oh-my-opencode 5.1.48 → 5.1.54

package/packages/omo-codex/plugin/skills/programming/scripts/python/new-project.ts

@@ -0,0 +1,231 @@
+#!/usr/bin/env bun
+/**
+ * Scaffold a new Python project with ultra-strict config from pyproject-strict.md.
+ *
+ * ─── How to run ───
+ * 1. Install Bun: curl -fsSL https://bun.sh/install | bash
+ * 2. Install uv:  curl -LsSf https://astral.sh/uv/install.sh | sh
+ * 3. Run:
+ *      bun run new-project.ts myproject
+ *      bun run new-project.ts myproject --path ./workspace
+ *      bun run new-project.ts myproject --lib   # library (publishable)
+ * ──────────────────
+ *
+ * Creates via `uv init`, then injects basedpyright + ruff ALL + pytest config.
+ * Exit codes: 0 created, 1 scaffold or uv failure, 2 usage error.
+ */
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { assertNever, runTool } from "../shared/run-tool.ts";
+
+const USAGE = `Usage: bun run new-project.ts <name> [--path <dir>] [--lib]
+
+Arguments:
+  name          Project name
+
+Options:
+  -p, --path    Parent directory (default: current dir)
+  --lib         Create as publishable library (uv init --lib)
+  -h, --help    Show this help`;
+
+const TOOL_CONFIG = `
+[dependency-groups]
+dev = [
+    "basedpyright>=1.21",
+    "ruff>=0.8",
+    "pytest>=8",
+    "pytest-cov>=5",
+]
+
+[tool.basedpyright]
+typeCheckingMode = "all"
+pythonVersion = "3.13"
+reportMissingTypeStubs = false
+reportUnknownMemberType = false
+reportUnknownArgumentType = false
+reportUnknownVariableType = false
+reportUnknownLambdaType = false
+reportUnknownParameterType = false
+reportMissingParameterType = false
+reportUnnecessaryIsInstance = false
+reportUnusedCallResult = false
+reportImplicitOverride = false
+
+[tool.ruff]
+target-version = "py313"
+line-length = 120
+
+[tool.ruff.lint]
+select = ["ALL"]
+ignore = [
+    "COM812",   # trailing comma (conflicts with formatter)
+    "ISC001",   # single-line string concat (conflicts with formatter)
+    "D1",       # undocumented-public-* (too noisy early on)
+    "ANN101",   # deprecated: self annotation
+    "ANN102",   # deprecated: cls annotation
+    "S101",     # assert used (pytest needs it)
+    "PLR2004",  # magic-value-comparison (test data)
+    "FBT",      # boolean-trap (too strict for CLIs)
+    "TD",       # flake8-todos (noisy)
+    "FIX",      # fixme (noisy)
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**/*.py" = ["S101", "PLR2004", "SLF001", "D", "ARG", "ANN"]
+
+[tool.ruff.lint.pydocstyle]
+convention = "google"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers --strict-config"
+`;
+
+const GITIGNORE = `__pycache__/
+*.py[cod]
+*.so
+.venv/
+dist/
+*.egg-info/
+.coverage
+htmlcov/
+.basedpyright/
+.ruff_cache/
+`;
+
+type ProjectOptions = { readonly name: string; readonly path: string; readonly lib: boolean };
+
+type Cli =
+  | { readonly kind: "run"; readonly options: ProjectOptions }
+  | { readonly kind: "help" }
+  | { readonly kind: "usage"; readonly problem: string };
+
+class ScaffoldError extends Error {
+  constructor(
+    readonly kind: "exists" | "uv-unavailable" | "uv-init-failed",
+    message: string,
+  ) {
+    super(message);
+    this.name = "ScaffoldError";
+  }
+}
+
+function parseCli(): Cli {
+  try {
+    const { values, positionals } = parseArgs({
+      args: Bun.argv.slice(2),
+      options: {
+        path: { type: "string", short: "p", default: "." },
+        lib: { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false },
+      },
+      allowPositionals: true,
+      strict: true,
+    });
+    if (values.help) return { kind: "help" };
+    const [name, ...extra] = positionals;
+    if (name === undefined || extra.length > 0) return { kind: "usage", problem: "expected exactly one project name" };
+    return { kind: "run", options: { name, path: values.path, lib: values.lib } };
+  } catch (error) {
+    if (error instanceof TypeError) return { kind: "usage", problem: error.message };
+    throw error;
+  }
+}
+
+function withoutDependencyGroups(pyproject: string): string {
+  const kept: string[] = [];
+  let skipping = false;
+  for (const line of pyproject.split(/(?<=\n)/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[dependency-groups]")) {
+      skipping = true;
+      continue;
+    }
+    if (skipping && trimmed.startsWith("[")) skipping = false;
+    if (!skipping) kept.push(line);
+  }
+  return `${kept.join("").replace(/\n+$/, "")}\n`;
+}
+
+function initProject(projectDir: string, lib: boolean): void {
+  const init = runTool("uv", ["init", lib ? "--lib" : "--app", projectDir]);
+  switch (init.kind) {
+    case "ok":
+      return;
+    case "unavailable":
+      throw new ScaffoldError(
+        "uv-unavailable",
+        `uv could not be started (${init.reason}); install it: curl -LsSf https://astral.sh/uv/install.sh | sh`,
+      );
+    case "failed":
+      throw new ScaffoldError("uv-init-failed", `uv init failed: ${init.stderr}`);
+    default:
+      return assertNever(init);
+  }
+}
+
+function addDevTools(projectDir: string): void {
+  const added = runTool("uv", ["add", "--dev", "basedpyright", "ruff", "pytest", "pytest-cov"], projectDir);
+  switch (added.kind) {
+    case "ok":
+      return;
+    case "unavailable":
+      console.error(`warn: uv add --dev could not start (${added.reason}); run it once uv is reachable`);
+      return;
+    case "failed":
+      console.error(`warn: uv add --dev failed; pyproject.toml still lists the dev tools:\n${added.stderr}`);
+      return;
+    default:
+      return assertNever(added);
+  }
+}
+
+function scaffold({ name, path, lib }: ProjectOptions): void {
+  const projectDir = join(path, name);
+  if (existsSync(projectDir)) throw new ScaffoldError("exists", `${projectDir} already exists`);
+  initProject(projectDir, lib);
+
+  const pyprojectPath = join(projectDir, "pyproject.toml");
+  writeFileSync(pyprojectPath, withoutDependencyGroups(readFileSync(pyprojectPath, "utf8")) + TOOL_CONFIG);
+  addDevTools(projectDir);
+
+  mkdirSync(join(projectDir, "tests"), { recursive: true });
+  appendFileSync(join(projectDir, "tests", "__init__.py"), "");
+  writeFileSync(join(projectDir, ".gitignore"), GITIGNORE);
+
+  const srcDir = join(projectDir, "src", name.replaceAll("-", "_"));
+  if (lib && existsSync(srcDir)) appendFileSync(join(srcDir, "py.typed"), "");
+
+  console.log(`✓ Created: ${projectDir}`);
+  console.log(`  cd ${name} && uv sync && uv run basedpyright . && uv run ruff check .`);
+}
+
+function main(): number {
+  const cli = parseCli();
+  switch (cli.kind) {
+    case "help":
+      console.log(USAGE);
+      return 0;
+    case "usage":
+      console.error(`Error: ${cli.problem}\n\n${USAGE}`);
+      return 2;
+    case "run":
+      break;
+    default:
+      return assertNever(cli);
+  }
+  try {
+    scaffold(cli.options);
+    return 0;
+  } catch (error) {
+    if (error instanceof ScaffoldError) {
+      console.error(`Error: ${error.message}`);
+      return 1;
+    }
+    throw error;
+  }
+}
+
+process.exit(main());

package/packages/omo-codex/plugin/skills/programming/scripts/python/new-script.ts

@@ -0,0 +1,134 @@
+#!/usr/bin/env bun
+/**
+ * Generate a PEP 723 Python script with all boilerplate pre-filled: uv shebang,
+ * inline metadata (requires-python + dependencies), the mandatory "How to run"
+ * block, `from __future__ import annotations`, and a main() guard.
+ *
+ * ─── How to run ───
+ * 1. Install Bun: curl -fsSL https://bun.sh/install | bash
+ * 2. Run:
+ *      bun run new-script.ts my_tool
+ *      bun run new-script.ts my_tool --output ./scripts/my_tool.py
+ *      bun run new-script.ts my_tool --deps 'httpx2[http2,brotli,zstd]' --deps rich --deps polars
+ *      bun run new-script.ts my_tool --py 3.13
+ * ──────────────────
+ *
+ * Writes to <os tmpdir>/uv-scripts/<name>.py unless --output is given.
+ * Exit codes: 0 written, 2 usage error.
+ */
+
+import { chmodSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { parseArgs } from "node:util";
+import { assertNever } from "../shared/run-tool.ts";
+
+const USAGE = `Usage: bun run new-script.ts <name> [--output <path>] [--deps <dep>]... [--py <version>]
+
+Arguments:
+  name          Script name (without .py extension)
+
+Options:
+  -o, --output  Output path (default: OS temp directory)
+  -d, --deps    Dependency to include (repeat --deps for each)
+  --py          Minimum Python version (default: 3.13)
+  -h, --help    Show this help`;
+
+type ScriptOptions = {
+  readonly name: string;
+  readonly output: string | undefined;
+  readonly deps: readonly string[];
+  readonly py: string;
+};
+
+type Cli =
+  | { readonly kind: "run"; readonly options: ScriptOptions }
+  | { readonly kind: "help" }
+  | { readonly kind: "usage"; readonly problem: string };
+
+function parseCli(): Cli {
+  try {
+    const { values, positionals } = parseArgs({
+      args: Bun.argv.slice(2),
+      options: {
+        output: { type: "string", short: "o" },
+        deps: { type: "string", short: "d", multiple: true, default: [] },
+        py: { type: "string", default: "3.13" },
+        help: { type: "boolean", short: "h", default: false },
+      },
+      allowPositionals: true,
+      strict: true,
+    });
+    if (values.help) return { kind: "help" };
+    const [name, ...extra] = positionals;
+    if (name === undefined || extra.length > 0) return { kind: "usage", problem: "expected exactly one script name" };
+    return { kind: "run", options: { name, output: values.output, deps: values.deps, py: values.py } };
+  } catch (error) {
+    if (error instanceof TypeError) return { kind: "usage", problem: error.message };
+    throw error;
+  }
+}
+
+function renderScript(pythonVersion: string, deps: readonly string[], filename: string): string {
+  const depsBlock =
+    deps.length > 0
+      ? deps.map((dep) => `#     "${dep}",\n`).join("")
+      : '#     # add deps here, e.g.: "httpx2[http2,brotli,zstd]"\n';
+  const argsHint = "";
+  return `#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=${pythonVersion}"
+# dependencies = [
+${depsBlock}# ]
+# ///
+
+# ─── How to run ───
+# 1. Install uv (if not installed):
+#      curl -LsSf https://astral.sh/uv/install.sh | sh
+# 2. Run directly (no venv, no pip install needed):
+#      uv run ${filename} ${argsHint}
+# 3. Or make executable and run:
+#      chmod +x ${filename} && ./${filename}
+# ──────────────────
+
+from __future__ import annotations
+
+
+def main() -> None:
+    """TODO: implement."""
+
+
+if __name__ == "__main__":
+    main()
+`;
+}
+
+function writeScript({ name, output, deps, py }: ScriptOptions): void {
+  const filename = name.endsWith(".py") ? name : `${name}.py`;
+  const dest = output ?? join(tmpdir(), "uv-scripts", filename);
+  mkdirSync(dirname(dest), { recursive: true });
+  writeFileSync(dest, renderScript(py, deps, filename));
+  if (process.platform !== "win32") chmodSync(dest, statSync(dest).mode | 0o111);
+
+  console.log(`✓ Created: ${dest}`);
+  console.log(`  Run: uv run ${dest}`);
+}
+
+function main(): number {
+  const cli = parseCli();
+  switch (cli.kind) {
+    case "help":
+      console.log(USAGE);
+      return 0;
+    case "usage":
+      console.error(`Error: ${cli.problem}\n\n${USAGE}`);
+      return 2;
+    case "run":
+      writeScript(cli.options);
+      return 0;
+    default:
+      return assertNever(cli);
+  }
+}
+
+process.exit(main());

package/packages/omo-codex/plugin/skills/programming/scripts/rust/new-project.ts

@@ -0,0 +1,215 @@
+#!/usr/bin/env bun
+/**
+ * Scaffold a new Rust project with strict lints, deny.toml, rustfmt.toml, and
+ * rust-toolchain.toml pre-configured. The generated project passes its own
+ * fmt + clippy gate before any code is written.
+ *
+ * ─── How to run ───
+ * 1. Install Bun:  curl -fsSL https://bun.sh/install | bash
+ * 2. Install Rust: https://rustup.rs (cargo >= 1.85, edition 2024)
+ * 3. Run:
+ *      bun run new-project.ts myproject
+ *      bun run new-project.ts myproject --path ./workspace
+ * ──────────────────
+ *
+ * Exit codes: 0 created, 1 cargo or scaffold failure, 2 usage error.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { assertNever, runTool } from "../shared/run-tool.ts";
+
+const USAGE = `Usage: bun run new-project.ts <name> [--path <dir>]
+
+Arguments:
+  name          Name of the new Rust project
+
+Options:
+  -p, --path    Parent directory where the project folder is created (default: cwd)
+  -h, --help    Show this help`;
+
+const RUST_TOOLCHAIN_TOML = `[toolchain]
+channel = "stable"
+components = ["rustfmt", "clippy", "rust-src"]
+profile = "default"
+`;
+
+const CARGO_TOML_LINTS = `
+[lints.rust]
+unsafe_op_in_unsafe_fn = "deny"
+missing_docs = "warn"
+missing_debug_implementations = "warn"
+unreachable_pub = "warn"
+unused_must_use = "deny"
+elided_lifetimes_in_paths = "warn"
+non_ascii_idents = "deny"
+trivial_numeric_casts = "warn"
+unused_lifetimes = "warn"
+single_use_lifetimes = "warn"
+unexpected_cfgs = { level = "deny", check-cfg = ["cfg(loom)"] }
+
+[lints.clippy]
+all = { level = "deny", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+nursery = { level = "warn", priority = -1 }
+cargo = { level = "warn", priority = -1 }
+undocumented_unsafe_blocks = "deny"
+multiple_unsafe_ops_per_block = "deny"
+unwrap_used = "deny"
+expect_used = "deny"
+panic = "deny"
+todo = "deny"
+unimplemented = "deny"
+dbg_macro = "deny"
+print_stdout = "warn"
+print_stderr = "warn"
+allow_attributes = "deny"
+allow_attributes_without_reason = "deny"
+let_underscore_must_use = "deny"
+indexing_slicing = "deny"
+mem_forget = "deny"
+clone_on_ref_ptr = "warn"
+module_name_repetitions = { level = "allow" }
+must_use_candidate = { level = "allow" }
+`;
+
+const DENY_TOML = `[advisories]
+yanked = "deny"
+
+[licenses]
+private = { ignore = true }  # publish = false crates carry no license field
+allow = ["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Zlib"]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+`;
+
+const MAIN_RS = `//! Command-line entry point.
+
+use std::io::Write as _;
+
+fn main() -> std::io::Result<()> {
+    writeln!(std::io::stdout().lock(), "Hello, world!")
+}
+`;
+
+const RUSTFMT_TOML = `edition = "2024"
+max_width = 100
+use_field_init_shorthand = true
+use_try_shorthand = true
+`;
+
+const EDITION_LINE = 'edition = "2024"\n';
+
+type ProjectOptions = { readonly name: string; readonly path: string };
+
+type Cli =
+  | { readonly kind: "run"; readonly options: ProjectOptions }
+  | { readonly kind: "help" }
+  | { readonly kind: "usage"; readonly problem: string };
+
+class ScaffoldError extends Error {
+  constructor(
+    readonly kind: "cargo-unavailable" | "cargo-init-failed" | "edition-too-old",
+    message: string,
+  ) {
+    super(message);
+    this.name = "ScaffoldError";
+  }
+}
+
+function parseCli(): Cli {
+  try {
+    const { values, positionals } = parseArgs({
+      args: Bun.argv.slice(2),
+      options: {
+        path: { type: "string", short: "p", default: process.cwd() },
+        help: { type: "boolean", short: "h", default: false },
+      },
+      allowPositionals: true,
+      strict: true,
+    });
+    if (values.help) return { kind: "help" };
+    const [name, ...extra] = positionals;
+    if (name === undefined || extra.length > 0) return { kind: "usage", problem: "expected exactly one project name" };
+    return { kind: "run", options: { name, path: values.path } };
+  } catch (error) {
+    if (error instanceof TypeError) return { kind: "usage", problem: error.message };
+    throw error;
+  }
+}
+
+function cargoInit(projectDir: string, name: string): void {
+  const init = runTool("cargo", ["init", projectDir, "--name", name]);
+  switch (init.kind) {
+    case "ok":
+      return;
+    case "unavailable":
+      throw new ScaffoldError("cargo-unavailable", `cargo not found (${init.reason}). Install Rust via https://rustup.rs`);
+    case "failed":
+      throw new ScaffoldError("cargo-init-failed", `cargo init failed:\n${init.stderr}`);
+    default:
+      return assertNever(init);
+  }
+}
+
+function scaffold({ name, path }: ProjectOptions): void {
+  const projectDir = join(path, name);
+  console.error(`Creating project ${name} at ${projectDir}`);
+  cargoInit(projectDir, name);
+
+  writeFileSync(join(projectDir, "rust-toolchain.toml"), RUST_TOOLCHAIN_TOML);
+  console.error("  wrote rust-toolchain.toml");
+
+  const cargoToml = join(projectDir, "Cargo.toml");
+  const manifest = readFileSync(cargoToml, "utf8");
+  if (!manifest.includes(EDITION_LINE)) {
+    throw new ScaffoldError("edition-too-old", "cargo did not create an edition 2024 package; install Rust >= 1.85");
+  }
+  const withMsrv = manifest.replace(EDITION_LINE, `${EDITION_LINE}rust-version = "1.85"\npublish = false\n`);
+  writeFileSync(cargoToml, withMsrv + CARGO_TOML_LINTS);
+  writeFileSync(join(projectDir, "src", "main.rs"), MAIN_RS);
+  console.error("  appended [lints] to Cargo.toml");
+
+  writeFileSync(join(projectDir, "deny.toml"), DENY_TOML);
+  console.error("  wrote deny.toml");
+
+  writeFileSync(join(projectDir, "rustfmt.toml"), RUSTFMT_TOML);
+  console.error("  wrote rustfmt.toml");
+
+  console.error(`\nDone! cd ${projectDir} && cargo check`);
+}
+
+function main(): number {
+  const cli = parseCli();
+  switch (cli.kind) {
+    case "help":
+      console.log(USAGE);
+      return 0;
+    case "usage":
+      console.error(`Error: ${cli.problem}\n\n${USAGE}`);
+      return 2;
+    case "run":
+      break;
+    default:
+      return assertNever(cli);
+  }
+  try {
+    scaffold(cli.options);
+    return 0;
+  } catch (error) {
+    if (error instanceof ScaffoldError) {
+      console.error(`Error: ${error.message}`);
+      return 1;
+    }
+    throw error;
+  }
+}
+
+process.exit(main());

package/packages/omo-codex/plugin/skills/programming/scripts/shared/run-tool.ts

@@ -0,0 +1,19 @@
+/** Shared by the Python, Rust, and Go scaffolders: run uv/cargo/go and classify the outcome. */
+
+import { spawnSync } from "node:child_process";
+
+export type ToolOutcome =
+  | { readonly kind: "ok" }
+  | { readonly kind: "unavailable"; readonly reason: string }
+  | { readonly kind: "failed"; readonly status: number | null; readonly stderr: string };
+
+export function runTool(command: string, args: readonly string[], cwd?: string): ToolOutcome {
+  const result = spawnSync(command, args, { cwd, encoding: "utf8" });
+  if (result.error !== undefined) return { kind: "unavailable", reason: result.error.message };
+  if (result.status === 0) return { kind: "ok" };
+  return { kind: "failed", status: result.status, stderr: result.stderr };
+}
+
+export function assertNever(value: never): never {
+  throw new Error(`Unhandled variant: ${JSON.stringify(value)}`);
+}

package/packages/omo-codex/plugin/skills/ultimate-browsing/SKILL.md

@@ -38,8 +38,9 @@ Read the matching reference before acting: [`references/insane-search/README.md`
 **Why first**: ~10x faster than a browser, no process spin-up; handles most "fetch this blocked page" requests via curl_cffi TLS impersonation, yt-dlp (1858 sites), official public APIs, mobile URL transforms, **Phase-2.5 surrogate archives** (Wayback / archive.today snapshots, provenance-tagged — see [`references/insane-search/cache-archive.md`](references/insane-search/cache-archive.md)), a key-gated Jina Reader (`JINA_API_KEY`), and a Playwright real-Chrome fallback. The engine lives **inside this skill** at `engine/` and is invoked as a module. Surrogate results are dated COPIES: a result whose `provenance` is `snapshot` must be reported with its `snapshot_timestamp`, never presented as the live page.
 
 ```bash
-# Core command — auto-detects WAF, runs the full fetch grid (run from the skill dir):
-python3 -m engine "https://example.com/blocked-page"
+# Core command — auto-detects WAF, runs the full fetch grid (run from the skill dir).
+# Keep -B: this skill can live inside a signed app bundle, and bytecode caches written into engine/ break its signature.
+python3 -B -m engine "https://example.com/blocked-page"
 #   add --selector "<CSS>" for positive-proof validation, --device auto|desktop|mobile,
 #   --trace to inspect every attempt, --json for machine-readable output.
 
@@ -119,9 +120,9 @@ When the blocked flow needs the user's account, drive the browser they are alrea
 ```bash
 # Extract cookies to a file:
 mkdir -p ~/.local/state/omo-cookies
-python3 scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
+python3 -B scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
 # Extract and inject into the running CDP session:
-python3 scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
+python3 -B scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
 ```
 
 Cookie export files are written with owner-only `0600` permissions. Do not place live auth cookies in shared temp directories or commit them to a repo. Cookie injection sends values to CDP over stdin rather than argv. Cookies apply on next navigation — reload after injecting. Google services use fingerprint-bound tokens that may not transfer across browser profiles. Limits in [references/chrome-stealth.md](references/chrome-stealth.md).

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/AGENTS.md

@@ -115,7 +115,7 @@ Any future upstream sync preserves BOTH sides. Concretely:
 
 ## OVERVIEW
 
-A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -m engine URL`), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.
+A 17-module Python package embedded in the `ultimate-browsing` skill: a site-agnostic fetch chain that escalates from a cheap curl probe to a real browser, with declarative WAF and surrogate registries. Not "optional scripts" — it has its own CLI entry (`python3 -B -m engine URL`; `-B` keeps bytecode caches out of a signed app bundle, #11373), two YAML config schemas, a 4-file test suite, and a standalone CI guard. Package exports (`__init__.py`): `fetch`, `FetchResult`, `Attempt`, `Verdict`, `ValidationResult`, `validate`, `CHALLENGE_MARKERS`, `detect`, `TRANSFORMS`, `apply_transform`.
 
 ## THE NO-SITE-NAME RULE (enforced in CI)
 
@@ -163,7 +163,7 @@ L3+   content checks
 ## CLI
 
 ```bash
-python3 -m engine URL [--selector S] [--device auto|desktop|mobile]
+python3 -B -m engine URL [--selector S] [--device auto|desktop|mobile]
                       [--timeout 25] [--max-attempts 12]
                       [--no-playwright] [--allow-proxy] [--json] [--trace]
 ```

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/__main__.py

@@ -2,13 +2,16 @@
 """CLI entrypoint for the insane-search engine.
 
 Usage:
-    python3 -m engine URL [--selector CSS] [--device auto|desktop|mobile]
-                          [--timeout N] [--max-attempts N] [--json] [--trace]
+    python3 -B -m engine URL [--selector CSS] [--device auto|desktop|mobile]
+                             [--timeout N] [--max-attempts N] [--json] [--trace]
+
+`-B` is required: `-m` compiles the package before any engine code runs, so only
+the interpreter flag keeps bytecode caches out of a signed app bundle.
 
 Examples:
-    python3 -m engine "https://example.com/" --selector "h1"
-    python3 -m engine "https://example.com/" --json
-    python3 -m engine "https://example.com/" --device mobile --trace
+    python3 -B -m engine "https://example.com/" --selector "h1"
+    python3 -B -m engine "https://example.com/" --json
+    python3 -B -m engine "https://example.com/" --device mobile --trace
 
 Exit codes:
     0   strong_ok or weak_ok
@@ -25,7 +28,7 @@ from . import fetch
 
 
 def build_parser() -> argparse.ArgumentParser:
-    p = argparse.ArgumentParser(prog="python3 -m engine",
+    p = argparse.ArgumentParser(prog="python3 -B -m engine",
                                 description="Generic WAF-profile fetch chain.")
     p.add_argument("url", help="URL to fetch.")
     p.add_argument("--selector", "-s", action="append", default=None,

package/packages/omo-codex/plugin/skills/ultimate-browsing/engine/summary.py

@@ -19,7 +19,7 @@ R7_HINT = (
     "💡 R7 API-first 권장: WAF가 HTML 경로를 차단 중. "
     "Playwright MCP 사용 → browser_navigate → browser_network_requests "
     "→ `/api/`·`/graphql`·`\\.json` 필터로 내부 엔드포인트 탐지 → "
-    "해당 URL을 `python3 -m engine <API_URL>`로 재호출. 대부분 API 레이어는 "
+    "해당 URL을 `python3 -B -m engine <API_URL>`로 재호출. 대부분 API 레이어는 "
     "WAF 방어가 얕아 curl_cffi만으로 수집됨."
 )