wize-dev-kit 0.10.1 → 0.12.0

package/src/security-overlay/_shared/scope-parser.js

@@ -111,10 +111,37 @@ function loadScope(scopePath) {
   return scope;
 }
 
+// signScope(scopePath) — read, parse, recompute SHA-256 of the body, and
+// rewrite the scope_sha256 field in the frontmatter. Returns metadata about
+// the signed scope. Throws ScopeError on missing file or invalid format.
+// Idempotent: running twice on the same body produces the same hash.
+function signScope(scopePath) {
+  if (!fs.existsSync(scopePath)) {
+    throw new ScopeError('MISSING_FILE', null,
+      `scope.md ausente em ${scopePath} — crie com wize-sec-scope antes de assinar`);
+  }
+  const text = fs.readFileSync(scopePath, 'utf8');
+  const scope = parseScope(text);
+
+  const newHash = computeScopeSha256(scope.body);
+
+  // Replace scope_sha256 within the frontmatter block only (avoid
+  // accidental matches in the body).
+  const fmMatch = text.match(/^---\n([\s\S]*?)\n---\n/);
+  const fmBlock = fmMatch[0];
+  const newFmBlock = fmBlock.replace(/^(scope_sha256:\s*).*$/m, `$1${newHash}`);
+  const newText = text.replace(fmBlock, newFmBlock);
+
+  fs.writeFileSync(scopePath, newText, 'utf8');
+
+  return { path: scopePath, sha256: newHash, accepted_by: scope.frontmatter.accepted_by };
+}
+
 module.exports = {
   parseScope,
   validateScope,
   computeScopeSha256,
   loadScope,
+  signScope,
   ScopeError
 };

package/src/security-overlay/agents/red-teamer/agent.yaml

@@ -22,9 +22,11 @@ overlay: security
 
 skills:
   - wize-sec-pentest
+  - wize-sec-scope
 
 commands:
   - /wize-sec-pentest
+  - /wize-sec-scope
 
 inputs:
   - ".wize/security/scope.md (gate of authorization)"

package/src/security-overlay/agents/red-teamer/persona.md

@@ -25,6 +25,12 @@ Each phase is a standalone skill; the orchestrator `wize-sec-pentest` chains the
 - **Missing tools degrade, they don't abort.** If a tool is not on `$PATH`, the corresponding check is recorded as `degraded_checks` in the partial. The pipeline continues.
 - **Flags via allowlist.** Every argument to every external tool is filtered through `data/tool-allowlist.json`. I never pass user-supplied flags directly to `execFile`.
 
+## Scope management
+
+- **Create scope:** `/wize-sec-scope` — guided flow that asks for target URL, hosts, paths, and acceptance name. Generates `.wize/security/scope.md` with a valid `scope_sha256`.
+- **Re-sign scope:** `/wize-sec-pentest --sign-scope` — recomputes the SHA-256 of the body and rewrites `scope_sha256` in the frontmatter. Use after editing the allowlist manually.
+- **Validate scope:** `loadScope()` is called before any offensive action. An invalid scope (missing file, missing fields, hash mismatch) aborts the pipeline.
+
 ## Limits
 
 - I do NOT attack hosts, URLs, or paths outside the `scope.md` allowlist. Even with `--active`.

package/src/security-overlay/skills/wize-sec-enumerate/skill.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-sec-enumerate
+description: "Use quando o recon estiver concluído e precisar enumerar a superfície de ataque (portas, serviços, tecnologias) a partir dos alvos autorizados."
 name: wize-sec-enumerate
 overlay: security
 module: security-overlay

package/src/security-overlay/skills/wize-sec-pentest/scripts/run-pipeline.js

@@ -26,10 +26,11 @@ const PHASE_SCRIPTS = {
 };
 
 function parseArgv(argv) {
-  const out = { active: false, scopePath: null, kitRoot: DEFAULT_KIT_ROOT };
+  const out = { active: false, scopePath: null, kitRoot: DEFAULT_KIT_ROOT, signScope: false };
   for (let i = 0; i < (argv || []).length; i++) {
     const a = argv[i];
     if (a === '--active') out.active = true;
+    else if (a === '--sign-scope') out.signScope = true;
     else if (a === '--scope' && argv[i + 1]) { out.scopePath = argv[i + 1]; i++; }
     else if (a.startsWith('--scope=')) out.scopePath = a.slice('--scope='.length);
   }
@@ -120,6 +121,22 @@ async function runPipeline(opts = {}) {
 // user invokes `/wize-sec-pentest`.
 async function main() {
   const args = parseArgv(process.argv.slice(2));
+
+  // --sign-scope: recompute SHA-256 and exit (no pipeline run).
+  if (args.signScope) {
+    try {
+      const { signScope } = require('../../../_shared/scope-parser.js');
+      const result = signScope(args.scopePath);
+      console.log(`✓ Scope re-assinado. SHA-256: ${result.sha256}`);
+      console.log(`  aceite por: ${result.accepted_by}`);
+      console.log(`  arquivo: ${result.path}`);
+      process.exit(0);
+    } catch (err) {
+      console.error('✖ sign-scope falhou:', err && err.message ? err.message : err);
+      process.exit(2);
+    }
+  }
+
   let result;
   try {
     // Derive the securityDir from the scopePath's parent (the .wize/security

package/src/security-overlay/skills/wize-sec-pentest/skill.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-sec-pentest
+description: "Use quando o scope de segurança estiver definido e precisar executar o pipeline completo de pentest (recon → enumerate → exploit → report)."
 name: wize-sec-pentest
 overlay: security
 module: security-overlay

package/src/security-overlay/skills/wize-sec-recon/skill.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-sec-recon
+description: "Use quando o scope de segurança estiver autorizado e precisar executar reconhecimento passivo (nmap) nos alvos."
 name: wize-sec-recon
 overlay: security
 module: security-overlay

package/src/security-overlay/skills/wize-sec-scope/scripts/generate-scope.js

@@ -0,0 +1,106 @@
+'use strict';
+
+// generate-scope.js — creates a valid .wize/security/scope.md from CLI args.
+// Zero-dep. Computes scope_sha256 from the body (including the leading newline
+// separator, matching parseScope's convention).
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+function parseArgv(argv) {
+  const out = { url: null, hosts: [], paths: [], acceptedBy: null, outPath: null };
+  for (let i = 0; i < (argv || []).length; i++) {
+    const a = argv[i];
+    if (a === '--url' && argv[i + 1]) { out.url = argv[i + 1]; i++; }
+    else if (a.startsWith('--url=')) out.url = a.slice('--url='.length);
+    else if (a === '--hosts' && argv[i + 1]) { out.hosts = argv[i + 1].split(',').map(s => s.trim()).filter(Boolean); i++; }
+    else if (a.startsWith('--hosts=')) out.hosts = a.slice('--hosts='.length).split(',').map(s => s.trim()).filter(Boolean);
+    else if (a === '--paths' && argv[i + 1]) { out.paths = argv[i + 1].split(',').map(s => s.trim()).filter(Boolean); i++; }
+    else if (a.startsWith('--paths=')) out.paths = a.slice('--paths='.length).split(',').map(s => s.trim()).filter(Boolean);
+    else if (a === '--accepted-by' && argv[i + 1]) { out.acceptedBy = argv[i + 1]; i++; }
+    else if (a.startsWith('--accepted-by=')) out.acceptedBy = a.slice('--accepted-by='.length);
+    else if (a === '--out' && argv[i + 1]) { out.outPath = argv[i + 1]; i++; }
+    else if (a.startsWith('--out=')) out.outPath = a.slice('--out='.length);
+  }
+  if (!out.outPath) out.outPath = path.join(process.cwd(), '.wize', 'security', 'scope.md');
+  return out;
+}
+
+function buildBody({ url, hosts, paths }) {
+  const lines = [];
+
+  lines.push('## allowlist');
+
+  lines.push('hosts:');
+  for (const h of hosts) lines.push(`  - ${h}`);
+
+  lines.push('urls:');
+  if (url) lines.push(`  - ${url.replace(/\/+$/, '')}/`);
+
+  lines.push('paths:');
+  if (paths.length > 0) {
+    for (const p of paths) lines.push(`  - ${p}`);
+  } else {
+    lines.push('  - /');
+  }
+
+  lines.push('');
+  lines.push('## dast_target');
+  if (url) lines.push(`url: ${url}`);
+  lines.push('');
+  lines.push('## notes');
+  lines.push(`Scope gerado por wize-sec-scope em ${new Date().toISOString()}.`);
+  lines.push('');
+
+  return lines.join('\n');
+}
+
+function generateScope({ url, hosts, paths, acceptedBy, outPath }) {
+  const body = buildBody({ url, hosts, paths });
+
+  // The hash is computed on the body as parseScope returns it: with the
+  // leading newline separator between the closing --- and the body.
+  const signedBody = '\n' + body;
+  const scopeSha256 = crypto.createHash('sha256').update(signedBody, 'utf8').digest('hex');
+  const acceptedAt = new Date().toISOString();
+
+  const fm = [
+    `accepted_by: ${acceptedBy || 'unknown'}`,
+    `accepted_at: ${acceptedAt}`,
+    `scope_sha256: ${scopeSha256}`
+  ].join('\n');
+
+  const content = `---\n${fm}\n---\n${signedBody}`;
+
+  const dir = path.dirname(outPath);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(outPath, content, 'utf8');
+
+  return { path: outPath, sha256: scopeSha256, acceptedBy, acceptedAt };
+}
+
+function main() {
+  const args = parseArgv(process.argv.slice(2));
+
+  if (!args.url) {
+    console.error('✖ --url é obrigatório (ex: --url=http://localhost:8080)');
+    process.exit(2);
+  }
+  if (!args.acceptedBy) {
+    console.error('✖ --accepted-by é obrigatório (ex: --accepted-by="Seu Nome")');
+    process.exit(2);
+  }
+
+  const result = generateScope(args);
+  console.log(`✓ scope.md gerado em ${result.path}`);
+  console.log(`  SHA-256: ${result.sha256}`);
+  console.log(`  aceite por: ${result.acceptedBy}`);
+  console.log(`  aceite em: ${result.acceptedAt}`);
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { generateScope, buildBody, parseArgv };

package/src/security-overlay/skills/wize-sec-scope/skill.md

@@ -0,0 +1,52 @@
+---
+
+code: wize-sec-scope
+description: "Use para criar ou re-assinar o scope.md de segurança. Guia o usuário com perguntas e gera o arquivo com hash SHA-256."
+name: wize-sec-scope
+overlay: security
+module: security-overlay
+owner: wize-sec-red-teamer  # Natasha Romanoff
+status: ready
+---
+
+# wize-sec-scope — Criação guiada de scope.md
+
+Cria o arquivo `.wize/security/scope.md` a partir de perguntas interativas. Gera o frontmatter com `accepted_by`, `accepted_at`, e `scope_sha256` (SHA-256 do corpo). O arquivo gerado passa na validação do `loadScope()` sem intervenção manual.
+
+## Uso
+
+```bash
+/wize-sec-scope
+```
+
+## Fluxo guiado
+
+O agente faz uma pergunta por vez:
+
+1. **URL base do alvo** — ex: `http://localhost:8080`
+2. **Hosts adicionais no escopo** — um por linha, Enter para pular
+3. **Paths no escopo** — ex: `/api/*`, Enter para todos (`/`)
+4. **Nome para o aceite** — quem está autorizando o pentest
+
+Ao final, gera `scope.md` com:
+
+- Frontmatter: `accepted_by`, `accepted_at` (ISO-8601), `scope_sha256`
+- Corpo: `## allowlist` com hosts, urls e paths
+- `## dast_target` com a URL base
+- `## notes` com o timestamp de criação
+
+## Re-assinatura
+
+Se o `scope.md` já existe e foi editado, use `--sign-scope` para recomputar o hash:
+
+```bash
+/wize-sec-pentest --sign-scope
+```
+
+## Script
+
+`scripts/generate-scope.js` — gera o arquivo programaticamente (usado pelo agente ou chamado diretamente).
+
+```bash
+node scripts/generate-scope.js --url=http://localhost:8080 --hosts=localhost,127.0.0.1 --paths=/api,/admin --accepted-by="Seu Nome"
+```

package/src/tea-skills/wize-qa-generate-e2e-tests/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-qa-generate-e2e-tests
+description: "Use quando o UX design e PRD estiverem validados e precisar gerar casos de teste E2E a partir das telas e ACs."
 name: Generate E2E Tests
 owner: wize-agent-test-architect   # Hawkeye
 status: ready

package/src/tea-skills/wize-tea-design/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-design
+description: "Use quando uma story entrar em desenvolvimento e precisar do contrato de testes (split, fixtures, mocks, assertions) que a Shuri implementará."
 name: TEA Test Design
+phase: 4-implementation
 gate: design
 owner: wize-agent-test-architect   # Hawkeye
 when: per-story-start

package/src/tea-skills/wize-tea-gate/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-gate
+description: "Use quando uma story chegar ao final e precisar da decisão de gate (PASS/CONCERNS/FAIL/WAIVED) com rationale documentado."
 name: TEA Gate Decision
+phase: 4-implementation
 gate: gate
 owner: wize-agent-test-architect   # Hawkeye
 when: story-final

package/src/tea-skills/wize-tea-nfr/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-nfr
+description: "Use quando um epic estiver próximo do merge e precisar verificar se atende aos princípios de NFR definidos pelo Fury."
 name: TEA NFR Assessment
+phase: 4-implementation
 gate: nfr
 owner: wize-agent-test-architect   # Hawkeye
 when: pre-merge-per-epic

package/src/tea-skills/wize-tea-review/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-review
+description: "Use quando uma story terminar implementação e precisar de revisão estruturada de AC fulfillment, disciplina de teste e cobertura de risco."
 name: TEA Story Review
+phase: 4-implementation
 gate: review
 owner: wize-agent-test-architect   # Hawkeye
 when: story-end

package/src/tea-skills/wize-tea-risk/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-risk
+description: "Use quando a arquitetura for assinada e precisar construir a matriz probabilidade × impacto que prioriza todo o trabalho de TEA."
 name: TEA Risk Profile
+phase: 4-implementation
 gate: risk
 owner: wize-agent-test-architect   # Hawkeye
 when: once-after-architecture

package/src/tea-skills/wize-tea-trace/workflow.md

@@ -1,6 +1,9 @@
 ---
+
 code: wize-tea-trace
+description: "Use quando uma story estiver em implementação e precisar mapear cada AC para testes concretos no repositório."
 name: TEA Traceability
+phase: 4-implementation
 gate: trace
 owner: wize-agent-test-architect   # Hawkeye
 when: during-or-after-implementation

package/src/web-overlay/wize-web-deploy/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-web-deploy
+description: "Use quando o projeto web estiver pronto para deploy e precisar do playbook de publicação."
 name: Web Deploy Playbook
 overlay: web
 owner: wize-agent-architect   # Tony

package/src/web-overlay/wize-web-scaffold/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-web-scaffold
+description: "Use quando precisar criar o scaffold inicial de um projeto web com a stack aprovada pelo Fury."
 name: Web Scaffold
 overlay: web
 owner: wize-agent-architect   # Tony executes; Fury approves stack family

package/src/web-overlay/wize-web-seo-audit/workflow.md

@@ -1,5 +1,7 @@
 ---
+
 code: wize-web-seo-audit
+description: "Use quando o projeto web estiver no ar e precisar de auditoria de SEO."
 name: Web SEO Audit
 overlay: web
 owner: wize-agent-pm   # Maria Hill commissions; Mantis + Tony execute

package/tools/installer/commands/doctor.js

@@ -252,13 +252,13 @@ async function cmdDoctor({ kitRoot, projectRoot, opts = {} } = {}) {
       const age = f.days == null ? 'no last_refreshed' : `${f.days}d ago`;
       log(`  ${f.name.padEnd(28)} ${age}`);
       if (f.days != null && f.days > 60) {
-        suggestions.push({ level: 'warn', text: `\`${f.name}\` last refreshed ${f.days}d ago. Run \`wize-refresh-knowledge\` after current sprint.` });
+        suggestions.push({ level: 'warn', text: `\`${f.name}\` last refreshed ${f.days}d ago. Run \`/wize-refresh-knowledge\` after current sprint.` });
       }
     }
     if (knowledge.pendingLines > 0) {
       log(`  _pending.md:                ${knowledge.pendingLines} inline note(s) waiting consolidation`);
       if (knowledge.pendingLines >= 5) {
-        suggestions.push({ level: 'info', text: `${knowledge.pendingLines} notes piled up in _pending.md. Time to run \`wize-refresh-knowledge\`.` });
+        suggestions.push({ level: 'info', text: `${knowledge.pendingLines} notes piled up in _pending.md. Time to run \`/wize-refresh-knowledge\`.` });
       }
     }
     const markerText = knowledge.toBeGeneratedMarkers > 0 ? `${knowledge.toBeGeneratedMarkers} marker(s)` : 'none';

package/tools/installer/onboarding.js

@@ -1,32 +1,25 @@
 /*
  * Onboarding handoff — Wizer-driven triage after install.
  *
- * Stub: in v0.1 this just prints the first action Wizer would take.
- * In a real run this would be a workflow executed by the active IDE adapter.
+ * Returns a clean, minimal message (≤3 lines) that always ends with "→ /wize".
+ * The message adapts to brownfield detection and active profiles without
+ * turning into a wall of text.
  */
 'use strict';
 
 function compose(detection, profiles) {
-  const lines = [
-    '',
-    '╭─ Wizer ─────────────────────────────────────╮',
-    '│ Welcome back. What are we working on?       │',
-    '╰─────────────────────────────────────────────╯'
-  ];
-  if (detection.brownfield) {
-    lines.push('');
-    lines.push('I see this repo already has code. I can ask Pepper and Peggy to baseline it before we plan.');
-    lines.push('  → /wize-document-project');
+  const lines = [];
+  const profileCodes = new Set(profiles.map(p => p.code));
+
+  if (detection && detection.brownfield) {
+    lines.push('Brownfield detected — baseline ready.');
+  }
+
+  if (profileCodes.has('security-overlay')) {
+    lines.push('Security pentest available (/wize-sec-recon).');
   }
-  lines.push('');
-  lines.push('When ready, name the next step:');
-  lines.push('  → /wize-product-brief          (Pepper)');
-  lines.push('  → /wize-create-prd             (Maria Hill, if brief exists)');
-  lines.push('  → /wize-create-architecture    (Tony, if PRD exists)');
-  lines.push('  → /wize-quick-dev              (Shuri, for small fixes)');
-  if (profiles.find(p => p.code === 'web-overlay')) lines.push('  → /wize-web-scaffold           (overlay)');
-  if (profiles.find(p => p.code === 'app-overlay')) lines.push('  → /wize-app-scaffold           (overlay)');
-  if (profiles.find(p => p.code === 'security-overlay')) lines.push('  → /wize-sec-pentest         (overlay)');
+
+  lines.push('→ /wize');
   return lines.join('\n');
 }
 

package/tools/installer/render-shared.js

@@ -12,6 +12,32 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { walkAgents, walkWorkflows, walkSkills } = require('./validators/walk.js');
 
+// Shared block-scalar reader used by both readYamlField (agent.yaml) and
+// readFrontmatter (skill.md / workflow.md). Returns { value, nextIndex }.
+function readBlockScalar(lines, startIndex, folded) {
+  const collected = [];
+  let baseIndent = null;
+  let i = startIndex;
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === '') { collected.push(''); continue; }
+    const indent = line.match(/^(\s*)/)[1].length;
+    if (indent === 0) break; // dedent to a sibling top-level key ends the block
+    if (baseIndent === null) baseIndent = indent;
+    collected.push(line.slice(baseIndent));
+  }
+  while (collected.length && collected[collected.length - 1] === '') collected.pop();
+  if (folded) {
+    const value = collected.reduce((acc, ln, idx) => {
+      if (idx === 0) return ln;
+      if (ln === '' || collected[idx - 1] === '') return acc + '\n' + ln;
+      return acc + ' ' + ln;
+    }, '').trim();
+    return { value, nextIndex: i };
+  }
+  return { value: collected.join('\n').trim(), nextIndex: i };
+}
+
 function readYamlField(content, field) {
   const lines = content.split('\n');
   const keyRe = new RegExp('^' + field + ':\\s*(.*)$');
@@ -23,27 +49,7 @@ function readYamlField(content, field) {
     // Block scalar (| literal, > folded) with optional chomp/indent indicator.
     const block = inline.match(/^([|>])[+-]?\d*\s*$/);
     if (block) {
-      const folded = block[1] === '>';
-      const collected = [];
-      let baseIndent = null;
-      for (let j = i + 1; j < lines.length; j++) {
-        const line = lines[j];
-        if (line.trim() === '') { collected.push(''); continue; }
-        const indent = line.match(/^(\s*)/)[1].length;
-        if (indent === 0) break; // dedent to a sibling top-level key ends the block
-        if (baseIndent === null) baseIndent = indent;
-        collected.push(line.slice(baseIndent));
-      }
-      while (collected.length && collected[collected.length - 1] === '') collected.pop();
-      if (folded) {
-        // Folded: blank line -> newline, otherwise join lines with a space.
-        return collected.reduce((acc, ln, idx) => {
-          if (idx === 0) return ln;
-          if (ln === '' || collected[idx - 1] === '') return acc + '\n' + ln;
-          return acc + ' ' + ln;
-        }, '').trim();
-      }
-      return collected.join('\n').trim();
+      return readBlockScalar(lines, i + 1, block[1] === '>').value;
     }
 
     // Inline scalar: quoted or plain.
@@ -59,9 +65,25 @@ function readFrontmatter(content) {
   if (end === -1) return {};
   const lines = content.slice(3, end).split('\n');
   const out = {};
-  for (const line of lines) {
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
     const m = line.match(/^([a-zA-Z_][a-zA-Z0-9_-]*):\s*(.*?)\s*$/);
-    if (m) out[m[1]] = m[2].replace(/^"|"$/g, '').replace(/^'|'$/g, '');
+    if (!m) continue;
+    const key = m[1];
+    const inline = m[2].trim();
+
+    // Block scalar (| literal, > folded) with optional chomp/indent indicator.
+    const block = inline.match(/^([|>])[+-]?\d*\s*$/);
+    if (block) {
+      const result = readBlockScalar(lines, i + 1, block[1] === '>');
+      out[key] = result.value;
+      i = result.nextIndex - 1; // -1 because the for loop will increment
+      continue;
+    }
+
+    // Inline scalar: quoted or plain.
+    const q = inline.match(/^"([^"]*)"$/) || inline.match(/^'([^']*)'$/);
+    out[key] = (q ? q[1] : inline).trim();
   }
   return out;
 }
@@ -154,7 +176,7 @@ function collectAssets(kitRoot, { profiles = ['core'] } = {}) {
       code: fm.code,
       name: fm.name || fm.code,
       title: fm.phase || fm.gate || '',
-      description: `${fm.phase || fm.gate || 'workflow'}: ${fm.name || fm.code}`,
+      description: fm.description || `${fm.phase || fm.gate || 'workflow'}: ${fm.name || fm.code}`,
       body: bodyAfterFrontmatter(content),
       overlay: fm.overlay || null,
       owner: fm.owner || null,
@@ -175,7 +197,7 @@ function collectAssets(kitRoot, { profiles = ['core'] } = {}) {
       code: fm.code,
       name: fm.name || fm.code,
       title: fm.module || '',
-      description: fm.module ? `${fm.module} skill: ${fm.name || fm.code}` : (fm.name || fm.code),
+      description: fm.description || (fm.module ? `${fm.module} skill: ${fm.name || fm.code}` : (fm.name || fm.code)),
       body: bodyAfterFrontmatter(content),
       overlay: fm.overlay || null,
       owner: fm.owner || null,
@@ -272,8 +294,8 @@ function renderAgentsMd(kitRoot, projectRoot, opts = {}) {
     'instructions and persistent memory — not background reading. Read project state before',
     'acting; write what you change back into `.wize/` so the next session inherits it.',
     '',
-    'Before editing, classify the demand via `/wize-help`: **Quick Dev** (small, predictable,',
-    '~≤1h, no new feature / architecture / UX / security) or **Full Lifecycle**. Never pick',
+    'Before editing, classify the demand via `/wize` (or `/wize-help`): **Quick Dev** (small, predictable,',
+    'trivially scoped, no new feature / architecture / UX / security) or **Full Lifecycle**. Never pick',
     'Quick Dev just to skip artifacts.',
     '',
     'When a skill fans out to subagents, match the model tier to the task: a lightweight tier',
@@ -288,7 +310,7 @@ function renderAgentsMd(kitRoot, projectRoot, opts = {}) {
     const optIn = a.code.startsWith('wize-sec-') ? ' _(security-overlay, opt-in)_' : '';
     lines.push(`- **${a.name}** (\`${a.code}\`)${optIn} — ${a.title}. ${clipOneLine(a.description, 180)}`);
   }
-  lines.push('', '## Where to start', '', 'Activate the orchestrator: `wize-orchestrator` (Wizer). Then ask `/wize-help`.', '');
+  lines.push('', '## Where to start', '', 'Activate the orchestrator: `/wize` (or `/wize-help`). Wizer will guide you.', '');
 
   if (opts.dryRun) return { written: ['[dry-run] AGENTS.md'], skipped: [] };
   fs.writeFileSync(file, lines.join('\n'), 'utf-8');

package/tools/installer/validators/run-all.js

@@ -13,7 +13,7 @@ const { walkAgents, walkWorkflows, walkSkills } = require('./walk.js');
 function checkAgent(file) {
   const content = fs.readFileSync(file, 'utf-8');
   const errs = [];
-  if (!/^code:\s+wize-/m.test(content)) errs.push('missing or invalid "code:" prefix');
+  if (!/^code:\s+wize(-|$)/m.test(content)) errs.push('missing or invalid "code:" prefix');
   if (!/^name:/m.test(content))         errs.push('missing "name:"');
   if (!/^title:/m.test(content))        errs.push('missing "title:"');
   if (!/^description:/m.test(content))  errs.push('missing "description:"');
@@ -24,9 +24,10 @@ function checkWorkflow(file) {
   const content = fs.readFileSync(file, 'utf-8');
   const errs = [];
   if (!/^---\s*$/m.test(content))    errs.push('missing YAML frontmatter');
-  if (!/^code:\s+wize-/m.test(content)) errs.push('missing or invalid "code:" prefix');
+  if (!/^code:\s+wize(-|$)/m.test(content)) errs.push('missing or invalid "code:" prefix');
   if (!/^name:/m.test(content))      errs.push('missing "name:"');
   if (!/^owner:/m.test(content) && !/^module:/m.test(content)) errs.push('missing "owner:" or "module:"');
+  if (!/^description:/m.test(content)) errs.push('missing "description:"');
   return errs;
 }