oh-my-opencode 5.0.0-beta.8 → 5.0.0-beta.9

package/packages/omo-codex/plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "@sisyphuslabs/omo-codex-plugin",
-	"version": "5.0.0-beta.8",
+	"version": "5.0.0-beta.9",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@sisyphuslabs/omo-codex-plugin",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"workspaces": [
 				"components/codegraph",
 				"components/comment-checker",
@@ -101,7 +101,7 @@
 		},
 		"components/codegraph": {
 			"name": "@sisyphuslabs/codex-codegraph",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"bin": {
 				"omo-codegraph": "dist/cli.js"
 			},
@@ -120,7 +120,7 @@
 		},
 		"components/comment-checker": {
 			"name": "@code-yeongyu/codex-comment-checker",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"bin": {
 				"omo-comment-checker": "dist/cli.js"
@@ -141,7 +141,7 @@
 		},
 		"components/git-bash": {
 			"name": "@sisyphuslabs/codex-git-bash-hook",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"bin": {
 				"omo-git-bash-hook": "dist/cli.js"
 			},
@@ -156,7 +156,7 @@
 		},
 		"components/lazycodex-executor-verify": {
 			"name": "@code-yeongyu/codex-lazycodex-executor-verify",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"bin": {
 				"lazycodex-executor-verify": "dist/cli.js"
@@ -173,7 +173,7 @@
 		},
 		"components/lsp": {
 			"name": "@code-yeongyu/codex-lsp",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"dependencies": {
 				"@code-yeongyu/lsp-daemon": "file:../../../../lsp-daemon",
@@ -194,7 +194,7 @@
 		},
 		"components/rules": {
 			"name": "@code-yeongyu/codex-rules",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"dependencies": {
 				"picomatch": "^4.0.3"
@@ -216,7 +216,7 @@
 		},
 		"components/start-work-continuation": {
 			"name": "@code-yeongyu/codex-start-work-continuation",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"bin": {
 				"omo-start-work-continuation": "dist/cli.js"
@@ -233,7 +233,7 @@
 		},
 		"components/teammode": {
 			"name": "@sisyphuslabs/codex-teammode",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"devDependencies": {
 				"@types/node": "^25.9.3",
 				"bun-types": "^1.3.1",
@@ -246,7 +246,7 @@
 		},
 		"components/telemetry": {
 			"name": "@code-yeongyu/codex-telemetry",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"bin": {
 				"omo-telemetry": "dist/cli.js"
@@ -264,7 +264,7 @@
 		},
 		"components/ultrawork": {
 			"name": "@code-yeongyu/codex-ultrawork",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"bin": {
 				"omo-ultrawork": "dist/cli.js"
@@ -282,7 +282,7 @@
 		},
 		"components/ulw-loop": {
 			"name": "@code-yeongyu/codex-ulw-loop",
-			"version": "5.0.0-beta.8",
+			"version": "5.0.0-beta.9",
 			"license": "MIT",
 			"bin": {
 				"omo-ulw-loop": "dist/cli.js",
@@ -1534,9 +1534,9 @@
 			}
 		},
 		"node_modules/nanoid": {
-			"version": "3.3.12",
-			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-			"integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+			"version": "3.3.18",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+			"integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
 			"dev": true,
 			"funding": [
 				{
@@ -1590,9 +1590,9 @@
 			}
 		},
 		"node_modules/postcss": {
-			"version": "8.5.15",
-			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-			"integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+			"version": "8.5.23",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+			"integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
 			"dev": true,
 			"funding": [
 				{
@@ -1610,7 +1610,7 @@
 			],
 			"license": "MIT",
 			"dependencies": {
-				"nanoid": "^3.3.12",
+				"nanoid": "^3.3.16",
 				"picocolors": "^1.1.1",
 				"source-map-js": "^1.2.1"
 			},

package/packages/omo-codex/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sisyphuslabs/omo-codex-plugin",
-  "version": "5.0.0-beta.8",
+  "version": "5.0.0-beta.9",
   "description": "Aggregate Codex plugin root for OMO components.",
   "type": "module",
   "packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/skills/ultimate-browsing/ATTRIBUTION.md

@@ -1,19 +1,46 @@
 # ATTRIBUTION / NOTICE
 
 This skill (`ultimate-browsing`, part of `@oh-my-opencode/shared-skills`) ships
-project-original content plus two third-party tools that it installs at runtime
-(it does NOT vendor their source). Each runtime tool's license and required
-notices are reproduced below.
+project-original content, one vendored-and-modified upstream engine, plus two
+third-party tools that it installs at runtime (it does NOT vendor their source).
+Each component's provenance, license, and required notices are reproduced below.
 
 ---
 
-## 1. Project-original content (no third-party source vendored)
+## 1. insane-search engine — vendored upstream snapshot, modified
+
+`engine/**` originates from the **insane-search** project and is NOT
+project-original code, despite being heavily modified since import.
+
+- Upstream source: https://github.com/fivetaku/insane-search
+- Vendored into this repository on 2026-06-21 by commit
+  **`a4e4ed797`** (`feat(ultimate-browsing): vendor insane-search engine (junk-excluded)`),
+  via an explicit file whitelist that excluded caches and smoke-test junk.
+- Baseline: the upstream state as of that date, a **pre-0.7.0 snapshot**.
+  Upstream's CHANGELOG dates 0.7.0 to 2026-06-22; imported files carry no
+  version marker. We have never re-vendored since; the tree has diverged in
+  both directions.
+- Modifications by this project (non-exhaustive): de-personalization
+  (`4743199a5`), the Phase 2.5 surrogate retrieval stage and surrogate registry,
+  the provenance/trust result contract, the `bias_check.py` no-site-name CI gate,
+  module split of the fetch chain, and the Python test suite under
+  `engine/tests/`.
+- No upstream `LICENSE` file was included in the vendored snapshot, so this
+  repository has no upstream license text to reproduce here. Do not infer
+  project-original licensing from that absence; treat `engine/**` as
+  upstream-derived when reasoning about provenance.
+
+The binding version policy — which upstream baseline we sit on, why we stay
+pinned, what a future re-vendor must preserve, and what it must not import — is
+[`engine/AGENTS.md` §UPSTREAM BASELINE AND VERSION POLICY](engine/AGENTS.md).
+
+---
+
+## 2. Project-original content (no third-party source vendored)
 
 The following are authored by the oh-my-openagent project and carry no third-party
 license obligation:
 
-- `engine/**` — the insane-search Tier-1 fetch engine (curl_cffi grid, WAF
-  detection, Playwright fallback templates, `bias_check.py` no-site-name gate).
 - `references/insane-search/**` and `references/agent-reach/**` — the Tier-1 and
   Tier-1.5 reference docs.
 - `scripts/extract_cookies.py`, `scripts/cookie_paths.py`, `scripts/cookie_crypto.py`
@@ -26,7 +53,7 @@ user installs separately; this skill includes none of their source.
 
 ---
 
-## 2. CloakBrowser (CloakHQ) — Tier-2 stealth Chromium (runtime dependency)
+## 3. CloakBrowser (CloakHQ) — Tier-2 stealth Chromium (runtime dependency)
 
 The Tier-2 stealth browser is **CloakBrowser**, installed at runtime via `pip`
 (`pip install cloakbrowser`). No CloakBrowser source is vendored in this repository.
@@ -73,7 +100,7 @@ SOFTWARE.
 
 ---
 
-## 3. agent-browser (vercel-labs) — Tier-2 CDP automation CLI (runtime dependency)
+## 4. agent-browser (vercel-labs) — Tier-2 CDP automation CLI (runtime dependency)
 
 The Tier-2 automation CLI is **agent-browser**, installed at runtime via `npm`
 (`npm i -g agent-browser`). No agent-browser source is vendored in this repository.

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/AGENTS.md

@@ -2,6 +2,116 @@
 
 **Generated:** 2026-08-10 / 38d268995
 
+## UPSTREAM BASELINE AND VERSION POLICY
+
+**READ THIS BEFORE TOUCHING `engine/**` OR PROPOSING AN UPSTREAM SYNC.**
+
+This engine is NOT project-original code. It is a vendored-and-modified snapshot of
+[fivetaku/insane-search](https://github.com/fivetaku/insane-search), and the version
+we run on is a deliberate choice, not an accident of neglect.
+
+### The pin
+
+| Fact | Value |
+|---|---|
+| Upstream project | `https://github.com/fivetaku/insane-search` |
+| Vendoring commit | `a4e4ed797` (2026-06-21) `feat(ultimate-browsing): vendor insane-search engine (junk-excluded)` |
+| De-personalization | `4743199a5` (2026-06-21) |
+| Pinned upstream baseline | upstream state as of 2026-06-21, **pre-0.7.0** (0.7.0 is dated 2026-06-22) |
+| Re-vendors since | none — every later change here is ours |
+
+We intentionally track a **pinned baseline plus local divergence**, not upstream HEAD.
+There is no submodule and no automated drift check for this engine (unlike the
+`frontend` skill's upstream submodules): the vendored files ARE the source of truth,
+and upstream is a reference we port FROM, deliberately, file by file.
+
+### Why we do not blind-rebase onto upstream HEAD
+
+1. **Upstream reset its public history.** On 2026-08-06 upstream published a single
+   squashed commit, `019ee16 refactor: reset public history at 0.14.0`, discarding the
+   prior public history through 0.13.x. There is no upstream commit graph to rebase onto and no
+   way to cherry-pick an individual upstream change by sha — only whole-file diffing
+   against a moving HEAD.
+2. **Upstream 0.14.0 REMOVED capability.** The endpoint-mining / internal-API
+   auto-derivation / site-recipe subsystems that upstream carried publicly between
+   0.12.0 and 0.14.0 are gone from upstream HEAD. Syncing to HEAD is therefore not
+   strictly an upgrade: parts of it are a downgrade relative to the intermediate
+   versions, and none of it is recoverable from the reset history.
+3. **Our tree diverged on purpose.** The KEEP list below is functionality upstream
+   never had. A wholesale overwrite with upstream HEAD would silently delete it.
+4. **Different threat model.** Our engine ships inside a published npm package and a
+   public marketplace mirror, under a CI no-site-name gate and a de-personalization
+   deny-list. Upstream carries neither constraint, so upstream code is not
+   drop-in-shippable here.
+
+### KEEP — our divergences a re-vendor MUST NOT regress
+
+These exist only in our tree. Any upstream sync that removes or bypasses one of them
+is a regression, not an upgrade:
+
+- **Phase 2.5 surrogate retrieval** (`surrogate.py`, `surrogates.yaml`) — archive /
+  reader / proxy routes tried before paying for a browser spin-up, with per-entry
+  `last_verified` staleness handling and `--allow-proxy` gating.
+- **Provenance / trust contract** (`result_schema.py`) — `Provenance` and `Trust`
+  literals on every result, so a snapshot can never be reported as the live page.
+- **Surrogate dead-end validation** (L1.5 in `validators.py`) — interstitial titles and
+  AMP-style redirect stubs rejected instead of returned as content.
+- **The no-site-name rule and its CI gate** (`bias_check.py`) — zero hard-coded site
+  names, brands, or target domains in `engine/**`.
+- **Module split of the fetch chain** — `curl_probe` / `referers` / `url_transforms` /
+  `waf_detector` / `validators` / `executor` / `summary` as separate modules rather than
+  one monolith.
+- **The Python test suite** under `engine/tests/` with its HTML/JSON fixtures.
+- **De-personalization** — no personal absolute paths, no personal auth token literals,
+  no personal browser choice; enforced by `depersonalization-gate.test.ts`.
+- **Skill-level layering** — the engine is Tier 1 under a router that also owns Tier 1.5
+  (agent-reach) and Tier 2 (CloakBrowser + agent-browser). Upstream has no such tiering.
+
+### WANT — upstream improvements worth porting forward
+
+Our snapshot predates these; they are wanted, and each must be ported as a reviewed,
+site-agnostic change that preserves every KEEP item above. Port individually; never as
+a tree overwrite:
+
+- **Content quality**: dedicated markdown conversion of fetched HTML, main-content
+  extraction, PDF text extraction, and JSON-LD rescue when the HTML body is thin.
+- **Transient-failure retry** and **render-merge** of statically fetched HTML with the
+  browser-rendered DOM.
+- **Differential block classification** — distinguishing a bot-detection block from an
+  infrastructure or authentication failure, instead of collapsing both into `challenge`.
+- **Additional stealth fetch backends** beyond the current Playwright templates, and
+  additional WAF vendor profiles.
+- **Per-host route learning** — remembering which route succeeded for a host, with a TTL
+  and a bounded store. Must stay runtime state, never committed site knowledge (R4).
+- **Engine-level Phase 0 routing** — the official-public-API preference is currently only
+  a documented rule (R5) the agent can skip; upstream moved it into code so it cannot be
+  skipped. Worth adopting.
+
+### OUT OF SCOPE
+
+- **The removed upstream endpoint-mining / internal-API auto-derivation / site-recipe
+  subsystems.** They are absent from upstream HEAD and are not reconstructed here. They
+  also sit against R3/R4 and R7's anti-bias rule: discovered internal endpoints are
+  runtime findings, never committed engine knowledge.
+- **Any upstream code carrying site-specific selectors, domains, or brand names.** It
+  fails `bias_check.py` at the door; re-derive it site-agnostically or leave it out.
+- **Automated upstream tracking.** No submodule, no drift check, no auto-bump. Syncing is
+  a deliberate, reviewed, human-initiated act.
+
+### THE SYNC RULE
+
+Any future upstream sync preserves BOTH sides. Concretely:
+
+1. Diff the specific upstream capability you want against our tree — do not overwrite
+   files wholesale, and never `git checkout` upstream over `engine/`.
+2. Port it as its own reviewed change, keeping every KEEP item intact.
+3. Re-run `python3 engine/bias_check.py` and the `engine/tests/` suite; a port that
+   introduces a site name or breaks a fixture does not ship.
+4. Update the pin table above (baseline, date, what was ported) in the same change, plus
+   the provenance section of [`../ATTRIBUTION.md`](../ATTRIBUTION.md).
+5. If a port must drop a KEEP item, say so explicitly in the PR and get it agreed first —
+   silent regressions of the KEEP list are the failure mode this policy exists to prevent.
+
 ## OVERVIEW
 
 A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -m engine URL`), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.

package/packages/omo-codex/plugin/test/aggregate-agents.test.mjs

@@ -15,103 +15,25 @@ const agentSchemaKeys = new Set([
 	"developer_instructions",
 ]);
 
+// `includes` entries below are machine-consumed tokens only: EVIDENCE_RECORDED is the sentinel the
+// lazycodex-executor-verify SubagentStop hook greps from worker messages; recommendation, blockers,
+// codeQualityStatus, not_applicable, surfaceEvidence, and adversarialCases are fields the ulw-loop
+// quality gate parses out of reviewer/QA reports; <attemptDir>/<goalId>-code-review.md and
+// -manual-qa.md are the artifact names the ulw-loop spawn guard requires before a gate-reviewer
+// spawn; currentAttemptDir is a field of `ulw-loop status --json`.
 const lazycodexAgentInvariants = new Map([
-	[
-		"explorer.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "low",
-			includes: [/Read-only/, /working tree/, /rg/],
-		},
-	],
-	[
-		"librarian.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "low",
-			includes: [/Read-only/, /SHA-pinned GitHub permalink/, /external/],
-		},
-	],
-	[
-		"metis.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "high",
-			includes: [/pre-planning analyst/i, /contradictions/, /Read-only/],
-		},
-	],
-	[
-		"momus.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "high",
-			includes: [/plan reviewer/i, /OKAY, ITERATE, or REJECT/, /Read-only/],
-		},
-	],
-	[
-		"plan.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "high",
-			includes: [/strategic planning consultant/i, /\.omo\/plans\/<slug>\.md/, /never implements/i],
-		},
-	],
-	[
-		"lazycodex-worker-low.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "high",
-			includes: [/EVIDENCE_RECORDED: <path>/, /low-difficulty/i, /smallest correct change/i],
-		},
-	],
-	[
-		"lazycodex-worker-medium.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "high",
-			includes: [/EVIDENCE_RECORDED: <path>/, /medium-difficulty/i, /smallest correct change/i],
-		},
-	],
-	[
-		"lazycodex-worker-high.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "medium",
-			includes: [/EVIDENCE_RECORDED: <path>/, /high-difficulty/i, /smallest correct change/i],
-		},
-	],
-	[
-		"lazycodex-clone-fidelity-reviewer.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "high",
-			includes: [/recommendation/, /blockers/, /\.omo\/evidence\/<goal>-clone-fidelity\.md/],
-		},
-	],
-	[
-		"lazycodex-code-reviewer.toml",
-		{
-			model: "gpt-5.6-terra",
-			effort: "medium",
-			includes: [/codeQualityStatus/, /recommendation/, /<attemptDir>\/<goalId>-code-review\.md/, /currentAttemptDir/],
-		},
-	],
-	[
-		"lazycodex-qa-executor.toml",
-		{
-			model: "gpt-5.6-luna",
-			effort: "high",
-			includes: [/not_applicable/, /surfaceEvidence/, /adversarialCases/, /<attemptDir>\/<goalId>-manual-qa\.md/],
-		},
-	],
-	[
-		"lazycodex-gate-reviewer.toml",
-		{
-			model: "gpt-5.6-sol",
-			effort: "low",
-			includes: [/APPROVE\/REJECT/, /blockers/, /<attemptDir>\/<goalId>-gate-review\.md/, /currentAttemptDir/],
-		},
-	],
+	["explorer.toml", { model: "gpt-5.6-luna", effort: "low" }],
+	["librarian.toml", { model: "gpt-5.6-luna", effort: "low" }],
+	["metis.toml", { model: "gpt-5.6-sol", effort: "high" }],
+	["momus.toml", { model: "gpt-5.6-terra", effort: "high" }],
+	["plan.toml", { model: "gpt-5.6-sol", effort: "high" }],
+	["lazycodex-worker-low.toml", { model: "gpt-5.6-luna", effort: "high", includes: [/EVIDENCE_RECORDED: <path>/] }],
+	["lazycodex-worker-medium.toml", { model: "gpt-5.6-terra", effort: "high", includes: [/EVIDENCE_RECORDED: <path>/] }],
+	["lazycodex-worker-high.toml", { model: "gpt-5.6-sol", effort: "medium", includes: [/EVIDENCE_RECORDED: <path>/] }],
+	["lazycodex-clone-fidelity-reviewer.toml", { model: "gpt-5.6-terra", effort: "high", includes: [/recommendation/, /blockers/] }],
+	["lazycodex-code-reviewer.toml", { model: "gpt-5.6-terra", effort: "medium", includes: [/codeQualityStatus/, /recommendation/, /<attemptDir>\/<goalId>-code-review\.md/, /currentAttemptDir/] }],
+	["lazycodex-qa-executor.toml", { model: "gpt-5.6-luna", effort: "high", includes: [/not_applicable/, /surfaceEvidence/, /adversarialCases/, /<attemptDir>\/<goalId>-manual-qa\.md/] }],
+	["lazycodex-gate-reviewer.toml", { model: "gpt-5.6-sol", effort: "low", includes: [/blockers/, /currentAttemptDir/] }],
 ]);
 
 const externalSourceTokenPattern = new RegExp(
@@ -156,7 +78,6 @@ test("#given bundled Codex agents #when components/ultrawork/agents directory is
 		}
 	}
 });
-
 test("#given bundled agent TOMLs #when nickname_candidates are inspected #then they use only the codex-accepted charset", async () => {
 	// given: codex_app_server ignores a role whose nickname has characters outside
 	// ASCII letters, digits, spaces, hyphens, underscores (observed live in task-15 QA)
@@ -174,16 +95,6 @@ test("#given bundled agent TOMLs #when nickname_candidates are inspected #then t
 	}
 });
 
-test("#given planner agent prompt #when inspected #then generated artifacts stay under .omo", async () => {
-	const prompt = await readFile(join(root, "components", "ultrawork", "agents", "plan.toml"), "utf8");
-
-	assert.match(prompt, /\.omo\/plans\/<slug>\.md/);
-	assert.match(prompt, /<attemptDir>\/task-<N>-<slug>\.<ext>/);
-	assert.match(prompt, /\.omo\/evidence\/ulw\/<session>\/<goalId>\/a<attempt>/);
-	assert.doesNotMatch(prompt, /(?<!\.omo\/)plans\/<slug>\.md/);
-	assert.doesNotMatch(prompt, /(?<!\.omo\/)evidence\/task-/);
-});
-
 test("#given lazycodex agent prompts #when inspected #then each role pins model effort and evidence discipline", async () => {
 	const agentsDir = join(root, "components", "ultrawork", "agents");
 
@@ -197,73 +108,8 @@ test("#given lazycodex agent prompts #when inspected #then each role pins model
 		assert.doesNotMatch(prompt, /^blocking\s*=/m);
 		assert.doesNotMatch(prompt, externalSourceTokenPattern);
 
-		for (const pattern of invariant.includes) {
+		for (const pattern of invariant.includes ?? []) {
 			assert.match(prompt, pattern, `${fileName} must include ${pattern}`);
 		}
 	}
 });
-
-test("#given LazyCodex reviewer prompts #when inspected #then anti-slop review coverage is required", async () => {
-	const agentsDir = join(root, "components", "ultrawork", "agents");
-	const codeReviewer = await readFile(join(agentsDir, "lazycodex-code-reviewer.toml"), "utf8");
-	const gateReviewer = await readFile(join(agentsDir, "lazycodex-gate-reviewer.toml"), "utf8");
-
-	assert.match(codeReviewer, /remove-ai-slops/);
-	assert.match(codeReviewer, /programming/);
-	assert.match(codeReviewer, /load or consult/);
-	assert.match(codeReviewer, /documented criteria/);
-	assert.match(codeReviewer, /violates either skill perspective/);
-	assert.match(codeReviewer, /overfit\/slop review pass/);
-	assert.match(codeReviewer, /deletion-only tests/);
-	assert.match(codeReviewer, /tests that merely verify a requested removal/);
-	assert.match(codeReviewer, /tautological tests/);
-	assert.match(codeReviewer, /mirror implementation constants/);
-	assert.match(codeReviewer, /unnecessary production data extraction, parsing, or normalization/);
-	assert.match(codeReviewer, /false confidence/);
-
-	assert.match(gateReviewer, /remove-ai-slops/);
-	assert.match(gateReviewer, /programming/);
-	assert.match(gateReviewer, /load or consult/);
-	assert.match(gateReviewer, /documented criteria/);
-	assert.match(gateReviewer, /Run the `remove-ai-slops`/);
-	assert.match(gateReviewer, /Apply the `programming`/);
-	assert.match(gateReviewer, /overfit\/slop pass yourself/);
-	assert.match(gateReviewer, /tests that merely verify a requested removal/);
-	assert.match(gateReviewer, /deletion-only/);
-	assert.match(gateReviewer, /tautological/);
-	assert.match(gateReviewer, /implementation-mirroring tests/);
-	assert.match(gateReviewer, /unnecessary production extraction, parsing, or normalization/);
-
-	const directPassIndex = gateReviewer.indexOf("overfit/slop pass yourself");
-	const reportCoverageIndex = gateReviewer.indexOf("Then confirm the code review report");
-	assert.notEqual(directPassIndex, -1);
-	assert.notEqual(reportCoverageIndex, -1);
-	assert.ok(
-		directPassIndex < reportCoverageIndex,
-		"gate reviewer must perform the overfit/slop pass directly before checking report coverage",
-	);
-});
-
-test("#given done-gate reviewer prompts #when inspected #then burden of proof is approve-unless-cited and reject priors are gone", async () => {
-	const agentsDir = join(root, "components", "ultrawork", "agents");
-	const gateReviewer = await readFile(join(agentsDir, "lazycodex-gate-reviewer.toml"), "utf8");
-	const qaExecutor = await readFile(join(agentsDir, "lazycodex-qa-executor.toml"), "utf8");
-	const codeReviewer = await readFile(join(agentsDir, "lazycodex-code-reviewer.toml"), "utf8");
-
-	assert.match(gateReviewer, /APPROVE unless you can cite/);
-	assert.match(gateReviewer, /violatedCriterion/);
-	assert.match(gateReviewer, /evidencePointer/);
-	assert.match(gateReviewer, /top blockers inline/);
-	assert.match(gateReviewer, /is a NOTE, not a blocker/);
-	assert.match(gateReviewer, /You do NOT check/);
-	assert.doesNotMatch(gateReviewer, /Assume the work has already failed/);
-	assert.doesNotMatch(gateReviewer, /Return exactly one recommendation: APPROVE\/REJECT\./);
-
-	assert.match(qaExecutor, /one-line reason/);
-	assert.match(qaExecutor, /rejecting a legitimately untriggered class is itself an error/);
-	assert.doesNotMatch(qaExecutor, /Trust nothing\./);
-
-	assert.match(codeReviewer, /MEDIUM by default/);
-	assert.doesNotMatch(codeReviewer, /Treat useless tests or needless production complexity as CRITICAL\/HIGH/);
-});
-

package/packages/omo-codex/plugin/test/aggregate-hooks.test.mjs

@@ -84,7 +84,7 @@ test("#given aggregate SubagentStop hooks #when inspected #then start-work and L
 	assert.equal(verifierGroups.length, 1);
 	assert.equal(verifierGroups[0]?.groupIndex, 0);
 	assert.equal(verifierGroups[0]?.handler.timeout, 10);
-	assert.match(verifierGroups[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Verifying LazyCodex Executor Evidence$/);
+	assert.match(verifierGroups[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate PostCompact hooks #when hooks are inspected #then LSP diagnostics cache reset is registered", async () => {
@@ -100,7 +100,7 @@ test("#given aggregate PostCompact hooks #when hooks are inspected #then LSP dia
 
 	// then
 	assert.equal(lspPostCompactHooks.length, 1);
-	assert.match(lspPostCompactHooks[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Resetting LSP Diagnostics Cache$/);
+	assert.match(lspPostCompactHooks[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate hook commands #when inspected #then every command exposes a Codex status message", async () => {
@@ -142,23 +142,6 @@ test("#given component hook commands #when inspected #then standalone packages e
 	assert.deepEqual(missingStatusMessages, []);
 });
 
-test("#given hook status messages #when inspected #then labels describe OMO responsibilities instead of the hook runner", async () => {
-	// given
-	const componentHooks = await readComponentHookManifests();
-
-	// when
-	const commandHooks = [
-		...(await readAggregateCommandHooks()),
-		...componentHooks.flatMap(({ source, hooks }) => collectCommandHooks(hooks, source)),
-	];
-	const genericStatusMessages = commandHooks
-		.filter(({ handler }) => typeof handler.statusMessage !== "string" || /\bhook\b/i.test(handler.statusMessage))
-		.map(hookLocation);
-
-	// then
-	assert.deepEqual(genericStatusMessages, []);
-});
-
 test("#given aggregate OMO plugin is enabled #when hooks are inspected #then shell guidance and ulw-loop guard are registered", async () => {
 	// given
 	const manifests = await readAggregateHookManifests();
@@ -169,9 +152,7 @@ test("#given aggregate OMO plugin is enabled #when hooks are inspected #then she
 
 	// then
 	assert.match(text, /components\/git-bash\/dist\/cli\.js/);
-	assert.match(text, /Recommending Git Bash MCP/);
 	assert.match(text, /hook post-compact/);
-	assert.match(text, /Resetting Git Bash MCP Reminder/);
 	assert.match(text, /components\/ulw-loop\/dist\/cli\.js/);
 	assert.match(text, /hook pre-tool-use/);
 	assert.deepEqual(preToolUseGroups.map((group) => group.matcher), [
@@ -221,7 +202,6 @@ test("#given aggregate SessionStart hooks #when inspected #then LazyCodex auto-u
 	// then
 	assert.equal(autoUpdateGroup?.matcher, "^startup$");
 	assert.match(text, /scripts\/auto-update\.mjs/);
-	assert.match(text, /Checking Auto Update/);
 	assert(sessionStartCommands.some((command) => command.includes("scripts/auto-update.mjs")));
 });
 
@@ -265,7 +245,7 @@ test("#given aggregate PostToolUse hooks #when inspected #then CodeGraph init gu
 	// then
 	assert.equal(codegraphPostToolUseHooks.length, 1);
 	assert.equal(codegraphPostToolUseHooks[0]?.matcher, "^(codegraph[._].*|mcp__codegraph__.*)$");
-	assert.match(codegraphPostToolUseHooks[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Checking CodeGraph Init Guidance$/);
+	assert.match(codegraphPostToolUseHooks[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate PostToolUse hooks #when inspected #then thread title hygiene is registered for created Codex threads", async () => {
@@ -282,7 +262,7 @@ test("#given aggregate PostToolUse hooks #when inspected #then thread title hygi
 	// then
 	assert.equal(threadTitleHooks.length, 1);
 	assert.equal(threadTitleHooks[0]?.matcher, "^(create_thread|codex_app\\.create_thread)$");
-	assert.match(threadTitleHooks[0]?.handler.statusMessage ?? "", /^\(OmO [^)]+\) Checking Thread Title Hygiene$/);
+	assert.match(threadTitleHooks[0]?.handler.statusMessage ?? "", /\S/);
 });
 
 test("#given aggregate plugin packaging #when inspected #then hooks and compatibility sentinels stay Python-free", async () => {