oh-my-opencode 5.1.51 → 5.1.55

package/packages/omo-codex/plugin/skills/programming/scripts/typescript/mutation-proof.ts

@@ -0,0 +1,179 @@
+#!/usr/bin/env bun
+/**
+ * Prove that a test can fail: apply one exact-match edit to a production file, run each test
+ * command against the mutated owner, then restore the original bytes and verify their hash.
+ *
+ * Usage:
+ *   bun run scripts/typescript/mutation-proof.ts --file <path> --find <text> --replace <text> \
+ *     --test '<label>=<argv...>' [--test ...] [--cwd <dir>] [--json]
+ *
+ *   --test takes "label=command words"; the command is split on spaces and quoting is not
+ *   supported, so select a test by a pattern without spaces or run the whole file.
+ *
+ * Verdicts per test: red (exit != 0, the test caught the mutation) or green (exit 0, it did not).
+ * The owner is restored on success, on a thrown error, and on SIGINT/SIGTERM.
+ * Exit codes: 0 ran and restored, 1 the find text is empty or did not match exactly once or the
+ * restore hash differed (the file was still restored), 2 usage, 130/143 interrupted and restored.
+ * Read references/testing/junk-classes.md "Proof rule" for how to read a candidate/keeper pair.
+ */
+
+import { createHash } from "node:crypto"
+import { readFileSync, writeFileSync } from "node:fs"
+import { resolve } from "node:path"
+import process from "node:process"
+import { parseArgs } from "node:util"
+
+export type MutationTest = { readonly label: string; readonly command: readonly string[] }
+
+export type MutationOutcome = {
+  readonly label: string
+  readonly command: readonly string[]
+  readonly exitCode: number
+  readonly verdict: "red" | "green"
+  readonly outputTail: string
+}
+
+export type MutationResult = {
+  readonly file: string
+  readonly find: string
+  readonly replace: string
+  readonly originalSha256: string
+  readonly restoredSha256: string
+  readonly outcomes: readonly MutationOutcome[]
+}
+
+export class MutationError extends Error {
+  constructor(
+    readonly kind: "FIND_EMPTY" | "FIND_NOT_UNIQUE" | "RESTORE_MISMATCH",
+    message: string,
+  ) {
+    super(message)
+    this.name = "MutationError"
+  }
+}
+
+const sha256 = (bytes: Uint8Array): string => createHash("sha256").update(bytes).digest("hex")
+
+async function runCaptured(command: readonly string[], cwd: string): Promise<{ readonly exitCode: number; readonly outputTail: string }> {
+  const child = Bun.spawn([...command], { cwd, stdin: "ignore", stdout: "pipe", stderr: "pipe" })
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ])
+  const lines = `${stdout}${stderr}`.trimEnd().split("\n")
+  return { exitCode, outputTail: lines.slice(-30).join("\n") }
+}
+
+export async function runMutation(options: {
+  readonly cwd: string
+  readonly file: string
+  readonly find: string
+  readonly replace: string
+  readonly tests: readonly MutationTest[]
+}): Promise<MutationResult> {
+  if (options.find.length === 0) throw new MutationError("FIND_EMPTY", `${options.file}: find text is empty`)
+  const full = resolve(options.cwd, options.file)
+  const original = readFileSync(full)
+  const text = original.toString("utf8")
+  const occurrences = text.split(options.find).length - 1
+  if (occurrences !== 1) {
+    throw new MutationError("FIND_NOT_UNIQUE", `${options.file}: find matched ${occurrences} times (need exactly 1)`)
+  }
+  const originalSha256 = sha256(original)
+  const outcomes: MutationOutcome[] = []
+  const restoreOnSignal = (signal: NodeJS.Signals): void => {
+    writeFileSync(full, original)
+    process.exit(signal === "SIGINT" ? 130 : 143)
+  }
+  process.on("SIGINT", restoreOnSignal)
+  process.on("SIGTERM", restoreOnSignal)
+  try {
+    writeFileSync(full, text.replace(options.find, () => options.replace))
+    for (const test of options.tests) {
+      const run = await runCaptured(test.command, options.cwd)
+      outcomes.push({
+        label: test.label,
+        command: test.command,
+        exitCode: run.exitCode,
+        verdict: run.exitCode === 0 ? "green" : "red",
+        outputTail: run.outputTail,
+      })
+    }
+  } finally {
+    writeFileSync(full, original)
+    process.off("SIGINT", restoreOnSignal)
+    process.off("SIGTERM", restoreOnSignal)
+  }
+  const restoredSha256 = sha256(readFileSync(full))
+  if (restoredSha256 !== originalSha256) {
+    throw new MutationError("RESTORE_MISMATCH", `${options.file} not restored byte for byte`)
+  }
+  return { file: options.file, find: options.find, replace: options.replace, originalSha256, restoredSha256, outcomes }
+}
+
+function parseTest(spec: string): MutationTest | undefined {
+  const separator = spec.indexOf("=")
+  if (separator <= 0) return undefined
+  const label = spec.slice(0, separator)
+  const command = spec
+    .slice(separator + 1)
+    .split(" ")
+    .filter((word) => word.length > 0)
+  return command.length === 0 ? undefined : { label, command }
+}
+
+function usage(): number {
+  console.error(
+    "usage: mutation-proof.ts --file <path> --find <text> --replace <text> --test '<label>=<argv...>' [--test ...] [--cwd <dir>] [--json]",
+  )
+  return 2
+}
+
+async function main(argv: readonly string[]): Promise<number> {
+  const { values } = parseArgs({
+    args: [...argv],
+    options: {
+      file: { type: "string" },
+      find: { type: "string" },
+      replace: { type: "string" },
+      test: { type: "string", multiple: true },
+      cwd: { type: "string", default: process.cwd() },
+      json: { type: "boolean", default: false },
+    },
+    strict: true,
+  })
+  if (values.file === undefined || values.find === undefined || values.replace === undefined || values.test === undefined) {
+    return usage()
+  }
+  const tests: MutationTest[] = []
+  for (const spec of values.test) {
+    const parsed = parseTest(spec)
+    if (parsed === undefined) return usage()
+    tests.push(parsed)
+  }
+  try {
+    const result = await runMutation({
+      cwd: values.cwd ?? process.cwd(),
+      file: values.file,
+      find: values.find,
+      replace: values.replace,
+      tests,
+    })
+    if (values.json) {
+      console.log(JSON.stringify(result, null, 2))
+    } else {
+      for (const outcome of result.outcomes) console.log(`${outcome.label}: ${outcome.verdict} (exit ${outcome.exitCode})`)
+      console.log(`restored ${result.file} (sha256 ${result.restoredSha256.slice(0, 12)})`)
+    }
+    return 0
+  } catch (error) {
+    if (error instanceof MutationError) {
+      console.error(`mutation-proof: ${error.kind}: ${error.message}`)
+      return 1
+    }
+    throw error
+  }
+}
+
+if (import.meta.main) process.exit(await main(process.argv.slice(2)))

package/packages/omo-codex/plugin/skills/remove-ai-slops/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: remove-ai-slops
-description: "Removes AI-generated code smells from branch changes or an explicit file list behind regression tests. Use when the user asks to clean up, deslop, or remove AI-slop patterns from recent changes."
+description: "Removes AI-generated code smells from branch changes or an explicit file list behind regression tests, including junk tests (prose pins, source greps, copied inventories, mock echoes), each proven by its class's rule before a cut. Use when the user asks to clean up, deslop, remove AI-slop patterns, or prune tests from recent changes."
 argument-hint: "[file ...]"
 ---
 
@@ -45,7 +45,7 @@ The core safety invariant: **behavior is locked by green tests before a single l
 
 ## Categories (what counts as slop)
 
-The agent looks for these nine categories. The first three are stylistic, the next three are structural, the next two are about hidden cost, and the last is about behavior coverage.
+The agent looks for these ten categories. The first three are stylistic, the next three are structural, the next two are about hidden cost, the ninth is tests, and the last is size.
 
 ### Stylistic
 1. **Obvious comments** — comments restating code, trivial docstrings, section dividers, commented-out code, vague TODOs/Notes.
@@ -86,10 +86,13 @@ The agent looks for these nine categories. The first three are stylistic, the ne
 
    **Hard rule**: only apply when behavior equivalence is obvious. Do NOT change algorithms with subtle correctness implications. Do NOT micro-optimize hot paths without a benchmark. If in doubt, SKIP.
 
-### Behavior coverage
-9. **Missing tests** — behavior present in changed files that is not locked by any regression test. The fix is not to remove code but to ADD the narrowest test that pins the behavior. EXCEPTION: a PROSE file (prompt, `SKILL.md`, rule, markdown) has no behavioral seam — do NOT add a text/word-count/phrase pin for it; that guards a diff, not behavior. Cover only a machine-consumed value (parsed field, sentinel a runtime greps, a doc JSON sample through its real validator) or leave it to review.
+### Tests
+9. **Tests: missing or junk** — tests are code in scope like any other file, judged by the one table in the `programming` skill, `references/testing/junk-classes.md` (junk classes, retention bar, R/F/C/D marks, proof rule). Two directions:
+   - **Missing**: a behavior in the changed files that no test guards, where the repository keeps tests for that kind of behavior and a regression would otherwise pass unnoticed. ADD the narrowest test that passes the four-question authoring gate (`references/testing/README.md`); name its owner contract. A PROSE file (prompt, `SKILL.md`, rule, markdown) has no behavioral seam: cover only a machine-consumed value (parsed field, sentinel a runtime greps, a doc JSON sample through its real validator) or leave it to review.
+   - **Junk**: mark every in-scope test declaration `R` / `F` / `C` / `D`. A `D` or `C` needs the proof the table names for its class BEFORE the cut: for a behavior class (cannot fail, mock echo, source grep, duplicate contract, layer replay, implementation mirror, fabricated postcondition, input transcript) a mutation of the production owner run against the candidate and its named keeper on the unmodified test tree; for a prose pin the assertion line plus the repo's prose rule; for a change certificate the revert that turns it red; for a seam keeper the `knip`/grep showing no production caller; for a copied inventory the generator or consumer that owns it; for a capability restatement the delivery test that owns the promise (none: `F`, not `D`); for near-duplicate cases the one table that keeps every old assertion (typecheck after). A misnamed test is re-marked by what its assertions check, never cut for its name. A mutation proves `D` only when the keeper goes red and the candidate stays green (cannot fail) or both go red (redundant); a candidate that is the ONLY red is `R`, or `C` into the keeper and re-run. Mutations run in Phase 4b, serially, by the orchestrator, never by a batch worker. A test-only production seam (export, flag, getter, reset hook) whose last test was deleted goes with it.
+   - KEEP: everything under the retention bar (public API, protocol, config, migration, storage, security, platform, shipped-copy equality, Node-compat suites, issue regressions, machine-consumed text). A test that is red on the unchanged base is a product bug to report, never a deletion. Static or slow is never a reason to delete.
 
-### Structural
+### Size
 10. **Oversized modules** — any source file exceeding **250 pure LOC** (non-blank, non-comment lines). This is an architectural defect, not a style preference. Measure: `awk '!/^[[:space:]]*$/ && !/^[[:space:]]*(#|\/\/)/' <file> | wc -l`.
 
    **When found, do NOT just flag it. Execute a full modular refactoring:**
@@ -147,16 +150,17 @@ For each in-scope source file:
 
 1. Identify the public/observable behavior the file exposes (exported functions, HTTP handlers, CLI commands, classes used elsewhere).
 2. Check whether existing tests cover that behavior. Use `git grep` / project test conventions to find related test files.
-3. **If behavior is uncovered or weakly covered, write the narrowest regression test that pins current behavior BEFORE editing the file.** Tests should pin observable outputs, not implementation details. A PROSE file (prompt/`SKILL.md`/rule/markdown) is exempt — its wording is not behavior; skip the test and rely on review, or assert only a machine-consumed value.
-4. Run the test suite (or at minimum the relevant tests). They must be **green** before any cleanup begins.
+3. **If a behavior the cleanup could change is uncovered, write the narrowest test that passes the authoring gate (`programming/references/testing/README.md`) BEFORE editing the file**, and name the behavior it guards. It asserts observable outputs at the real boundary, never the implementation shape the cleanup is about to change, and never a value derived from the code under test. A PROSE file (prompt/`SKILL.md`/rule/markdown) is exempt: its wording is not behavior; skip the test and rely on review, or assert only a machine-consumed value.
+4. Run the test suite (or at minimum the relevant tests). A test that is red on the unchanged base is recorded as a bug (baseline-red list), excluded from every proof, and neither fixed in this pass nor deleted; everything else must be **green** before any cleanup begins.
+5. Run the `programming` skill's static detector over every in-scope test file, the ones written in step 3 included: `bun run <programming skill dir>/scripts/typescript/check-test-junk.ts <test files>` (exit 1 lists `file:line` per junk class it can see: source grep, prose pin, fixed sleep, `.only`/`.skip`, self-comparison, lower-bound cardinality). Its findings are category-9 candidates for the Tests Ledger (marked `R`/`F`/`C`/`D` by the table once its proof runs), never automatic cuts, and a test from step 3 that it flags is rewritten before the pass continues.
 
-If you cannot establish a green baseline (e.g., test runner is broken), STOP and report. Do not proceed with cleanup on unverified ground.
+Only a broken runner stops the pass: if the suite cannot run at all, STOP and report. Do not proceed with cleanup on unverified ground.
 
 ### Phase 3: Cleanup plan — existence first, then smells
 
 The largest, safest deletion is code that should not have existed. **Before categorizing smells, run the deletion ladder on each changed unit:**
 
-- **Delete entirely** — the behavior is not needed (YAGNI, speculative, dead on arrival).
+- **Delete entirely** — the behavior is not needed (YAGNI, speculative, dead on arrival); for a test, its contract is already owned by a keeper or it has none (category 9, with the proof).
 - **Reuse** — an existing helper or pattern in this repo already does it; replace the reimplementation with a call to it.
 - **Platform / stdlib / native / dependency** — the language stdlib, the runtime, or an already-installed dependency already does it (a hand-rolled date picker → `<input type="date">`, a custom query parser → `URLSearchParams`, a bespoke debounce → the util already imported).
 - **Simplify in place** — it must exist; make it smaller.
@@ -183,11 +187,11 @@ File: src/bar.py
 
 **Intentional shortcuts:** if the plan deliberately keeps a bounded simplification (a naive scan fine under N rows, a global lock, an O(n²) path), mark it in-code with a `debt:` comment naming the ceiling and the upgrade trigger (in omo, prefix with `// @allow` so the comment-checker treats it as intentional), and list it under "Remaining Risks / Deferred" in the report. That section is the debt ledger — a simplification with a known ceiling and no marker is indistinguishable from a bug.
 
-Order rule (safest → riskiest): comments → dead code → defensive → duplication → complexity → abstraction/boundary → performance → tests → oversized-modules. This minimizes blast radius of any one change.
+Order rule (safest → riskiest): comments → dead code → defensive → duplication → complexity → abstraction/boundary → performance → tests (`F` rows; `D`/`C` wait for Phase 4b) → oversized-modules. This minimizes blast radius of any one change.
 
 ### Phase 4: Parallel slop removal via `deep-low` agents in batches of 5
 
-Files are processed by `deep-low` category agents with the `$omo:remove-ai-slops` skill loaded, **batched 5 at a time in parallel**. The executable skill name is `remove-ai-slops`. The `deep-low` category gives the agent enough thoroughness to correctly evaluate the 9 categories and respect the KEEP rules without slipping into surface fixes; the 5-wide batch is the sweet spot — more than 5 creates result-merging noise and context contention, fewer wastes parallelism.
+Files are processed by `deep-low` category agents with the `$omo:remove-ai-slops` skill loaded, **batched 5 at a time in parallel**. The executable skill name is `remove-ai-slops`. The `deep-low` category gives the agent enough thoroughness to correctly evaluate the 10 categories and respect the KEEP rules without slipping into surface fixes; the 5-wide batch is the sweet spot — more than 5 creates result-merging noise and context contention, fewer wastes parallelism.
 
 **Batching protocol** (strict):
 
@@ -213,9 +217,9 @@ Remove AI slops from: {file_path}
 
 First run the deletion ladder from Phase 3 on this file (delete entirely / reuse existing repo code / platform-stdlib-native / simplify in place); only code that must exist proceeds to smell removal.
 
-Then evaluate EVERY category defined in this skill's "Categories (what counts as slop)" section, applying that section's KEEP and REFACTOR rules verbatim — the Categories section you have loaded is canonical, do not work from a restated subset.
+Then evaluate EVERY category defined in this skill's "Categories (what counts as slop)" section, applying that section's KEEP and REFACTOR rules verbatim — the Categories section you have loaded is canonical, do not work from a restated subset. For a test file, do NOT cut yet: mark every declaration R/F/C/D against `programming/references/testing/junk-classes.md` and return one ledger row per D/C/F (`| test | mark | keeper or reason | proposed proof |`), where the proposed proof names the class's proof kind and, for a mutation, the owner file, the exact find/replace, and the keeper to run. This worker applies `F` rows in the test file it owns and reports them in the ledger as applied; `D`/`C` rows are returned uncut; it never mutates any file to prove a test - the orchestrator runs the proofs in Phase 4b.
 
-Apply changes in this order (safest → riskiest): comments → dead code → defensive → duplication → complexity → abstraction/boundary → performance → oversized-modules.
+Apply changes in this order (safest → riskiest): comments → dead code → defensive → duplication → complexity → abstraction/boundary → performance → tests (`F` rows; `D`/`C` wait for Phase 4b) → oversized-modules.
 
 Hard constraints:
 - Behavior MUST be preserved. When equivalence is not obvious, SKIP.
@@ -225,11 +229,15 @@ Hard constraints:
 - Diff stays minimal and scoped to slop removal.
 
 Report changes grouped by category. For each change, give before/after, why-slop, why-safe.
-For each skipped issue, give reason.
+For each skipped issue, give reason. For a test file, end with the ledger rows.
 """
 )
 ```
 
+### Phase 4b: Prove the test cuts, serially, then cut
+
+After the last batch finishes and no worker is running, the orchestrator takes the collected ledger rows. For each row whose proof is a mutation, run the `programming` skill's `bun run <programming skill dir>/scripts/typescript/mutation-proof.ts --file <owner> --find <text> --replace <text> --test 'candidate=<argv>' --test 'keeper=<argv>'` (add `--json` for the ledger; each `--test` value is split on spaces with no quoting, so a filter that contains a space needs a wrapper script or a file-path target instead): it applies the find/replace to the production owner, runs the candidate and the keeper on the unmodified test tree, records both verdicts, and restores the owner byte for byte (sha256-checked) before the next row. One mutation at a time, never while another worker or test run is live, and never two on the same file; a mutation touches a file outside the diff only transiently and is never committed. Rows proven per the table become the cuts; a D or C whose proof fails or was not run is an R. Non-mutation proofs (prose pin, change certificate, seam keeper, copied inventory, capability restatement, near-duplicate cases) are checked here too, from the row's evidence.
+
 **Batch failure handling**: a `multi_agent_v1.wait_agent` timeout only means no new mailbox update arrived, not that a `deep-low` agent failed. For long passes, require each child to send `WORKING: <file> - <current phase>` and `BLOCKED: <reason>` only when it cannot progress. Treat a running child as alive. Mark a file for retry only when the child is completed without the deliverable, ack-only after followup, explicitly `BLOCKED:`, or no longer running. Do NOT block the remaining 4 in that batch; collect successful results and retry the failed file once later. If retry also fails, escalate that file under "Issues Found & Fixed" in the final report.
 
 ### Phase 5: Verify with quality gates + critical review
@@ -284,8 +292,8 @@ Files: [N files]
 
 Behavior Lock:
   - Existing coverage: [N files already covered]
-  - Tests added: [M new regression tests at path/to/test_X.py]
-  - Baseline status: GREEN
+  - Tests added: [M gate-passing tests at path/to/test_X.py, each naming its contract]
+  - Baseline status: GREEN apart from the baseline-red list (recorded as bugs, excluded from proofs, not deleted): [none] OR [list]
 
 Cleanup Plan:
   - path/to/file1.ts: [ladder: 1 delete (native) + simplify-in-place] → [dead code → complexity → performance]
@@ -303,6 +311,12 @@ Per-File Results (each cut shows what replaces it):
     - Obvious comments: 5 removed → nothing
     - Over-defensive: 1 simplified (redundant isinstance on typed param)
 
+Tests Ledger (category 9; one row per test declaration marked D/C/F, proofs run in Phase 4b):
+  | Test | Mark | Keeper / reason | Proof |
+  |---|---|---|---|
+  | `foo.test.ts > reads the source for "export"` | D | source grep; `foo.test.ts > exports parse()` owns the contract | mutation parse.ts `return tokens` -> `return []`: candidate green, keeper red; restored sha-equal |
+  | `skill.test.ts > mentions the gate` | D | prose pin on SKILL.md | assertion line + repo prose rule (no mutation applies) |
+
 Quality Gates:
   - Regression tests: PASS (12 tests, 0 failed)
   - Lint: PASS
@@ -355,7 +369,5 @@ Final Status: CLEAN | ISSUES FIXED | REQUIRES ATTENTION
 ## Quality Assurance
 
 - NEVER remove code that serves a functional purpose.
-- ALWAYS verify changes compile/parse and pass type-check.
-- ALWAYS preserve test coverage; add tests rather than remove them.
-- If uncertain about a change, err on the side of keeping the original code.
-- The default action when in doubt is SKIP, not GUESS.
+- Preserve every proven contract: a test leaves only with its proof receipt (category 9), and a missing contract gets a gate-passing test, never a change certificate.
+- When in doubt, SKIP and keep the original; never GUESS.

package/packages/omo-codex/plugin/skills/ulw-research/scripts/source-commands.mjs

@@ -143,7 +143,9 @@ function declareOverKeptRaw(sourcesDir, id, input) {
 	const dir = join(sourcesDir, String(id))
 	if (input.kind !== "converted-only" || !existsSync(join(dir, "raw.bin")) || !existsSync(join(dir, "meta.json"))) return
 	const before = JSON.parse(readFileSync(join(dir, "meta.json"), "utf8"))
-	Object.assign(input, { url: before.url, raw: readFileSync(join(dir, "raw.bin")), kind: before.kind, declared: true })
+	const raw = readFileSync(join(dir, "raw.bin"))
+	if (sha256Of(raw) !== before.sha256) throw new CliError(`snapshot_hash_mismatch: ${id} raw.bin no longer matches its pinned hash`)
+	Object.assign(input, { url: before.url, raw, kind: before.kind, observed_at: before.observed_at, declared: true })
 	delete input.path
 }
 

package/packages/omo-codex/plugin/skills/visual-qa/SKILL.md

@@ -66,6 +66,10 @@ The verdict is per page. One failing page fails the whole surface, so "most page
 
 Every gate runs on captures produced AFTER the last edit to the rendered source. If any screenshot, PDF, capture, or QA JSON is older than the source file it claims to verify, it is stale and invalid - regenerate it before trusting it. Never report a PASS from an artifact you did not just produce against the current build. Between review rounds, re-capture only the pages a fix touched; the final approving round always judges a complete fresh set. The one deliberately old artifact is the `before` set of Step 6, which is dated to the pre-edit build on purpose.
 
+### Machine pre-check - the detect SDK before any reviewer
+
+On a web surface, run the `frontend` skill's detect SDK on every enumerated page before capturing for reviewers (`frontend/references/perfection/detect.md`: `detectPage({ kind: "url", url }, { reflow: true })`, or `bun <frontend skill dir>/scripts/detect/cli.ts --reflow --json <url>`). It reads the rendered page and reports contrast against the painted background, the type scale and heading order, overflow at 320-1440 px under an unbroken stress string, and decoration and copy tells. An error or warning is a FAIL on the matching checklist item (E2 contrast, B8 type scale, A9 or A13 layout, F8/F9 surfaces and scaffolds, C4 wrapping) before either reviewer looks; fix it and rerun. Keep the JSON beside the captures and hand it to both reviewers as evidence. Advisories go to the verdict's taste findings.
+
 ### Capture hygiene - validate before dispatching reviewers
 
 Before any reviewer sees an image, verify each capture yourself: the file signature matches its extension (a JPEG named `.png` is invalid), the frame is fully composited (no black or missing regions from the screenshot compositor), dimensions match the requested viewport, and the frame holds only the page - a capture showing the browser's tabs or address bar, or the capture tool's own UI, is a window grab, not evidence. A defective capture wastes an entire review round on the pipeline instead of the product - fix the capture tooling and re-shoot before dispatch, and record the tooling defect in the QA log instead of looping the reviewer on it.
@@ -140,7 +144,7 @@ This is the platform baseline, distilled from Apple's Human Interface Guidelines
 **A. Layout and alignment**
 - A1 Content is anchored by intent, centred or on the layout grid; nothing sits in the top-left of an otherwise empty canvas.
 - A2 Backgrounds and scrolling layouts run full-bleed to the display edges; no stray inset margin.
-- A3 Margins are symmetric; prose sits in a 45-75 character measure.
+- A3 Margins are symmetric; prose sits in a 65-75 character measure on desktop and at least 45 on a phone.
 - A4 (phone) Safe areas respected: bars and content inset for the home indicator, notch and status bar.
 - A5 (phone) Scrollbars are overlay; no reserved right-hand gutter.
 - A6 One scroll owner per region, no nested same-direction scrolling; a sticky or floating bar stays legible over whatever scrolls under it.
@@ -150,6 +154,7 @@ This is the platform baseline, distilled from Apple's Human Interface Guidelines
 - A10 Content that continues out of view shows a cue (partial item, fade, chevron).
 - A11 (mac) Nothing important lives only at the window's bottom edge; the minimum window size keeps toolbar and content legible; the sidebar collapses when the window narrows.
 - A12 (web and app screens; N/A for a TUI, a printed page, or a figure) Layout contract: every changed screen or region has a `Layout:` line (in `DESIGN.md`, or in the change description when the project has none; the `frontend` skill's Brief step); the capture shows that pattern's structure; the logged owner is the region's main scroller in the probe output, every other scroller listed is nested inside it for its own content (a code block, a dropdown, a composer) or is named in the line too; none of the line's anti-patterns appear. A missing line, a different main scroller, an unexplained sibling scroller, or a present anti-pattern is a FAIL; a logged skip still owes the scroll-owner check.
+- A13 Spacing rhythm, read from computed values: the space above a section heading is at least 1.5x the space below it, and the gap between groups is at least 2x the gap inside a group (the `frontend` skill's `references/perfection/craft-floor.md`).
 
 **B. Hierarchy**
 - B1 One primary action per view, in the prominent style (accent on its background, not its glyph); peers differ by style, never by size.
@@ -159,6 +164,7 @@ This is the platform baseline, distilled from Apple's Human Interface Guidelines
 - B5 One or two accents per screen; toolbars and tab bars stay monochrome over colourful content; nothing decorative carries accent.
 - B6 Type hierarchy comes from weight, size and colour, holds in both themes, and uses at most two typefaces.
 - B7 (web and app screens; N/A for a TUI, a printed page, or a figure) The screen matches its brief (the `frontend` skill's Brief step): the named primary action is the single prominent control, priorities 1-3 appear in that order in reading order on the first viewport, and nothing listed under "left out on purpose" is on the screen. A screen built or changed in this session with no brief is a FAIL; a pre-existing screen under audit with no brief is N/A.
+- B8 Type scale floor, read from computed values: each heading step in use (display to h3, and the smallest heading to body) differs by at least 1.25x in size, and body-family roles (lead, body, small, caption, label) that sit closer also differ by weight, colour or case, a display heading stays at or under 6rem, and letter spacing never goes below -0.04em, unless the brief's chosen style route sets its own display scale or tracking (then that value is the check).
 
 **C. Text and copy**
 - C1 Body text is at least 17 pt-equivalent at 390 (15 pt for secondary text) and 14 px on desktop; no thin weights at small sizes.
@@ -183,6 +189,7 @@ This is the platform baseline, distilled from Apple's Human Interface Guidelines
 - E4 One colour never means two things; status colours are consistent across the surface.
 - E5 Translucent surfaces keep text legible over any scrolled content: blur or vibrancy, not a plain alpha fill.
 - E6 The theme follows the system; an in-app theme control also offers "system".
+- E7 Secondary text on a tinted or coloured surface is a shade of that hue or the foreground at reduced alpha, never neutral gray; a shadow carries a y-offset and a soft blur, never a zero-offset coloured glow unless the brief asked for glowing-border cards (the `frontend` skill's ambience route).
 
 **F. Consistency and brand**
 - F1 One icon set with one stroke, weight and size; icon weight matches adjacent text; no emoji used as an icon.
@@ -192,6 +199,10 @@ This is the platform baseline, distilled from Apple's Human Interface Guidelines
 - F5 Selected or active state is a wash plus a glyph; focus is a focus-visible ring on fields and a row highlight in lists; no coloured accent side-border marks state.
 - F6 Standard glyphs for standard actions (share, close, back, search, more) in their standard places.
 - F7 Windows, sheets and popovers use system shapes; one sheet or popover at a time; a popover's arrow points at its source; only an alert may appear over a popover.
+- F8 Browser surfaces carry the palette in both themes: text selection, caret, visible scrollbars, focus ring, link underline offset, and tabular numerals in changing or aligned numbers; none shows the browser default (select text and focus a field in the capture to prove it).
+- F9 None of the generated scaffolds: a kicker label above a heading, an icon tile stacked over a heading in a grid of same-size cards, a hero metric with no decision behind it, a card nested in a card, monospace used as a "technical" costume. One the brief or its chosen route asked for, recorded as such, passes.
+
+A13, B8, E7, F8 and F9 are adapted from the craft floor of [pbakaus/impeccable](https://github.com/pbakaus/impeccable) (Apache-2.0, Copyright 2025 Paul Bakaus); the license and the list of changes are in the `frontend` skill's `ATTRIBUTION.md` section 6.
 
 **G. Motion and feedback**
 - G1 Every animation has a cause - an interaction, a state change, an arrival; no motion on non-interactive elements, no hover that changes nothing, no permanent loop.

package/packages/omo-codex/plugin/test/auto-update.test.mjs

@@ -417,6 +417,68 @@ test("#given marketplace flow with stale local cache state #when running check #
 	]);
 });
 
+async function writeStaleCacheManifestWithConfig(codexHome, marketplaceBlock) {
+	await mkdir(join(codexHome, "plugins", "cache", "sisyphuslabs", ".agents", "plugins"), { recursive: true });
+	await writeFile(
+		join(codexHome, "plugins", "cache", "sisyphuslabs", ".agents", "plugins", "marketplace.json"),
+		JSON.stringify({
+			name: "sisyphuslabs",
+			plugins: [{ name: "omo", source: { source: "local", path: "./omo/1.0.1" } }],
+		}),
+	);
+	await writeFile(join(codexHome, "config.toml"), marketplaceBlock);
+}
+
+test("#given a Git marketplace in config and a stale cache manifest #when resolving plan #then no local repair starts", async () => {
+	const { root, pluginRoot } = await makeStorePluginRoot("lazycodex-auto-update-git-marketplace-");
+	const codexHome = join(root, "codex-home");
+	await writeStaleCacheManifestWithConfig(
+		codexHome,
+		'[marketplaces.sisyphuslabs]\nsource_type = "git"\nsource = "https://github.com/code-yeongyu/lazycodex.git"\n',
+	);
+	const env = marketplaceCheckEnv(root, pluginRoot, join(root, "spawn.log"), { CODEX_HOME: codexHome });
+
+	const plan = resolveAutoUpdatePlan({ env, now: 123_457, lastCheckedAt: 123_456, lastStatus: "success" });
+
+	assert.equal(plan.shouldRun, false);
+	assert.equal(plan.reason, "marketplace-flow");
+});
+
+test("#given a Git marketplace in config and a dangling managed bin #when resolving plan #then the bin still starts the repair", async () => {
+	const { root, pluginRoot } = await makeStorePluginRoot("lazycodex-auto-update-git-marketplace-bin-");
+	const codexHome = join(root, "codex-home");
+	const binDir = join(root, "bin");
+	await writeStaleCacheManifestWithConfig(
+		codexHome,
+		'[marketplaces.sisyphuslabs]\nsource_type = "git"\nsource = "https://github.com/code-yeongyu/lazycodex.git"\n',
+	);
+	await mkdir(binDir, { recursive: true });
+	await symlink(join(codexHome, "plugins", "cache", "sisyphuslabs", "omo", "1.0.1", "components", "ulw-loop", "dist", "cli.js"), join(binDir, "ulw"));
+	const env = marketplaceCheckEnv(root, pluginRoot, join(root, "spawn.log"), { CODEX_HOME: codexHome, CODEX_LOCAL_BIN_DIR: binDir });
+
+	const plan = resolveAutoUpdatePlan({ env, now: 123_457, lastCheckedAt: 123_456, lastStatus: "success" });
+
+	assert.equal(plan.shouldRun, true);
+	assert.equal(plan.kind, "marketplace-local-repair");
+	assert.deepEqual(plan.repairReasons, [{ kind: "dangling-managed-bin", binName: "ulw" }]);
+});
+
+test("#given a local marketplace in config and a stale cache manifest #when resolving plan #then local repair still starts", async () => {
+	const { root, pluginRoot } = await makeStorePluginRoot("lazycodex-auto-update-local-marketplace-");
+	const codexHome = join(root, "codex-home");
+	await writeStaleCacheManifestWithConfig(
+		codexHome,
+		`[marketplaces.sisyphuslabs]\nsource_type = "local"\nsource = ${JSON.stringify(join(codexHome, "plugins", "cache", "sisyphuslabs"))}\n`,
+	);
+	const env = marketplaceCheckEnv(root, pluginRoot, join(root, "spawn.log"), { CODEX_HOME: codexHome });
+
+	const plan = resolveAutoUpdatePlan({ env, now: 123_457, lastCheckedAt: 123_456, lastStatus: "success" });
+
+	assert.equal(plan.shouldRun, true);
+	assert.equal(plan.kind, "marketplace-local-repair");
+	assert.deepEqual(plan.repairReasons, [{ kind: "missing-marketplace-payload" }]);
+});
+
 test("#given stale marketplace cache and recent success state #when resolving plan #then repair bypasses success throttle", async () => {
 	const { root, pluginRoot } = await makeStorePluginRoot("lazycodex-auto-update-marketplace-repair-throttle-");
 	const spawnLogPath = join(root, "spawn.log");

package/packages/omo-codex/plugin/test/payload-equivalence.test.mjs

@@ -46,6 +46,11 @@ async function readTelemetryCoreDefaultPostHogConstants() {
 
 test("payload-equivalence: #given telemetry-core and component shim #when session_start is captured #then payload schema matches telemetry-core", async () => {
 	const stateDir = mkdtempSync(join(tmpdir(), "omo-codex-payload-equivalence-"));
+	const savedTermProgram = process.env.TERM_PROGRAM;
+	process.env.TERM_PROGRAM = "/home/sentinel-user/bin/x";
+	const previousShell = process.env.SHELL;
+	// A login shell path can carry the user's name; only the program name may be sent.
+	process.env.SHELL = "/home/payload-user/.nix-profile/bin/zsh";
 	try {
 		await readTelemetryCoreDefaultPostHogConstants();
 		const componentPostHog = await import("../components/telemetry/dist/posthog.js");
@@ -88,15 +93,20 @@ test("payload-equivalence: #given telemetry-core and component shim #when sessio
 					reason: "session_start",
 					runtime: "node",
 					runtime_version: process.version,
-					shell: process.env.SHELL,
+					shell: "zsh",
 					source: "plugin",
-					terminal: process.env.TERM_PROGRAM,
+					terminal: "other",
 					timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
 					total_memory_gb: 16,
 				},
 			},
 		]);
+		assert.doesNotMatch(JSON.stringify(componentMessages), /sentinel-user/);
 	} finally {
+		if (savedTermProgram === undefined) delete process.env.TERM_PROGRAM;
+		else process.env.TERM_PROGRAM = savedTermProgram;
+		if (previousShell === undefined) delete process.env.SHELL;
+		else process.env.SHELL = previousShell;
 		rmSync(stateDir, { recursive: true, force: true });
 	}
 });