oh-my-opencode 5.1.48 → 5.1.51

package/packages/omo-codex/plugin/skills/lcx-report-bug/SKILL.md

@@ -9,8 +9,8 @@ metadata:
 
 You are a LazyCodex bug router and reporter. Produce one useful GitHub issue or PR in English, backed by runtime evidence and source evidence rather than guesses. Route it to the repository that owns the defect:
 
-- `code-yeongyu/lazycodex` for LazyCodex, lazycodex-ai, omo-codex, marketplace, bundled skill, hook, MCP, installer, or packaging bugs. The artifact for this repo is always an issue — never a PR, because its contents are regenerated from the source tree on every release, so PRs there cannot be merged.
-- `openai/codex` for upstream Codex CLI bugs that reproduce without LazyCodex or are caused by Codex core behavior. This is the only repo where this skill may create a PR.
+- `code-yeongyu/lazycodex` for LazyCodex, lazycodex-ai, omo-codex, marketplace, bundled skill, hook, MCP, installer, or packaging bugs. The artifact for this repo is always an issue, never a PR: it is a distribution mirror generated from `code-yeongyu/oh-my-openagent` (its `plugins/omo/` tree is synced from `packages/omo-codex/plugin/`), so PRs there cannot be merged. A fix for these defects goes to `code-yeongyu/oh-my-openagent` as a fork PR (base `dev`, source-tree paths, changelog fragment) through `$lcx-contribute-bug-fix`; the mirror issue stays short and links that PR.
+- `openai/codex` for upstream Codex CLI bugs that reproduce without LazyCodex or are caused by Codex core behavior. A PR may be created here.
 
 Use GPT-5.5 style: outcome first, concise, evidence-bound. Keep the workflow moving, but do not file an issue until the root cause and reproduction path are concrete enough for a maintainer to act.
 
@@ -90,7 +90,7 @@ sync_latest_source openai/codex "$LAZYCODEX_SOURCE_ROOT/chatgpt-subscription-sou
    - Use `code-yeongyu/lazycodex` when the bug is in LazyCodex integration, distribution, bundled plugin code, skills, hooks, MCP wiring, installer behavior, aliases, marketplace sync, docs, or any behavior that disappears in clean upstream Codex.
    - Use `openai/codex` when the bug reproduces in clean upstream Codex without LazyCodex, or the failing behavior comes from Codex CLI core, plugin API contracts, sandboxing, approvals, config loading, or built-in tool behavior.
    - If ownership remains ambiguous after evidence gathering, do not guess. Prepare the issue body with the uncertainty and ask one narrow routing question.
-7. Search for an existing issue in the selected repo before creating a new one. Search the other repo too when the ownership boundary is close:
+7. Search for an existing issue or lead PR before creating anything new. Search your own open PRs across all repos first (`gh search prs --author @me --state open "<symbol or error text>"`), then the selected repo, and the other repo too when the ownership boundary is close:
 
 ```bash
 TARGET_REPO="code-yeongyu/lazycodex" # or openai/codex
@@ -111,7 +111,7 @@ fi
 
 If the selected repo is `openai/codex` and label management is not available, still include the footer tag in the body and continue without claiming label creation succeeded.
 10. If no matching issue exists, create the issue with `gh` and apply the `lazycodex-generated` label.
-11. Create a PR only when the target repo is `openai/codex` AND the user asked for a PR, the fix is already implemented on a branch, or the smallest correct fix can be safely made there. Never create a PR or push a branch against `code-yeongyu/lazycodex` — always file an issue there, embedding the verified patch in the Proposed Fix section when one exists. Apply the `lazycodex-generated` label to every PR created by this skill. Otherwise create an issue with fix guidance.
+11. Create a PR only when the target repo is `openai/codex` or `code-yeongyu/oh-my-openagent` (the source of the LazyCodex mirror, base `dev`) AND the user asked for a PR, the fix is already implemented on a branch, or the smallest correct fix can be safely made there; use `$lcx-contribute-bug-fix` for the fix workflow. Never create a PR or push a branch against `code-yeongyu/lazycodex`: file a short issue there (symptom and failing input) that links the oh-my-openagent PR, with no patch. Apply the `lazycodex-generated` label to every PR created by this skill. Otherwise create an issue with fix guidance.
 
 ## Required Label And Footer
 
@@ -176,7 +176,7 @@ Tag: lazycodex-generated
 
 ## PR Body Template
 
-Use this only when a PR is the right artifact, which is only ever for `openai/codex`:
+Use this only when a PR is the right artifact, which is only ever for `openai/codex` or `code-yeongyu/oh-my-openagent`:
 
 ```markdown
 ## Summary
@@ -226,7 +226,7 @@ if [ "${#LABEL_ARGS[@]}" -gt 0 ]; then
 fi
 ```
 
-For a PR from a branch pushed to a fork — `openai/codex` only, never `code-yeongyu/lazycodex`:
+For a PR from a branch pushed to a fork, against `openai/codex` or `code-yeongyu/oh-my-openagent` (never `code-yeongyu/lazycodex`):
 
 ```bash
 PR_BODY="${TMPDIR:-/tmp}/lcx-report-bug-pr-$(date +%Y%m%d-%H%M%S).md"
@@ -259,7 +259,7 @@ Stop and ask one narrow question only when the missing fact changes the issue ma
 
 Do not file:
 
-- a PR or pushed branch targeting `code-yeongyu/lazycodex` — file the issue instead, always
+- a PR or pushed branch targeting `code-yeongyu/lazycodex` — send a fix PR to `code-yeongyu/oh-my-openagent` and keep any mirror issue short, always
 - a vague issue without reproduction steps
 - an issue that claims a root cause not supported by runtime evidence
 - a duplicate when commenting on an existing issue is enough

package/packages/omo-codex/plugin/skills/lcx-report-bug/agents/openai.yaml

@@ -8,4 +8,4 @@ interface:
     - "omo-codex bug"
     - "openai codex bug"
     - "codex upstream issue"
-  default_prompt: "Use $lcx-report-bug to investigate this LazyCodex or Codex bug, compare LazyCodex evidence with sources under LAZYCODEX_SOURCE_ROOT or ${TMPDIR:-/tmp}/lazycodex-sources, choose the correct GitHub repo, and file an issue (or, for openai/codex only, a PR — never a PR on code-yeongyu/lazycodex) with reproduction, root cause, fix guidance, and the lazycodex-generated label and footer."
+  default_prompt: "Use $lcx-report-bug to investigate this LazyCodex or Codex bug, compare LazyCodex evidence with sources under LAZYCODEX_SOURCE_ROOT or ${TMPDIR:-/tmp}/lazycodex-sources, choose the correct GitHub repo, and file an issue (or a PR on code-yeongyu/oh-my-openagent or openai/codex when the fix is ready — never a PR on the code-yeongyu/lazycodex mirror) with reproduction, root cause, fix guidance, and the lazycodex-generated label and footer."

package/packages/omo-codex/plugin/skills/ultimate-browsing/SKILL.md

@@ -38,8 +38,9 @@ Read the matching reference before acting: [`references/insane-search/README.md`
 **Why first**: ~10x faster than a browser, no process spin-up; handles most "fetch this blocked page" requests via curl_cffi TLS impersonation, yt-dlp (1858 sites), official public APIs, mobile URL transforms, **Phase-2.5 surrogate archives** (Wayback / archive.today snapshots, provenance-tagged — see [`references/insane-search/cache-archive.md`](references/insane-search/cache-archive.md)), a key-gated Jina Reader (`JINA_API_KEY`), and a Playwright real-Chrome fallback. The engine lives **inside this skill** at `engine/` and is invoked as a module. Surrogate results are dated COPIES: a result whose `provenance` is `snapshot` must be reported with its `snapshot_timestamp`, never presented as the live page.
 
 ```bash
-# Core command — auto-detects WAF, runs the full fetch grid (run from the skill dir):
-python3 -m engine "https://example.com/blocked-page"
+# Core command — auto-detects WAF, runs the full fetch grid (run from the skill dir).
+# Keep -B: this skill can live inside a signed app bundle, and bytecode caches written into engine/ break its signature.
+python3 -B -m engine "https://example.com/blocked-page"
 #   add --selector "<CSS>" for positive-proof validation, --device auto|desktop|mobile,
 #   --trace to inspect every attempt, --json for machine-readable output.
 
@@ -119,9 +120,9 @@ When the blocked flow needs the user's account, drive the browser they are alrea
 ```bash
 # Extract cookies to a file:
 mkdir -p ~/.local/state/omo-cookies
-python3 scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
+python3 -B scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
 # Extract and inject into the running CDP session:
-python3 scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
+python3 -B scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
 ```
 
 Cookie export files are written with owner-only `0600` permissions. Do not place live auth cookies in shared temp directories or commit them to a repo. Cookie injection sends values to CDP over stdin rather than argv. Cookies apply on next navigation — reload after injecting. Google services use fingerprint-bound tokens that may not transfer across browser profiles. Limits in [references/chrome-stealth.md](references/chrome-stealth.md).

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/AGENTS.md

@@ -115,7 +115,7 @@ Any future upstream sync preserves BOTH sides. Concretely:
 
 ## OVERVIEW
 
-A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -m engine URL`), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.
+A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -B -m engine URL`; `-B` keeps bytecode caches out of a signed app bundle, #11373), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.
 
 ## THE NO-SITE-NAME RULE (enforced in CI)
 
@@ -163,7 +163,7 @@ L3+   content checks
 ## CLI
 
 ```bash
-python3 -m engine URL [--selector S] [--device auto|desktop|mobile]
+python3 -B -m engine URL [--selector S] [--device auto|desktop|mobile]
                       [--timeout 25] [--max-attempts 12]
                       [--no-playwright] [--allow-proxy] [--json] [--trace]
 ```

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/__main__.py

@@ -2,13 +2,16 @@
 """CLI entrypoint for the insane-search engine.
 
 Usage:
-    python3 -m engine URL [--selector CSS] [--device auto|desktop|mobile]
-                          [--timeout N] [--max-attempts N] [--json] [--trace]
+    python3 -B -m engine URL [--selector CSS] [--device auto|desktop|mobile]
+                             [--timeout N] [--max-attempts N] [--json] [--trace]
+
+`-B` is required: `-m` compiles the package before any engine code runs, so only
+the interpreter flag keeps bytecode caches out of a signed app bundle.
 
 Examples:
-    python3 -m engine "https://example.com/" --selector "h1"
-    python3 -m engine "https://example.com/" --json
-    python3 -m engine "https://example.com/" --device mobile --trace
+    python3 -B -m engine "https://example.com/" --selector "h1"
+    python3 -B -m engine "https://example.com/" --json
+    python3 -B -m engine "https://example.com/" --device mobile --trace
 
 Exit codes:
     0   strong_ok or weak_ok
@@ -25,7 +28,7 @@ from . import fetch
 
 
 def build_parser() -> argparse.ArgumentParser:
-    p = argparse.ArgumentParser(prog="python3 -m engine",
+    p = argparse.ArgumentParser(prog="python3 -B -m engine",
                                 description="Generic WAF-profile fetch chain.")
     p.add_argument("url", help="URL to fetch.")
     p.add_argument("--selector", "-s", action="append", default=None,

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/summary.py

@@ -19,7 +19,7 @@ R7_HINT = (
     "💡 R7 API-first 권장: WAF가 HTML 경로를 차단 중. "
     "Playwright MCP 사용 → browser_navigate → browser_network_requests "
     "→ `/api/`·`/graphql`·`\\.json` 필터로 내부 엔드포인트 탐지 → "
-    "해당 URL을 `python3 -m engine <API_URL>`로 재호출. 대부분 API 레이어는 "
+    "해당 URL을 `python3 -B -m engine <API_URL>`로 재호출. 대부분 API 레이어는 "
     "WAF 방어가 얕아 curl_cffi만으로 수집됨."
 )
 

package/packages/omo-codex/plugin/skills/ultimate-browsing/references/insane-search/README.md

@@ -2,7 +2,7 @@
 # Insane Search
 
 > Part of the **ultimate-browsing** skill (Tier 1). Routing and tier-escalation live in [../../SKILL.md](../../SKILL.md).
-> The engine package it drives is at [../../engine/](../../engine/), invoked from the skill directory as `python3 -m engine "<URL>"`.
+> The engine package it drives is at [../../engine/](../../engine/), invoked from the skill directory as `python3 -B -m engine "<URL>"` (`-B` keeps bytecode caches out of a signed app bundle).
 > Deep-dives in this folder: TLS impersonation, Playwright routing, fallback, metadata, Jina, cache/archive, RSS, JSON/public APIs, Twitter, Naver, media.
 
 
@@ -16,7 +16,7 @@
 1. WebFetch, 즉흥 curl, 수동 헤더 조합 **시도 금지**
 2. 즉시 다음을 실행:
    ```bash
-   python3 -m engine "<URL>" [--selector "<CSS>"] [--device auto|desktop|mobile] [--trace] \
+   python3 -B -m engine "<URL>" [--selector "<CSS>"] [--device auto|desktop|mobile] [--trace] \
                               [--no-retry] [--no-extract]
    ```
 3. 종료코드 0(ok) 또는 1(fail) 받은 뒤 판단. trace를 먼저 읽고 재시도 결정.
@@ -49,7 +49,7 @@
 **MCP 정찰 루트**:
 1. `mcp__playwright__browser_navigate` → 대상 페이지 로드 (브라우저 렌더링)
 2. `mcp__playwright__browser_network_requests` → XHR/fetch 호출 목록 수집, `/api/`·`/graphql`·`\.json` 필터로 내부 엔드포인트 식별
-3. 식별된 JSON API URL을 `python3 -m engine <API_URL>`로 재호출 (백그라운드 engine과는 별개 호출). 대부분 API 레이어는 페이지 HTML보다 WAF 보호가 얕아 curl_cffi로 바로 수집됨
+3. 식별된 JSON API URL을 `python3 -B -m engine <API_URL>`로 재호출 (백그라운드 engine과는 별개 호출). 대부분 API 레이어는 페이지 HTML보다 WAF 보호가 얕아 curl_cffi로 바로 수집됨
 4. 응답 스키마 파악 후 pagination / query parameter 조합해 반복 수집
 
 **왜**: SPA + WAF 사이트(쇼핑몰·커머스 다수)는 마케팅 페이지(HTML)만 WAF로 중투자하고 내부 API는 gateway 레벨 기본 방어만 쓰는 경우가 많다. HTML 격자 전수 낭비(50회 × 0.5s + Playwright fallback 40s ≈ 65초)보다 **MCP 정찰 1회(5~10초) + API 재호출(0.5초)**가 훨씬 경제적이고 성공률 높음.
@@ -62,7 +62,7 @@
 
 이 스킬의 핵심 불변식:
 
-- **단일 진입점**: 일반 웹 페이지는 항상 `python3 -m engine <URL>` 또는 `from engine import fetch; fetch(...)`.
+- **단일 진입점**: 일반 웹 페이지는 항상 `python3 -B -m engine <URL>` 또는 `from engine import fetch; fetch(...)`.
 - **편향 금지**: `engine/**`, `waf_profiles.yaml`에 특정 사이트 하드코딩 금지.
 - **힌트는 런타임에만**: 사이트 고유 정보는 CLI/`user_hint` 경유.
 

package/packages/omo-codex/plugin/skills/ultimate-browsing/scripts/extract_cookies.py

@@ -7,8 +7,8 @@ with synthetic fixtures on any OS. This module wires them to a real browser DB
 and a local Chrome CDP session controlled by playwright-core scripts.
 
 Usage:
-    python extract_cookies.py --browser chrome --domain youtube.com --output /tmp/cookies.json
-    python extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
+    python -B extract_cookies.py --browser chrome --domain youtube.com --output /tmp/cookies.json
+    python -B extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
 """
 from __future__ import annotations
 
@@ -23,6 +23,8 @@ import tempfile
 from pathlib import Path
 from typing import Callable, NotRequired, TypedDict
 
+sys.dont_write_bytecode = True
+
 from cookie_crypto import (
     decrypt_chromium_value,
     derive_key,

package/packages/omo-codex/plugin/skills/ultrawork/SKILL.md

@@ -483,6 +483,9 @@ commits this session — then stage + draft the message instead.
   the receipt, then continue.
 - After 2 identical failed attempts at one step, surface what was tried
   and ask the user before another retry.
+- A permission denial or a refusal by the user is not a blocker to work
+  around: it is final for what that call was meant to do. Never reach that
+  result with another tool, command, path or host; ask the user.
 - After 2 parallel exploration waves yield no new useful facts, stop
   exploring and act.
 

package/packages/omo-codex/plugin/skills/ulw-research/AGENTS.md

@@ -23,11 +23,11 @@ ulw-research/
     ├── report-tools-commands.mjs    # one function per subcommand
     ├── cli-support.mjs / entry-guard.mjs   # flags, CliError, exit codes, atomic JSON, symlink-safe entry check
     ├── contracts.mjs                # frozen vocabulary: DEFECT_CODES (severity lives only here), FIDELITY_CODES, enums, manifest + repair-state validators
-    ├── outcome.mjs                  # outcome.json manifest, deliverable state, verify, closing briefing
+    ├── outcome.mjs / outcome-start.mjs # manifest lifecycle + the run clock outcome init records (--started-at, metadata, dir-name fallback)
     ├── repair-tracker.mjs           # bounded repair decisions (attempts, plateau, oscillation, wall clock, integrity codes)
     ├── html-lite.mjs / entities.mjs # HTML tokenizer, selector paths, prose text
     ├── css-lite.mjs / design-spec.mjs      # CSS scanning, palette + lineage parsing, design-spec rendering
-    ├── gates-static.mjs + gates-text.mjs / gates-figures.mjs / gates-structure.mjs   # static gates G1-G17
+    ├── gates-static.mjs + gates-text.mjs / gates-figures.mjs / gates-structure.mjs   # static gates G1-G17; sources-citation.mjs is the one Sources predicate (claim segments vs citation fields)
     ├── layout-probe.mjs / gates-layout.mjs # in-page probe source + layout gates L1-L5 over its output
     ├── format-extract.mjs / format-extract-css.mjs   # design-spec draft from a pointed-at HTML or Markdown document
     ├── fact-ledger.mjs              # fact ledger IO and writers (addRow, retractRow, supersedeRow, --view table)
@@ -43,14 +43,18 @@ ulw-research/
     ├── fact-commands.mjs            # `fact add|quote|retract|export|fill|derive` (lazy-loaded by report-tools)
     ├── fact-commands-verify.mjs     # `fact verify` and the Markdown projection it checks
     ├── fidelity-records.mjs         # FIDELITY_RECORDS table + the delivery barrier of outcome verify/finish (fidelity_unresolved, edition_unverified)
-    ├── source-commands.mjs          # `source snapshot`, `claims index`, snapshot readers
+    ├── source-commands.mjs          # `source snapshot`, `claims index`, snapshot readers; `source refresh` is source-refresh.mjs
+    ├── source-view.mjs / raw-decode.mjs / html-text-map.mjs   # the one snapshot reading: locator text, charset decode, byte map, visible-text extraction
+    ├── css-hiding.mjs               # whether inline styles and the page's <style> rules hide an element from every reader (cascade, conditional at-rules)
+    ├── conversion-probe.mjs / number-grammar.mjs   # `source probe-conversion` (numeric diff of a conversion); the one grouped-number grammar (shared with numerals.mjs)
+    ├── markdown-closers.mjs         # CommonMark closer runs (titled/parenthesised link and image targets, references, escapes) for the probe's sign reading and link spans
     ├── *.test.ts                    # co-located bun tests, one per module (unshipped)
     └── tests/fixtures/              # good/bad reports, boxes.json, reference docs (unshipped)
 ```
 
 ## SURFACE
 
-`node "$SKILL_DIR/scripts/report-tools.mjs" <command>`: `check`, `layout-probe`, `repair decide`, `outcome init`, `outcome set`, `outcome gate`, `outcome render`, `outcome state`, `outcome verify`, `outcome finish`, `outcome briefing`, `format-extract`, `fact add`, `fact quote`, `fact retract`, `fact export`, `fact fill`, `fact verify`, `fact derive`, `source snapshot`, `claims index`, `--help --json`. Gates recorded by `outcome gate`, in order: `static`, `fidelity`, `layout`, `visual`, `proofread` (`fidelity` is `fact verify` on every reader-facing edition; HTML only in this stage). Exit codes: `0` pass, `1` semantic failure (blockers, a failed verify, a blocked repair), `2` usage or IO. JSON on stdout, one summary line on stderr. Flags per command: `references/deliverable-phase.md` section 10.
+`node "$SKILL_DIR/scripts/report-tools.mjs" <command>`: `check`, `layout-probe`, `repair decide`, `outcome init`, `outcome set`, `outcome gate`, `outcome render`, `outcome state`, `outcome verify`, `outcome finish`, `outcome briefing`, `format-extract`, `fact add`, `fact quote`, `fact retract`, `fact export`, `fact fill`, `fact verify`, `fact derive`, `source snapshot`, `source refresh`, `claims index`, `--help --json`. Gates recorded by `outcome gate`, in order: `static`, `fidelity`, `layout`, `visual`, `proofread` (`fidelity` is `fact verify` on every reader-facing edition; HTML, or Markdown with its fill map). Exit codes: `0` pass, `1` semantic failure (blockers, a failed verify, a blocked repair), `2` usage or IO. JSON on stdout, one summary line on stderr. Flags per command: `references/deliverable-phase.md` section 10.
 
 ## CONVENTIONS