oh-my-opencode 4.13.0 → 4.14.1

package/dist/skills/frontend/references/designpowers/vendor/skills/usability-testing/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: usability-testing
+description: "Use when planning or conducting usability tests — writing test scripts, defining tasks, selecting participants, analysing findings, and turning observations into design actions"
+---
+
+# Usability Testing
+
+Testing with real people is how you find out if the design works — not by looking at it, but by watching someone use it.
+
+## When to Use
+
+- After design-builder produces a working prototype
+- Before declaring a design complete
+- When the design-critic flags persona coverage gaps
+- When assumptions about user behaviour need evidence
+
+## Process
+
+### Step 1: Define What You're Testing
+
+Write 3-5 task scenarios that map to the core jobs in the brief. Each task:
+- **Starts with a realistic trigger** — "You just bought a new plant and want to add it to the app"
+- **Has a clear success condition** — "The plant appears in your list with a watering schedule"
+- **Does not tell the user how** — never say "tap the + button"
+
+### Step 2: Select Participants
+
+Recruit 5-8 participants. At minimum include:
+- 1 person who uses a screen reader
+- 1 person over 60
+- 1 person who is not a native speaker of the interface language
+- 1 person with low tech confidence
+
+Reference `inclusive-personas` for the ability spectrum.
+
+### Step 3: Choose Method
+
+| Method | When to use | Minimum participants |
+|--------|-----------|---------------------|
+| Moderated think-aloud | New flows, complex interactions | 5 |
+| Unmoderated remote | Simple tasks, large sample | 8-12 |
+| Guerrilla (hallway) | POC validation, time-constrained | 3-5 |
+| Accessibility audit with AT users | After build, before ship | 2-3 |
+
+### Step 4: Write the Test Script
+
+1. **Welcome** — explain what you're testing (the design, not them)
+2. **Background** — 2-3 questions about their relationship to the problem
+3. **Tasks** — present each scenario one at a time, observe silently
+4. **Debrief** — "What was hardest?" "What would you change?"
+
+Never help during a task. Silence is data.
+
+### Step 5: Analyse Findings
+
+Classify outcomes per task:
+- **Completed easily** — no hesitation, no errors
+- **Completed with difficulty** — hesitation or errors but recovered
+- **Failed** — could not complete
+- **Completed wrong** — thought they succeeded but didn't
+
+Severity: Critical (blocks 2+ participants), Major (significant difficulty), Minor (noticed but not impeding).
+
+### Step 6: Turn Findings Into Actions
+
+Every finding becomes a design action: "[Severity] [What happened] → [Design action] → [Which agent handles it]"
+
+## What You Deliver
+
+- Task success rates table
+- Ranked findings by severity
+- Design actions with agent assignments
+- Recommendation: iterate / ship / rethink
+
+## Integration
+
+- **Informed by:** `inclusive-personas`, `design-discovery`
+- **Feeds into:** `design-lead`, `design-builder`, `design-strategist`

package/dist/skills/frontend/references/designpowers/vendor/skills/verification-before-shipping/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: verification-before-shipping
+description: "Use before declaring any design work complete, fixed, or ready — requires running verification and confirming output before making any success claims. Evidence before assertions, always"
+---
+
+# Verification Before Shipping
+
+Do not say it is done until you have proof. This skill prevents the most common failure mode in design work — declaring completion based on intent rather than evidence.
+
+## The Rule
+
+NEVER claim work is complete, fixed, passing, or ready without running verification and confirming the output. "I believe this works" is not verification. "I ran these checks and here are the results" is.
+
+## When to Use
+
+- Before declaring a design task complete
+- Before moving from one phase to the next
+- Before handoff to engineering
+- Before creating a PR or committing design artefacts
+- Any time you are about to say "done"
+
+## Process
+
+### Step 1: Check Against the Plan
+
+If a design plan exists:
+- [ ] Every task in the plan is marked complete
+- [ ] Every verification criterion in the plan has been met
+- [ ] No tasks were skipped or deferred without explicit user approval
+
+### Step 2: Check Against the Brief
+
+Reference the design brief:
+- [ ] The stated problem is addressed
+- [ ] All identified personas are served
+- [ ] Success criteria are met or measurable
+- [ ] Nothing in "out of scope" crept into scope (and vice versa)
+
+### Step 3: Accessibility Verification
+
+Run — do not guess:
+
+**If code exists:**
+- [ ] Automated accessibility scan (axe-core, Lighthouse, or equivalent) — report results
+- [ ] Keyboard navigation test — report results
+- [ ] Screen reader test (at minimum, check heading structure and form labels)
+- [ ] Zoom to 200% — report results
+- [ ] Check prefers-reduced-motion behaviour — report results
+
+**If design artefacts only:**
+- [ ] Contrast ratios verified with a tool (not by eye)
+- [ ] Touch targets measured (not estimated)
+- [ ] Heading hierarchy documented
+- [ ] All states designed (not just the happy path)
+
+### Step 4: Content Verification
+
+- [ ] All placeholder text has been replaced with real content
+- [ ] Error messages are written (not "TODO")
+- [ ] Alt text is present for all images
+- [ ] Labels are specific and descriptive
+
+### Step 5: Cross-Reference Personas
+
+For each persona from the inclusive-personas phase:
+- [ ] Could [Persona 1] complete the primary task? How?
+- [ ] Could [Persona 2] complete the primary task? How?
+- [ ] Could [Edge Case Persona] complete the primary task? What barriers remain?
+
+### Step 6: Check Design Debt
+
+Before declaring the project shippable, review the Design Debt Register in `design-state.md`:
+
+- [ ] All Critical and Major items are Resolved (not just Open or Escalated)
+- [ ] Any Escalated items have been addressed or consciously Accepted by the user
+- [ ] Open Minor items have been reviewed — the user knows what debt ships with this release
+- [ ] Accessibility debt items have explicit user acknowledgement if Accepted
+
+### Step 7: Report
+
+Present verification results to the user:
+
+```markdown
+## Verification Report: [Feature/Task]
+
+**Date:** [YYYY-MM-DD]
+
+### Plan Completion
+[All tasks complete / X tasks remaining]
+
+### Brief Alignment
+[Aligned / Gaps identified]
+
+### Accessibility Results
+- Automated scan: [Pass/Fail — specific issues]
+- Keyboard: [Pass/Fail — specific issues]
+- Screen reader: [Pass/Fail — specific issues]
+- Zoom: [Pass/Fail — specific issues]
+- Motion: [Pass/Fail — specific issues]
+
+### Content Status
+[Complete / Gaps identified]
+
+### Persona Walkthrough
+[Summary of persona-by-persona evaluation]
+
+### Design Debt Status
+- Open items shipping with this release: [count]
+- Escalated items: [count] — [resolved/accepted]
+- Accessibility debt accepted: [count] — [summary]
+- Oldest unresolved: [DD-XXX] from [date]
+
+### Verdict
+[Ready to ship / Issues to resolve first]
+```
+
+## Integration
+
+- **Called by:** Before any completion claim
+- **Follows:** `designpowers-critique`, `design-handoff`
+- **Blocks:** Completion claims, PR creation, merge decisions
+
+## The Iron Law
+
+If you cannot produce evidence that the design works for the identified personas — including those at the margins of the ability spectrum — it is not done. Go back and verify.

package/dist/skills/frontend/references/designpowers/vendor/skills/voice-and-tone/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: voice-and-tone
+description: "Use when establishing or applying brand voice — defining voice attributes, tone adaptation across contexts, vocabulary lists, writing examples, and ensuring consistent personality across the interface"
+---
+
+# Voice and Tone
+
+Voice is who you are. Tone is how you say it right now. Voice stays constant. Tone adapts to context. This skill defines both so every word sounds like the same person wrote it.
+
+## When to Use
+
+- At the start of a project, during or after `design-strategy`
+- When the content-writer agent needs voice guardrails
+- When interface copy sounds inconsistent across screens
+
+## Step 1: Define Voice Attributes
+
+Choose 3-5. For each, define "this, not that":
+
+| Attribute | This | Not that |
+|-----------|------|----------|
+| Warm | Friendly, approachable | Sycophantic, emoji-heavy |
+| Knowledgeable | Confident, precise | Academic, condescending |
+| Direct | Clear, action-oriented | Blunt, cold, robotic |
+| Encouraging | Celebrates effort | Patronising, fake-cheerful |
+
+The "not that" column prevents drift.
+
+## Step 2: Define Tone by Context
+
+| Context | Feel | Example |
+|---------|------|---------|
+| Success | Celebration, warmth | "Your monstera is happy. Next water Thursday." |
+| Error | Calm, helpful, no blame | "We couldn't save that. Check your connection and try again." |
+| Onboarding | Welcoming, confidence-building | "Let's get to know your plants. About 30 seconds." |
+| Empty state | Inviting, action-oriented | "Your windowsill is empty. Add your first plant." |
+| Loading | Reassuring, brief | "Checking your plants..." |
+| Destructive | Clear, calm, reversible | "Remove this plant? You can undo this." |
+
+## Step 3: Build the Vocabulary
+
+| Always use | Never use |
+|-----------|----------|
+| water | irrigate |
+| happy | optimal |
+| check it out | investigate |
+| you | the user |
+
+The content-writer agent uses this as a constraint.
+
+## Step 4: Set Reading Level
+
+| Audience | Target |
+|----------|--------|
+| General consumer | Grade 6-8 |
+| Professional tool | Grade 8-10 |
+| Technical docs | Grade 10-12 |
+
+## Voice Audit Checklist
+
+- [ ] Every screen sounds like the same person wrote it
+- [ ] Voice attributes are present in the copy
+- [ ] Tone matches the context
+- [ ] Vocabulary list words used consistently
+- [ ] Reading level at or below target
+- [ ] Copy works read aloud by a screen reader
+
+## What You Deliver
+
+- Voice attributes table (3-5, with "this not that")
+- Tone guide by context with examples
+- Vocabulary list
+- Reading level target
+- 3-5 before/after examples
+
+## Integration
+
+- **Informed by:** `design-strategy`, `design-discovery`
+- **Feeds into:** `content-writer` agent, `accessible-content`, `design-critic`

package/dist/skills/frontend/references/designpowers/vendor/skills/writing-design-plans/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: writing-design-plans
+description: "Use when you have a design brief or strategy and need to break implementation into reviewable chunks — creates step-by-step plans with verification criteria for each task"
+---
+
+# Writing Design Plans
+
+A design plan breaks an approved design direction into discrete, reviewable tasks. Each task is small enough to evaluate clearly and specific enough that the result is predictable.
+
+## When to Use
+
+- After design-discovery and/or design-strategy have produced an approved direction
+- Before any implementation work begins
+- When a design task is too large to complete and review in one step
+
+## Process
+
+### Step 1: Review Inputs
+
+Gather:
+- Design brief (from design-discovery)
+- Strategy document (from design-strategy, if applicable)
+- Personas (from inclusive-personas)
+- Existing design system inventory
+
+### Step 2: Identify Design Tasks
+
+Break the work into categories:
+
+1. **Structure tasks** — information architecture, page hierarchy, navigation
+2. **Component tasks** — individual UI components that need designing
+3. **Layout tasks** — how components compose into screens
+4. **Interaction tasks** — states, transitions, feedback patterns
+5. **Content tasks** — copy, labels, error messages, help text
+6. **Accessibility tasks** — specific inclusive design requirements per component
+
+### Step 3: Order the Work
+
+Design work has natural dependencies:
+
+```
+Structure → Layout → Components → Interactions → Content → Review
+     ↑ accessibility woven through each step, not a final phase ↑
+```
+
+Order tasks so that:
+- Foundation work (structure, layout) comes before detail work (interactions, content)
+- Each task can be reviewed independently
+- Accessibility is addressed within each task, not deferred
+
+### Step 4: Write the Plan
+
+```markdown
+# Design Plan: [Feature/Project Name]
+
+> **For agentic workers:** REQUIRED: Use designpowers:designpowers-critique to review completed work against this plan.
+
+**Goal:** [One sentence — what this plan delivers]
+
+**Design Direction:** [Reference to the design brief or strategy]
+
+**Personas:** [Reference to personas this plan serves]
+
+---
+
+## Task 1: [Task Name]
+
+**Files:** [Which files will be created or modified]
+
+- [ ] Step 1: [Specific action]
+- [ ] Step 2: [Specific action]
+- [ ] Step 3: [Specific action]
+
+**Accessibility check:** [What inclusive design criteria this task must meet]
+
+**Verification:** [How to confirm this task is complete and correct]
+
+---
+
+## Task 2: [Task Name]
+...
+```
+
+### Step 5: Task Sizing
+
+Each task should be:
+- **2-5 minutes of focused work** — small enough to hold in your head
+- **Independently reviewable** — someone can evaluate it without seeing everything else
+- **Specifically described** — exact files, exact components, exact acceptance criteria
+- **Accessibility-inclusive** — each task addresses its own inclusive design requirements
+
+If a task takes longer than 5 minutes, break it down further.
+
+### Step 6: Save and Review
+
+Save to: `docs/designpowers/plans/YYYY-MM-DD-<feature>-plan.md`
+
+Present the plan to the user. Walk through:
+- Does the task order make sense?
+- Are any tasks missing?
+- Are the accessibility checks appropriate for each task?
+- Is the scope right, or should anything be deferred?
+
+User must approve the plan before execution begins.
+
+## Integration
+
+- **Called by:** `design-discovery`, `design-strategy`
+- **Calls:** Implementation begins via the relevant design skills (`ui-composition`, `interaction-design`, etc.)
+- **Pairs with:** `designpowers-critique` (reviews work against the plan)
+
+## Anti-Patterns
+
+| Pattern | Problem |
+|---------|---------|
+| Tasks without accessibility checks | Every task affects the user experience. Every task has accessibility implications |
+| Tasks that say "make it look good" | Vague tasks produce vague results. Be specific about what "good" means |
+| Accessibility as the final task | By then it is too late. Accessibility is in every task |
+| Plan without persona references | If you do not know who you are designing for, you cannot verify the design works |

package/dist/skills/git-master/SKILL.md

@@ -36,6 +36,10 @@ git merge-base HEAD origin/master
 
 Missing upstream or missing `main`/`master` is normal. Fall back to the best available branch or report the missing fact. Never treat a failed lookup as proof.
 
+## PR Body Evidence Attachments
+
+When a PR body needs screenshots or terminal PNGs, use the repo reference at `docs/reference/github-attachment-upload.md`. The allowed hosting path is GitHub user attachments from the authenticated web attachment flow; never commit temporary images, never use GitHub Releases for PR evidence, and never use external image hosts. Do not log browser cookies, CSRF tokens, S3 form fields, or upload headers.
+
 ## Commit Mode
 
 Commit only the user's requested changes. Preserve unrelated dirty work.

package/dist/skills/lcx-contribute-bug-fix/SKILL.md

@@ -18,7 +18,7 @@ Route ownership the same way as `$lcx-report-bug`, but the deliverable differs b
 
 For `openai/codex`, create a fork PR that includes:
 
-- a focused branch from a fresh `/tmp` clone/worktree
+- a focused branch from a fresh `${TMPDIR:-/tmp}` clone/worktree
 - reproduction logs from before the fix
 - the smallest implementation that fixes the defect
 - verification logs from after the fix
@@ -30,7 +30,7 @@ For `code-yeongyu/lazycodex`, create an issue (never a PR) that includes:
 
 - reproduction logs from before the fix
 - the root cause with source evidence
-- the verified patch as a unified diff, produced and tested in a fresh `/tmp` clone/worktree
+- the verified patch as a unified diff, produced and tested in a fresh `${TMPDIR:-/tmp}` clone/worktree
 - verification logs from after the fix
 - the `lazycodex-generated` label and the footer tag `Tag: lazycodex-generated`
 - cleanup of temporary worktrees and clones
@@ -39,27 +39,58 @@ For `code-yeongyu/lazycodex`, create an issue (never a PR) that includes:
 
 1. Read the user's bug report and identify the affected surface.
 2. Invoke `$omo:debugging` for the investigation. If only unqualified skill names are exposed, invoke `$debugging` and state that it is the OMO debugging skill.
-3. Materialize the latest sources, then decide the target repository. Sync both checkouts on every run and compare them before choosing — a stale checkout routes the fix to the wrong repo:
+3. Materialize the latest sources under `LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"`, then decide the target repository. Sync both checkouts on every run and compare them before choosing. Validate cached checkouts before reuse so an incomplete `.git` directory cannot route the fix to the wrong repo:
 
 ```bash
+LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"
+mkdir -p "$LAZYCODEX_SOURCE_ROOT"
+
+valid_source_checkout() {
+  DEST="$1"
+  git -C "$DEST" rev-parse --is-inside-work-tree >/dev/null 2>&1 &&
+    git -C "$DEST" config --get remote.origin.url >/dev/null 2>&1
+}
+
+recover_corrupt_source_checkout() {
+  DEST="$1"
+  if [ -e "$DEST" ] && ! valid_source_checkout "$DEST"; then
+    QUARANTINED="$DEST.corrupt.$(date +%Y%m%d%H%M%S)"
+    mv "$DEST" "$QUARANTINED"
+    echo "Moved corrupt source cache $DEST to $QUARANTINED" >&2
+  fi
+}
+
 sync_latest_source() {
   REPO="$1"; DEST="$2"
-  if [ ! -d "$DEST/.git" ]; then
+  recover_corrupt_source_checkout "$DEST"
+  if [ ! -d "$DEST" ]; then
     gh repo clone "$REPO" "$DEST" -- --depth=1 \
       || git clone --depth=1 "https://github.com/$REPO" "$DEST"
   fi
+  if ! valid_source_checkout "$DEST"; then
+    echo "Source cache $DEST is not a usable git checkout after clone" >&2
+    return 1
+  fi
+  git -C "$DEST" remote set-url origin "https://github.com/$REPO.git" >/dev/null 2>&1 || true
   DEFAULT_BRANCH="$(git -C "$DEST" remote show origin | sed -n '/HEAD branch/s/.*: //p')"
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    DEFAULT_BRANCH="$(git -C "$DEST" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+  fi
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    echo "Could not determine default branch for $REPO in $DEST" >&2
+    return 1
+  fi
   git -C "$DEST" fetch --depth=1 origin "$DEFAULT_BRANCH"
   git -C "$DEST" checkout -B "$DEFAULT_BRANCH" FETCH_HEAD
 }
-sync_latest_source code-yeongyu/lazycodex /tmp/lazycodex-source
-sync_latest_source openai/codex /tmp/openai-codex-source
+sync_latest_source code-yeongyu/lazycodex "$LAZYCODEX_SOURCE_ROOT/lazycodex-source"
+sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/openai-codex-source"
 ```
-4. Create a fresh temporary clone and branch. Do not modify the user's current repository for the target fix unless the current repository is itself the requested target and the user explicitly asked for local edits.
+4. Create a fresh temporary clone and branch under `${TMPDIR:-/tmp}`. Do not modify the user's current repository for the target fix unless the current repository is itself the requested target and the user explicitly asked for local edits.
 
 ```bash
 TARGET_REPO="code-yeongyu/lazycodex" # or openai/codex
-WORK_ROOT="$(mktemp -d /tmp/lazycodex-fix-XXXXXX)"
+WORK_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/lazycodex-fix-XXXXXX")"
 gh repo clone "$TARGET_REPO" "$WORK_ROOT/repo" -- --depth=1
 cd "$WORK_ROOT/repo"
 BASE_BRANCH="$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')"
@@ -71,7 +102,7 @@ cd "$WORK_ROOT/worktree"
 
 If `gh` cannot clone, use `git clone --depth=1 "https://github.com/$TARGET_REPO" "$WORK_ROOT/repo"` and continue with the same worktree flow.
 
-5. Reproduce the bug in the worktree through the real surface. Save exact command output to `/tmp/lazycodex-fix-<short-slug>-repro.log`.
+5. Reproduce the bug in the worktree through the real surface. Save exact command output to `${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-repro.log`.
 6. Write or update a failing regression test before production changes. Confirm it fails for the bug, not for a missing fixture or typo.
 7. Implement the smallest correct fix. Avoid refactors unless the fix cannot be made safely without one.
 8. Run the regression test, adjacent tests, and the smallest real-surface QA command that proves the user-visible behavior changed.
@@ -89,7 +120,7 @@ git log --oneline "origin/$BASE_BRANCH..HEAD"
    - `code-yeongyu/lazycodex`: export the verified patch and write the issue body from the Verified-Fix Issue Template below:
 
 ```bash
-PATCH_FILE="/tmp/lazycodex-fix-<short-slug>.patch"
+PATCH_FILE="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>.patch"
 git diff "origin/$BASE_BRANCH"..HEAD > "$PATCH_FILE"
 ```
 
@@ -108,7 +139,7 @@ fi
    - `code-yeongyu/lazycodex`: create the verified-fix issue. Never push a branch to this repo and never run `gh pr create` against it:
 
 ```bash
-ISSUE_BODY="/tmp/lazycodex-fix-<short-slug>-issue.md"
+ISSUE_BODY="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-issue.md"
 gh issue create --repo code-yeongyu/lazycodex --title "<short fix title>" "${LABEL_ARGS[@]}" --body-file "$ISSUE_BODY"
 ```
 
@@ -184,8 +215,8 @@ Use the bundled script to generate the PR body. Create a JSON file with this sha
 Run:
 
 ```bash
-PR_INPUT="/tmp/lazycodex-fix-<short-slug>-pr.json"
-PR_BODY="/tmp/lazycodex-fix-<short-slug>-pr.md"
+PR_INPUT="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-pr.json"
+PR_BODY="${TMPDIR:-/tmp}/lazycodex-fix-<short-slug>-pr.md"
 node "<skill-root>/scripts/create-pr-body.mjs" "$PR_INPUT" "$PR_BODY"
 ```
 

package/dist/skills/lcx-contribute-bug-fix/agents/openai.yaml

@@ -9,4 +9,4 @@ interface:
     - "lazycodex fix"
     - "omo-codex bug fix"
     - "codex bug fix pr"
-  default_prompt: "Use $lcx-contribute-bug-fix to debug this LazyCodex or Codex bug, work from a fresh /tmp clone and worktree, implement the smallest verified fix, apply the lazycodex-generated label, deliver it (verified-fix issue on code-yeongyu/lazycodex — never a PR there; fork PR only for openai/codex), and clean up."
+  default_prompt: "Use $lcx-contribute-bug-fix to debug this LazyCodex or Codex bug, work from a fresh ${TMPDIR:-/tmp} clone and worktree, implement the smallest verified fix, apply the lazycodex-generated label, deliver it (verified-fix issue on code-yeongyu/lazycodex — never a PR there; fork PR only for openai/codex), and clean up."

package/dist/skills/lcx-doctor/SKILL.md

@@ -7,40 +7,73 @@ metadata:
 
 # lcx-doctor
 
-You are a LazyCodex install doctor. Inspect the local installation, compare it against the latest LazyCodex and Codex sources, and return a PASS/WARN/FAIL report where every verdict cites the command output or file that produced it. Diagnose only: the only writes you make are under `/tmp`. Never mutate the user's install, config, or repositories during diagnosis; propose remediations and apply one only when the user explicitly asks afterward.
+You are a LazyCodex install doctor. Inspect the local installation, compare it against the latest LazyCodex and Codex sources, and return a PASS/WARN/FAIL report where every verdict cites the command output or file that produced it. Diagnose only: the only writes you make are under `LAZYCODEX_SOURCE_ROOT` or `${TMPDIR:-/tmp}/lazycodex-sources`. Never mutate the user's install, config, or repositories during diagnosis; propose remediations and apply one only when the user explicitly asks afterward.
 
 Use GPT-5.5 style: outcome first, concise, evidence-bound.
 
 ## Required Workflow
 
-1. Materialize the latest sources under `/tmp` first. Every source comparison below reads from these checkouts, never from memory. Re-sync on every run so a cached checkout cannot go stale:
+1. Materialize the latest sources under `LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"` first. Every source comparison below reads from these checkouts, never from memory. Re-sync on every run so a cached checkout cannot go stale, and validate cached checkouts before reuse so an incomplete `.git` directory cannot poison diagnosis:
 
 ```bash
+LAZYCODEX_SOURCE_ROOT="${LAZYCODEX_SOURCE_ROOT:-${TMPDIR:-/tmp}/lazycodex-sources}"
+mkdir -p "$LAZYCODEX_SOURCE_ROOT"
+
+valid_source_checkout() {
+  DEST="$1"
+  git -C "$DEST" rev-parse --is-inside-work-tree >/dev/null 2>&1 &&
+    git -C "$DEST" config --get remote.origin.url >/dev/null 2>&1
+}
+
+recover_corrupt_source_checkout() {
+  DEST="$1"
+  if [ -e "$DEST" ] && ! valid_source_checkout "$DEST"; then
+    QUARANTINED="$DEST.corrupt.$(date +%Y%m%d%H%M%S)"
+    mv "$DEST" "$QUARANTINED"
+    echo "Moved corrupt source cache $DEST to $QUARANTINED" >&2
+  fi
+}
+
 sync_latest_source() {
   REPO="$1"; DEST="$2"
-  if [ ! -d "$DEST/.git" ]; then
+  recover_corrupt_source_checkout "$DEST"
+  if [ ! -d "$DEST" ]; then
     gh repo clone "$REPO" "$DEST" -- --depth=1 \
       || git clone --depth=1 "https://github.com/$REPO" "$DEST"
   fi
+  if ! valid_source_checkout "$DEST"; then
+    echo "Source cache $DEST is not a usable git checkout after clone" >&2
+    return 1
+  fi
+  git -C "$DEST" remote set-url origin "https://github.com/$REPO.git" >/dev/null 2>&1 || true
   DEFAULT_BRANCH="$(git -C "$DEST" remote show origin | sed -n '/HEAD branch/s/.*: //p')"
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    DEFAULT_BRANCH="$(git -C "$DEST" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+  fi
+  if [ -z "$DEFAULT_BRANCH" ]; then
+    echo "Could not determine default branch for $REPO in $DEST" >&2
+    return 1
+  fi
   git -C "$DEST" fetch --depth=1 origin "$DEFAULT_BRANCH"
   git -C "$DEST" checkout -B "$DEFAULT_BRANCH" FETCH_HEAD
 }
-sync_latest_source code-yeongyu/lazycodex /tmp/lazycodex-source
-sync_latest_source openai/codex /tmp/openai-codex-source
+sync_latest_source code-yeongyu/lazycodex "$LAZYCODEX_SOURCE_ROOT/lazycodex-source"
+sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/openai-codex-source"
 ```
 
 2. Inventory the installed surface. Resolve `CODEX_HOME` (default `~/.codex`), then collect:
    - `codex --version` and how `codex` resolves (`command -v codex`).
    - Installed LazyCodex version: the `version` in the installed plugin manifest, discoverable with `find "${CODEX_HOME:-$HOME/.codex}/plugins" -path '*/.codex-plugin/plugin.json'`. Installed plugins live under `$CODEX_HOME/plugins/cache/<marketplace>/<name>/<version>/`.
-   - Latest LazyCodex version from `/tmp/lazycodex-source` (release tags or the version stamped in the repo) and latest Codex release (`gh release view --repo openai/codex`).
+   - Latest LazyCodex version from `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` (release tags or the version stamped in the repo) and latest Codex release (`gh release view --repo openai/codex`).
    - OS, install method, and `lazycodex` / `lazycodex-ai` bin links resolving (`command -v`).
-3. Check config and wiring against the latest installer, not against assumptions. Read what the current installer under `/tmp/lazycodex-source` writes (installer sources live in the omo-codex package, e.g. `scripts/install/`), then verify the local equivalents:
+3. Check config and wiring against the latest installer, not against assumptions. Read what the current installer under `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` writes (installer sources live in the omo-codex package, e.g. `scripts/install/`), then verify the local equivalents:
    - `$CODEX_HOME/config.toml` exists and parses; LazyCodex-managed entries match what the latest installer would write.
-   - Plugin payload present and non-empty: `hooks/hooks.json`, `skills/`, `.mcp.json`, components under the installed plugin root.
+   - Plugin payload present and non-empty: read `.codex-plugin/plugin.json`; when that manifest declares a `hooks` array, validate every direct hook path declared by the manifest; require `hooks/hooks.json` only when the manifest declares it; do not require retired paths such as `components/workflow-selector` or `hooks/user-prompt-submit-selecting-lazycodex-workflow.json` unless the current manifest declares them.
+   - Verify the manifest-declared runtime payload, not a remembered source tree. Current payload includes `skills/`, `.mcp.json`, root CLI runtimes such as `dist/cli/index.js` and `dist/cli-node/index.js`, and every hook/MCP `components/*/dist/*.js` target referenced by installed manifests.
+   - Treat install-time materialization rewrites as expected when the rewritten target exists and is non-empty. For example, `.mcp.json` may use plugin-local or absolute installed paths for CodeGraph/MCP runtimes; that is PASS/WARN context, not payload drift. Missing or zero-byte rewritten targets are FAIL.
    - Stale project-local leftovers the installer now removes (e.g. `.codex/hooks.json`, `.codex/skills` in the project) are flagged, not deleted.
-4. Probe the real surface. Do not invoke `lazycodex doctor`; this skill is already running inside that doctor workflow, so calling it would recurse. Instead run non-recursive probes directly: `codex --version`, `command -v codex`, the bin-link checks above, config/plugin payload inspections, and a trivial non-interactive Codex invocation that loads the plugin. Capture stderr verbatim; a clean exit with warnings is WARN, not PASS.
-5. Compare for drift. Where installed bundled files differ from the same files at the installed version, or the latest source renamed or removed something the local config still references, record it with both paths.
+4. Probe the real surface. Do not invoke `lazycodex doctor`; this skill is already running inside that doctor workflow, so calling it would recurse. Instead run non-recursive probes directly: `codex --version`, `command -v codex`, the bin-link checks above, config/plugin payload inspections, and a trivial non-interactive Codex invocation that loads the plugin. Use the configured Codex default model for the runtime probe unless the user explicitly passed a model override to the doctor surface; never force a guessed/rejected model such as `gpt-5.5-codex-mini`. Capture stderr verbatim; a clean exit with warnings is WARN, not PASS.
+5. Compare for drift. Where installed manifest-declared bundled files differ from the same files at the installed version, or the latest source removed or renamed something the local config still references, record it with both paths. Do not report expected materialization differences, such as absolute `.mcp.json` runtime paths, as drift when their targets exist and are non-empty.
 6. Check whether each FAIL is already known: `gh issue list --repo code-yeongyu/lazycodex --search "<short symptom>" --state open` (and `openai/codex` when the failure points upstream). Link matches in the report instead of re-diagnosing from scratch.
 7. If a probe fails and the cause is not explained by config or source comparison, invoke `$omo:debugging` for the investigation. If Codex exposes only unqualified skill names in the current session, invoke `$debugging` and state that it is the OMO debugging skill.
 8. Emit the report.
@@ -67,7 +100,7 @@ sync_latest_source openai/codex /tmp/openai-codex-source
 | Plugin payload wiring | PASS/WARN/FAIL | [evidence] |
 | Bin links / aliases | PASS/WARN/FAIL | [evidence] |
 | Runtime probe | PASS/WARN/FAIL | [evidence] |
-| Drift vs latest source | PASS/WARN/FAIL | [evidence, citing /tmp/lazycodex-source or /tmp/openai-codex-source paths] |
+| Drift vs latest source | PASS/WARN/FAIL | [evidence, citing `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` or `$LAZYCODEX_SOURCE_ROOT/openai-codex-source` paths] |
 
 ### Remediations
 1. [Most important fix first: exact command or config edit, and what it resolves.]
@@ -79,7 +112,7 @@ sync_latest_source openai/codex /tmp/openai-codex-source
 ## Follow-up Routing
 
 - Local misconfiguration or stale install: give the remediation; reinstalling via the standard LazyCodex install command is the default fix for payload drift.
-- Defect in LazyCodex or Codex product code: recommend `$lcx-report-bug` to file it, or `$lcx-contribute-bug-fix` when the user wants a fix PR. Both reuse the `/tmp` checkouts you already synced.
+- Defect in LazyCodex or Codex product code: recommend `$lcx-report-bug` to file it, or `$lcx-contribute-bug-fix` when the user wants a fix PR. Both reuse the source-root checkouts you already synced.
 
 ## Stop Conditions
 
@@ -89,5 +122,7 @@ Do not:
 
 - mutate config, installs, or repositories during diagnosis
 - report a verdict without captured evidence
-- compare against remembered source layout instead of `/tmp/lazycodex-source` and `/tmp/openai-codex-source`
+- compare against remembered source layout instead of `$LAZYCODEX_SOURCE_ROOT/lazycodex-source` and `$LAZYCODEX_SOURCE_ROOT/openai-codex-source`
+- require retired payload paths that the current `.codex-plugin/plugin.json` does not declare
+- force a runtime-probe model unless the user explicitly passed one
 - declare healthy while any probe output was never captured