oh-my-opencode 4.13.0 → 4.14.1

package/packages/omo-codex/plugin/components/teammode/skills/teammode/scripts/team-state.mjs

@@ -9,8 +9,9 @@
 // this file stays the state concern only.
 
 import { randomUUID } from "node:crypto";
-import { lstat, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 
 export const LENSES = ["area", "ownership", "perspective"];
 export const MEMBER_STATUSES = ["pending", "active", "reported", "blocked", "archived"];
@@ -24,6 +25,8 @@ export function isUnderstaffed(team) {
 // A team dir is a single child of .omo/teams. This pattern alone blocks "/", "\", and a
 // leading "." so ".." and "a/b" can never name a team dir (the escape guard).
 const SESSION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const LOCK_TIMEOUT_MS = Number.parseInt(process.env.OMO_TEAMMODE_LOCK_TIMEOUT_MS ?? "10000", 10);
+const LOCK_RETRY_MS = Number.parseInt(process.env.OMO_TEAMMODE_LOCK_RETRY_MS ?? "25", 10);
 
 function isoNow(now) {
 	return now ?? new Date().toISOString();
@@ -233,6 +236,65 @@ async function lstatOrNull(p) {
 	});
 }
 
+function positiveIntegerOrFallback(value, fallback) {
+	return Number.isInteger(value) && value > 0 ? value : fallback;
+}
+
+async function readLockOwner(lockDir) {
+	return readFile(join(lockDir, "owner.json"), "utf8")
+		.then((content) => JSON.parse(content))
+		.catch(() => null);
+}
+
+async function describeLockOwner(lockDir) {
+	const owner = await readLockOwner(lockDir);
+	if (!owner || typeof owner !== "object") return "another team.mjs command";
+	const parts = [];
+	if (owner.command) parts.push(String(owner.command));
+	if (owner.pid) parts.push(`pid ${owner.pid}`);
+	if (owner.createdAt) parts.push(`since ${owner.createdAt}`);
+	return parts.length > 0 ? parts.join(", ") : "another team.mjs command";
+}
+
+export async function withTeamLock(dir, command, fn, options = {}) {
+	const timeoutMs = positiveIntegerOrFallback(options.timeoutMs ?? LOCK_TIMEOUT_MS, 10000);
+	const retryMs = positiveIntegerOrFallback(options.retryMs ?? LOCK_RETRY_MS, 25);
+	const lockDir = join(dir, ".team.lock");
+	const deadline = Date.now() + timeoutMs;
+	let acquired = false;
+	for (;;) {
+		try {
+			await mkdir(lockDir, { mode: 0o700 });
+			acquired = true;
+			await writeFile(
+				join(lockDir, "owner.json"),
+				`${JSON.stringify({ pid: process.pid, command, createdAt: new Date().toISOString() }, null, 2)}\n`,
+				{ encoding: "utf8", flag: "wx" },
+			);
+			break;
+		} catch (error) {
+			if (acquired) {
+				await rm(lockDir, { recursive: true, force: true });
+				throw error;
+			}
+			if (!error || error.code !== "EEXIST") throw error;
+			const st = await lstatOrNull(lockDir);
+			if (st?.isSymbolicLink()) throw new Error(`refused: team lock path is a symlink: ${lockDir}`);
+			if (st && !st.isDirectory()) throw new Error(`refused: team lock path is not a directory: ${lockDir}`);
+			if (Date.now() >= deadline) {
+				const owner = await describeLockOwner(lockDir);
+				throw new Error(`team state is locked by ${owner}; retry after that command completes`);
+			}
+			await delay(Math.min(retryMs, Math.max(1, deadline - Date.now())));
+		}
+	}
+	try {
+		return await fn();
+	} finally {
+		await rm(lockDir, { recursive: true, force: true });
+	}
+}
+
 // Create a directory chain refusing any symlinked component, so team state can never be
 // written through a symlink that escapes the workspace.
 async function mkdirNoSymlink(dir, stopAt) {

package/packages/omo-codex/plugin/components/teammode/skills/teammode/scripts/team.mjs

@@ -20,7 +20,7 @@ import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { buildGuide, buildMemberPrompt } from "./team-guide.mjs";
+import { buildGuide, buildMemberPrompt, codexThreadLink } from "./team-guide.mjs";
 import {
 	addMember,
 	archive,
@@ -35,6 +35,7 @@ import {
 	setMemberStatus,
 	setMemberWorktree,
 	teamExists,
+	withTeamLock,
 	writeGuideAtomic,
 	writeTeamAtomic,
 } from "./team-state.mjs";
@@ -82,57 +83,71 @@ async function persist(team, dir) {
 	await writeGuideAtomic(team, buildGuide(team), dir);
 }
 
+async function mutateTeam(cwd, sessionId, command, fn) {
+	const dir = await assertSafeTeamDir(cwd, sessionId);
+	return withTeamLock(dir, command, async () => {
+		const team = await readTeam(dir);
+		return fn(team, dir);
+	});
+}
+
 const handlers = {
 	async init(cwd, flags) {
 		const teamName = requireFlag(flags, "name");
 		const sessionName = requireFlag(flags, "session-name");
 		const sessionId = typeof flags.session === "string" ? flags.session : `team-${randomUUID().slice(0, 8)}`;
 		const dir = await ensureTeamDir(cwd, sessionId);
-		if (await teamExists(dir)) {
-			process.stdout.write(`exists: ${dir} (left untouched; re-init is a safe no-op)\n`);
-			return;
-		}
-		const team = buildTeam({
-			teamName,
-			sessionName,
-			sessionId,
-			dir,
-			worktreeEnabled: flags.worktree === true,
-			baseBranch: typeof flags["base-branch"] === "string" ? flags["base-branch"] : "dev",
+		await withTeamLock(dir, "init", async () => {
+			if (await teamExists(dir)) {
+				process.stdout.write(`exists: ${dir} (left untouched; re-init is a safe no-op)\n`);
+				return;
+			}
+			const team = buildTeam({
+				teamName,
+				sessionName,
+				sessionId,
+				dir,
+				worktreeEnabled: flags.worktree === true,
+				baseBranch: typeof flags["base-branch"] === "string" ? flags["base-branch"] : "dev",
+			});
+			await persist(team, dir);
+			process.stdout.write(`created: ${dir}\n`);
+			process.stdout.write(`team.json + guide.md written; artifacts/ ready. session id: ${sessionId}\n`);
+			process.stdout.write(`next: add-member --team ${sessionId} --id A --name "<short role>" --focus "<part/ownership/perspective>" --lens area|ownership|perspective --deliverable "<...>"\n`);
 		});
-		await persist(team, dir);
-		process.stdout.write(`created: ${dir}\n`);
-		process.stdout.write(`team.json + guide.md written; artifacts/ ready. session id: ${sessionId}\n`);
-		process.stdout.write(`next: add-member --team ${sessionId} --id A --name "<short role>" --focus "<part/ownership/perspective>" --lens area|ownership|perspective --deliverable "<...>"\n`);
 	},
 
 	async "add-member"(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
 		const memberId = requireFlag(flags, "id").trim();
-		addMember(team, {
+		const memberInput = {
 			id: memberId,
 			name: typeof flags.name === "string" ? flags.name : null,
 			focus: requireFlag(flags, "focus"),
 			lens: requireFlag(flags, "lens"),
 			deliverable: typeof flags.deliverable === "string" ? flags.deliverable : "",
 			branch: typeof flags.branch === "string" ? flags.branch : null,
+		};
+		const { team, member } = await mutateTeam(cwd, sessionId, "add-member", async (team, dir) => {
+			addMember(team, memberInput);
+			await persist(team, dir);
+			return { team, member: team.members.find((m) => m.id === memberId) };
 		});
-		await persist(team, dir);
-		const member = team.members.find((m) => m.id === memberId);
 		process.stdout.write(`added member ${memberId} to team ${sessionId}.\n\nSend this as the new thread's first message (title the thread "${member.threadTitle}"):\n---\n${buildMemberPrompt(team, memberId)}\n---\n`);
 	},
 
 	async "bind-thread"(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
-		bindThread(team, {
+		const input = {
 			id: requireFlag(flags, "id"),
 			threadId: requireFlag(flags, "thread"),
 			cwd: typeof flags.cwd === "string" ? flags.cwd : null,
 			worktreePath: typeof flags["worktree-path"] === "string" ? flags["worktree-path"] : null,
+		};
+		await mutateTeam(cwd, sessionId, "bind-thread", async (team, dir) => {
+			bindThread(team, input);
+			await persist(team, dir);
 		});
-		await persist(team, dir);
 		process.stdout.write(`bound member ${flags.id} to thread ${flags.thread}.\n`);
 	},
 
@@ -144,38 +159,49 @@ const handlers = {
 
 	async "set-status"(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
-		setMemberStatus(team, {
+		const input = {
 			id: requireFlag(flags, "id"),
 			status: requireFlag(flags, "status"),
 			note: typeof flags.note === "string" ? flags.note : "",
+		};
+		await mutateTeam(cwd, sessionId, "set-status", async (team, dir) => {
+			setMemberStatus(team, input);
+			await persist(team, dir);
 		});
-		await persist(team, dir);
 		process.stdout.write(`member ${flags.id} -> ${flags.status}\n`);
 	},
 
 	async "worktree-add"(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
-		const member = memberOrThrow(team, requireFlag(flags, "id"));
-		const result = addMemberWorktree(cwd, team, member, {
-			baseBranch: typeof flags["base-branch"] === "string" ? flags["base-branch"] : null,
+		const memberId = requireFlag(flags, "id");
+		const baseBranch = typeof flags["base-branch"] === "string" ? flags["base-branch"] : null;
+		const { member, result } = await mutateTeam(cwd, sessionId, "worktree-add", async (team, dir) => {
+			const member = memberOrThrow(team, memberId);
+			const result = addMemberWorktree(cwd, team, member, { baseBranch });
+			setMemberWorktree(team, { id: member.id, path: result.path, branch: result.branch });
+			await persist(team, dir);
+			return { member, result };
 		});
-		setMemberWorktree(team, { id: member.id, path: result.path, branch: result.branch });
-		await persist(team, dir);
 		const note = result.created ? "" : " (already exists)";
+		const thread = member.threadId
+			? `\nMember thread: ${codexThreadLink(member.threadId)}\nTell that member to: cd "${result.path}"`
+			: "\nMember thread is not bound yet; wait for the real Codex thread id, then bind-thread before sending bootstrap. After binding, send the member this worktree path.";
 		process.stdout.write(
-			`worktree for member ${member.id}${note}: ${result.path} on branch ${result.branch} (off ${result.base}).\nTell that member to: cd "${result.path}"\n`,
+			`worktree for member ${member.id}${note}: ${result.path} on branch ${result.branch} (off ${result.base}).${thread}\n`,
 		);
 	},
 
 	async "worktree-remove"(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
-		const member = memberOrThrow(team, requireFlag(flags, "id"));
-		removeMemberWorktree(cwd, team, member, { force: flags.force === true });
-		clearMemberWorktree(team, { id: member.id });
-		await persist(team, dir);
+		const memberId = requireFlag(flags, "id");
+		const force = flags.force === true;
+		const member = await mutateTeam(cwd, sessionId, "worktree-remove", async (team, dir) => {
+			const member = memberOrThrow(team, memberId);
+			removeMemberWorktree(cwd, team, member, { force });
+			clearMemberWorktree(team, { id: member.id });
+			await persist(team, dir);
+			return member;
+		});
 		process.stdout.write(`removed worktree for member ${member.id}\n`);
 	},
 
@@ -205,25 +231,30 @@ const handlers = {
 
 	async archive(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
-		archive(team, {
+		const input = {
 			id: typeof flags.id === "string" ? flags.id : null,
 			note: typeof flags.note === "string" ? flags.note : "",
+		};
+		await mutateTeam(cwd, sessionId, "archive", async (team, dir) => {
+			archive(team, input);
+			await persist(team, dir);
 		});
-		await persist(team, dir);
 		process.stdout.write(flags.id ? `archived member ${flags.id}\n` : `archived team ${sessionId} and closed all members\n`);
 	},
 
 	async delete(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
-		const active = team.members.filter((m) => m.status !== "archived");
-		if (flags.force !== true && (team.status !== "archived" || active.length > 0)) {
-			throw new Error(
-				`refused: team "${sessionId}" is not archived or still has ${active.length} active member(s). Archive first, or pass --force to delete anyway.`,
-			);
-		}
-		await rm(dir, { recursive: true, force: true });
+		const dir = await assertSafeTeamDir(cwd, sessionId);
+		await withTeamLock(dir, "delete", async () => {
+			const team = await readTeam(dir);
+			const active = team.members.filter((m) => m.status !== "archived");
+			if (flags.force !== true && (team.status !== "archived" || active.length > 0)) {
+				throw new Error(
+					`refused: team "${sessionId}" is not archived or still has ${active.length} active member(s). Archive first, or pass --force to delete anyway.`,
+				);
+			}
+			await rm(dir, { recursive: true, force: true });
+		});
 		process.stdout.write(`deleted team state: ${dir}\n`);
 	},
 
@@ -232,7 +263,8 @@ const handlers = {
 		const { team } = await loadTeam(cwd, sessionId);
 		process.stdout.write(`Team ${team.teamName} [${team.status}] - leader: main session - ${team.members.length} member(s)\n`);
 		for (const m of team.members) {
-			process.stdout.write(`  ${m.id} (${m.lens}) ${m.focus} -> ${m.deliverable || "(no deliverable)"} [${m.status}]${m.threadId ? ` thread=${m.threadId}` : ""}${m.cwd ? ` cwd=${m.cwd}` : ""}\n`);
+			const thread = m.threadId ? ` thread=${m.threadId} link=${codexThreadLink(m.threadId)}` : "";
+			process.stdout.write(`  ${m.id} (${m.lens}) ${m.focus} -> ${m.deliverable || "(no deliverable)"} [${m.status}]${thread}${m.cwd ? ` cwd=${m.cwd}` : ""}\n`);
 		}
 		if (isUnderstaffed(team)) {
 			process.stdout.write(
@@ -243,9 +275,11 @@ const handlers = {
 
 	async guide(cwd, flags) {
 		const sessionId = requireFlag(flags, "team");
-		const { dir, team } = await loadTeam(cwd, sessionId);
-		await writeGuideAtomic(team, buildGuide(team), dir);
-		process.stdout.write(`${team.paths.guide}\n`);
+		const guidePath = await mutateTeam(cwd, sessionId, "guide", async (team, dir) => {
+			await writeGuideAtomic(team, buildGuide(team), dir);
+			return team.paths.guide;
+		});
+		process.stdout.write(`${guidePath}\n`);
 	},
 };
 

package/packages/omo-codex/plugin/components/teammode/src/codex-hook.ts

@@ -64,7 +64,7 @@ function threadTitleReminder(threadReference: ThreadCreationReference): string {
 	const id = formatIdentifier(threadReference.id);
 	return threadReference.kind === "thread"
 		? `THREAD ID ${id}: CALL codex_app.set_thread_title NOW. USE THE REAL TASK/ROLE.`
-		: `PENDING WORKTREE ID ${id}: CALL codex_app.set_thread_title AS SOON AS THREAD ID EXISTS. USE THE REAL TASK/ROLE.`;
+		: `PENDING WORKTREE ID ${id}: WORKTREE THREAD IS NOT READY YET. DO NOT bind-thread OR SEND THE MEMBER BOOTSTRAP UNTIL A REAL THREAD ID EXISTS. THEN CALL codex_app.set_thread_title USING THE REAL TASK/ROLE.`;
 }
 
 function formatIdentifier(value: string): string {
@@ -73,18 +73,33 @@ function formatIdentifier(value: string): string {
 }
 
 function extractThreadCreationReference(toolResponse: unknown): ThreadCreationReference | null {
-	if (!isRecord(toolResponse)) return null;
-	const threadId = toolResponse["threadId"];
+	const response = parseToolResponseRecord(toolResponse);
+	if (response === null) return null;
+	const threadId = response["threadId"];
 	if (typeof threadId === "string" && threadId.trim().length > 0) {
 		return { kind: "thread", id: threadId };
 	}
-	const pendingWorktreeId = toolResponse["pendingWorktreeId"];
+	const pendingWorktreeId = response["pendingWorktreeId"];
 	if (typeof pendingWorktreeId === "string" && pendingWorktreeId.trim().length > 0) {
 		return { kind: "pendingWorktree", id: pendingWorktreeId };
 	}
 	return null;
 }
 
+function parseToolResponseRecord(toolResponse: unknown): Record<string, unknown> | null {
+	if (isRecord(toolResponse)) return toolResponse;
+	if (typeof toolResponse !== "string") return null;
+	const trimmed = toolResponse.trim();
+	if (trimmed.length === 0) return null;
+	try {
+		const parsed: unknown = JSON.parse(trimmed);
+		return isRecord(parsed) ? parsed : null;
+	} catch (error) {
+		if (error instanceof SyntaxError) return null;
+		return null;
+	}
+}
+
 function isPostToolUsePayload(value: unknown): value is PostToolUsePayload {
 	if (!isRecord(value)) return false;
 	return (

package/packages/omo-codex/plugin/components/teammode/test/thread-title-hook.test.ts

@@ -34,6 +34,36 @@ describe("thread title PostToolUse guidance", () => {
 		);
 	});
 
+	it("#given Codex reports create_thread output as a JSON string #when the hook runs #then it still extracts the thread id", () => {
+		// given
+		const output = runPostToolUseHook({
+			hook_event_name: "PostToolUse",
+			session_id: "s-team",
+			turn_id: "t-team",
+			transcript_path: null,
+			cwd: "/repo",
+			model: "gpt-5.5",
+			permission_mode: "default",
+			tool_name: "codex_app.create_thread",
+			tool_use_id: "tool-create-thread",
+			tool_input: {
+				prompt: "Review a worktree PR",
+				target: { type: "project", projectId: "/repo", environment: { type: "local" } },
+			},
+			tool_response: '{"threadId":"019ef350-ee78-72a3-bd5e-e40cebc3d814"}',
+		});
+
+		// when
+		const parsed: unknown = JSON.parse(output);
+
+		// then
+		expect(isHookOutput(parsed)).toBe(true);
+		if (!isHookOutput(parsed)) return;
+		expect(parsed.hookSpecificOutput.additionalContext).toBe(
+			"THREAD ID 019ef350-ee78-72a3-bd5e-e40cebc3d814: CALL codex_app.set_thread_title NOW. USE THE REAL TASK/ROLE.",
+		);
+	});
+
 	it("#given an unrelated tool completed #when the hook runs #then it stays silent", () => {
 		// given
 		const output = runPostToolUseHook({
@@ -57,7 +87,7 @@ describe("thread title PostToolUse guidance", () => {
 		expect(actual).toBe("");
 	});
 
-	it("#given worktree-backed thread creation is pending #when the hook runs #then it tells Codex to title the thread once the thread id exists", () => {
+	it("#given worktree-backed thread creation is pending #when the hook runs #then it tells Codex to wait for the real thread before bootstrapping", () => {
 		// given
 		const output = runPostToolUseHook({
 			hook_event_name: "PostToolUse",
@@ -89,7 +119,7 @@ describe("thread title PostToolUse guidance", () => {
 		expect(isHookOutput(parsed)).toBe(true);
 		if (!isHookOutput(parsed)) return;
 		expect(parsed.hookSpecificOutput.additionalContext).toBe(
-			"PENDING WORKTREE ID remote-control:env:test-worktree: CALL codex_app.set_thread_title AS SOON AS THREAD ID EXISTS. USE THE REAL TASK/ROLE.",
+			"PENDING WORKTREE ID remote-control:env:test-worktree: WORKTREE THREAD IS NOT READY YET. DO NOT bind-thread OR SEND THE MEMBER BOOTSTRAP UNTIL A REAL THREAD ID EXISTS. THEN CALL codex_app.set_thread_title USING THE REAL TASK/ROLE.",
 		);
 	});
 });

package/packages/omo-codex/plugin/components/telemetry/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-telemetry",
-	"version": "4.13.0",
+	"version": "4.14.1",
 	"description": "Codex plugin component that emits omo-codex anonymous daily-active telemetry on SessionStart.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ultrawork/README.md

@@ -9,7 +9,7 @@ Bundled Codex agent role TOMLs in `agents/` are installed into `CODEX_HOME/agent
 | Mandate | Behavior |
 |---|---|
 | Goal + binding success criteria | Call `create_goal` (or open with a `# Goal` block) listing the deliverable + **3+ realistic QA scenarios** (happy path, edge cases, adjacent-surface regression). Each scenario MUST name which **Manual-QA channel** it will use. "Tests pass" is supporting signal, NEVER completion proof. |
-| Manual-QA channels (TESTS ALONE NEVER PROVE DONE) | A dedicated top-level section enumerates the **four** channels you can use to verify a criterion in reality: **(1) HTTP call** (`curl -i` / Playwright APIRequestContext), **(2) tmux** (`tmux new-session` + `send-keys` + `capture-pane`), **(3) Browser use** (Playwright / puppeteer / Chromium driving the real page), **(4) Computer use** (OS-level GUI automation against the running app). Every criterion picks one channel, builds a real-usage scenario, runs it, and captures the artifact — every time. Aux surfaces (CLI stdout / DB diff / parsed config) only count for genuinely CLI- or data-shaped criteria. |
+| Manual-QA channels (TESTS ALONE NEVER PROVE DONE) | A dedicated top-level section enumerates the **four** channels you can use to verify a criterion in reality: **(1) HTTP call** (`curl -i` / Playwright APIRequestContext), **(2) tmux** (`tmux new-session` + `send-keys` + `capture-pane`), **(3) Browser use** (in Codex, `browser:control-in-app-browser` first when no authenticated/persistent browser profile is needed; otherwise Playwright / puppeteer / Chromium driving the real page), **(4) Computer use** (OS-level GUI automation against the running app). Every criterion picks one channel, builds a real-usage scenario, runs it, and captures the artifact — every time. Aux surfaces (CLI stdout / DB diff / parsed config) only count for genuinely CLI- or data-shaped criteria. |
 | Surface + paired cleanup | Execution loop step 4 (**SURFACE-AS-SCENARIO**) runs the chosen channel scenario end-to-end. Step 5 (**CLEANUP, PAIRED**) tears down every QA-spawned process / tmux session / browser context / container / port / temp dir, with a one-line receipt appended to the notepad. Leftover state → NOT done. |
 | Durable /tmp notepad | `mktemp -t ulw-$(date +%Y%m%d-%H%M%S).XXXXXX.md` with sections `Plan`, `Success criteria + QA scenarios`, `Now`, `Todo`, `Findings`, `Learnings`. **Append**, never rewrite. |
 | Obsessive atomic todos | Every action — even one-line edits, `ls`, single test runs — becomes a todo. Format: `path: <action> for <criterion> — verify by <check>`. One in_progress at a time, mark completed immediately. |

package/packages/omo-codex/plugin/components/ultrawork/agents/explorer.toml

@@ -46,7 +46,7 @@ If asked "where is auth?", explain the auth flow you found.]
 </results>
 
 # Tool strategy (parallel, flood the first wave)
-- Use `omo sparkshell <command>` first for repo-wide inspection, CLI smoke tests, git/history checks, and bounded command output. Raw `rg`/`grep`/`cat`/`git` are fallbacks when Sparkshell is unavailable or too narrow. Use `omo sparkshell --shell '<command>'` only for shell metacharacters or pipelines. Use `omo sparkshell --tmux-pane <pane-id> --tail-lines 400` only to inspect an existing tmux pane, never to launch ordinary commands.
+- Repo-wide inspection, CLI smoke tests, git/history checks, and bounded command output -> use native shell commands directly: `rg`, `rg --files`, `cat`, and `git`. Narrow huge output before reading it.
 - Symbol questions -> `lsp_goto_definition`, `lsp_find_references`, `lsp_symbols`, `lsp_diagnostics`.
 - Structural shapes -> the `ast-grep` skill helper or `sg` CLI with `$VAR` / `$$$` metavars.
 - Text / strings / comments / logs -> `rg` (grep).

package/packages/omo-codex/plugin/components/ultrawork/agents/plan.toml

@@ -107,10 +107,10 @@ Critical path: Task 1 -> Task 2 -> Task 6
   - [ ] <verifiable condition with the exact command or assertion>
 
   QA scenarios (MANDATORY - task incomplete without these):
-  > Name the exact tool AND its exact invocation - not "verify it works". Browser use: use Chrome to drive the page; if Chrome is not available, download and use agent-browser (https://github.com/vercel-labs/agent-browser). Computer use: OS-level GUI automation for a non-browser desktop app.
+  > Name the exact tool AND its exact invocation - not "verify it works". Browser use: in Codex, use `browser:control-in-app-browser` first when available and no authenticated/persistent user browser profile is required; otherwise use Chrome to drive the page, or agent-browser (https://github.com/vercel-labs/agent-browser) when Chrome is unavailable. Computer use: OS-level GUI automation for a non-browser desktop app.
   ```
   Scenario: <happy path>
-    Tool:     <bash | curl | tmux | playwright(real Chrome) | agent-browser | computer-use>
+    Tool:     <bash | curl | tmux | browser:control-in-app-browser | playwright(real Chrome) | agent-browser | computer-use>
     Steps:    <exact command / API call / page action with concrete inputs - URL, payload, keystrokes, selectors>
     Expected: <concrete, binary pass/fail observable>
     Evidence: .omo/evidence/task-<N>-<slug>.<ext>

package/packages/omo-codex/plugin/components/ultrawork/directive.md

@@ -52,8 +52,10 @@ exercises the surface; capture the artifact.
   2. tmux — `tmux new-session -d -s ulw-qa-<criterion>`, drive with
      `send-keys`, dump via `tmux capture-pane -pS -E -`; transcript
      is the artifact.
-  3. Browser use — use Chrome to drive the REAL page; if Chrome is
-     not available, download and use agent-browser
+  3. Browser use — in Codex, use `browser:control-in-app-browser`
+     first when available and no authenticated/persistent user browser
+     profile is required. Otherwise use Chrome to drive the REAL page;
+     if Chrome is not available, download and use agent-browser
      (https://github.com/vercel-labs/agent-browser). Capture action
      log + screenshot path. Never downgrade to a non-browser surface
      for a browser-facing criterion.
@@ -68,7 +70,8 @@ upfront: the literal command / API call / page action with its concrete
 inputs (URL, payload, keystrokes, selectors) and the single binary
 observable that decides PASS vs FAIL. "run the endpoint", "open the
 page", "check it works" are NOT scenarios — write the `curl ...`, the
-`send-keys ...`, the `page.click(...)`, the expected status/text.
+`send-keys ...`, the Browser plugin action, the `page.click(...)`, the
+expected status/text.
 
 Auxiliary surfaces (CLI stdout / DB state diff / parsed config dump)
 are first-class evidence for CLI- or data-shaped criteria; use a
@@ -76,6 +79,14 @@ channel scenario when the behavior is user-facing. `--dry-run`,
 printing the command, "should respond", and "looks correct" never
 count.
 
+For TUI visual QA, terminal transcripts alone are not enough when a
+visual surface is being evaluated. In this repo, prefer
+`node script/qa/web-terminal-visual-qa.mjs --title "<surface>" --from-file <capture.txt> --evidence-dir <dir>`
+or the helper's `--command` tmux-backed PTY connector when available.
+Outside this repo, capture equivalent browser/computer-use rendered
+terminal evidence: screenshot, plain transcript, rendered HTML or action
+log, and cleanup receipt.
+
 # Bootstrap (DO ALL FOUR BEFORE ANY OTHER WORK — NO SKIPPING)
 
 ## 0. Survey the skills, then size the work
@@ -143,8 +154,8 @@ artifact path the moment it happens. Update `## Now` and
 is your durable memory and it OUTLIVES the context window. After any
 compaction or context loss (a `Context compacted` notice, a summarized
 history, or you no longer see your own earlier steps), STOP and re-read
-the WHOLE notepad FIRST — `omo sparkshell cat "$NOTE"`, or read the path
-directly — before any other action, then resume from `## Now`. Recover
+the WHOLE notepad FIRST before any other action, then resume from
+`## Now`. Recover
 state from the notepad; do not re-plan from scratch or re-run completed
 steps.
 
@@ -178,11 +189,8 @@ serialize only when one output strictly feeds the next.
   inactive/uninitialized, or cold-start unavailable, keep moving with
   Read/Grep/Glob/LSP and the ast-grep skill.
 - Repo-wide inspection, CLI smoke tests, git/history, bounded command
-  output → use `omo sparkshell <command>` first. Raw
-  `rg`/`grep`/`cat`/`git` are fallbacks when Sparkshell is unavailable
-  or too narrow. `--shell` is only for shell metacharacters or
-  pipelines; `--tmux-pane` is only for inspecting an existing pane,
-  never for launching ordinary commands. Sparkshell is your default lens.
+  output → use native shell commands directly: `rg`, `rg --files`,
+  `cat`, and `git`. Narrow huge output before reading it.
 - Symbols — definitions, references, rename impact, diagnostics →
   `lsp_goto_definition`, `lsp_find_references`, `lsp_symbols`,
   `lsp_diagnostics`. Use the LSP, not text search, for anything

package/packages/omo-codex/plugin/components/ultrawork/dist/cli.js

@@ -80,7 +80,7 @@ function isContextPressureTranscript(transcriptPath) {
   if (transcriptPath === undefined || transcriptPath === null)
     return false;
   try {
-    return isContextPressureRecoveryPrompt(readFileSync2(transcriptPath, "utf8"));
+    return isContextPressureRecoveryPrompt(readTranscriptTail(transcriptPath));
   } catch (error) {
     if (error instanceof Error)
       return false;

package/packages/omo-codex/plugin/components/ultrawork/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-ultrawork",
-	"version": "4.13.0",
+	"version": "4.14.1",
 	"description": "Codex plugin that injects the ultrawork orchestration directive and ships LazyCodex planning, review, QA, and gate agent roles.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ultrawork/skills/ulw-plan/SKILL.md

@@ -15,10 +15,12 @@ Outcome-first: explore a lot, ask few sharp questions - or none, when the intent
 
 ## INTENT ROUTING - pick ONE intent reference
 
-After grounding, make ONE judgment and load ONE intent reference (you ALSO read `references/full-workflow.md` for the shared mechanics - see below). The test keys on whether the desired **OUTCOME** is clear, NOT on request length.
+Before routing, parse review modifiers separately. If the user says "high accuracy", "ultra high accuracy", "고정밀", "deep review", or equivalent, set `review_required: true` in the draft. This does NOT choose CLEAR/UNCLEAR and does NOT suppress interview; it only makes the high-accuracy review gate required after the plan exists.
+
+After grounding, make ONE judgment, record `intent: clear|unclear` plus `review_required`, and load ONE intent reference (you ALSO read `references/full-workflow.md` for the shared mechanics - see below). The test keys on whether the desired **OUTCOME** is clear, NOT on request length.
 
 - **OVERRIDE - explicit ask wins:** if the user explicitly asks to be questioned or interviewed ("ask me", "interview me", "why aren't you asking me" - in any language), route **CLEAR**, run the interview, and turn the adopt-default filter OFF: the user has claimed the forks, so every surviving one is ASKED, not defaulted. This beats the OUTCOME test below, even on a fuzzy brief.
-- **CLEAR** - the user knows the outcome; the only open items are preferences/tradeoffs the repo cannot answer (genuine owner-decisions). Read **`references/intent-clear.md`**: ask the surviving forks with WHY, run the normal approval gate, high-accuracy review is OPTIONAL (offered as one question).
+- **CLEAR** - the user knows the outcome; the only open items are preferences/tradeoffs the repo cannot answer (genuine owner-decisions). Read **`references/intent-clear.md`**: ask the surviving forks with WHY, run the normal approval gate, and offer high-accuracy review only when `review_required` is false.
 - **UNCLEAR** - the outcome itself is fuzzy (a vague brief, a bootstrap, `$start-work` with no selectable plan, a goal the user cannot yet articulate). Asking would offload your own job onto the user. Read **`references/intent-unclear.md`**: research maximally, adopt and ANNOUNCE best-practice defaults, do NOT ask the user extra questions, and run high-accuracy review AUTOMATICALLY (unless Classify sized the work Trivial).
 - **ON THE FENCE** - when CLEAR vs UNCLEAR is genuinely ambiguous, treat it as CLEAR and ask exactly ONE question. A user wrongly silenced is worse than one extra question. The dominant failure to guard against is mis-routing a CLEAR request to UNCLEAR, which silently applies defaults and overrides forks the user wanted to own.
 
@@ -47,7 +49,7 @@ Run it ONCE at plan generation. A plain re-run on an existing plan is a safe no-
 - **Explore to sufficiency, then STOP.** One research wave per open question; stop when the clearance check is answerable; never re-explore to double-check.
 - **Parallel-dispatch** independent research in ONE turn and keep working while it runs. Subagent outputs are CLAIMS until you independently verify them.
 - **Approval is not execution.** Approval authorizes writing the plan ONLY, never implementation. ONE request -> ONE plan, however large.
-- **The durable draft is the resume point.** Record decisions, the approval gate, and the ledgers to `.omo/drafts/<slug>.md` as you go; on any later turn read it and resume at the gate.
+- **The durable draft is the resume point.** Record `intent`, `review_required`, decisions, the approval gate, and the ledgers to `.omo/drafts/<slug>.md` as you go; on any later turn read it and resume from those fields instead of rerouting from memory.
 - **Agent-executed QA per todo** (happy + failure, exact tool + invocation, evidence path). Zero human-intervention verification. Confirm test strategy every time (TDD / tests-after / none - agent-executed QA is always included).
 
 ## Approval gate
@@ -66,5 +68,5 @@ Roles: `explorer` (internal patterns/conventions/tests), `librarian` (external d
 
 ## Stop rules
 
-- Plan file exists, template filled, every todo has references + acceptance + QA + commit, dependency matrix consistent: present the summary, then (CLEAR) ask the start-or-high-accuracy question, or (UNCLEAR) lead with the best-practice brief - and stop. **Never begin execution yourself.**
+- Plan file exists, template filled, every todo has references + acceptance + QA + commit, dependency matrix consistent, and any required high-accuracy receipts are recorded: present the summary, then (CLEAR without `review_required`) ask the start-or-high-accuracy question, or (CLEAR with `review_required` / UNCLEAR) report the review result - and stop. **Never begin execution yourself.**
 - Brief presented and `status: awaiting-approval` recorded: wait. Do not re-explore unless the user changes scope.