Look for runtime-specific markers in plaintext strings
-strings -n 12 ./target 2>/dev/null | rg -iE 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|NODE_SEA_BLOB|tauri|ESZIP_V2|denort' | head -20
+strings -n 12 ./target 2>/dev/null | rg -i 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|NODE_SEA_BLOB|tauri|ESZIP_V2|denort' | head -20
 ```
 
 | Marker pattern | Bundler | Source format |

package/packages/shared-skills/skills/debugging/references/runtimes/native-binary.md

@@ -20,7 +20,7 @@ Quick check:
 ```bash
 file ./target                                                    # Mach-O / ELF / PE - inconclusive
 du -h ./target                                                   # 50 MB+ for a "simple CLI" → suspect bundled
-strings -n 12 ./target | rg -iE 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri' | head -5
+strings -n 12 ./target | rg -i 'bun|node_modules|webpack|esbuild|deno|pkg/lib|electron|pyinstaller|nexe|NODE_SEA_FUSE|tauri' | head -5
 ```
 
 **If any hits** → close this file, open [bundled-js-binary.md](bundled-js-binary.md) instead. Following the Ghidra/pwndbg path on a bundled-app binary wastes hours decompiling the runtime VM while the app-level bundle is recoverable with the right per-bundler tool (plaintext for Bun/pkg/nexe/Electron-asar; eszip / V8-cache / `.pyc` for Deno / Node SEA / PyInstaller).

package/packages/shared-skills/skills/debugging/references/tools/browser-qa.md

@@ -25,8 +25,6 @@ const profile = mkdtempSync(join(tmpdir(), "debug-repro-"))
 const browser = await omowright.connectPipe({ browserPath, browserArgs: ["--headless", `--user-data-dir=${profile}`], storageRoot: profile })
 const page = await browser.newTab("about:blank")
 const trace = omowright.createTrace(page, { dir: traceDir })          // trace.jsonl + trace.har + before/after screenshots
-const consoleErrors = []
-page.on("console", (entry) => { if (entry.type === "error") consoleErrors.push(entry.text) })
 try {
   await trace.step("open", () => page.goto(url, { waitUntil: "load" }))
   await trace.step("submit", async () => {
@@ -36,6 +34,7 @@ try {
     await page.waitForURL(/\/done/, { timeout: 10_000 })
   })
   await Bun.write(pngPath, await page.screenshot())
+  const consoleErrors = (await page.console.logs({ levels: ["error"] })).map((entry) => entry.message)
 } finally {
   await trace.stop()
   await browser.close()

package/packages/shared-skills/skills/frontend/SKILL.md

@@ -5,7 +5,7 @@ description: "Builds, styles, and polishes anything drawn with HTML, CSS, or SVG
 
 # Frontend
 
-This file is a router over `references/`; the rules live there. The flow is ground -> brief -> build -> subtract -> verify. The bar is restraint with a visible hierarchy: one primary action, the important thing first, nothing on the screen without a job. A quiet, correct screen that holds its hierarchy at 390 and 1440 in both themes is a finish. Atmosphere, motion, and award-grade surface work are opt-in: build them when the brief asks (a named brand, "premium", "make it stunning", a marketing page), never by default for an internal tool, dashboard, admin screen, report, or figure.
+This file is a router over `references/`; the rules live there. The flow is ground -> brief -> build -> subtract -> verify. The bar is restraint with a visible hierarchy: one primary action, the important thing first, nothing on the screen without a job. A quiet, correct screen that holds its hierarchy at 390 and 1440 in both themes is a finish. Atmosphere, motion, and award-grade surface work are opt-in: build them when the brief asks (a named brand, "premium", "make it stunning", a marketing page), never by default for an internal tool, dashboard, admin screen, report, or figure. An inline page shown beside a reply (a chart, table, or diagram for `show_html_page`, `html_preview`, or `html_render`) follows the `visualize` skill when it is available; either way it is exempt from the `DESIGN.md` gate, the Lighthouse audit, and the research lanes, and keeps the build rules, the Draft guard, and the lint.
 
 ## Route: name the references, read exactly those
 
@@ -131,7 +131,7 @@ uv run $SKILL_DIR/scripts/perfection/lighthouse-audit.py https://localhost:3000
 
 ```bash
 python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --design-system -p "Project"   # design-system generation
-python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --domain <domain>             # product style typography color landing chart ux react web prompt
+python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --domain <domain>             # product style typography color landing chart ux react web icons google-fonts
 python3 -B $SKILL_DIR/references/ui-ux-db/scripts/search.py "<query>" --stack <stack>               # html-tailwind react nextjs vue svelte astro swiftui react-native flutter shadcn jetpack-compose
 ```
 

package/packages/shared-skills/skills/frontend/references/design/design-system-architecture.md

@@ -60,7 +60,7 @@ rather than borders, creating layers you feel more than see."
 | Status/info | --status-info | #2563EB | #3B82F6 | Informational |
 
 ### Rules
-- Accent marks the one or two most likely actions on a screen, on the control's background rather than its glyph or label. Peer choices differ by style, never by size. Nothing decorative carries accent.
+- Accent marks the screen's one primary action, on the control's background rather than its glyph or label; a second likely action takes a quieter style. Peer choices differ by style, never by size. Nothing decorative carries accent.
 - Never introduce a color not in this table. Extend the table first.
 
 ## 3. Typography

package/packages/shared-skills/skills/frontend/references/design/print-paged-media.md

@@ -73,4 +73,4 @@ pdftoppm -png -r 150 report.pdf out/page   # one PNG per page
 
 Read every page image for: blank or near-empty pages, a block stranded alone after a keep-together push, a table or figure split mid-exhibit, a heading orphaned at a page foot, clipped or overflowing text, and a running header or footer that drifted or vanished.
 
-Extracting the text proves the words are present. It cannot see any defect in this list - layout is exactly the information that extraction discards. Fix, re-render, and look again until the pages are clean; the same standard governs the `ulw-research` delivery gate and the `mass-ulw` verification wave.
+Extracting the text proves the words are present. It cannot see any defect in this list - layout is exactly the information that extraction discards. Fix, re-render, and look again until the pages are clean. The `ulw-research` delivery gate and the `mass-ulw` verification wave hold the same page-by-page inspection standard; `ulw-research` bounds its repair loop (its `repair decide` stop rules) and ships any residual defect listed in its manifest.

package/packages/shared-skills/skills/frontend/references/perfection/README.md

@@ -90,7 +90,6 @@ Quick audit via the cross-platform Python CLI (macOS, Linux, Windows):
 
 ```bash
 uv run $SKILL_DIR/scripts/perfection/lighthouse-audit.py https://localhost:3000
-uv run $SKILL_DIR/scripts/perfection/lighthouse-audit.py https://localhost:3000 --threshold 95
 uv run $SKILL_DIR/scripts/perfection/lighthouse-audit.py https://localhost:3000 --desktop-only
 bun $SKILL_DIR/scripts/perfection/check-draft-guard.ts src/   # exit 1 = accent stripe or outline, promo copy, emoji icon, hype badge, or vanity stat
 ```

package/packages/shared-skills/skills/frontend/references/perfection/react-perf-tooling.md

@@ -20,17 +20,38 @@ If the project does not yet have react-scan and react-doctor wired into its dev
 import { chromium } from "playwright";
 import { playAudit } from "playwright-lighthouse";
 
+declare global {
+  interface Window {
+    __renderEvents: unknown[];
+  }
+}
+
+// Narrow only the fields this gate reads from a react-scan commit event.
+function hasUnnecessaryRender(event: unknown): boolean {
+  if (typeof event !== "object" || event === null || !("tree" in event) || !Array.isArray(event.tree)) return false;
+  return event.tree.some(
+    (node: unknown) =>
+      typeof node === "object" &&
+      node !== null &&
+      "changeDescription" in node &&
+      typeof node.changeDescription === "object" &&
+      node.changeDescription !== null &&
+      "kind" in node.changeDescription &&
+      node.changeDescription.kind === "unnecessary",
+  );
+}
+
 const browser = await chromium.launch({ channel: "chrome" });
 const context = await browser.newContext();
 
 // Inject react-scan/lite BEFORE the app boots
 await context.addInitScript(() => {
-  // @ts-ignore — pulled from the project's node_modules or a self-hosted bundle
+  // react-scan is a dev dependency of the project (see ../design/react-dev-tooling-skill.md), so its types resolve
   import("react-scan/lite").then(({ instrument }) => {
-    (window as any).__renderEvents = [];
+    window.__renderEvents = [];
     instrument({
-      onEvent: (event: any) => {
-        if (event.kind === "commit") (window as any).__renderEvents.push(event);
+      onEvent: (event) => {
+        if (event.kind === "commit") window.__renderEvents.push(event);
       },
       recordChangeDescriptions: true,
       includeFiberSource: true,
@@ -51,10 +72,8 @@ await playAudit({
 });
 
 // Pull render events and assert on render quality
-const events = await page.evaluate(() => (window as any).__renderEvents);
-const unnecessary = events.filter((e: any) =>
-  e.tree?.some((node: any) => node.changeDescription?.kind === "unnecessary"),
-);
+const events = await page.evaluate(() => window.__renderEvents);
+const unnecessary = events.filter(hasUnnecessaryRender);
 
 if (unnecessary.length > 0) {
   console.error(`FAIL: ${unnecessary.length} unnecessary renders detected during audit`);

package/packages/shared-skills/skills/frontend/scripts/perfection/lighthouse-audit.py

@@ -16,7 +16,6 @@
 # 3. Run:
 #      uv run lighthouse-audit.py https://example.com
 #      uv run lighthouse-audit.py https://example.com --desktop-only
-#      uv run lighthouse-audit.py https://example.com --threshold 95
 # ──────────────────
 
 """Lighthouse audit via real Playwright Chrome.

package/packages/shared-skills/skills/git-master/SKILL.md

@@ -16,7 +16,7 @@ Classify the request first:
 - `HISTORY`: answer when, where, who, why, or which commit changed something.
 - `STATUS`: inspect branch, diff, or working-tree state without changing it.
 
-Do not commit, rebase, push, force-push, reset, stash-pop, or delete anything unless the user explicitly asked for that operation. If the request is only investigative, report findings and stop.
+Do not commit, rebase, push, force-push, reset, stash-pop, or delete anything unless the user explicitly asked for that operation. When a workflow the user started mandates one of them (ulw-loop commits each verified unit, ulw-execute lands its branches), that workflow's instruction is the ask. If the request is only investigative, report findings and stop.
 
 ## Ground Truth
 
@@ -38,7 +38,17 @@ Missing upstream or missing `main`/`master` is normal. Fall back to the best ava
 
 ## PR Body Evidence Attachments
 
-When a PR body needs screenshots or terminal PNGs, use the repo reference at `docs/reference/github-attachment-upload.md`. The allowed hosting path is GitHub user attachments from the authenticated web attachment flow; never commit temporary images, never use GitHub Releases for PR evidence, and never use external image hosts. Do not log browser cookies, CSRF tokens, S3 form fields, or upload headers.
+When a PR body needs screenshots or terminal PNGs, the allowed hosting path is GitHub user attachments from the authenticated web attachment flow; never commit temporary images, never use GitHub Releases for PR evidence, and never use external image hosts. Do not log browser cookies, CSRF tokens, S3 form fields, or upload headers.
+
+The flow needs an authenticated GitHub web session (a `gh` API token alone is not enough):
+
+1. Open the target PR or issue page in that session and read its file-attachment CSRF token and repository id.
+2. `POST https://github.com/upload/policies/assets` with `repository_id`, `name`, `size`, `content_type`, and that token as `authenticity_token`.
+3. Upload the bytes to the returned S3 URL with the returned form fields exactly as given.
+4. `PUT https://github.com/upload/assets/:id` with the returned `asset_upload_authenticity_token`.
+5. Put only the final `https://github.com/user-attachments/assets/<uuid>` URL in the PR body (write the body to a temp file and pass it with `gh pr edit --body-file`).
+
+If no authenticated browser session is available, leave the local evidence paths in the PR body and state the blocker.
 
 ## Commit Mode
 

package/packages/shared-skills/skills/init-deep/SKILL.md

@@ -171,7 +171,7 @@ for each background task ID (`bg_...`): background_output(task_id="bg_...")
 ```
 AGENTS_LOCATIONS = [
   { path: ".", type: "root" },
-  { path: "src/hooks", score: 18, reason: "high complexity" },
+  { path: "src/hooks", score: 16, reason: "high complexity" },
   { path: "src/api", score: 12, reason: "distinct domain" }
 ]
 ```

package/packages/shared-skills/skills/lsp-setup/SKILL.md

@@ -27,11 +27,11 @@ reference before installing or configuring anything**.
 | `.py .pyi` | `references/python/README.md` |
 | `.go` | `references/go/README.md` |
 | `.rs` | `references/rust/README.md` |
-| `.c .cpp .cc .cxx .h .hpp .hh .hxx` | `references/c-cpp/README.md` |
+| `.c .cpp .cc .cxx .c++ .h .hpp .hh .hxx .h++` | `references/c-cpp/README.md` |
 | `.java` | `references/java/README.md` |
 | `.kt .kts` | `references/kotlin/README.md` |
 | `.cs .razor .cshtml` | `references/csharp/README.md` |
-| `.swift` | `references/swift/README.md` |
+| `.swift .m .mm` | `references/swift/README.md` |
 | `.rb .rake .gemspec .ru` | `references/ruby/README.md` |
 | `.php` | `references/php/README.md` |
 | `.dart` | `references/dart/README.md` |
@@ -75,13 +75,20 @@ command -v <server-executable>   # e.g. typescript-language-server, gopls, rust-
 
 Most builtin servers need **no config** — they are resolved automatically by
 file extension. Write config only to: pick between competing servers, set a
-`priority`, pass `initialization` options, override `extensions`, set `env`, or
-`disable` a server.
+`priority`, pass `initialization` options, override `extensions`, set `env`
+(user config only), or `disable` a server.
 
-Two project-scoped config files, **identical JSON shape**:
+Config files per harness, **identical JSON shape**. Each harness reads the
+first project file that exists, plus one user file:
 
-- Codex harness → `.codex/lsp-client.json` (user: `~/.codex/lsp-client.json`)
-- OpenCode/omo harness → `.opencode/lsp.json` (also `.omo/lsp.json`)
+| Harness | Project config | User config |
+|---|---|---|
+| Codex | `.codex/lsp-client.json` | `$CODEX_HOME/lsp-client.json` (default `~/.codex/lsp-client.json`) |
+| OpenCode | `.opencode/lsp.json`, then `.omo/lsp.json`, then `.omo/lsp-client.json` | `lsp.json` in the OpenCode config dir (default `~/.config/opencode/lsp.json`) |
+| OmO native | `.omo/lsp-client.json`, then `.pi/lsp-client.json` | `~/.omo/lsp-client.json` (`~/.pi/lsp-client.json` when only that one exists) |
+
+A standalone `lsp-tools-mcp` launch reads the paths in
+`LSP_TOOLS_MCP_PROJECT_CONFIG` / `LSP_TOOLS_MCP_USER_CONFIG` instead.
 
 ```jsonc
 {
@@ -100,14 +107,16 @@ Two project-scoped config files, **identical JSON shape**:
 
 Rules enforced by `config-loader.ts`:
 
-- In a **project** config (`.codex/lsp-client.json`, `.opencode/lsp.json`) an
-  entry whose id is a **builtin** server inherits `command` automatically — you
-  only override `extensions` / `priority` / `initialization`. A non-builtin id
-  in a project config is **ignored**.
-- To define a **fully custom** (non-builtin) server with its own `command`, put
-  it in the **user** config (`~/.codex/lsp-client.json`, or the path set by
-  `LSP_TOOLS_MCP_USER_CONFIG`), where `command` + `extensions` are honored.
-- Project entries win over user entries; both win over builtin defaults.
+- In a **project** config an entry whose id is a **builtin** server inherits
+  `command` automatically — you only override `extensions` / `priority` /
+  `initialization` / `disabled`. Its `env` is dropped, and a non-builtin id in
+  a project config is **ignored**.
+- To set `env`, or to define a **fully custom** (non-builtin) server with its
+  own `command`, put it in the **user** config from the table above, where
+  `command` + `extensions` + `env` are honored.
+- Project entries win over user entries; both win over builtin defaults. A user
+  entry is skipped when an enabled project entry has the same id, so keep an id
+  that needs `env` out of the project config.
 
 Each language reference gives a ready-to-paste snippet.
 

package/packages/shared-skills/skills/lsp-setup/references/bash/README.md

@@ -27,17 +27,17 @@ command -v shellcheck
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "bash": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 
-None commonly required. `bash-language-server` discovers `shellcheck` on PATH automatically. To point at a non-PATH binary, export `SHELLCHECK_PATH` via `env`:
+None commonly required. `bash-language-server` discovers `shellcheck` on PATH automatically. To point at a non-PATH binary, export `SHELLCHECK_PATH` via `env` (USER config only; a project entry drops `env`):
 
 ```json
 { "lsp": { "bash": { "env": { "SHELLCHECK_PATH": "/opt/bin/shellcheck" } } } }

package/packages/shared-skills/skills/lsp-setup/references/c-cpp/README.md

@@ -20,13 +20,13 @@ command -v clangd
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "clangd": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/csharp/README.md

@@ -22,13 +22,13 @@ command -v csharp-ls
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "csharp": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/dart/README.md

@@ -20,13 +20,13 @@ command -v dart
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "dart": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/elixir/README.md

@@ -21,13 +21,13 @@ command -v elixir-ls
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "elixir-ls": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/go/README.md

@@ -25,13 +25,13 @@ command -v gopls
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "gopls": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/haskell/README.md

@@ -27,13 +27,13 @@ command -v haskell-language-server-wrapper
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "haskell-language-server": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)