wizz-method 2.17.2 → 2.19.0

package/src/skills-lib/wizz-huashu-design/scripts/test_scripts.py

@@ -0,0 +1,209 @@
+"""Testes (unittest, stdlib) das partes puras de fetch_images.py e verify.py.
+
+Rede e browser ficam de fora: a API da Wikimedia e o download são trocados por
+mocks. Rodam via `python3 -m unittest discover` (test/test-python-skills.js).
+"""
+import contextlib
+import io
+import os
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import fetch_images  # noqa: E402
+import verify  # noqa: E402
+
+
+class FakeResponse:
+    """Resposta mínima de urlopen usada como context manager."""
+
+    def __init__(self, payload=b"IMG"):
+        self._payload = payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+    def read(self):
+        return self._payload
+
+
+def page(title, thumb=None, url=None, lic="CC BY-SA 4.0", artist="<a href='x'>Ana</a> Silva"):
+    info = {
+        "descriptionurl": "https://commons.example/" + title,
+        "extmetadata": {"LicenseShortName": {"value": lic}, "Artist": {"value": artist}},
+    }
+    if thumb:
+        info["thumburl"] = thumb
+    if url:
+        info["url"] = url
+    return {"title": title, "imageinfo": [info]}
+
+
+class SafeNameTest(unittest.TestCase):
+    def test_replaces_unsafe_chars(self):
+        self.assertEqual(fetch_images._safe("Petronas Towers/KL"), "Petronas_Towers_KL")
+
+    def test_keeps_word_chars_dash_dot(self):
+        self.assertEqual(fetch_images._safe("a-b.c_d"), "a-b.c_d")
+
+    def test_truncates_to_60(self):
+        self.assertEqual(len(fetch_images._safe("x" * 200)), 60)
+
+
+class FetchTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.out = self.tmp.name
+
+    def run_fetch(self, pages, query="Langkawi beach", count=2, width=1600, urlopen=None):
+        data = {"query": {"pages": pages}}
+        stack = contextlib.ExitStack()
+        stack.enter_context(mock.patch.object(fetch_images, "_api_get", return_value=data))
+        opener = urlopen or (lambda req, timeout=0: FakeResponse())
+        stack.enter_context(mock.patch.object(fetch_images.urllib.request, "urlopen", side_effect=opener))
+        with stack:
+            buf = io.StringIO()
+            with contextlib.redirect_stdout(buf), contextlib.redirect_stderr(io.StringIO()):
+                got = fetch_images.fetch(query, self.out, count, width)
+        return got, buf.getvalue()
+
+    def test_downloads_thumb_and_prints_license_and_clean_artist(self):
+        pages = {"1": page("File:Beach one.jpg", thumb="https://up.example/t/beach.jpg?x=1")}
+        got, out = self.run_fetch(pages)
+        self.assertEqual(len(got), 1)
+        self.assertTrue(os.path.exists(got[0]))
+        self.assertTrue(got[0].startswith(self.out))
+        self.assertTrue(got[0].endswith(".jpg"), "extensão vem da URL sem a query string")
+        self.assertIn("CC BY-SA 4.0", out)
+        self.assertIn("Ana Silva", out)
+        self.assertNotIn("<a", out, "tags HTML do autor são removidas")
+        self.assertIn("https://commons.example/File:Beach one.jpg", out)
+
+    def test_filename_has_query_and_title_without_file_prefix(self):
+        got, _ = self.run_fetch({"1": page("File:Nice view.png", thumb="https://up.example/x.png")}, query="Petronas Towers")
+        name = os.path.basename(got[0])
+        self.assertTrue(name.startswith("Petronas_Towers_"), name)
+        self.assertNotIn("File_", name)
+        self.assertTrue(name.endswith(".png"))
+
+    def test_falls_back_to_url_when_no_thumb_and_default_ext_jpg(self):
+        got, _ = self.run_fetch({"1": page("File:a", url="https://up.example/noext")})
+        self.assertEqual(len(got), 1)
+        self.assertTrue(got[0].endswith(".jpg"))
+
+    def test_skips_pages_without_any_image_url(self):
+        got, _ = self.run_fetch({"1": page("File:nada")})
+        self.assertEqual(got, [])
+
+    def test_respects_count(self):
+        pages = {str(i): page(f"File:img{i}.jpg", thumb=f"https://up.example/{i}.jpg") for i in range(5)}
+        got, _ = self.run_fetch(pages, count=2)
+        self.assertEqual(len(got), 2)
+
+    def test_missing_metadata_uses_question_mark(self):
+        bare = {"title": "File:x.jpg", "imageinfo": [{"thumburl": "https://up.example/x.jpg"}]}
+        _, out = self.run_fetch({"1": bare})
+        self.assertIn("| ? | ?", out)
+
+    def test_api_failure_returns_empty_list(self):
+        with mock.patch.object(fetch_images, "_api_get", side_effect=OSError("boom")):
+            with contextlib.redirect_stderr(io.StringIO()) as err:
+                got = fetch_images.fetch("q", self.out, 2, 800)
+        self.assertEqual(got, [])
+        self.assertIn("FAIL search", err.getvalue())
+
+    def test_no_pages_returns_empty_and_warns(self):
+        with mock.patch.object(fetch_images, "_api_get", return_value={"query": {}}):
+            with contextlib.redirect_stderr(io.StringIO()) as err:
+                got = fetch_images.fetch("q", self.out, 2, 800)
+        self.assertEqual(got, [])
+        self.assertIn("EMPTY", err.getvalue())
+
+    def test_download_failure_is_skipped_not_fatal(self):
+        def opener(req, timeout=0):
+            raise OSError("download caiu")
+
+        got, _ = self.run_fetch({"1": page("File:a.jpg", thumb="https://up.example/a.jpg")}, urlopen=opener)
+        self.assertEqual(got, [])
+
+    def test_requests_send_compliant_user_agent_and_width(self):
+        seen = {}
+
+        def fake_api(params):
+            seen.update(params)
+            return {"query": {"pages": {}}}
+
+        with mock.patch.object(fetch_images, "_api_get", side_effect=fake_api):
+            with contextlib.redirect_stderr(io.StringIO()):
+                fetch_images.fetch("Georgetown", self.out, 3, 1200)
+        self.assertEqual(seen["gsrsearch"], "Georgetown")
+        self.assertEqual(seen["gsrlimit"], 3)
+        self.assertEqual(seen["iiurlwidth"], 1200)
+        self.assertEqual(seen["gsrnamespace"], 6)
+        self.assertIn("huashu-design", fetch_images.UA)
+
+    def test_module_clears_proxy_env(self):
+        for key in ("ALL_PROXY", "HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "all_proxy"):
+            self.assertNotIn(key, os.environ)
+
+
+class MainTest(unittest.TestCase):
+    def run_main(self, argv, fetch_result):
+        with mock.patch.object(sys, "argv", ["fetch_images.py", *argv]):
+            with mock.patch.object(fetch_images, "fetch", return_value=fetch_result) as fetch:
+                with contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()):
+                    try:
+                        fetch_images.main()
+                        code = None
+                    except SystemExit as exc:
+                        code = exc.code
+        return code, fetch
+
+    def test_exit_1_when_nothing_downloaded(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            code, _ = self.run_main(["--query", "a", "b", "--out", os.path.join(tmp, "img")], [])
+        self.assertEqual(code, 1)
+
+    def test_success_creates_out_dir_and_passes_defaults(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            out = os.path.join(tmp, "novo", "img")
+            code, fetch = self.run_main(["--query", "a", "b", "--out", out], ["f.jpg"])
+            self.assertIsNone(code)
+            self.assertTrue(os.path.isdir(out))
+        self.assertEqual(fetch.call_count, 2, "um fetch por query")
+        fetch.assert_any_call("a", out, 2, 1600)
+
+    def test_custom_count_and_width(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            out = os.path.join(tmp, "img")
+            _, fetch = self.run_main(["--query", "x", "--out", out, "--count", "4", "--width", "800"], ["f"])
+        fetch.assert_called_once_with("x", out, 4, 800)
+
+    def test_requires_query_and_out(self):
+        with mock.patch.object(sys, "argv", ["fetch_images.py"]):
+            with contextlib.redirect_stderr(io.StringIO()):
+                with self.assertRaises(SystemExit) as ctx:
+                    fetch_images.main()
+        self.assertEqual(ctx.exception.code, 2)
+
+
+class ParseViewportTest(unittest.TestCase):
+    def test_parses_width_x_height(self):
+        self.assertEqual(verify.parse_viewport("1440x900"), {"width": 1440, "height": 900})
+        self.assertEqual(verify.parse_viewport("375x667"), {"width": 375, "height": 667})
+
+    def test_rejects_malformed(self):
+        for bad in ("1440", "axb", "1x2x3", ""):
+            with self.assertRaises(ValueError, msg=bad):
+                verify.parse_viewport(bad)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/src/skills-lib/wizz-huashu-design/scripts/tts-doubao.mjs

@@ -28,8 +28,7 @@ import { randomUUID } from 'node:crypto';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const SKILL_ROOT = path.resolve(__dirname, '..');
 
-function loadEnv() {
-  const envPath = path.join(SKILL_ROOT, '.env');
+function loadEnv(envPath = path.join(SKILL_ROOT, '.env')) {
   if (!fs.existsSync(envPath)) return;
   const text = fs.readFileSync(envPath, 'utf8');
   for (const line of text.split('\n')) {
@@ -45,7 +44,6 @@ function loadEnv() {
     if (!(key in process.env)) process.env[key] = val;
   }
 }
-loadEnv();
 
 function parseArgs(argv) {
   const args = { speed: '1.0', encoding: 'mp3' };
@@ -90,16 +88,9 @@ function getDuration(filePath) {
   }
 }
 
-async function tts({ text, voice, speed, encoding }) {
-  const apiKey = process.env.DOUBAO_TTS_API_KEY;
-  const cluster = process.env.DOUBAO_TTS_CLUSTER || 'volcano_icl';
-  const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v1/tts';
-  const voiceId = voice || process.env.DOUBAO_TTS_VOICE_ID;
-
-  if (!apiKey) throw new Error('缺 DOUBAO_TTS_API_KEY（检查 .env）');
-  if (!voiceId) throw new Error('缺 DOUBAO_TTS_VOICE_ID（检查 .env 或用 --voice 传）');
-
-  const body = {
+/** Corpo da requisição à API do Doubao (puro, sem rede). */
+function buildTtsBody({ cluster, voiceId, encoding, speed, text, reqid = randomUUID() }) {
+  return {
     app: { cluster },
     user: { uid: 'wizz-huashu-design' },
     audio: {
@@ -108,11 +99,36 @@ async function tts({ text, voice, speed, encoding }) {
       speed_ratio: parseFloat(speed),
     },
     request: {
-      reqid: randomUUID(),
+      reqid,
       text,
       operation: 'query',
     },
   };
+}
+
+/** Valida a resposta JSON do Doubao e devolve o áudio decodificado (Buffer). */
+function parseTtsResponse(json) {
+  // 豆包标准返回：{ code, message, data: "<base64 audio>", ... }
+  // code === 3000 表示成功
+  if (json.code !== undefined && json.code !== 3000) {
+    throw new Error(`API 返回错误 code=${json.code} msg=${json.message || JSON.stringify(json)}`);
+  }
+  if (!json.data) {
+    throw new Error(`API 响应无 data 字段：${JSON.stringify(json).slice(0, 500)}`);
+  }
+  return Buffer.from(json.data, 'base64');
+}
+
+async function tts({ text, voice, speed, encoding }) {
+  const apiKey = process.env.DOUBAO_TTS_API_KEY;
+  const cluster = process.env.DOUBAO_TTS_CLUSTER || 'volcano_icl';
+  const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v1/tts';
+  const voiceId = voice || process.env.DOUBAO_TTS_VOICE_ID;
+
+  if (!apiKey) throw new Error('缺 DOUBAO_TTS_API_KEY（检查 .env）');
+  if (!voiceId) throw new Error('缺 DOUBAO_TTS_VOICE_ID（检查 .env 或用 --voice 传）');
+
+  const body = buildTtsBody({ cluster, voiceId, encoding, speed, text });
 
   const res = await fetch(endpoint, {
     method: 'POST',
@@ -128,16 +144,7 @@ async function tts({ text, voice, speed, encoding }) {
     throw new Error(`HTTP ${res.status}: ${errText.slice(0, 500)}`);
   }
 
-  const json = await res.json();
-  // 豆包标准返回：{ code, message, data: "<base64 audio>", ... }
-  // code === 3000 表示成功
-  if (json.code !== undefined && json.code !== 3000) {
-    throw new Error(`API 返回错误 code=${json.code} msg=${json.message || JSON.stringify(json)}`);
-  }
-  if (!json.data) {
-    throw new Error(`API 响应无 data 字段：${JSON.stringify(json).slice(0, 500)}`);
-  }
-  return Buffer.from(json.data, 'base64');
+  return parseTtsResponse(await res.json());
 }
 
 async function main() {
@@ -178,7 +185,14 @@ async function main() {
   console.log(JSON.stringify(result));
 }
 
-main().catch((err) => {
-  console.error(`TTS 失败：${err.message}`);
-  process.exit(1);
-});
+// Só executa quando chamado como script; importar o módulo (testes) não lê .env nem chama a API.
+const isMain = process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  loadEnv();
+  main().catch((err) => {
+    console.error(`TTS 失败：${err.message}`);
+    process.exit(1);
+  });
+}
+
+export { parseArgs, loadEnv, buildTtsBody, parseTtsResponse };

package/src/skills-lib/wizz-ig-profile-optimizer/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sergey Bulaev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/skills-lib/wizz-ig-profile-optimizer/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: wizz-ig-profile-optimizer
+description: Audits and rewrites an Instagram profile so a visitor decides to follow. Captures the public profile by the @ (photo, NAME field, @, bio, link, first grid rows), scores the nine parts (photo, NAME, @, bio, link, category, highlights, first nine of the grid, pinned posts) against the profile's goal (grow, sell, land clients, authority), and delivers a scorecard, fixes ranked by impact, before and after rewrites inside Instagram's limits (bio 150, NAME 30), a highlights plan and the pins chosen by real metrics when Buffer is connected. Use when someone asks to review, fix or optimise an Instagram profile or bio. Triggers - arruma minha bio, revisa meu perfil do instagram, o que colocar nos destaques, quais posts fixar, meu perfil não converte seguidor. Does not write captions or scripts (that is wizz-social-content) and does not design the highlight covers (that is wizz-canvas-design).
+---
+
+# wizz-ig-profile-optimizer: the header that earns the follow
+
+The follow decision happens on the header and the first rows of the grid: photo, NAME, bio, link, then the grid at a glance. This skill reads that as a stranger would, scores it, and rewrites what fails.
+
+All text delivered is Brazilian Portuguese with "você", and no em dash in anything public (bio, NAME, highlight names, pinned captions).
+
+## Inputs
+
+- The @ (preferred), or a screenshot of the header and the first grid rows.
+- The goal of the profile: **crescer**, **vender**, **conseguir cliente** or **autoridade**. It changes the link, the bio's last line and the pins. Ask once if it is not clear.
+
+## Steps
+
+1. **Read the profile.** `scripts/capture-profile.sh <@> <out_dir>` (out_dir under `_wizz-output/`) saves `profile.png` and `profile.json` (NAME, bio and link as text, follower and post counts). **Open the image.** Logged out, Instagram may hide highlights, the category label and the pin marks: ask for a screenshot of those parts instead of guessing them.
+2. **Pull what the Method already knows**, before judging:
+   - Positioning, audience and tone from the project's Cérebro (`/wizz-cerebro ver`).
+   - Highlights already made in the project (for example a `posts/highlights/` folder).
+   - The offer from `wizz-offer-forge`, when one exists: the link and one pin depend on it.
+   - Real performance: with Buffer connected, `get_aggregated_post_metrics` and the post list give the best posts by saves, shares and reach. Without it, ask which posts did best; never pick pins by guess.
+3. **Score the nine parts** (table below): passa / ajustar / reprova, one line of reason each.
+4. **Rewrite what fails**, in order of impact: NAME, bio, pins first.
+   - **NAME** = name + the word people type in search, up to 30 characters ("Ana Souza | Nutrição"). The NAME field is what Instagram search indexes, not the @.
+   - **Bio** up to 150 = who it helps + what it posts about + one proof or specific. Lead with what the follower gets, not the job title. One anchor emoji at most; line breaks are fine.
+   - **Link**: one, matched to the goal (offer, booking, newsletter); a link hub only when several are really needed.
+   - **Category** (business or creator account): one label that reinforces the bio.
+   - **Highlights**: 4 to 6, left to right in the order of the visitor's next question (Comece aqui, Resultados, Oferta, Dúvidas, Sobre), names short enough to show whole, covers in one style.
+   - **First nine**: judged as a set (consistent look, readable at a glance, range without chaos); say which tiles to move or replace.
+   - **Pins** (up to 3), by goal: a top performer, the offer, a "pra quem é" post.
+5. **Check every rewrite**: `node scripts/limits.mjs --bio "..." --name "..." [--handle "..."] [--highlight "..."]`. It fails on bio over 150, NAME over 30, a NAME with no search word, an @ with invalid characters, a highlight name that gets cut, an em dash, or AI words. Nothing is delivered until it passes. Then run bio and NAME through `wizz-humanizer`.
+6. **Header test.** Reading only photo + NAME + bio + link + first grid row: would a stranger know who this is for and follow? Answer yes or no, and why.
+
+## Scorecard
+
+| # | Part | Passes when |
+|---|---|---|
+| 1 | Foto | face (or mark) fills the circle, recent, high contrast, readable small |
+| 2 | NOME | name + search word, up to 30 |
+| 3 | @ | short, matches the brand, no numbers or underscores when avoidable |
+| 4 | Bio | value + topic + proof in up to 150, no cliché opener, no emoji storm |
+| 5 | Link | one, goal-matched; the top link carries the click |
+| 6 | Categoria | set, one niche label that reinforces the bio |
+| 7 | Destaques | 4 to 6, ordered by the visitor's next question, one cover style, names not cut |
+| 8 | 9 primeiras | consistent look, readable, shows range; weak tiles moved or replaced |
+| 9 | Fixados | up to 3, each the best proof for the goal, chosen by metrics |
+
+## Delivery
+
+```
+👤 PERFIL LIDO: @ · seguidores · posts · objetivo · como foi lido (captura / print)
+📊 PLACAR: 9 linhas, passa | ajustar | reprova + motivo
+🔧 CORREÇÕES POR IMPACTO: lista curta
+✍️ ANTES → DEPOIS: NOME, bio, link, categoria (só o que reprovou), com a contagem do limits.mjs
+⭐ DESTAQUES: ordem, nomes, o que vai em cada um
+📌 FIXADOS: 3 posts + por quê (métrica)
+🧪 TESTE DO CABEÇALHO: sim/não + motivo
+```
+
+## Hand-off
+
+- Highlight covers and the pinned posts' art: `wizz-canvas-design`.
+- Captions of the pinned posts: `wizz-social-content`.
+- The offer behind the link: `wizz-offer-forge`.
+
+## Hard rules
+
+- Never ship a bio or NAME that fails `limits.mjs`, and never a truncated highlight name.
+- Never invent proof for the bio (a number, a client count, a result): ask, or leave a slot.
+- Never log in to Instagram on the user's behalf; a logged-out capture plus their screenshots is enough.
+- Highlights and grid are judged as sets: fix order and consistency, not only single items.

package/src/skills-lib/wizz-ig-profile-optimizer/scripts/capture-profile.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Captures a public Instagram profile as a logged-out visitor sees it, with agent-browser.
+# Usage: capture-profile.sh <@handle or handle> <out_dir>
+#   → <out_dir>/profile.png (phone-width, header + first rows of the grid)
+#     <out_dir>/profile.json (page title, meta description with counts, header text: NAME, bio, link)
+# Logged out, Instagram may hide highlights, the category label and the pin marks: ask for a
+# screenshot of those. Exit 2 = usage or missing tool; 1 = page did not load.
+set -euo pipefail
+[ $# -eq 2 ] || { echo "uso: capture-profile.sh <@perfil> <pasta de saída>" >&2; exit 2; }
+handle="${1#@}"; out="$2"
+[[ "$handle" =~ ^[A-Za-z0-9._]{1,30}$ ]] || { echo "@ inválido: $1" >&2; exit 2; }
+command -v agent-browser >/dev/null || { echo "falta agent-browser no PATH (skill wizz-agent-browser)" >&2; exit 2; }
+mkdir -p "$out"
+trap 'agent-browser close >/dev/null 2>&1 || true' EXIT
+
+agent-browser set viewport 430 1400 >/dev/null
+agent-browser open "https://www.instagram.com/$handle/" >/dev/null
+agent-browser wait 3000 >/dev/null
+# Cookie banner (pt or en), then Escape closes the sign-up prompt that covers the grid.
+agent-browser find text "Recusar cookies opcionais" click >/dev/null 2>&1 \
+  || agent-browser find text "Decline optional cookies" click >/dev/null 2>&1 || true
+agent-browser wait 1500 >/dev/null
+agent-browser press Escape >/dev/null 2>&1 || true
+agent-browser wait 800 >/dev/null
+
+agent-browser eval 'JSON.stringify({
+  title: document.title,
+  description: document.querySelector("meta[property=\"og:description\"]")?.content ?? null,
+  header: document.querySelector("header")?.innerText ?? null
+})' > "$out/profile.raw"
+node -e '
+const fs = require("node:fs");
+const [raw, out] = process.argv.slice(1);
+let data = JSON.parse(fs.readFileSync(raw, "utf8"));
+if (typeof data === "string") data = JSON.parse(data);
+if (!data.header) { console.error("perfil não carregou (privado, inexistente ou bloqueado)"); process.exit(1); }
+fs.writeFileSync(out, JSON.stringify(data, null, 1));
+' "$out/profile.raw" "$out/profile.json"
+rm -f "$out/profile.raw"
+agent-browser screenshot "$out/profile.png" >/dev/null
+echo "ok: $out/profile.json + profile.png"

package/src/skills-lib/wizz-ig-profile-optimizer/scripts/limits.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// Checks Instagram profile text against the platform limits and the Wizz text rules.
+//   node limits.mjs --bio "<text>" --name "<text>" [--handle "<text>"] [--highlight "<name>" ...] [--json]
+// Exit 0 = everything fits; 1 = something fails (listed); 2 = usage.
+// Counting is conservative: UTF-16 units, so an emoji counts as 2. Instagram's own counter may be
+// more lenient; a text that passes here fits there.
+
+const LIMITS = { bio: 150, name: 30, handle: 30 };
+// Not a platform limit: above this a highlight name gets cut under the circle on most phones.
+const HIGHLIGHT_VISIBLE = 15;
+const AI_WORDS = /\b(alavanc\w*|fundamentalmente|potencializ\w*|eleve|elevar|revolucion\w*|game[- ]changer|leverage|elevate)\b/i;
+const EM_DASH = /—/;
+const HANDLE_CHARS = /^[A-Za-z0-9._]+$/;
+
+function parse(argv) {
+  const options = { highlights: [], json: false };
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    if (flag === '--json') options.json = true;
+    else if (flag === '--highlight') options.highlights.push(argv[++i] ?? '');
+    else if (['--bio', '--name', '--handle'].includes(flag)) options[flag.slice(2)] = argv[++i] ?? '';
+    else usage(`unknown argument: ${flag}`);
+  }
+  if (options.bio === undefined && options.name === undefined && options.handle === undefined && options.highlights.length === 0) {
+    usage('nothing to check');
+  }
+  return options;
+}
+
+function usage(message) {
+  process.stderr.write(`limits: ${message}\nusage: node limits.mjs --bio "..." --name "..." [--handle "..."] [--highlight "..."] [--json]\n`);
+  process.exit(2);
+}
+
+const graphemes = (text) => [...new Intl.Segmenter('pt-BR', { granularity: 'grapheme' }).segment(text)].length;
+
+function checkField(field, text, limit) {
+  const problems = [];
+  if (text.length > limit) problems.push(`${text.length} caracteres (limite ${limit}, emoji conta 2)`);
+  if (EM_DASH.test(text)) problems.push('travessão (—) em texto público');
+  const ai = text.match(AI_WORDS);
+  if (ai) problems.push(`palavra de IA: "${ai[0]}"`);
+  return { field, text, length: text.length, graphemes: graphemes(text), limit, ok: problems.length === 0, problems };
+}
+
+function check(options) {
+  const results = [];
+  if (options.bio !== undefined) results.push(checkField('bio', options.bio, LIMITS.bio));
+  if (options.name !== undefined) {
+    const name = checkField('nome', options.name, LIMITS.name);
+    if (!/[|·,\-]/.test(options.name) && options.name.trim().split(/\s+/).length < 3) {
+      name.problems.push('NOME sem palavra-chave de busca (ex.: "Ana Souza | Nutrição")');
+      name.ok = false;
+    }
+    results.push(name);
+  }
+  if (options.handle !== undefined) {
+    const handle = checkField('@', options.handle.replace(/^@/, ''), LIMITS.handle);
+    if (!HANDLE_CHARS.test(handle.text)) {
+      handle.problems.push('@ só aceita letras, números, ponto e sublinhado');
+      handle.ok = false;
+    }
+    results.push(handle);
+  }
+  for (const highlight of options.highlights) {
+    const result = checkField('destaque', highlight, HIGHLIGHT_VISIBLE);
+    result.problems = result.problems.map((p) => p.replace(/\(limite \d+, emoji conta 2\)/, `(acima de ${HIGHLIGHT_VISIBLE} corta embaixo do círculo)`));
+    results.push(result);
+  }
+  return results;
+}
+
+const options = parse(process.argv.slice(2));
+const results = check(options);
+if (options.json) process.stdout.write(`${JSON.stringify(results, null, 2)}\n`);
+else {
+  for (const r of results) {
+    const mark = r.ok ? 'ok ' : 'ERRO';
+    process.stdout.write(`${mark} ${r.field}: ${r.length}/${r.limit}${r.problems.length ? ' · ' + r.problems.join(' · ') : ''}\n`);
+  }
+}
+process.exit(results.every((r) => r.ok) ? 0 : 1);

package/src/skills-lib/wizz-inicio-de-projeto/SKILL.md

@@ -87,7 +87,7 @@ Before the first file of a new project, and on the first use of the method in an
 
 1. `node _wizz/hooks/wizz-arrumar.js layout` proposes it from what already exists (types: `codigo`, `scripts`, `dados`, `docs`, `midia`, `arquivo`; a type mapped to `.` lives at the root, e.g. a Next.js app at the root).
 2. Show the proposal to the owner in **one line** and record it with `node _wizz/hooks/wizz-arrumar.js layout --gravar [tipo=pasta ...]`. It creates each new folder with a short README.
-3. An existing project with loose files at the root: `wizz-arrumar.js planejar` writes a `.tsv` manifest; review it and run `wizz-arrumar.js aplicar <manifesto> --testes "<test command>" --refs <auto-memory dir>`. It moves, rewrites references in code, docs and memories, runs the tests before and after, and writes `desfazer.sh`.
+3. An existing project with loose files at the root: `wizz-arrumar.js planejar` writes a `.tsv` manifest; review it and run `wizz-arrumar.js aplicar <manifesto> --testes "<test command>" --refs <auto-memory dir>`. It moves, rewrites references in code, docs and memories, runs the tests before and after, and writes an undo: `wizz-arrumar.js desfazer <run folder>` on any OS, or the `desfazer.sh` (`desfazer.cmd` on Windows) shortcut. `--testes` accepts only known test runners (npm/pnpm/yarn/bun test, npx vitest|jest, pytest, go/cargo/make test); any other command needs `--testes-livre`.
 
 From then on the `wizz-artifact-guard.js` hook points out any file born loose at the root and the command that moves it. Full duty in the wizz module's `_shared/organizacao.md`.
 

package/src/skills-lib/wizz-launch-readiness/SKILL.md

@@ -8,8 +8,8 @@ description: >
   ready to launch?", "pre-launch audit", "broad release checklist", "what's left
   before going to production", considering the whole project (not just the site). Output: a diagnosis
   prioritized by severity (red blocks launch, orange high, yellow medium, green ok), never
-  blind fixing. Different from security-audit-pentest (hunts vulnerabilities with proof of exploitation)
-  and site-launch-kit (executes the 15 rounds for ONE site): this DIAGNOSES the whole project and points to
+  blind fixing. Different from wizz-security-audit-pentest (hunts vulnerabilities with proof of exploitation)
+  and wizz-site-launch-kit (executes the 15 rounds for ONE site): this DIAGNOSES the whole project and points to
   the right fix owner per finding. Persists the result in a dated section of project-context.md.
 ---
 
@@ -17,7 +17,7 @@ description: >
 
 Seven checking areas, each a closed pass: single scope, standardized output, its own cutoff rule. At the end, a merge step consolidates everything into a prioritized diagnosis and writes the summary to the project's `project-context.md`.
 
-This is not a build skill (that's `wizz-premium-landing-ui-researcher` / `wizz-taste-skill` / `wizz-agent-dev`), not the vulnerability-hunting methodology (that's `security-audit-pentest`), and it doesn't execute the 15 corrective rounds for a site (that's `site-launch-kit`): this is a broad, prioritized diagnosis to decide whether it's ready to launch.
+This is not a build skill (that's `wizz-premium-landing-ui-researcher` / `wizz-taste-skill` / `wizz-agent-dev`), not the vulnerability-hunting methodology (that's `wizz-security-audit-pentest`), and it doesn't execute the 15 corrective rounds for a site (that's `wizz-site-launch-kit`): this is a broad, prioritized diagnosis to decide whether it's ready to launch.
 
 ## Stage gate (read BEFORE running)
 
@@ -25,7 +25,7 @@ Read the project's stage: `grep -m1 '^stage:' {project-root}/**/project-context.
 
 - **`mvp` or `production`:** run the full audit. This is exactly what the skill exists for.
 - **`prototype` or no `project-context.md` file:** stop before running. Reply that the project is still too early for a launch audit (little or nothing built yet to audit) and point to the right path for this stage: `wizz-inicio-de-projeto`, `wizz-forge-idea`, or `wizz-decision-maker` to define the product first. Only proceed if the user explicitly insists, and in that case warn that the findings will come back full of PENDING ITEMS due to lack of built surface.
-- **`maintenance`:** normally not the use case (product already launched, running). Only makes sense if the request is about a NEW batch starting from scratch (a big feature, a new product within the same repo): confirm this before running; otherwise, point to `security-audit-pentest` (periodic pentest) or the `wizz-router`'s "360° Audit" mode (broad audit of a codebase already in production, not about a launch event).
+- **`maintenance`:** normally not the use case (product already launched, running). Only makes sense if the request is about a NEW batch starting from scratch (a big feature, a new product within the same repo): confirm this before running; otherwise, point to `wizz-security-audit-pentest` (periodic pentest) or the `wizz-router`'s "360° Audit" mode (broad audit of a codebase already in production, not about a launch event).
 
 ## Common contract (applies to all 7 areas)
 
@@ -81,8 +81,8 @@ After the 7:
 
 ## Relationship with other skills
 
-- **`security-audit-pentest`**: security deep dive. Area 02 here is a light sweep (exposed surface); findings that need proof of exploitation ("how it's exploited") go to `security-audit-pentest`, they aren't redone here.
-- **`site-launch-kit`**: when the surface of the finding is a SITE (CTA, social proof, Open Graph, local schema, robots/sitemap, site LGPD, measurement), the fix owner is `site-launch-kit`. This skill doesn't repeat the 15 rounds: it only points to which round resolves the finding.
+- **`wizz-security-audit-pentest`**: security deep dive. Area 02 here is a light sweep (exposed surface); findings that need proof of exploitation ("how it's exploited") go to `wizz-security-audit-pentest`, they aren't redone here.
+- **`wizz-site-launch-kit`**: when the surface of the finding is a SITE (CTA, social proof, Open Graph, local schema, robots/sitemap, site LGPD, measurement), the fix owner is `wizz-site-launch-kit`. This skill doesn't repeat the 15 rounds: it only points to which round resolves the finding.
 - **`wizz-seo-audit`**: broad ranking/traffic/Core Web Vitals diagnosis. Area 03 here is only basic indexability (can the site be found), not a full SEO audit.
 - **`wizz-router`'s "360° Audit" mode**: a broad audit of a project already in production, by technical area (code, database, design, growth...), without the "we're about to launch" framing or the stage gate. Use wizz-launch-readiness for the launch event; use 360° mode for a mature project's general health.
 
@@ -90,5 +90,5 @@ After the 7:
 
 - Doesn't fix anything on its own; it points to the fix owner.
 - Doesn't decide GO/NO-GO on behalf of the project owner; delivers the prioritized reading.
-- Doesn't replace `security-audit-pentest` for deep security or `site-launch-kit` for executing the 15 site rounds.
+- Doesn't replace `wizz-security-audit-pentest` for deep security or `wizz-site-launch-kit` for executing the 15 site rounds.
 - Doesn't run on a project with no built surface (discovery/ideation stage).

package/src/skills-lib/wizz-launch-readiness/references/02-seguranca.md

@@ -1,6 +1,6 @@
 # Area 02 · Security
 
-A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities with proof of exploitation. A finding that requires a concrete payload to prove (mass assignment, IDOR, injection) is NOT dug into here: log the suspicion as 🟠 and point to `security-audit-pentest` as the owner of the deep dive.
+A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities with proof of exploitation. A finding that requires a concrete payload to prove (mass assignment, IDOR, injection) is NOT dug into here: log the suspicion as 🟠 and point to `wizz-security-audit-pentest` as the owner of the deep dive.
 
 ## Objective checks
 
@@ -11,11 +11,11 @@ A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities wit
 5. **CORS too open.** `Access-Control-Allow-Origin: *` on an API that accepts credentials/tokens is 🔴; without credentials is 🟡.
 6. **Rate limiting missing on a sensitive route.** Login, signup, password recovery, or an endpoint that costs money (AI, SMS, email) with no limit at all is 🟠; point to `wizz-web-security` as the fixer.
 7. **Dependency with a known critical CVE on the production path.** Reinforces finding #7 from area 01 if it applies specifically to an auth/crypto lib: escalate to 🔴.
-8. **Unproven indication of mass assignment, IDOR, or injection.** An update field that accepts the client's entire object with no allowlist, or a query built by string concatenation: log as 🟠 "suspicion, needs proof of exploitation" and point to `security-audit-pentest`.
+8. **Unproven indication of mass assignment, IDOR, or injection.** An update field that accepts the client's entire object with no allowlist, or a query built by string concatenation: log as 🟠 "suspicion, needs proof of exploitation" and point to `wizz-security-audit-pentest`.
 
 ## Cutoff rule
 
-This area NEVER delivers "how to exploit it" with a real payload: that is exclusively `security-audit-pentest`'s scope. If during the sweep you'd already have the payload ready, still don't include it here: log the suspicion and the reference, to avoid duplicating the two skills' output format.
+This area NEVER delivers "how to exploit it" with a real payload: that is exclusively `wizz-security-audit-pentest`'s scope. If during the sweep you'd already have the payload ready, still don't include it here: log the suspicion and the reference, to avoid duplicating the two skills' output format.
 
 ## Output format