oh-my-opencode 5.1.48 → 5.1.54

package/packages/shared-skills/skills/programming/scripts/rust/new-project.ts

@@ -0,0 +1,215 @@
+#!/usr/bin/env bun
+/**
+ * Scaffold a new Rust project with strict lints, deny.toml, rustfmt.toml, and
+ * rust-toolchain.toml pre-configured. The generated project passes its own
+ * fmt + clippy gate before any code is written.
+ *
+ * ─── How to run ───
+ * 1. Install Bun:  curl -fsSL https://bun.sh/install | bash
+ * 2. Install Rust: https://rustup.rs (cargo >= 1.85, edition 2024)
+ * 3. Run:
+ *      bun run new-project.ts myproject
+ *      bun run new-project.ts myproject --path ./workspace
+ * ──────────────────
+ *
+ * Exit codes: 0 created, 1 cargo or scaffold failure, 2 usage error.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { assertNever, runTool } from "../shared/run-tool.ts";
+
+const USAGE = `Usage: bun run new-project.ts <name> [--path <dir>]
+
+Arguments:
+  name          Name of the new Rust project
+
+Options:
+  -p, --path    Parent directory where the project folder is created (default: cwd)
+  -h, --help    Show this help`;
+
+const RUST_TOOLCHAIN_TOML = `[toolchain]
+channel = "stable"
+components = ["rustfmt", "clippy", "rust-src"]
+profile = "default"
+`;
+
+const CARGO_TOML_LINTS = `
+[lints.rust]
+unsafe_op_in_unsafe_fn = "deny"
+missing_docs = "warn"
+missing_debug_implementations = "warn"
+unreachable_pub = "warn"
+unused_must_use = "deny"
+elided_lifetimes_in_paths = "warn"
+non_ascii_idents = "deny"
+trivial_numeric_casts = "warn"
+unused_lifetimes = "warn"
+single_use_lifetimes = "warn"
+unexpected_cfgs = { level = "deny", check-cfg = ["cfg(loom)"] }
+
+[lints.clippy]
+all = { level = "deny", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+nursery = { level = "warn", priority = -1 }
+cargo = { level = "warn", priority = -1 }
+undocumented_unsafe_blocks = "deny"
+multiple_unsafe_ops_per_block = "deny"
+unwrap_used = "deny"
+expect_used = "deny"
+panic = "deny"
+todo = "deny"
+unimplemented = "deny"
+dbg_macro = "deny"
+print_stdout = "warn"
+print_stderr = "warn"
+allow_attributes = "deny"
+allow_attributes_without_reason = "deny"
+let_underscore_must_use = "deny"
+indexing_slicing = "deny"
+mem_forget = "deny"
+clone_on_ref_ptr = "warn"
+module_name_repetitions = { level = "allow" }
+must_use_candidate = { level = "allow" }
+`;
+
+const DENY_TOML = `[advisories]
+yanked = "deny"
+
+[licenses]
+private = { ignore = true }  # publish = false crates carry no license field
+allow = ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Zlib"]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+`;
+
+const MAIN_RS = `//! Command-line entry point.
+
+use std::io::Write as _;
+
+fn main() -> std::io::Result<()> {
+    writeln!(std::io::stdout().lock(), "Hello, world!")
+}
+`;
+
+const RUSTFMT_TOML = `edition = "2024"
+max_width = 100
+use_field_init_shorthand = true
+use_try_shorthand = true
+`;
+
+const EDITION_LINE = 'edition = "2024"\n';
+
+type ProjectOptions = { readonly name: string; readonly path: string };
+
+type Cli =
+  | { readonly kind: "run"; readonly options: ProjectOptions }
+  | { readonly kind: "help" }
+  | { readonly kind: "usage"; readonly problem: string };
+
+class ScaffoldError extends Error {
+  constructor(
+    readonly kind: "cargo-unavailable" | "cargo-init-failed" | "edition-too-old",
+    message: string,
+  ) {
+    super(message);
+    this.name = "ScaffoldError";
+  }
+}
+
+function parseCli(): Cli {
+  try {
+    const { values, positionals } = parseArgs({
+      args: Bun.argv.slice(2),
+      options: {
+        path: { type: "string", short: "p", default: process.cwd() },
+        help: { type: "boolean", short: "h", default: false },
+      },
+      allowPositionals: true,
+      strict: true,
+    });
+    if (values.help) return { kind: "help" };
+    const [name, ...extra] = positionals;
+    if (name === undefined || extra.length > 0) return { kind: "usage", problem: "expected exactly one project name" };
+    return { kind: "run", options: { name, path: values.path } };
+  } catch (error) {
+    if (error instanceof TypeError) return { kind: "usage", problem: error.message };
+    throw error;
+  }
+}
+
+function cargoInit(projectDir: string, name: string): void {
+  const init = runTool("cargo", ["init", projectDir, "--name", name]);
+  switch (init.kind) {
+    case "ok":
+      return;
+    case "unavailable":
+      throw new ScaffoldError("cargo-unavailable", `cargo not found (${init.reason}). Install Rust via https://rustup.rs`);
+    case "failed":
+      throw new ScaffoldError("cargo-init-failed", `cargo init failed:\n${init.stderr}`);
+    default:
+      return assertNever(init);
+  }
+}
+
+function scaffold({ name, path }: ProjectOptions): void {
+  const projectDir = join(path, name);
+  console.error(`Creating project ${name} at ${projectDir}`);
+  cargoInit(projectDir, name);
+
+  writeFileSync(join(projectDir, "rust-toolchain.toml"), RUST_TOOLCHAIN_TOML);
+  console.error("  wrote rust-toolchain.toml");
+
+  const cargoToml = join(projectDir, "Cargo.toml");
+  const manifest = readFileSync(cargoToml, "utf8");
+  if (!manifest.includes(EDITION_LINE)) {
+    throw new ScaffoldError("edition-too-old", "cargo did not create an edition 2024 package; install Rust >= 1.85");
+  }
+  const withMsrv = manifest.replace(EDITION_LINE, `${EDITION_LINE}rust-version = "1.85"\npublish = false\n`);
+  writeFileSync(cargoToml, withMsrv + CARGO_TOML_LINTS);
+  writeFileSync(join(projectDir, "src", "main.rs"), MAIN_RS);
+  console.error("  appended [lints] to Cargo.toml");
+
+  writeFileSync(join(projectDir, "deny.toml"), DENY_TOML);
+  console.error("  wrote deny.toml");
+
+  writeFileSync(join(projectDir, "rustfmt.toml"), RUSTFMT_TOML);
+  console.error("  wrote rustfmt.toml");
+
+  console.error(`\nDone! cd ${projectDir} && cargo check`);
+}
+
+function main(): number {
+  const cli = parseCli();
+  switch (cli.kind) {
+    case "help":
+      console.log(USAGE);
+      return 0;
+    case "usage":
+      console.error(`Error: ${cli.problem}\n\n${USAGE}`);
+      return 2;
+    case "run":
+      break;
+    default:
+      return assertNever(cli);
+  }
+  try {
+    scaffold(cli.options);
+    return 0;
+  } catch (error) {
+    if (error instanceof ScaffoldError) {
+      console.error(`Error: ${error.message}`);
+      return 1;
+    }
+    throw error;
+  }
+}
+
+process.exit(main());

package/packages/shared-skills/skills/programming/scripts/scaffolders.test.ts

@@ -0,0 +1,96 @@
+import { afterAll, describe, expect, test } from "bun:test";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const runRoot = mkdtempSync(join(process.env.RUN_TMP ?? tmpdir(), "programming-scaffolders-"));
+const emptyBin = join(runRoot, "empty-bin");
+mkdirSync(emptyBin);
+
+afterAll(() => rmSync(runRoot, { recursive: true, force: true }));
+
+async function scaffold(script: string, args: readonly string[]) {
+  const child = Bun.spawn([process.execPath, join(import.meta.dir, script), ...args], {
+    cwd: runRoot,
+    env: { ...process.env, PATH: emptyBin },
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  const [stderr, code] = await Promise.all([new Response(child.stderr).text(), child.exited]);
+  return { stderr, code };
+}
+
+function pep723Metadata(source: string): unknown {
+  const block = /^# \/\/\/ script\n((?:#.*\n)*?)# \/\/\/$/m.exec(source)?.[1] ?? "";
+  return Bun.TOML.parse(block.replace(/^# ?/gm, ""));
+}
+
+describe("#given the Bun scaffolders run offline", () => {
+  test("#when new-script gets --deps and --py #then it writes an executable PEP 723 script declaring them", async () => {
+    const dest = join(runRoot, "scripts", "tool.py");
+
+    const result = await scaffold("python/new-script.ts", ["tool", "--output", dest, "-d", "polars", "--deps", "duckdb", "--py", "3.12"]);
+
+    expect(result.code).toBe(0);
+    expect(pep723Metadata(readFileSync(dest, "utf8"))).toEqual({ "requires-python": ">=3.12", dependencies: ["polars", "duckdb"] });
+    expect(statSync(dest).mode & 0o111).toBe(process.platform === "win32" ? 0 : 0o111);
+  });
+
+  test("#when go is not on PATH #then go new-project writes the fallback go.mod and substitutes the templates", async () => {
+    const project = join(runRoot, "svc");
+
+    const result = await scaffold("go/new-project.ts", ["svc", "--path", runRoot, "--module", "example.com/acme/svc", "--purpose", "billing"]);
+
+    expect(result.code).toBe(0);
+    expect(readFileSync(join(project, "go.mod"), "utf8")).toBe("module example.com/acme/svc\n\ngo 1.23\n");
+    expect(readFileSync(join(project, "cmd", "server", "main.go"), "utf8")).toContain('"example.com/acme/svc/internal/cmd"');
+    const agents = readFileSync(join(project, "AGENTS.md"), "utf8");
+    expect(agents).toContain(" billing ");
+    expect(agents).not.toMatch(/\$\{?[_a-z]/i);
+    expect(readFileSync(join(project, "README.md"), "utf8").split("\n")[0]).toBe("# svc");
+  });
+
+  test("#when the go templates were checked out with CRLF #then every generated file is LF", async () => {
+    // A CRLF checkout (git autocrlf) must not leak into the scaffolded project: its own .editorconfig says end_of_line = lf.
+    const scriptsCopy = join(runRoot, "crlf-scripts");
+    for (const dir of ["go", "shared"]) cpSync(join(import.meta.dir, dir), join(scriptsCopy, dir), { recursive: true });
+    const templatesDir = join(scriptsCopy, "go", "templates");
+    for (const file of readdirSync(templatesDir)) {
+      const path = join(templatesDir, file);
+      writeFileSync(path, readFileSync(path, "utf8").replace(/\r?\n/g, "\r\n"));
+    }
+    const project = join(runRoot, "crlf-svc");
+
+    const child = Bun.spawn([process.execPath, join(scriptsCopy, "go", "new-project.ts"), "crlf-svc", "--path", runRoot, "--module", "example.com/acme/crlf", "--purpose", "billing"], {
+      cwd: runRoot,
+      env: { ...process.env, PATH: emptyBin },
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    const [stderr, code] = await Promise.all([new Response(child.stderr).text(), child.exited]);
+
+    expect(code, stderr).toBe(0);
+    const generated = readdirSync(project, { recursive: true, withFileTypes: true })
+      .filter((entry) => entry.isFile())
+      .map((entry) => join(entry.parentPath, entry.name));
+    expect(generated.length).toBe(11);
+    const withCr = generated.filter((file) => readFileSync(file, "utf8").includes("\r"));
+    expect(withCr).toEqual([]);
+    expect(readFileSync(join(project, "README.md"), "utf8").split("\n")[0]).toBe("# crlf-svc");
+  });
+
+  test("#when cargo is not on PATH #then rust new-project exits 1 naming cargo", async () => {
+    const result = await scaffold("rust/new-project.ts", ["rsapp", "--path", runRoot]);
+
+    expect(result.code).toBe(1);
+    expect(result.stderr).toMatch(/\bcargo\b/);
+  });
+
+  test("#when uv is not on PATH #then python new-project exits 1 naming uv and creates nothing", async () => {
+    const result = await scaffold("python/new-project.ts", ["pyapp", "--path", runRoot]);
+
+    expect(result.code).toBe(1);
+    expect(result.stderr).toMatch(/\buv\b/);
+    expect(existsSync(join(runRoot, "pyapp"))).toBe(false);
+  });
+});

package/packages/shared-skills/skills/programming/scripts/shared/run-tool.ts

@@ -0,0 +1,19 @@
+/** Shared by the Python, Rust, and Go scaffolders: run uv/cargo/go and classify the outcome. */
+
+import { spawnSync } from "node:child_process";
+
+export type ToolOutcome =
+  | { readonly kind: "ok" }
+  | { readonly kind: "unavailable"; readonly reason: string }
+  | { readonly kind: "failed"; readonly status: number | null; readonly stderr: string };
+
+export function runTool(command: string, args: readonly string[], cwd?: string): ToolOutcome {
+  const result = spawnSync(command, args, { cwd, encoding: "utf8" });
+  if (result.error !== undefined) return { kind: "unavailable", reason: result.error.message };
+  if (result.status === 0) return { kind: "ok" };
+  return { kind: "failed", status: result.status, stderr: result.stderr };
+}
+
+export function assertNever(value: never): never {
+  throw new Error(`Unhandled variant: ${JSON.stringify(value)}`);
+}

package/packages/shared-skills/skills/ultimate-browsing/SKILL.md

@@ -38,8 +38,9 @@ Read the matching reference before acting: [`references/insane-search/README.md`
 **Why first**: ~10x faster than a browser, no process spin-up; handles most "fetch this blocked page" requests via curl_cffi TLS impersonation, yt-dlp (1858 sites), official public APIs, mobile URL transforms, **Phase-2.5 surrogate archives** (Wayback / archive.today snapshots, provenance-tagged — see [`references/insane-search/cache-archive.md`](references/insane-search/cache-archive.md)), a key-gated Jina Reader (`JINA_API_KEY`), and a Playwright real-Chrome fallback. The engine lives **inside this skill** at `engine/` and is invoked as a module. Surrogate results are dated COPIES: a result whose `provenance` is `snapshot` must be reported with its `snapshot_timestamp`, never presented as the live page.
 
 ```bash
-# Core command — auto-detects WAF, runs the full fetch grid (run from the skill dir):
-python3 -m engine "https://example.com/blocked-page"
+# Core command — auto-detects WAF, runs the full fetch grid (run from the skill dir).
+# Keep -B: this skill can live inside a signed app bundle, and bytecode caches written into engine/ break its signature.
+python3 -B -m engine "https://example.com/blocked-page"
 #   add --selector "<CSS>" for positive-proof validation, --device auto|desktop|mobile,
 #   --trace to inspect every attempt, --json for machine-readable output.
 
@@ -119,9 +120,9 @@ When the blocked flow needs the user's account, drive the browser they are alrea
 ```bash
 # Extract cookies to a file:
 mkdir -p ~/.local/state/omo-cookies
-python3 scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
+python3 -B scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
 # Extract and inject into the running CDP session:
-python3 scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
+python3 -B scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
 ```
 
 Cookie export files are written with owner-only `0600` permissions. Do not place live auth cookies in shared temp directories or commit them to a repo. Cookie injection sends values to CDP over stdin rather than argv. Cookies apply on next navigation — reload after injecting. Google services use fingerprint-bound tokens that may not transfer across browser profiles. Limits in [references/chrome-stealth.md](references/chrome-stealth.md).

package/packages/shared-skills/skills/ultimate-browsing/engine/AGENTS.md

@@ -115,7 +115,7 @@ Any future upstream sync preserves BOTH sides. Concretely:
 
 ## OVERVIEW
 
-A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -m engine URL`), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.
+A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -B -m engine URL`; `-B` keeps bytecode caches out of a signed app bundle, #11373), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.
 
 ## THE NO-SITE-NAME RULE (enforced in CI)
 
@@ -163,7 +163,7 @@ L3+   content checks
 ## CLI
 
 ```bash
-python3 -m engine URL [--selector S] [--device auto|desktop|mobile]
+python3 -B -m engine URL [--selector S] [--device auto|desktop|mobile]
                       [--timeout 25] [--max-attempts 12]
                       [--no-playwright] [--allow-proxy] [--json] [--trace]
 ```

package/packages/shared-skills/skills/ultimate-browsing/engine/__main__.py

@@ -2,13 +2,16 @@
 """CLI entrypoint for the insane-search engine.
 
 Usage:
-    python3 -m engine URL [--selector CSS] [--device auto|desktop|mobile]
-                          [--timeout N] [--max-attempts N] [--json] [--trace]
+    python3 -B -m engine URL [--selector CSS] [--device auto|desktop|mobile]
+                             [--timeout N] [--max-attempts N] [--json] [--trace]
+
+`-B` is required: `-m` compiles the package before any engine code runs, so only
+the interpreter flag keeps bytecode caches out of a signed app bundle.
 
 Examples:
-    python3 -m engine "https://example.com/" --selector "h1"
-    python3 -m engine "https://example.com/" --json
-    python3 -m engine "https://example.com/" --device mobile --trace
+    python3 -B -m engine "https://example.com/" --selector "h1"
+    python3 -B -m engine "https://example.com/" --json
+    python3 -B -m engine "https://example.com/" --device mobile --trace
 
 Exit codes:
     0   strong_ok or weak_ok
@@ -25,7 +28,7 @@ from . import fetch
 
 
 def build_parser() -> argparse.ArgumentParser:
-    p = argparse.ArgumentParser(prog="python3 -m engine",
+    p = argparse.ArgumentParser(prog="python3 -B -m engine",
                                 description="Generic WAF-profile fetch chain.")
     p.add_argument("url", help="URL to fetch.")
     p.add_argument("--selector", "-s", action="append", default=None,

package/packages/shared-skills/skills/ultimate-browsing/engine/summary.py

@@ -19,7 +19,7 @@ R7_HINT = (
     "💡 R7 API-first 권장: WAF가 HTML 경로를 차단 중. "
     "Playwright MCP 사용 → browser_navigate → browser_network_requests "
     "→ `/api/`·`/graphql`·`\\.json` 필터로 내부 엔드포인트 탐지 → "
-    "해당 URL을 `python3 -m engine <API_URL>`로 재호출. 대부분 API 레이어는 "
+    "해당 URL을 `python3 -B -m engine <API_URL>`로 재호출. 대부분 API 레이어는 "
     "WAF 방어가 얕아 curl_cffi만으로 수집됨."
 )
 

package/packages/shared-skills/skills/ultimate-browsing/references/insane-search/README.md

@@ -2,7 +2,7 @@
 # Insane Search
 
 > Part of the **ultimate-browsing** skill (Tier 1). Routing and tier-escalation live in [../../SKILL.md](../../SKILL.md).
-> The engine package it drives is at [../../engine/](../../engine/), invoked from the skill directory as `python3 -m engine "<URL>"`.
+> The engine package it drives is at [../../engine/](../../engine/), invoked from the skill directory as `python3 -B -m engine "<URL>"` (`-B` keeps bytecode caches out of a signed app bundle).
 > Deep-dives in this folder: TLS impersonation, Playwright routing, fallback, metadata, Jina, cache/archive, RSS, JSON/public APIs, Twitter, Naver, media.
 
 
@@ -16,7 +16,7 @@
 1. WebFetch, 즉흥 curl, 수동 헤더 조합 **시도 금지**
 2. 즉시 다음을 실행:
    ```bash
-   python3 -m engine "<URL>" [--selector "<CSS>"] [--device auto|desktop|mobile] [--trace] \
+   python3 -B -m engine "<URL>" [--selector "<CSS>"] [--device auto|desktop|mobile] [--trace] \
                               [--no-retry] [--no-extract]
    ```
 3. 종료코드 0(ok) 또는 1(fail) 받은 뒤 판단. trace를 먼저 읽고 재시도 결정.
@@ -49,7 +49,7 @@
 **MCP 정찰 루트**:
 1. `mcp__playwright__browser_navigate` → 대상 페이지 로드 (브라우저 렌더링)
 2. `mcp__playwright__browser_network_requests` → XHR/fetch 호출 목록 수집, `/api/`·`/graphql`·`\.json` 필터로 내부 엔드포인트 식별
-3. 식별된 JSON API URL을 `python3 -m engine <API_URL>`로 재호출 (백그라운드 engine과는 별개 호출). 대부분 API 레이어는 페이지 HTML보다 WAF 보호가 얕아 curl_cffi로 바로 수집됨
+3. 식별된 JSON API URL을 `python3 -B -m engine <API_URL>`로 재호출 (백그라운드 engine과는 별개 호출). 대부분 API 레이어는 페이지 HTML보다 WAF 보호가 얕아 curl_cffi로 바로 수집됨
 4. 응답 스키마 파악 후 pagination / query parameter 조합해 반복 수집
 
 **왜**: SPA + WAF 사이트(쇼핑몰·커머스 다수)는 마케팅 페이지(HTML)만 WAF로 중투자하고 내부 API는 gateway 레벨 기본 방어만 쓰는 경우가 많다. HTML 격자 전수 낭비(50회 × 0.5s + Playwright fallback 40s ≈ 65초)보다 **MCP 정찰 1회(5~10초) + API 재호출(0.5초)**가 훨씬 경제적이고 성공률 높음.
@@ -62,7 +62,7 @@
 
 이 스킬의 핵심 불변식:
 
-- **단일 진입점**: 일반 웹 페이지는 항상 `python3 -m engine <URL>` 또는 `from engine import fetch; fetch(...)`.
+- **단일 진입점**: 일반 웹 페이지는 항상 `python3 -B -m engine <URL>` 또는 `from engine import fetch; fetch(...)`.
 - **편향 금지**: `engine/**`, `waf_profiles.yaml`에 특정 사이트 하드코딩 금지.
 - **힌트는 런타임에만**: 사이트 고유 정보는 CLI/`user_hint` 경유.
 

package/packages/shared-skills/skills/ultimate-browsing/scripts/extract_cookies.py

@@ -7,8 +7,8 @@ with synthetic fixtures on any OS. This module wires them to a real browser DB
 and a local Chrome CDP session controlled by playwright-core scripts.
 
 Usage:
-    python extract_cookies.py --browser chrome --domain youtube.com --output /tmp/cookies.json
-    python extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
+    python -B extract_cookies.py --browser chrome --domain youtube.com --output /tmp/cookies.json
+    python -B extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
 """
 from __future__ import annotations
 
@@ -23,6 +23,8 @@ import tempfile
 from pathlib import Path
 from typing import Callable, NotRequired, TypedDict
 
+sys.dont_write_bytecode = True
+
 from cookie_crypto import (
     decrypt_chromium_value,
     derive_key,

package/packages/shared-skills/skills/ulw-research/AGENTS.md

@@ -23,11 +23,11 @@ ulw-research/
     ├── report-tools-commands.mjs    # one function per subcommand
     ├── cli-support.mjs / entry-guard.mjs   # flags, CliError, exit codes, atomic JSON, symlink-safe entry check
     ├── contracts.mjs                # frozen vocabulary: DEFECT_CODES (severity lives only here), FIDELITY_CODES, enums, manifest + repair-state validators
-    ├── outcome.mjs                  # outcome.json manifest, deliverable state, verify, closing briefing
+    ├── outcome.mjs / outcome-start.mjs # manifest lifecycle + the run clock outcome init records (--started-at, metadata, dir-name fallback)
     ├── repair-tracker.mjs           # bounded repair decisions (attempts, plateau, oscillation, wall clock, integrity codes)
     ├── html-lite.mjs / entities.mjs # HTML tokenizer, selector paths, prose text
     ├── css-lite.mjs / design-spec.mjs      # CSS scanning, palette + lineage parsing, design-spec rendering
-    ├── gates-static.mjs + gates-text.mjs / gates-figures.mjs / gates-structure.mjs   # static gates G1-G17
+    ├── gates-static.mjs + gates-text.mjs / gates-figures.mjs / gates-structure.mjs   # static gates G1-G17; sources-citation.mjs is the one Sources predicate (claim segments vs citation fields)
     ├── layout-probe.mjs / gates-layout.mjs # in-page probe source + layout gates L1-L5 over its output
     ├── format-extract.mjs / format-extract-css.mjs   # design-spec draft from a pointed-at HTML or Markdown document
     ├── fact-ledger.mjs              # fact ledger IO and writers (addRow, retractRow, supersedeRow, --view table)
@@ -43,14 +43,18 @@ ulw-research/
     ├── fact-commands.mjs            # `fact add|quote|retract|export|fill|derive` (lazy-loaded by report-tools)
     ├── fact-commands-verify.mjs     # `fact verify` and the Markdown projection it checks
     ├── fidelity-records.mjs         # FIDELITY_RECORDS table + the delivery barrier of outcome verify/finish (fidelity_unresolved, edition_unverified)
-    ├── source-commands.mjs          # `source snapshot`, `claims index`, snapshot readers
+    ├── source-commands.mjs          # `source snapshot`, `claims index`, snapshot readers; `source refresh` is source-refresh.mjs
+    ├── source-view.mjs / raw-decode.mjs / html-text-map.mjs   # the one snapshot reading: locator text, charset decode, byte map, visible-text extraction
+    ├── css-hiding.mjs               # whether inline styles and the page's <style> rules hide an element from every reader (cascade, conditional at-rules)
+    ├── conversion-probe.mjs / number-grammar.mjs   # `source probe-conversion` (numeric diff of a conversion); the one grouped-number grammar (shared with numerals.mjs)
+    ├── markdown-closers.mjs         # CommonMark closer runs (titled/parenthesised link and image targets, references, escapes) for the probe's sign reading and link spans
     ├── *.test.ts                    # co-located bun tests, one per module (unshipped)
     └── tests/fixtures/              # good/bad reports, boxes.json, reference docs (unshipped)
 ```
 
 ## SURFACE
 
-`node "$SKILL_DIR/scripts/report-tools.mjs" <command>`: `check`, `layout-probe`, `repair decide`, `outcome init`, `outcome set`, `outcome gate`, `outcome render`, `outcome state`, `outcome verify`, `outcome finish`, `outcome briefing`, `format-extract`, `fact add`, `fact quote`, `fact retract`, `fact export`, `fact fill`, `fact verify`, `fact derive`, `source snapshot`, `claims index`, `--help --json`. Gates recorded by `outcome gate`, in order: `static`, `fidelity`, `layout`, `visual`, `proofread` (`fidelity` is `fact verify` on every reader-facing edition; HTML only in this stage). Exit codes: `0` pass, `1` semantic failure (blockers, a failed verify, a blocked repair), `2` usage or IO. JSON on stdout, one summary line on stderr. Flags per command: `references/deliverable-phase.md` section 10.
+`node "$SKILL_DIR/scripts/report-tools.mjs" <command>`: `check`, `layout-probe`, `repair decide`, `outcome init`, `outcome set`, `outcome gate`, `outcome render`, `outcome state`, `outcome verify`, `outcome finish`, `outcome briefing`, `format-extract`, `fact add`, `fact quote`, `fact retract`, `fact export`, `fact fill`, `fact verify`, `fact derive`, `source snapshot`, `source refresh`, `claims index`, `--help --json`. Gates recorded by `outcome gate`, in order: `static`, `fidelity`, `layout`, `visual`, `proofread` (`fidelity` is `fact verify` on every reader-facing edition; HTML, or Markdown with its fill map). Exit codes: `0` pass, `1` semantic failure (blockers, a failed verify, a blocked repair), `2` usage or IO. JSON on stdout, one summary line on stderr. Flags per command: `references/deliverable-phase.md` section 10.
 
 ## CONVENTIONS