oh-my-opencode 5.0.0-beta.60 → 5.0.0-beta.63

package/packages/omo-codex/plugin/skills/visual-qa/SKILL.md

@@ -13,13 +13,13 @@ This skill may include examples copied from the OpenCode harness. In Codex, do n
 | `call_omo_agent(subagent_type="librarian", ...)` | `multi_agent_v1.spawn_agent({"message":"TASK: act as a librarian. ...","agent_type":"librarian","fork_context":false})` |
 | `task(subagent_type="plan", ...)` | `multi_agent_v1.spawn_agent({"message":"TASK: act as a planning agent. ...","agent_type":"plan","fork_context":false})` |
 | `task(subagent_type="oracle", ...)` for final verification | By default, record a self-review in the notepad: re-read the diff, run diagnostics, and capture evidence for every acceptance criterion. Only when the user demanded strict, rigorous, or high-accuracy review, use `multi_agent_v1.spawn_agent({"message":"TASK: act as a rigorous reviewer. ...","agent_type":"lazycodex-gate-reviewer","fork_context":false})`; include `fork_context: false`. |
-| `task(category="...", ...)` for implementation or QA | `multi_agent_v1.spawn_agent({"message":"TASK: act as an implementation or QA worker. ...","fork_context":false})` |
+| `task(category="...", ...)` for implementation or QA | `multi_agent_v1.spawn_agent({"message":"TASK: act as an implementation or QA worker. ...","agent_type":"lazycodex-worker-medium","fork_context":false})` |
 | `background_output(task_id="...")` | `multi_agent_v1.wait_agent(...)` for mailbox signals |
 | `team_*(...)` | Use Codex native subagents via `multi_agent_v1.spawn_agent` and `multi_agent_v1.wait_agent`; use `multi_agent_v1.send_input` and `multi_agent_v1.close_agent` only when exposed in the active tools list |
 
-Role-specific behavior must be described in a self-contained `message`. Use `fork_context: false` to start the child with only the initial prompt (no parent history); use `fork_context: true` only when full parent history is truly required. Include any required conversation context, files, diffs, constraints, and requested skill names directly in the spawned agent's `message`. OMO installs these selectable agent roles into `~/.codex/agents/`: `explorer`, `librarian`, `plan`, `momus`, `metis`, `lazycodex-code-reviewer`, `lazycodex-qa-executor`, and `lazycodex-gate-reviewer` - pass the matching name as `agent_type` so the child gets that role's model and instructions. If the spawn tool exposes no `agent_type` parameter, omit it and describe the role inside `message`. If a code block below conflicts with this section, this section wins.
+Role-specific behavior must be described in a self-contained `message`. Use `fork_context: false` to start the child with only the initial prompt (no parent history); use `fork_context: true` only when full parent history is truly required. Include any required conversation context, files, diffs, constraints, and requested skill names directly in the spawned agent's `message`. OMO installs these selectable agent roles into `~/.codex/agents/`: `explorer`, `librarian`, `plan`, `momus`, `metis`, `lazycodex-code-reviewer`, `lazycodex-qa-executor`, and `lazycodex-gate-reviewer` - pass the matching name as `agent_type` so the child gets that role's model and instructions. Inspect the actual spawn schema: whenever `agent_type` is exposed, EVERY spawn MUST select an exact LazyCodex role, on V1 or V2. Implementation difficulty selects `lazycodex-worker-low`, `lazycodex-worker-medium`, or `lazycodex-worker-high`; clone QA can select `lazycodex-clone-fidelity-reviewer`. Never select generic `worker` or `default`. If a code block below conflicts with this section, this section wins.
 
-Codex exposes ONE of two subagent tool surfaces per session; check your own tool list and route accordingly. If `multi_agent_v1.*` tools exist, use the table above as written. If instead a flat `spawn_agent` with a required `task_name` exists (`multi_agent_v2`), rewrite every `multi_agent_v1.*` example: `multi_agent_v1.spawn_agent({...,"fork_context":false})` becomes `spawn_agent({"task_name":"<lowercase_digits_underscores>","message":...,"agent_type":...,"fork_turns":"none"})` (`"all"` only when full parent history is truly required); `send_input` becomes `send_message`; do not call `close_agent`/`resume_agent` (finished agents end on their own; `followup_task` re-tasks one, `interrupt_agent` stops one); `wait_agent` takes only `timeout_ms` and returns on any child mailbox activity. On the v2 surface `agent_type` may be ABSENT from the spawn schema (verified 2026-07-11: only `fork_turns`/`message`/`task_name`) — when absent, omit it and describe the role inside `message`; installed role TOMLs cannot be selected on that surface. If a code block below conflicts with this section, this section wins. `fork_context` is rejected on `multi_agent_v2` (`fork_context is not supported in MultiAgentV2; use fork_turns instead`).
+Codex exposes ONE of two subagent tool surfaces per session; check your own tool list and route accordingly. If `multi_agent_v1.*` tools exist, use the table above as written. If instead a flat `spawn_agent` with a required `task_name` exists (`multi_agent_v2`), rewrite every `multi_agent_v1.*` example: `multi_agent_v1.spawn_agent({...,"fork_context":false})` becomes `spawn_agent({"task_name":"<lowercase_digits_underscores>","message":...,"agent_type":...,"fork_turns":"none"})` (`"all"` only when full parent history is truly required); `send_input` becomes `send_message`; do not call `close_agent`/`resume_agent` (finished agents end on their own; `followup_task` re-tasks one, `interrupt_agent` stops one); `wait_agent` takes only `timeout_ms` and returns on any child mailbox activity. Do not infer role support from V1/V2 or a model version. Legacy-schema exception: only if the actual schema lacks `agent_type`, omit that unsupported field and carry the complete role instructions in `message`, with history explicitly disabled. This cannot select a specialized TOML; an installed managed default supplies the medium worker for unnamed non-forks. The guard has no schema metadata and rejects unnamed calls, so report incompatible routing instead of retrying generically. Every deliberate full-history fork must still name its role: Codex skips role application on unnamed full-history forks, an upstream gap no LazyCodex default can repair. If a code block below conflicts with this section, this section wins. `fork_context` is rejected on `multi_agent_v2` (`fork_context is not supported in MultiAgentV2; use fork_turns instead`).
 
 When translating `load_skills=[...]`, include the requested skill names in the spawned agent's `message`. If a code block below conflicts with this section, this section wins.
 
@@ -73,7 +73,7 @@ Before any reviewer sees an image, verify each capture yourself: the file signat
 ### Web
 
 1. Capture a REFERENCE image: the user's mock/target, generated page snapshot, Figma export, source-site capture, or known-good baseline. Save as PNG. If the user provided overview text or annotations, save them next to the image and treat them as part of the reference packet.
-2. Capture the ACTUAL rendered screenshot at the same viewport size, driving the browser your harness actually has. Where a code cell can reach a browser (`new Bun.WebView()` on a Bun >= 1.4 kernel, otherwise `playwright-core` against the local Chrome), capture in-process: it needs no CLI and returns the PNG path directly. In Codex, `browser:control-in-app-browser` is that in-process surface — use it first unless the page needs an authenticated user browser session. Otherwise use the project's configured browser tooling (the playwright, agent-browser, or dev-browser skill). Save as PNG. If nothing is available, install [agent-browser](https://github.com/vercel-labs/agent-browser) (`bun add -g agent-browser && agent-browser install`) and capture with it — see `$SKILL_DIR/references/agent-browser-setup.md` for the full setup, including how to shoot a fixed-viewport screenshot.
+2. Capture the ACTUAL rendered screenshot at the reference viewport. Use two browser tiers from js eval: (1) `new Bun.WebView()` on Bun >= 1.4 (macOS default; Linux/Windows need installed Chrome/Chromium/Edge); (2) otherwise, or for Chrome semantics, stealth, trace, or authenticated profiles, WRITE a `playwright-core` script and run it from the kernel against local Chrome (`chromium.launch({ channel: "chrome" })` / `launchPersistentContext` on a CLONED profile, never the live one). In Codex, prefer `browser:control-in-app-browser` for ordinary captures. Save PNG and return its path; close the browser context. See `$SKILL_DIR/references/browser-setup.md` for fixed-viewport examples and prerequisites.
 3. Run the diff and keep the JSON:
 
 ```

package/packages/omo-codex/plugin/skills/visual-qa/references/browser-setup.md

@@ -0,0 +1,75 @@
+# Browser setup (Web capture)
+
+Use the js-eval kernel for both tiers. In Codex, prefer
+`browser:control-in-app-browser` for ordinary captures.
+
+## Tier 1: Bun.WebView
+
+On a Bun >= 1.4 kernel, `new Bun.WebView()` is the macOS default (system
+WebKit, no browser download). Linux/Windows require `backend: "chrome"`
+and installed Chrome/Chromium/Edge. WebView is headless; WebKit has no CDP,
+and `type()` emits no keyboard events. Use tier 2 when these differences matter.
+
+```js
+// js-eval cell; url and pngPath belong to this QA run.
+const view = new Bun.WebView({ width: 1280, height: 720 })
+try {
+  await view.navigate(url)
+  await Bun.write(pngPath, await view.screenshot())
+  console.log(pngPath)
+} finally {
+  view[Symbol.dispose]()
+}
+```
+
+## Tier 2: playwright-core with local Chrome
+
+For other kernels, real-Chrome semantics, stealth, traces, or authenticated
+profiles, WRITE a script beside the project's installed `playwright-core`
+dependency and execute it from js eval. The user installs `playwright-core`
+once with `bun add playwright-core` if needed; Chrome must already exist.
+No managed browser download is needed.
+
+```js
+// capture.mjs
+import { chromium } from "playwright-core"
+const [url, pngPath] = process.argv.slice(2)
+const browser = await chromium.launch({ channel: "chrome", headless: true })
+try {
+  const page = await browser.newPage({ viewport: { width: 1280, height: 720 }, deviceScaleFactor: 1 })
+  await page.goto(url, { waitUntil: "load", timeout: 30000 })
+  await page.screenshot({ path: pngPath })
+  console.log(pngPath)
+} finally {
+  await browser.close()
+}
+```
+
+Run from the js-eval kernel (also works on a Node kernel):
+
+```js
+const { promisify } = await import("node:util")
+const { execFile } = await import("node:child_process")
+const result = await promisify(execFile)("node", [scriptPath, url, pngPath], { timeout: 45000 })
+console.log(result.stdout)
+```
+
+For auth, CLONE the user-data directory to a private task-owned directory
+and use `chromium.launchPersistentContext(clonePath, { channel: "chrome" })`.
+NEVER launch against or clear cookies/cache/site data from the live profile.
+Close the context and remove only the clone after QA. For script-based stealth,
+read the ultimate-browsing skill's `references/chrome-stealth.md`.
+
+## Capture a screenshot at a fixed viewport
+
+Match CSS viewport AND PNG dimensions: WebKit follows native display scale
+(a 1280x720 viewport can yield 2560x1440 pixels). Use matching reference
+captures or Chrome's `deviceScaleFactor`, not resizing to force a pass.
+Wait for the specific page state, not a sleep, then compare:
+
+```sh
+node "$SKILL_DIR/scripts/visual-qa.mjs" image-diff reference.png actual.png
+```
+
+Inspect `dimensionsMatch` and `diffRatio`, then inspect the image. Close every
+WebView/browser context and the fixture server, even on a failed capture.

package/packages/omo-codex/plugin/test/bootstrap-default-role.test.mjs

@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { runWorkerSetup } from "../components/bootstrap/dist/cli.js";
+
+async function fixture(run) {
+	const root = await mkdtemp(join(tmpdir(), "bootstrap-default-"));
+	try {
+		const pluginRoot = join(root, "plugin");
+		const codexHome = join(root, "codex");
+		const pluginData = join(root, "data");
+		const agents = join(pluginRoot, "components", "ultrawork", "agents");
+		await mkdir(agents, { recursive: true });
+		await mkdir(join(pluginRoot, "dist", "cli"), { recursive: true });
+		await mkdir(join(root, ".omo"), { recursive: true });
+		await mkdir(join(codexHome, "agents"), { recursive: true });
+		await writeFile(join(pluginRoot, "dist", "cli", "index.js"), "");
+		await writeFile(join(agents, "lazycodex-worker-medium.toml"), 'name = "lazycodex-worker-medium"\nmodel = "qa-model"\ndeveloper_instructions = "qa worker"\n');
+		await run({ root, codexHome, pluginRoot, pluginData, platform: "darwin", env: { HOME: root, USERPROFILE: root }, target: join(codexHome, "agents", "default.toml") });
+	} finally {
+		await rm(root, { recursive: true, force: true });
+	}
+}
+
+test("#given a bundled worker #when bootstrap repeats #then default registration and bytes are stable", async () => {
+	await fixture(async (input) => {
+		await runWorkerSetup(input);
+		const content = await readFile(input.target, "utf8");
+		assert.match(content, /^name = "default"$/m);
+		assert.match(content, /^model = "qa-model"$/m);
+		const config = await readFile(join(input.codexHome, "config.toml"), "utf8");
+		assert.match(config, /\[agents\.default\]\nconfig_file = "\.\/agents\/default\.toml"/);
+		await runWorkerSetup(input);
+		assert.equal(await readFile(input.target, "utf8"), content);
+		assert.equal(await readFile(join(input.codexHome, "config.toml"), "utf8"), config);
+	});
+});
+
+test("#given unified default.disable #when bootstrap runs #then fresh and previously managed defaults are absent", async () => {
+	await fixture(async (input) => {
+		const configPath = join(input.root, ".omo", "omo.jsonc");
+		const disabled = JSON.stringify({ "[codex]": { agents: { default: { disable: true } } } });
+		await writeFile(configPath, disabled);
+		await runWorkerSetup(input);
+		await assert.rejects(readFile(input.target), { code: "ENOENT" });
+		await writeFile(configPath, "{}");
+		await runWorkerSetup(input);
+		assert.match(await readFile(input.target, "utf8"), /^name = "default"$/m);
+		await writeFile(configPath, disabled);
+		await runWorkerSetup(input);
+		await assert.rejects(readFile(input.target), { code: "ENOENT" });
+		assert.doesNotMatch(await readFile(join(input.codexHome, "config.toml"), "utf8"), /\[agents\.default\]/);
+	});
+});
+
+test("#given a user default #when bootstrap runs #then it is preserved and degradation is visible", async () => {
+	await fixture(async (input) => {
+		const custom = 'name = "default"\nmodel = "custom"\n';
+		await writeFile(input.target, custom);
+		const outcome = await runWorkerSetup(input);
+		assert.ok(outcome.degraded.some((entry) => entry.component === "agents"));
+		assert.equal(await readFile(input.target, "utf8"), custom);
+	});
+});

package/packages/omo-codex/plugin/test/component-hook-contract-cases.mjs

@@ -7,7 +7,7 @@ export function componentHookContractCases(tempRoot) {
 	writeFileSync(join(tempRoot, ".omo", "evidence", "receipt.txt"), "command output PASS\n".repeat(10));
 	const spawnPayload = {
 		cwd: tempRoot, hook_event_name: "PreToolUse", model: "gpt-6-astra",
-		permission_mode: "default", session_id: "s-spawn-admission", tool_input: { message: "scan" },
+		permission_mode: "default", session_id: "s-spawn-admission", tool_input: { message: "scan", agent_type: "explorer", fork_context: false },
 		tool_name: "spawn_agent", tool_use_id: "spawn-1", transcript_path: null, turn_id: "t-spawn",
 	};
 	const marker = join(tempRoot, "plugin-data", "spawn-breaker", "s-spawn-admission.json");
@@ -45,6 +45,18 @@ export function componentHookContractCases(tempRoot) {
 			payload: { ...spawnPayload, session_id: "s-spawn-clean" },
 			assertOutput(stdout) { assert.equal(stdout, ""); },
 		},
+		...[
+			{ message: "scan", fork_context: false },
+			{ message: "scan", agent_type: "worker", fork_context: false },
+			{ message: "scan", fork_turns: "all", task_name: "scan" },
+		].map((tool_input, index) => ({
+			name: `ulw-loop rejects generic or unnamed role ${index}`,
+			component: "ulw-loop", event: "pre-tool-use-spawn",
+			payload: { ...spawnPayload, session_id: "s-spawn-clean", tool_input },
+			assertOutput(stdout) {
+				assert.equal(JSON.parse(stdout).hookSpecificOutput.permissionDecision, "deny");
+			},
+		})),
 		{
 			name: "rules session-start",
 			component: "rules",