oh-my-opencode 5.0.0-beta.4 → 5.0.0-beta.42

package/packages/omo-codex/plugin/skills/ultimate-browsing/ATTRIBUTION.md

@@ -1,19 +1,46 @@
 # ATTRIBUTION / NOTICE
 
 This skill (`ultimate-browsing`, part of `@oh-my-opencode/shared-skills`) ships
-project-original content plus two third-party tools that it installs at runtime
-(it does NOT vendor their source). Each runtime tool's license and required
-notices are reproduced below.
+project-original content, one vendored-and-modified upstream engine, plus two
+third-party tools that it installs at runtime (it does NOT vendor their source).
+Each component's provenance, license, and required notices are reproduced below.
 
 ---
 
-## 1. Project-original content (no third-party source vendored)
+## 1. insane-search engine — vendored upstream snapshot, modified
+
+`engine/**` originates from the **insane-search** project and is NOT
+project-original code, despite being heavily modified since import.
+
+- Upstream source: https://github.com/fivetaku/insane-search
+- Vendored into this repository on 2026-06-21 by commit
+  **`a4e4ed797`** (`feat(ultimate-browsing): vendor insane-search engine (junk-excluded)`),
+  via an explicit file whitelist that excluded caches and smoke-test junk.
+- Baseline: the upstream state as of that date, a **pre-0.7.0 snapshot**.
+  Upstream's CHANGELOG dates 0.7.0 to 2026-06-22; imported files carry no
+  version marker. We have never re-vendored since; the tree has diverged in
+  both directions.
+- Modifications by this project (non-exhaustive): de-personalization
+  (`4743199a5`), the Phase 2.5 surrogate retrieval stage and surrogate registry,
+  the provenance/trust result contract, the `bias_check.py` no-site-name CI gate,
+  module split of the fetch chain, and the Python test suite under
+  `engine/tests/`.
+- No upstream `LICENSE` file was included in the vendored snapshot, so this
+  repository has no upstream license text to reproduce here. Do not infer
+  project-original licensing from that absence; treat `engine/**` as
+  upstream-derived when reasoning about provenance.
+
+The binding version policy — which upstream baseline we sit on, why we stay
+pinned, what a future re-vendor must preserve, and what it must not import — is
+[`engine/AGENTS.md` §UPSTREAM BASELINE AND VERSION POLICY](engine/AGENTS.md).
+
+---
+
+## 2. Project-original content (no third-party source vendored)
 
 The following are authored by the oh-my-openagent project and carry no third-party
 license obligation:
 
-- `engine/**` — the insane-search Tier-1 fetch engine (curl_cffi grid, WAF
-  detection, Playwright fallback templates, `bias_check.py` no-site-name gate).
 - `references/insane-search/**` and `references/agent-reach/**` — the Tier-1 and
   Tier-1.5 reference docs.
 - `scripts/extract_cookies.py`, `scripts/cookie_paths.py`, `scripts/cookie_crypto.py`
@@ -26,13 +53,13 @@ user installs separately; this skill includes none of their source.
 
 ---
 
-## 2. CloakBrowser (CloakHQ) — Tier-2 stealth Chromium (runtime dependency)
+## 3. CloakBrowser (CloakHQ) — Tier-2 stealth Chromium (runtime dependency)
 
 The Tier-2 stealth browser is **CloakBrowser**, installed at runtime via `pip`
 (`pip install cloakbrowser`). No CloakBrowser source is vendored in this repository.
 
 - Source: https://github.com/CloakHQ/CloakBrowser
-- Pinned runtime version: **0.4.10** (documented in `references/chrome-stealth.md`;
+- Pinned runtime version: **0.5.7** (documented in `references/chrome-stealth.md`;
   this is a documented version string, not an automated drift check).
 - Wrapper source license: MIT License.
 - Binary license: the compiled CloakBrowser Chromium binary downloaded by
@@ -73,13 +100,13 @@ SOFTWARE.
 
 ---
 
-## 3. agent-browser (vercel-labs) — Tier-2 CDP automation CLI (runtime dependency)
+## 4. agent-browser (vercel-labs) — Tier-2 CDP automation CLI (runtime dependency)
 
 The Tier-2 automation CLI is **agent-browser**, installed at runtime via `npm`
-(`npm i -g agent-browser`). No agent-browser source is vendored in this repository.
+(`bun add -g agent-browser`). No agent-browser source is vendored in this repository.
 
 - Source: https://github.com/vercel-labs/agent-browser
-- Pinned runtime version: **0.31.1** (documented in `references/chrome-stealth.md`;
+- Pinned runtime version: **0.34.0** (documented in `references/chrome-stealth.md`;
   documented version string, no automated drift check).
 - Licensed under the Apache License, Version 2.0 (the "License"); you may not use
   these files except in compliance with the License. You may obtain a copy of the

package/packages/omo-codex/plugin/skills/ultimate-browsing/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: ultimate-browsing
-description: "Escalation skill for blocked or hard-to-reach web access — load it when a normal browse/fetch is blocked (WAF, 403, Cloudflare, JS-only render, login-gated, or a platform a generic fetcher cannot read). Tiered router: TIER 1 insane-search (headless extraction + WAF bypass via curl_cffi TLS impersonation, yt-dlp, Jina Reader, public APIs, Playwright real-Chrome fallback); TIER 1.5 agent-reach (platform-native readers for Chinese and social platforms: Xiaohongshu, Douyin, Weibo, Bilibili, V2EX, WeChat, plus Twitter/Reddit/LinkedIn/GitHub); TIER 2 Chrome stealth (CloakBrowser stealth Chromium + agent-browser CDP for clicks, forms, screenshots, video, cookie login). Triggers: blocked site, bypass bot detection, cloudflare/WAF bypass, scrape, stealth browser, import cookies, fill form, screenshot, play youtube, xiaohongshu, douyin, weibo, bilibili, v2ex, wechat article, podcast transcript. NOT for simple searches (use web-search) or plain fetches (use webfetch)."
+description: "Reaches web pages a plain fetch cannot: renders JS, drives clicks and forms, captures screenshots, holds a login, and gets past WAF blocks through platform-native readers and stealth Chrome. Use for any page work beyond retrieving static text."
 ---
 
 # Ultimate Browsing
 
-Escalation web access for tasks a normal browse or fetch cannot complete. Reach for this skill the moment a page is blocked (WAF / 403 / Cloudflare), needs JS rendering, hides behind a login, or lives on a platform a generic fetcher cannot read. Escalate only when the cheaper tier cannot do the job:
+Web access for everything a plain fetch cannot finish: a page that renders in JS, a click or a form, a screenshot, a login that must persist across pages, or a host that blocks generic fetchers (WAF / 403 / Cloudflare). Start at the cheapest tier that can do the job and climb only when it cannot:
 
-**Tier 1 — insane-search** (headless extraction + WAF bypass) -> **Tier 1.5 — agent-reach** (platform-native APIs, esp. Chinese platforms) -> **Tier 2 — Chrome stealth** (real interaction via CloakBrowser + agent-browser).
+**Tier 1 — insane-search** (headless extraction + WAF bypass) -> **Tier 1.5 — agent-reach** (platform-native APIs, esp. Chinese platforms) -> **Tier 2 — a real browser**: 2a a code-driven kernel browser, 2b Chrome stealth (CloakBrowser + agent-browser) when the page fights back.
 
 ## PHASE 0 — ROUTE FIRST (MANDATORY)
 
@@ -23,11 +23,11 @@ User request
   +- podcast transcript / stock forum ----------------- TIER 1.5 agent-reach
   +- Twitter feed / LinkedIn profile / GitHub via CLI - TIER 1.5 agent-reach
   |
-  +- Tier 1/1.5 returned empty or partial ------------- TIER 2  Chrome stealth
-  +- click / fill form / scroll / interact ------------ TIER 2  Chrome stealth
-  +- screenshot / render / play video ----------------- TIER 2  Chrome stealth
-  +- login session across pages / inject cookies ------ TIER 2  Chrome stealth
-  +- test web app / QA / dogfood ---------------------- TIER 2  Chrome stealth
+  +- Tier 1/1.5 returned empty or partial ------------- TIER 2  2a kernel browser -> 2b stealth
+  +- click / fill form / scroll / interact ------------ TIER 2  2a kernel browser -> 2b stealth
+  +- screenshot / render / play video ----------------- TIER 2  2a kernel browser -> 2b stealth
+  +- login session across pages / inject cookies ------ TIER 2  2b Chrome stealth (profile + cookies)
+  +- test web app / QA / dogfood ---------------------- TIER 2  2a kernel browser -> 2b stealth
   |
   +- simple search query ------------------------------ NOT this skill (use web-search)
 ```
@@ -80,12 +80,29 @@ curl -s "https://www.v2ex.com/api/topics/hot.json"            # V2EX public API
 
 Routing table, per-platform auth (set `TWITTER_*` env vars, `gh auth login`, a transcription key — only if you have access), rate-limit notes, and known version quirks are in [references/agent-reach/README.md](references/agent-reach/README.md).
 
-## Tier 2 — Chrome stealth (real interaction)
+## Tier 2 — a real browser (real interaction)
 
 **When**: real interaction is needed (clicks, forms, screenshots, video, persistent login), or Tier 1/1.5 failed.
 
+### Tier 2a — kernel browser (default)
+
+Drive the page from the code cell you are already in, with no CLI process and no open CDP port. On a Bun >= 1.4 runtime that is `new Bun.WebView()` (`navigate`, `click`, `type`, `evaluate`, `screenshot`, raw `cdp`); elsewhere it is `playwright-core`/`puppeteer-core` against the local Chrome. Snapshots and screenshots come back in-process, so this is the cheapest way to answer "what does the page actually render".
+
+```js
+await using view = new Bun.WebView({ width: 1280, height: 800 })
+await view.navigate(url)
+const title = await view.evaluate("document.title")
+await view.screenshot({ path: "/tmp/page.png" })
+```
+
+Climb to 2b when the site detects automation (Turnstile, FingerprintJS, "unusual traffic"), when the flow needs a persistent logged-in profile or injected cookies, or when the kernel browser cannot reach the page at all.
+
+### Tier 2b — Chrome stealth (blocked or logged-in pages)
+
 CloakBrowser is a stealth Chromium with source-level fingerprint patches that passes Cloudflare Turnstile, FingerprintJS, BrowserScan, and 30+ detectors; agent-browser is the CDP automation CLI that drives it. Both are runtime-installed tools (not vendored here). Full setup, version pins, launch flow, cookie login, and cross-platform notes are in [references/chrome-stealth.md](references/chrome-stealth.md).
 
+NEVER clear cookies, cache, or site data (`Network.clearBrowserCookies`, `Storage.clearCookies`, `chrome.browsingData.remove`, "clear browsing data") on the user's real/main browser profile — it wipes their logged-in state everywhere. If the task needs that profile's login state, clone the profile directory first (`rsync -a <profile>/ <tmp-clone>/`) and launch CloakBrowser / agent-browser with the clone as the user-data-dir; run any clearing on the clone only.
+
 ```bash
 # 1. Launch CloakBrowser with CDP on :9242 (see chrome-stealth.md for install + venv).
 # 2. CloakBrowser launches tabless — open the first tab via CDP before any agent-browser command:

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/AGENTS.md

@@ -2,6 +2,116 @@
 
 **Generated:** 2026-08-10 / 38d268995
 
+## UPSTREAM BASELINE AND VERSION POLICY
+
+**READ THIS BEFORE TOUCHING `engine/**` OR PROPOSING AN UPSTREAM SYNC.**
+
+This engine is NOT project-original code. It is a vendored-and-modified snapshot of
+[fivetaku/insane-search](https://github.com/fivetaku/insane-search), and the version
+we run on is a deliberate choice, not an accident of neglect.
+
+### The pin
+
+| Fact | Value |
+|---|---|
+| Upstream project | `https://github.com/fivetaku/insane-search` |
+| Vendoring commit | `a4e4ed797` (2026-06-21) `feat(ultimate-browsing): vendor insane-search engine (junk-excluded)` |
+| De-personalization | `4743199a5` (2026-06-21) |
+| Pinned upstream baseline | upstream state as of 2026-06-21, **pre-0.7.0** (0.7.0 is dated 2026-06-22) |
+| Re-vendors since | none — every later change here is ours |
+
+We intentionally track a **pinned baseline plus local divergence**, not upstream HEAD.
+There is no submodule and no automated drift check for this engine (unlike the
+`frontend` skill's upstream submodules): the vendored files ARE the source of truth,
+and upstream is a reference we port FROM, deliberately, file by file.
+
+### Why we do not blind-rebase onto upstream HEAD
+
+1. **Upstream reset its public history.** On 2026-08-06 upstream published a single
+   squashed commit, `019ee16 refactor: reset public history at 0.14.0`, discarding the
+   prior public history through 0.13.x. There is no upstream commit graph to rebase onto and no
+   way to cherry-pick an individual upstream change by sha — only whole-file diffing
+   against a moving HEAD.
+2. **Upstream 0.14.0 REMOVED capability.** The endpoint-mining / internal-API
+   auto-derivation / site-recipe subsystems that upstream carried publicly between
+   0.12.0 and 0.14.0 are gone from upstream HEAD. Syncing to HEAD is therefore not
+   strictly an upgrade: parts of it are a downgrade relative to the intermediate
+   versions, and none of it is recoverable from the reset history.
+3. **Our tree diverged on purpose.** The KEEP list below is functionality upstream
+   never had. A wholesale overwrite with upstream HEAD would silently delete it.
+4. **Different threat model.** Our engine ships inside a published npm package and a
+   public marketplace mirror, under a CI no-site-name gate and a de-personalization
+   deny-list. Upstream carries neither constraint, so upstream code is not
+   drop-in-shippable here.
+
+### KEEP — our divergences a re-vendor MUST NOT regress
+
+These exist only in our tree. Any upstream sync that removes or bypasses one of them
+is a regression, not an upgrade:
+
+- **Phase 2.5 surrogate retrieval** (`surrogate.py`, `surrogates.yaml`) — archive /
+  reader / proxy routes tried before paying for a browser spin-up, with per-entry
+  `last_verified` staleness handling and `--allow-proxy` gating.
+- **Provenance / trust contract** (`result_schema.py`) — `Provenance` and `Trust`
+  literals on every result, so a snapshot can never be reported as the live page.
+- **Surrogate dead-end validation** (L1.5 in `validators.py`) — interstitial titles and
+  AMP-style redirect stubs rejected instead of returned as content.
+- **The no-site-name rule and its CI gate** (`bias_check.py`) — zero hard-coded site
+  names, brands, or target domains in `engine/**`.
+- **Module split of the fetch chain** — `curl_probe` / `referers` / `url_transforms` /
+  `waf_detector` / `validators` / `executor` / `summary` as separate modules rather than
+  one monolith.
+- **The Python test suite** under `engine/tests/` with its HTML/JSON fixtures.
+- **De-personalization** — no personal absolute paths, no personal auth token literals,
+  no personal browser choice; enforced by `depersonalization-gate.test.ts`.
+- **Skill-level layering** — the engine is Tier 1 under a router that also owns Tier 1.5
+  (agent-reach) and Tier 2 (CloakBrowser + agent-browser). Upstream has no such tiering.
+
+### WANT — upstream improvements worth porting forward
+
+Our snapshot predates these; they are wanted, and each must be ported as a reviewed,
+site-agnostic change that preserves every KEEP item above. Port individually; never as
+a tree overwrite:
+
+- **Content quality**: dedicated markdown conversion of fetched HTML, main-content
+  extraction, PDF text extraction, and JSON-LD rescue when the HTML body is thin.
+- **Transient-failure retry** and **render-merge** of statically fetched HTML with the
+  browser-rendered DOM.
+- **Differential block classification** — distinguishing a bot-detection block from an
+  infrastructure or authentication failure, instead of collapsing both into `challenge`.
+- **Additional stealth fetch backends** beyond the current Playwright templates, and
+  additional WAF vendor profiles.
+- **Per-host route learning** — remembering which route succeeded for a host, with a TTL
+  and a bounded store. Must stay runtime state, never committed site knowledge (R4).
+- **Engine-level Phase 0 routing** — the official-public-API preference is currently only
+  a documented rule (R5) the agent can skip; upstream moved it into code so it cannot be
+  skipped. Worth adopting.
+
+### OUT OF SCOPE
+
+- **The removed upstream endpoint-mining / internal-API auto-derivation / site-recipe
+  subsystems.** They are absent from upstream HEAD and are not reconstructed here. They
+  also sit against R3/R4 and R7's anti-bias rule: discovered internal endpoints are
+  runtime findings, never committed engine knowledge.
+- **Any upstream code carrying site-specific selectors, domains, or brand names.** It
+  fails `bias_check.py` at the door; re-derive it site-agnostically or leave it out.
+- **Automated upstream tracking.** No submodule, no drift check, no auto-bump. Syncing is
+  a deliberate, reviewed, human-initiated act.
+
+### THE SYNC RULE
+
+Any future upstream sync preserves BOTH sides. Concretely:
+
+1. Diff the specific upstream capability you want against our tree — do not overwrite
+   files wholesale, and never `git checkout` upstream over `engine/`.
+2. Port it as its own reviewed change, keeping every KEEP item intact.
+3. Re-run `python3 engine/bias_check.py` and the `engine/tests/` suite; a port that
+   introduces a site name or breaks a fixture does not ship.
+4. Update the pin table above (baseline, date, what was ported) in the same change, plus
+   the provenance section of [`../ATTRIBUTION.md`](../ATTRIBUTION.md).
+5. If a port must drop a KEEP item, say so explicitly in the PR and get it agreed first —
+   silent regressions of the KEEP list are the failure mode this policy exists to prevent.
+
 ## OVERVIEW
 
 A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -m engine URL`), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/templates/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "description": "Local deps for Playwright real-Chrome templates. npm install && npx playwright install chrome",
   "dependencies": {
-    "playwright": "^1.61.1",
+    "playwright": "^1.62.1",
     "playwright-extra": "^4.3.6",
     "puppeteer-extra-plugin-stealth": "^2.11.2"
   }

package/packages/omo-codex/plugin/skills/ultimate-browsing/references/chrome-stealth.md

@@ -2,8 +2,8 @@
 
 Real interaction (clicks, forms, screenshots, video, persistent login) for pages that defeat Tier 1/1.5. Two runtime tools, both installed on demand — neither is vendored in this skill:
 
-- **CloakBrowser** (`pip`) — stealth Chromium with source-level C++ fingerprint patches. The Python wrapper source is MIT; the downloaded Chromium binary is covered by CloakBrowser's separate binary license and is not redistributed by this package. Passes Cloudflare Turnstile, FingerprintJS, BrowserScan, and 30+ detectors. Pin **0.5.5**.
-- **agent-browser** (`npm`, Apache-2.0) — native CDP automation CLI that drives CloakBrowser. AX-tree snapshots, `@eN` refs, click/fill/type/scroll, screenshots, video, cookie/state/session management. Pin **0.33.2**.
+- **CloakBrowser** (`pip`) — stealth Chromium with source-level C++ fingerprint patches. The Python wrapper source is MIT; the downloaded Chromium binary is covered by CloakBrowser's separate binary license and is not redistributed by this package. Passes Cloudflare Turnstile, FingerprintJS, BrowserScan, and 30+ detectors. Pin **0.5.7**.
+- **agent-browser** (`npm`, Apache-2.0) — native CDP automation CLI that drives CloakBrowser. AX-tree snapshots, `@eN` refs, click/fill/type/scroll, screenshots, video, cookie/state/session management. Pin **0.34.0**.
 
 ```
 CloakBrowser (stealth Chromium) <- CDP port 9242 -> agent-browser CLI
@@ -17,30 +17,35 @@ CloakBrowser (stealth Chromium) <- CDP port 9242 -> agent-browser CLI
 
 CloakBrowser runs in a dedicated Python venv. Cross-platform: macOS, Linux, and Windows all supported by both tools (use the venv path convention for your OS).
 
+The venv lives at a fixed path so every session reuses one stealth-Chromium download instead of creating a new venv per working directory, and every command below calls its interpreter by absolute path — no `activate` step to forget.
+
 ```bash
-# CloakBrowser (MIT wrapper source; separate binary license, pin 0.5.5):
-uv venv .cloak-venv --python 3.13
-# macOS/Linux: source .cloak-venv/bin/activate    Windows: .cloak-venv\Scripts\activate
-uv pip install "cloakbrowser==0.5.5"
-python -c "import cloakbrowser; cloakbrowser.ensure_binary()"   # downloads stealth Chromium on first import
-
-# agent-browser (Apache-2.0, pin 0.33.2):
-npm i -g agent-browser@0.33.2 && agent-browser install
-agent-browser --version   # 0.33.2
+# CloakBrowser (MIT wrapper source; separate binary license, pin 0.5.7):
+VENV="$HOME/.agents/cloak-venv"          # Windows: %USERPROFILE%\.agents\cloak-venv
+uv venv "$VENV" --python 3.13
+uv pip install --python "$VENV/bin/python" "cloakbrowser==0.5.7"
+"$VENV/bin/python" -c "import cloakbrowser; cloakbrowser.ensure_binary()"   # downloads stealth Chromium on first import
+
+# agent-browser (Apache-2.0, pin 0.34.0):
+bun add -g agent-browser@0.34.0 && agent-browser install
+agent-browser --version   # 0.34.0
 ```
 
 Verify CloakBrowser:
 
 ```bash
-python -c "import cloakbrowser; print(cloakbrowser.__version__, cloakbrowser.CHROMIUM_VERSION, cloakbrowser.binary_info()['installed'])"
-# -> 0.5.5  <chromium-version>  True
+"$VENV/bin/python" -c "import cloakbrowser; print(cloakbrowser.__version__, cloakbrowser.CHROMIUM_VERSION, cloakbrowser.binary_info()['installed'])"
+# -> 0.5.7  <chromium-version>  True
 ```
 
 ## Launch + drive
 
+NEVER clear cookies, cache, or site data (`Network.clearBrowserCookies`, `Storage.clearCookies`, `chrome.browsingData.remove`, "clear browsing data") on the user's real/main browser profile — it wipes their logged-in state everywhere. If you need that profile's login state, clone it first (`rsync -a <profile>/ <tmp-clone>/`) and launch with the clone as the user-data-dir; run any clearing on the clone only.
+
 ```bash
-# 1. Launch CloakBrowser with CDP on :9242 (background). With the venv active:
-python -c "import asyncio,cloakbrowser; asyncio.run(cloakbrowser.launch_async(headless=False, stealth_args=True, args=['--remote-debugging-port=9242']))" &
+# 1. Launch CloakBrowser with CDP on :9242 (background). cloakbrowser lives only in the venv,
+#    so call its interpreter by absolute path — this works in any shell, activated or not:
+"$HOME/.agents/cloak-venv/bin/python" -c "import asyncio,cloakbrowser; asyncio.run(cloakbrowser.launch_async(headless=False, stealth_args=True, args=['--remote-debugging-port=9242']))" &
 
 # 2. CloakBrowser launches tabless -> agent-browser would say "No page found".
 #    Open the first tab via CDP before any agent-browser command:
@@ -76,7 +81,7 @@ agent-browser skills list                # everything available on the installed
 agent-browser --cdp 9242 eval 'navigator.webdriver'   # must print false
 ```
 
-Verified 2026-07 with CloakBrowser 0.5.5 + agent-browser 0.33.2: `navigator.webdriver` reads the boolean false with no init-script, bot.sannysoft.com all-green, browserscan.net "Normal" (15/15), nowsecure.nl Turnstile bypassed.
+Verified 2026-07 with CloakBrowser 0.5.7 + agent-browser 0.34.0: `navigator.webdriver` reads the boolean false with no init-script, bot.sannysoft.com all-green, browserscan.net "Normal" (15/15), nowsecure.nl Turnstile bypassed.
 
 > **agent-browser 0.33.x behavior note:** the daemon now defaults to a 1-hour idle timeout (saves restore state, closes the browser, exits after 1 h of no commands). Set `AGENT_BROWSER_IDLE_TIMEOUT_MS=0` to restore the old always-persist behavior. External WebSocket stream consumers see latest-wins frame delivery; `record` (CDP) and the dashboard are unaffected.
 
@@ -117,6 +122,6 @@ lsof -ti:9242 | xargs kill -9
 # agent-browser can't connect:
 curl -s http://127.0.0.1:9242/json/version | head -5   # empty -> CloakBrowser not running
 # Update either tool:
-uv pip install --upgrade "cloakbrowser==0.5.5" && python -c "import cloakbrowser; cloakbrowser.ensure_binary()"
-npm i -g agent-browser@0.33.2
+uv pip install --python "$HOME/.agents/cloak-venv/bin/python" --upgrade "cloakbrowser==0.5.7" && "$HOME/.agents/cloak-venv/bin/python" -c "import cloakbrowser; cloakbrowser.ensure_binary()"
+bun add -g agent-browser@0.34.0
 ```

package/packages/omo-codex/plugin/skills/ultimate-browsing/references/insane-search/README.md

@@ -16,7 +16,8 @@
 1. WebFetch, 즉흥 curl, 수동 헤더 조합 **시도 금지**
 2. 즉시 다음을 실행:
    ```bash
-   python3 -m engine "<URL>" [--selector "<CSS>"] [--device auto|desktop|mobile] [--trace]
+   python3 -m engine "<URL>" [--selector "<CSS>"] [--device auto|desktop|mobile] [--trace] \
+                              [--no-retry] [--no-extract]
    ```
 3. 종료코드 0(ok) 또는 1(fail) 받은 뒤 판단. trace를 먼저 읽고 재시도 결정.
 4. 실패 시에만 `--trace --json`으로 재호출해서 원인 진단 후 `--device` 또는 `user_hint` 조정.
@@ -135,7 +136,13 @@ result = fetch(
 
 if result.ok:
     print(result.verdict)     # strong_ok | weak_ok
-    html = result.content
+    html = result.content     # raw body — 단, content-rescue가 발동한 경우 구조 텍스트
+    # v0.10.0 content-rescue: PDF 응답은 pypdf 추출 텍스트, visible text가 얇은
+    # SPA 셸은 JSON-LD articleBody / 렌더된 innerText로 대체될 수 있다.
+    # result.extraction_source로 판별: "raw"(원문 그대로) | pdf | json_ld | *+inner_text.
+    # 일반 HTML 성공은 항상 raw. 끄기: enable_extraction=False / --no-extract.
+    # 429/502/503/504는 probe에서 백오프 재시도(Retry-After 반영, 총 10초 캡);
+    # 끄기: enable_retry=False / --no-retry.
 else:
     # Phase 3 수동 개입 (Playwright MCP) 필요 — result.trace로 원인 진단
     pass

package/packages/omo-codex/plugin/skills/ultrawork/SKILL.md

@@ -73,7 +73,13 @@ exercises the surface; capture the artifact.
      if Chrome is not available, download and use agent-browser
      (https://github.com/vercel-labs/agent-browser). Capture action
      log + screenshot path. Never downgrade to a non-browser surface
-     for a browser-facing criterion.
+     for a browser-facing criterion. NEVER clear cookies, cache, or
+     site data (`Network.clearBrowserCookies`, `Storage.clearCookies`,
+     `chrome.browsingData.remove`, "clear browsing data") on the user's
+     real/main browser profile — it wipes their logged-in state. If you
+     need that profile's login state, clone it first (`rsync -a
+     <profile>/ <tmp-clone>/`) and launch Chrome / agent-browser against
+     the clone as the user-data-dir; run any clearing there only.
   4. Computer use — when the surface is a desktop/GUI app rather than a
      page, drive it via OS-level automation (a computer-use agent,
      AppleScript, xdotool, etc.) against the running app; capture
@@ -133,6 +139,12 @@ exactly `objective`; do not include `status`. Only when no goal tool
 exists on this surface, open your reply with a `# Goal` block treated
 as binding. Goals are unlimited; never invent a numeric budget or
 limit.
+Check `get_goal` first: continue a matching active goal instead of
+duplicating one; surface a conflicting one. Write the objective
+outcome-first: the concrete thing that will be TRUE when done (an
+outcome, never an activity), the named deliverable surfaces, and
+explicit scope bounds — a vague objective produces vague criteria,
+and vague criteria cannot be proven.
 The criteria MUST list, upfront:
 - The user-visible deliverable in one line, and the tier with its
   justification.
@@ -224,8 +236,8 @@ and utility functions to batch commands and reduce output. Keep direct calls
 when one result chooses the next action, outputs are already small, semantic
 judgment is required between calls, approval or side effects are involved,
 or native artifacts / citations must be preserved.
-- Architecture / flow / blast radius → `codegraph_explore` first when
-  `codegraph_*` exists; if unavailable, continue with repo tools and LSP.
+- Architecture / flow / blast radius → explore agents plus LSP references
+  and impact; do not guess from conventions.
 - **SYMBOLS REQUIRE LSP** — definitions, references, rename impact,
   workspace symbols, and diagnostics use the available `lsp_*` tools, not
   text search. Run diagnostics after edits and treat errors as blocking.

package/packages/omo-codex/plugin/skills/{start-work → ulw-execute}/SKILL.md

@@ -1,6 +1,6 @@
 ---
-name: start-work
-description: "Execute a Prometheus work plan with Boulder state, evidence ledger updates, worktree discipline, parallel subagents, and Stop-hook continuation. Use after planning when the user says start work, execute plan, continue plan, resume plan, or asks to run a .omo/plans plan."
+name: ulw-execute
+description: "Executes a written Prometheus work plan with Boulder state, evidence ledger, worktree discipline, and parallel subagents. Use when the user says ulw-execute or asks to run a .omo/plans plan."
 ---
 
 ## Codex Harness Tool Compatibility
@@ -38,28 +38,28 @@ Every `multi_agent_v1.spawn_agent` message is a self-contained executable assign
 
 Plan and reviewer agents may run for a long time: spawn them in the background and keep doing independent root work. Between `multi_agent_v1.wait_agent` calls, back off — double the timeout up to ~5 minutes — instead of spinning short cycles. A timeout only means no new mailbox update arrived; treat a running child as alive. Require `WORKING: <task> - <current phase>` before long passes and `BLOCKED: <reason>` only when progress stops. Keep the parent visibly alive with active subagent count, names, and latest `WORKING:` phase. Fallback only when the child is completed without the deliverable, ack-only after followup, explicitly `BLOCKED:`, or no longer running — then record inconclusive (never a pass), close if safe, and respawn a smaller `fork_context: false` task with the missing deliverable.
 
-# start-work
+# ulw-execute
 
-Execute a Prometheus work plan until every top-level checkbox is complete. This skill pairs with the harness's start-work continuation hook, which re-injects the next turn while `.omo/boulder.json` says this `codex:<session_id>` still has unchecked plan work.
+Execute a Prometheus work plan until every top-level checkbox is complete. This skill pairs with the harness's ulw-execute continuation hook, which re-injects the next turn while `.omo/boulder.json` says this `codex:<session_id>` still has unchecked plan work.
 
 ## Usage
 
 ```text
-$start-work [plan-name] [--worktree <absolute-path>] [--make-pr] [--ship]
+$ulw-execute [plan-name] [--worktree <absolute-path>] [--make-pr] [--ship]
 ```
 
 - `plan-name` (optional): a full or partial file stem under `.omo/plans/`.
-- `--worktree` (required for PR/branch work; otherwise optional): the task-owned git worktree path.
-- `--make-pr` (optional): deliver the work as a pull request. IMPLIES worktree mode: when `--worktree` is absent, create a task-owned worktree (`git worktree add <absolute-path> <base-branch>`) before implementation and record it as `worktree_path`. On completion, push the branch and open a reviewer-readable PR, then hand off with the PR URL - merge only if the user asks.
+- `--worktree` (optional): reuse an existing task-owned worktree for the first phase instead of creating one; every phase runs in a task-owned worktree regardless.
+- `--make-pr` (optional): deliver each phase's worktree as a pull request — push the branch, open a reviewer-readable PR, hand off with the URL, and merge only if the user asks.
 - `--ship` (optional): full delivery lifecycle; implies `--make-pr`. After the PR opens, stay on the job until it is MERGED: watch CI and review gates, fix failures and address feedback from the worktree (fresh QA evidence for behavior changes), merge per the repository's merge policy, then remove the worktree and sync `.omo/` state back.
 
 ## Goal and todo discipline (MANDATORY)
 
 Do ALL of this immediately after the plan is selected, BEFORE the first implementation dispatch. Skipping any step is a defect.
 
-1. **Set the goal, in detail.** When a goal tool is available (`create_goal`), call it with a DETAILED objective: the plan name and path, the concrete end state, the phase and task counts, the delivery mode (direct, `--make-pr`, or `--ship`), and how completion will be verified. One work session = one goal. No goal tool -> record the same objective as the first ledger entry.
+1. **Set the goal, in detail.** When a goal tool is available (`create_goal`), call it with a DETAILED objective: the plan name and path, the concrete end state, the phase and task counts, the delivery mode (direct, `--make-pr`, or `--ship`), and how completion will be verified. One work session = one registered goal (the goal tool holds one active goal); each phase then carries its own concrete goal — the ledger entry Phase 2 records before the wave's first dispatch, defined from the previous phase's landed and verified evidence. No goal tool -> record the same objective as the first ledger entry.
 2. **Register every phase and task as todos.** Mirror the plan into the todo/plan tool of your harness: one phase per plan wave, one todo per column-zero checkbox (including the final verification wave). Register ALL of them up front - never keep tasks in memory only.
-3. **Keep them current at every moment.** Mark a todo in_progress when its work dispatches and done immediately after its verification passes. Never batch-complete at the end, never execute work that is not a registered todo; discovered work is appended as a todo before it runs. The todo list, Boulder state, and plan checkboxes must always tell the same story.
+3. **Keep them current at every moment.** Mark a todo in_progress when its work dispatches and done immediately after its verification passes. Never batch-complete at the end, never execute work that is not a registered todo; discovered work — a pre-existing bug, failing test, stale doc, or wrong guidance — is appended to the plan as a checkbox, mirrored as a todo before it runs, and fixed to the ideal state, never deferred as a follow-up. A worker that meets a defect outside its assigned files reports it instead of fixing it; only the orchestrator appends the checkbox and dispatches it to a correctly scoped unit. The todo list, Boulder state, and plan checkboxes must always tell the same story.
 
 ## Phase 1: Select the plan
 
@@ -73,7 +73,7 @@ Do ALL of this immediately after the plan is selected, BEFORE the first implemen
 
 ### No-plan bootstrap
 
-When the user explicitly said `start work` / `$start-work` and no selectable plan exists, treat that phrase as approval: bootstrap `ulw-plan` to create the approved plan before execution and implementation, instead of stalling or asking for generic approval again. A brief or notes file without waves, checkboxes, and acceptance criteria is NOT decision-complete — enter this bootstrap too.
+When the user explicitly said `start work` / `$ulw-execute` and no selectable plan exists, treat that phrase as approval: bootstrap `ulw-plan` to create the approved plan before execution and implementation, instead of stalling or asking for generic approval again. A brief or notes file without waves, checkboxes, and acceptance criteria is NOT decision-complete — enter this bootstrap too.
 
 1. Invoke the `ulw-plan` skill from the current request and require its dynamic adversarial workflow: collect, verify, design, adversarial plan-review, synthesize.
 2. The generated Prometheus plan must be saved under `.omo/plans/<slug>.md` before implementation or Boulder state writes that point at plan work.
@@ -102,13 +102,14 @@ Write `.omo/boulder.json` before implementation starts. Prefix session ids with
 }
 ```
 
-For PR/branch work, a task-owned worktree is mandatory before implementation starts: pass `--worktree`, or use `--make-pr`/`--ship`, which auto-create one. Verify the path with `git worktree list --porcelain` or create it with `git worktree add <path> <branch-or-HEAD>`, then store the absolute path as `worktree_path`. All edits, commands, tests, and evidence capture must run inside that worktree.
+Every phase (plan wave) runs in its own task-owned worktree with its own goal: before the wave's first dispatch, record the wave's goal — its checkboxes and their acceptance criteria — as a ledger entry, then `git worktree add <repo>-wt/<plan>-<wave> <branch off the integration base>` (or verify a `--worktree` path with `git worktree list --porcelain`), store the absolute path as `worktree_path`, run every edit, command, test, and evidence capture inside it; the wave lands on the integration base once its checkboxes are verified (direct merge, or the PR under `--make-pr`/`--ship`), and the next wave branches from that landed base.
 
 ## Parallel delivery lanes (teams and worktrees)
 
 Solo orchestration with parallel background workers is the default topology. Decide once, when the wave's lanes are known, and record the verdict in the ledger:
 
 - **Independent lanes -> parallel workers.** Separate files, no shared contract: one parallel spawn burst; no team.
+- **Dependency-ordered lanes -> one `workflow` run per wave.** Sub-tasks with real ordering between them (C needs A and B finished first) and a harness with a native `workflow` tool: dispatch the wave as ONE run (one producer node per lane plus a verification node); recover inside it with `retry`/`amend`/`send`; let node completions wake you instead of arming per-lane watchers; the next wave is a NEW run (or `amend` when only the definition changed) — never one graph for the whole plan. Read the `mass-ulw` skill's `SKILL.md` and `references/planning.md` IN FULL before defining any graph.
 - **Overlapping lanes -> a team.** The lanes touch the same module or contract AND running them concurrently actually finishes sooner: stand up a team (where the harness has one) so one lane's discoveries relay through you mid-flight.
 - **PR-mode independent lanes -> a worktree per lane.** Under `--make-pr`/`--ship`, when a wave holds independent checkboxes, give each lane its own branch and task-owned worktree, delivered as its own PR.
 
@@ -125,7 +126,7 @@ Landing rules, regardless of topology:
 3. Ignore nested checkboxes under acceptance criteria, evidence, and definition-of-done sections.
 4. Classify the checkbox tier and record it in its ledger entry. Default is LIGHT — a narrow change inside existing layers. Take HEAVY only on a fact you can point to: a new module / abstraction / domain model; auth, security, or session; an external integration; a DB schema or migration; concurrency or transaction boundaries; a cross-domain refactor; or the plan or user signals care. When unsure, take HEAVY; upgrade and redo skipped gates the moment a HEAVY fact surfaces; never downgrade.
 5. Decompose that checkbox into atomic sub-tasks sized for ONE worker in ONE run — a sub-task that would need mid-flight steering is two sub-tasks. Collect every other unchecked checkbox in the same plan wave whose dependencies are met — their lanes execute concurrently. A wave that could split further but holds fewer than 3 independent sub-tasks is under-split.
-6. **DELEGATE EVERYTHING. YOU NEVER IMPLEMENT.** Route every sub-task through the delegation router below, then dispatch ALL independent sub-tasks across those checkboxes in one parallel worker-spawn burst (a single batched spawn call where the harness supports it); serialize only named dependencies. Verification and checkbox marking stay per-checkbox.
+6. **DELEGATE EVERYTHING. YOU NEVER IMPLEMENT.** Route every sub-task through the delegation router below, then dispatch ALL independent sub-tasks across those checkboxes in one parallel worker-spawn burst (a single batched spawn call where the harness supports it); route named dependencies per the lane-topology decision above. Verification and checkbox marking stay per-checkbox.
 7. Give every dispatched sub-task its completion condition and watch for it per the section below. A dispatch whose completion nobody watches is an unfinished dispatch.
 
 ### Monitor every dispatched subagent to its completion condition
@@ -168,7 +169,7 @@ Each sub-task message must include:
    - Terminal / TUI: drive a real pty; `tmux send-keys` is fine for a boot/behavior smoke, but color/layout/CJK evidence goes through the xterm.js web terminal below, NEVER `tmux capture-pane`.
    - Browser use: prefer the harness's in-app browser control when available and the scenario does not need an authenticated or persistent user browser profile; otherwise drive the real page with Chrome, or agent-browser (https://github.com/vercel-labs/agent-browser) when Chrome is unavailable.
    - Computer use: OS-level GUI automation against the running desktop app when the surface is not a page.
-   - TUI visual evidence: when a TUI claim needs visual QA or PR proof, run `node script/qa/web-terminal-visual-qa.mjs --command "<cmd>" --input "{Enter}" --evidence-dir <dir>` (real pty rendered through xterm.js in Chrome) and attach `terminal.png` plus `metadata.json`.
+   - TUI visual evidence: when a TUI claim needs visual QA or PR proof, run `bun script/qa/web-terminal-visual-qa.mjs --command "<cmd>" --input "{Enter}" --evidence-dir <dir>` (real pty rendered through xterm.js in Chrome) and attach `terminal.png` plus `metadata.json`.
 6. The adversarial classes that apply to this sub-task (from the 9 ultraqa classes) and how each is probed.
 7. Required artifact path and cleanup receipt.
 8. Tool-use expectations: batch independent tool calls in parallel; when the harness exposes a code-execution surface (eval), use it for multi-call steps instead of one-by-one calls.
@@ -185,7 +186,7 @@ For each checkbox, complete all five gates before marking it done:
 4. Adversarial QA: exercise every class the Phase 3 trigger map marks applicable and capture the observable result for each.
 5. Cleanup: register every QA resource teardown as its own todo when spawned (QA scripts, tmux assets, browser sessions, PIDs, ports, containers, temp dirs), execute each, and capture the receipt. No QA asset is left running.
 
-Append evidence to `.omo/start-work/ledger.jsonl`, one JSON object per line. Include at least `event`, `plan`, `task`, `session_id`, `commands`, `artifact`, `adversarial_classes`, and `cleanup` fields. `adversarial_classes` lists each probed class with its observable result and each ruled-out class with a one-line reason.
+Append evidence to `.omo/ulw-execute/ledger.jsonl`, one JSON object per line. Include at least `event`, `plan`, `task`, `session_id`, `commands`, `artifact`, `adversarial_classes`, and `cleanup` fields. `adversarial_classes` lists each probed class with its observable result and each ruled-out class with a one-line reason.
 
 ### Sisyphus-style completion contract
 
@@ -231,16 +232,9 @@ Only after verification passes:
 When all top-level checkboxes in `## TODOs` and `## Final Verification Wave` are complete:
 
 1. Run the plan's final verification commands.
-2. Complete the **Global Review and Debugging Gate** before any completion claim, PR creation, PR handoff, branch handoff, or merge:
-   - Invoke the `review-work` skill with the final diff, changed files, user goal, constraints, run command, and verification evidence. All five review lanes must return PASS. A timeout, missing deliverable, ack-only child, `BLOCKED:`, or inconclusive lane is a gate failure, not approval.
-   - Each passing review lane binds to the exact full commit SHA it reviewed. Immediately append a durable record to `.omo/start-work/ledger.jsonl` with the lane name, full SHA, PASS verdict, and report artifact/source. Before same-SHA reuse after any continuation or compaction, re-read the ledger record and require the exact lane/SHA pair; memory, chat history, or an unstamped report is not coverage. New commits require fresh applicable lane coverage.
-   - Run a debugging-oriented runtime audit even when the review passes: name at least three plausible failure hypotheses for the changed surface, run the distinguishing checks against the actual artifact, and append a separate durable record with the audit name, exact full SHA, verdict, and evidence artifact/source to `.omo/start-work/ledger.jsonl`. Reuse it only after re-reading an exact audit/SHA match.
-   - If any review lane or debugging hypothesis fails, invoke the `debugging` skill, confirm root cause with runtime evidence, add the minimal failing test or reproduction, fix it, rerun the affected verification, then rerun the Global Review and Debugging Gate.
-   - Evidence hygiene is mandatory: redact or mask secrets and sensitive user data before writing `.omo/start-work/ledger.jsonl`, a PR body, or a handoff. Never include raw tokens, credentials, auth headers, cookies, API keys, env dumps, private logs, or PII; use concise summaries, lengths, hashes, or short non-sensitive prefixes instead.
-   - If the work includes creating, updating, or handing off a PR, refresh `git status` and the PR/branch state from the task-owned worktree after the gate, and include only redacted review/debugging evidence in the PR body or handoff.
-3. Finish the PR/branch lifecycle from its task-owned worktree: sync `.omo/` state back to the main repo, create or update the PR when requested, wait for CI/review/Cubic gates, merge by default unless explicitly opted out, and remove the worktree only after successful merge or explicit handoff.
-4. Remove or mark the Boulder work as completed.
-5. Print an `ORCHESTRATION COMPLETE` block with the plan path, verification commands, Global Review and Debugging Gate verdict, artifacts, and cleanup receipts.
+2. For PR/branch work, finish the lifecycle from the last phase's worktree: sync `.omo/` state back to the main repo, create or update the PR, wait for review/verification gates, merge by default unless explicitly opted out, and remove the worktree only after successful merge or explicit handoff.
+3. Remove or mark the Boulder work as completed.
+4. Print an `ORCHESTRATION COMPLETE` block with the plan path, verification commands, artifacts, and cleanup receipts.
 
 ## Hard rules
 
@@ -249,7 +243,6 @@ When all top-level checkboxes in `## TODOs` and `## Final Verification Wave` are
 - No tests-only completion claim. A Manual-QA artifact is required.
 - **NO DIRECT IMPLEMENTATION BY THE ORCHESTRATOR.** Root NEVER edits product files, writes tests, or runs QA itself — a spawned worker does.
 - No completion claim while an applicable ultraqa adversarial class was never probed. Each applicable class needs a captured observable result; each skipped class needs a one-line not-applicable reason in the ledger.
-- No `ORCHESTRATION COMPLETE`, final response, PR creation, PR handoff, or merge before the Global Review and Debugging Gate passes with recorded evidence.
-- No PR/branch implementation or review in the main worktree; create or use a task-owned git worktree first.
+- No implementation, review, or merge in the main checkout; every phase works in its task-owned worktree.
 - No unprefixed session ids in Boulder state. Sessions are always recorded as `codex:<session_id>`.
 - No stale-memory execution. The plan and ledger are the durable source of truth.

package/packages/omo-codex/plugin/skills/ulw-execute/agents/openai.yaml

@@ -0,0 +1,2 @@
+interface:
+  display_name: "(OmO) ulw-execute"

package/packages/omo-codex/plugin/skills/ulw-loop/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ulw-loop
-description: Goal-like loop that uses ultrawork mode to decompose work into systematic, evidence-bound steps.
+description: "A goal-like loop that decomposes work into systematic, evidence-bound ultrawork steps. Use when the user wants a goal loop or durable, checkpointed execution."
 metadata:
   short-description: Goal-like ultrawork loop for systematic decomposition
 ---
@@ -15,12 +15,13 @@ This skill is intentionally compact. The full workflow lives in `references/full
 
 1. Open `references/full-workflow.md`.
 2. Read through **Bootstrap** (including its tier triage), **Execution Loop**, the **Manual-QA channels** table, and the **Stop Rules** before running any ULW command or recording evidence.
-3. If the task has code edits, tests, QA, or commit work, follow the full workflow's delegation and evidence rules. Tests alone never prove done.
+3. Open `references/define-goal.md` and register the run's goal by it. Goal creation is NEVER skipped: shape the objective and every success criterion by that reference before any implementation.
+4. If the task has code edits, tests, QA, or commit work, follow the full workflow's delegation and evidence rules. Tests alone never prove done.
 
 ## Non-Negotiables
 
 - Use the ulw-loop CLI state under `.omo/ulw-loop`; do not hand-edit goal state.
-- Register goals up front (`omo-agent-toolkit ulw-loop create-goals`, then `create_goal` from the printed handoff) and mirror every atomic step into the live `update_plan` checklist: one ultra-granular step per action, exactly one in_progress, transitions marked the instant they happen.
+- Register goals up front, shaped by `references/define-goal.md` (`omo-agent-toolkit ulw-loop create-goals`, then `create_goal` from the printed handoff), and mirror every atomic step into the live `update_plan` checklist: one ultra-granular step per action, exactly one in_progress, transitions marked the instant they happen.
 - After any compaction or context loss, re-read brief + goals + ledger FIRST plus `omo-agent-toolkit ulw-loop status --json`, then resume; never re-plan from scratch.
 - If `omo-agent-toolkit ulw-loop create-goals` says the existing aggregate is already complete, start unrelated new work with a fresh `--session-id <new-id>` instead of steering or forcing the completed default state. Use `--force` only to intentionally overwrite completed evidence.
 - Every success criterion needs observable evidence from a real surface: a channel (terminal/TUI via the xterm.js web terminal, HTTP, browser, computer-use) or, for CLI- or data-shaped criteria, an auxiliary surface (CLI stdout, DB diff, parsed config dump).