wizz-method 2.18.0 → 2.19.0

package/src/skills-lib/wizz-huashu-design/scripts/test_scripts.py

@@ -0,0 +1,209 @@
+"""Testes (unittest, stdlib) das partes puras de fetch_images.py e verify.py.
+
+Rede e browser ficam de fora: a API da Wikimedia e o download são trocados por
+mocks. Rodam via `python3 -m unittest discover` (test/test-python-skills.js).
+"""
+import contextlib
+import io
+import os
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import fetch_images  # noqa: E402
+import verify  # noqa: E402
+
+
+class FakeResponse:
+    """Resposta mínima de urlopen usada como context manager."""
+
+    def __init__(self, payload=b"IMG"):
+        self._payload = payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+    def read(self):
+        return self._payload
+
+
+def page(title, thumb=None, url=None, lic="CC BY-SA 4.0", artist="<a href='x'>Ana</a> Silva"):
+    info = {
+        "descriptionurl": "https://commons.example/" + title,
+        "extmetadata": {"LicenseShortName": {"value": lic}, "Artist": {"value": artist}},
+    }
+    if thumb:
+        info["thumburl"] = thumb
+    if url:
+        info["url"] = url
+    return {"title": title, "imageinfo": [info]}
+
+
+class SafeNameTest(unittest.TestCase):
+    def test_replaces_unsafe_chars(self):
+        self.assertEqual(fetch_images._safe("Petronas Towers/KL"), "Petronas_Towers_KL")
+
+    def test_keeps_word_chars_dash_dot(self):
+        self.assertEqual(fetch_images._safe("a-b.c_d"), "a-b.c_d")
+
+    def test_truncates_to_60(self):
+        self.assertEqual(len(fetch_images._safe("x" * 200)), 60)
+
+
+class FetchTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.out = self.tmp.name
+
+    def run_fetch(self, pages, query="Langkawi beach", count=2, width=1600, urlopen=None):
+        data = {"query": {"pages": pages}}
+        stack = contextlib.ExitStack()
+        stack.enter_context(mock.patch.object(fetch_images, "_api_get", return_value=data))
+        opener = urlopen or (lambda req, timeout=0: FakeResponse())
+        stack.enter_context(mock.patch.object(fetch_images.urllib.request, "urlopen", side_effect=opener))
+        with stack:
+            buf = io.StringIO()
+            with contextlib.redirect_stdout(buf), contextlib.redirect_stderr(io.StringIO()):
+                got = fetch_images.fetch(query, self.out, count, width)
+        return got, buf.getvalue()
+
+    def test_downloads_thumb_and_prints_license_and_clean_artist(self):
+        pages = {"1": page("File:Beach one.jpg", thumb="https://up.example/t/beach.jpg?x=1")}
+        got, out = self.run_fetch(pages)
+        self.assertEqual(len(got), 1)
+        self.assertTrue(os.path.exists(got[0]))
+        self.assertTrue(got[0].startswith(self.out))
+        self.assertTrue(got[0].endswith(".jpg"), "extensão vem da URL sem a query string")
+        self.assertIn("CC BY-SA 4.0", out)
+        self.assertIn("Ana Silva", out)
+        self.assertNotIn("<a", out, "tags HTML do autor são removidas")
+        self.assertIn("https://commons.example/File:Beach one.jpg", out)
+
+    def test_filename_has_query_and_title_without_file_prefix(self):
+        got, _ = self.run_fetch({"1": page("File:Nice view.png", thumb="https://up.example/x.png")}, query="Petronas Towers")
+        name = os.path.basename(got[0])
+        self.assertTrue(name.startswith("Petronas_Towers_"), name)
+        self.assertNotIn("File_", name)
+        self.assertTrue(name.endswith(".png"))
+
+    def test_falls_back_to_url_when_no_thumb_and_default_ext_jpg(self):
+        got, _ = self.run_fetch({"1": page("File:a", url="https://up.example/noext")})
+        self.assertEqual(len(got), 1)
+        self.assertTrue(got[0].endswith(".jpg"))
+
+    def test_skips_pages_without_any_image_url(self):
+        got, _ = self.run_fetch({"1": page("File:nada")})
+        self.assertEqual(got, [])
+
+    def test_respects_count(self):
+        pages = {str(i): page(f"File:img{i}.jpg", thumb=f"https://up.example/{i}.jpg") for i in range(5)}
+        got, _ = self.run_fetch(pages, count=2)
+        self.assertEqual(len(got), 2)
+
+    def test_missing_metadata_uses_question_mark(self):
+        bare = {"title": "File:x.jpg", "imageinfo": [{"thumburl": "https://up.example/x.jpg"}]}
+        _, out = self.run_fetch({"1": bare})
+        self.assertIn("| ? | ?", out)
+
+    def test_api_failure_returns_empty_list(self):
+        with mock.patch.object(fetch_images, "_api_get", side_effect=OSError("boom")):
+            with contextlib.redirect_stderr(io.StringIO()) as err:
+                got = fetch_images.fetch("q", self.out, 2, 800)
+        self.assertEqual(got, [])
+        self.assertIn("FAIL search", err.getvalue())
+
+    def test_no_pages_returns_empty_and_warns(self):
+        with mock.patch.object(fetch_images, "_api_get", return_value={"query": {}}):
+            with contextlib.redirect_stderr(io.StringIO()) as err:
+                got = fetch_images.fetch("q", self.out, 2, 800)
+        self.assertEqual(got, [])
+        self.assertIn("EMPTY", err.getvalue())
+
+    def test_download_failure_is_skipped_not_fatal(self):
+        def opener(req, timeout=0):
+            raise OSError("download caiu")
+
+        got, _ = self.run_fetch({"1": page("File:a.jpg", thumb="https://up.example/a.jpg")}, urlopen=opener)
+        self.assertEqual(got, [])
+
+    def test_requests_send_compliant_user_agent_and_width(self):
+        seen = {}
+
+        def fake_api(params):
+            seen.update(params)
+            return {"query": {"pages": {}}}
+
+        with mock.patch.object(fetch_images, "_api_get", side_effect=fake_api):
+            with contextlib.redirect_stderr(io.StringIO()):
+                fetch_images.fetch("Georgetown", self.out, 3, 1200)
+        self.assertEqual(seen["gsrsearch"], "Georgetown")
+        self.assertEqual(seen["gsrlimit"], 3)
+        self.assertEqual(seen["iiurlwidth"], 1200)
+        self.assertEqual(seen["gsrnamespace"], 6)
+        self.assertIn("huashu-design", fetch_images.UA)
+
+    def test_module_clears_proxy_env(self):
+        for key in ("ALL_PROXY", "HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "all_proxy"):
+            self.assertNotIn(key, os.environ)
+
+
+class MainTest(unittest.TestCase):
+    def run_main(self, argv, fetch_result):
+        with mock.patch.object(sys, "argv", ["fetch_images.py", *argv]):
+            with mock.patch.object(fetch_images, "fetch", return_value=fetch_result) as fetch:
+                with contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()):
+                    try:
+                        fetch_images.main()
+                        code = None
+                    except SystemExit as exc:
+                        code = exc.code
+        return code, fetch
+
+    def test_exit_1_when_nothing_downloaded(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            code, _ = self.run_main(["--query", "a", "b", "--out", os.path.join(tmp, "img")], [])
+        self.assertEqual(code, 1)
+
+    def test_success_creates_out_dir_and_passes_defaults(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            out = os.path.join(tmp, "novo", "img")
+            code, fetch = self.run_main(["--query", "a", "b", "--out", out], ["f.jpg"])
+            self.assertIsNone(code)
+            self.assertTrue(os.path.isdir(out))
+        self.assertEqual(fetch.call_count, 2, "um fetch por query")
+        fetch.assert_any_call("a", out, 2, 1600)
+
+    def test_custom_count_and_width(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            out = os.path.join(tmp, "img")
+            _, fetch = self.run_main(["--query", "x", "--out", out, "--count", "4", "--width", "800"], ["f"])
+        fetch.assert_called_once_with("x", out, 4, 800)
+
+    def test_requires_query_and_out(self):
+        with mock.patch.object(sys, "argv", ["fetch_images.py"]):
+            with contextlib.redirect_stderr(io.StringIO()):
+                with self.assertRaises(SystemExit) as ctx:
+                    fetch_images.main()
+        self.assertEqual(ctx.exception.code, 2)
+
+
+class ParseViewportTest(unittest.TestCase):
+    def test_parses_width_x_height(self):
+        self.assertEqual(verify.parse_viewport("1440x900"), {"width": 1440, "height": 900})
+        self.assertEqual(verify.parse_viewport("375x667"), {"width": 375, "height": 667})
+
+    def test_rejects_malformed(self):
+        for bad in ("1440", "axb", "1x2x3", ""):
+            with self.assertRaises(ValueError, msg=bad):
+                verify.parse_viewport(bad)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/src/skills-lib/wizz-huashu-design/scripts/tts-doubao.mjs

@@ -28,8 +28,7 @@ import { randomUUID } from 'node:crypto';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const SKILL_ROOT = path.resolve(__dirname, '..');
 
-function loadEnv() {
-  const envPath = path.join(SKILL_ROOT, '.env');
+function loadEnv(envPath = path.join(SKILL_ROOT, '.env')) {
   if (!fs.existsSync(envPath)) return;
   const text = fs.readFileSync(envPath, 'utf8');
   for (const line of text.split('\n')) {
@@ -45,7 +44,6 @@ function loadEnv() {
     if (!(key in process.env)) process.env[key] = val;
   }
 }
-loadEnv();
 
 function parseArgs(argv) {
   const args = { speed: '1.0', encoding: 'mp3' };
@@ -90,16 +88,9 @@ function getDuration(filePath) {
   }
 }
 
-async function tts({ text, voice, speed, encoding }) {
-  const apiKey = process.env.DOUBAO_TTS_API_KEY;
-  const cluster = process.env.DOUBAO_TTS_CLUSTER || 'volcano_icl';
-  const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v1/tts';
-  const voiceId = voice || process.env.DOUBAO_TTS_VOICE_ID;
-
-  if (!apiKey) throw new Error('缺 DOUBAO_TTS_API_KEY（检查 .env）');
-  if (!voiceId) throw new Error('缺 DOUBAO_TTS_VOICE_ID（检查 .env 或用 --voice 传）');
-
-  const body = {
+/** Corpo da requisição à API do Doubao (puro, sem rede). */
+function buildTtsBody({ cluster, voiceId, encoding, speed, text, reqid = randomUUID() }) {
+  return {
     app: { cluster },
     user: { uid: 'wizz-huashu-design' },
     audio: {
@@ -108,11 +99,36 @@ async function tts({ text, voice, speed, encoding }) {
       speed_ratio: parseFloat(speed),
     },
     request: {
-      reqid: randomUUID(),
+      reqid,
       text,
       operation: 'query',
     },
   };
+}
+
+/** Valida a resposta JSON do Doubao e devolve o áudio decodificado (Buffer). */
+function parseTtsResponse(json) {
+  // 豆包标准返回：{ code, message, data: "<base64 audio>", ... }
+  // code === 3000 表示成功
+  if (json.code !== undefined && json.code !== 3000) {
+    throw new Error(`API 返回错误 code=${json.code} msg=${json.message || JSON.stringify(json)}`);
+  }
+  if (!json.data) {
+    throw new Error(`API 响应无 data 字段：${JSON.stringify(json).slice(0, 500)}`);
+  }
+  return Buffer.from(json.data, 'base64');
+}
+
+async function tts({ text, voice, speed, encoding }) {
+  const apiKey = process.env.DOUBAO_TTS_API_KEY;
+  const cluster = process.env.DOUBAO_TTS_CLUSTER || 'volcano_icl';
+  const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v1/tts';
+  const voiceId = voice || process.env.DOUBAO_TTS_VOICE_ID;
+
+  if (!apiKey) throw new Error('缺 DOUBAO_TTS_API_KEY（检查 .env）');
+  if (!voiceId) throw new Error('缺 DOUBAO_TTS_VOICE_ID（检查 .env 或用 --voice 传）');
+
+  const body = buildTtsBody({ cluster, voiceId, encoding, speed, text });
 
   const res = await fetch(endpoint, {
     method: 'POST',
@@ -128,16 +144,7 @@ async function tts({ text, voice, speed, encoding }) {
     throw new Error(`HTTP ${res.status}: ${errText.slice(0, 500)}`);
   }
 
-  const json = await res.json();
-  // 豆包标准返回：{ code, message, data: "<base64 audio>", ... }
-  // code === 3000 表示成功
-  if (json.code !== undefined && json.code !== 3000) {
-    throw new Error(`API 返回错误 code=${json.code} msg=${json.message || JSON.stringify(json)}`);
-  }
-  if (!json.data) {
-    throw new Error(`API 响应无 data 字段：${JSON.stringify(json).slice(0, 500)}`);
-  }
-  return Buffer.from(json.data, 'base64');
+  return parseTtsResponse(await res.json());
 }
 
 async function main() {
@@ -178,7 +185,14 @@ async function main() {
   console.log(JSON.stringify(result));
 }
 
-main().catch((err) => {
-  console.error(`TTS 失败：${err.message}`);
-  process.exit(1);
-});
+// Só executa quando chamado como script; importar o módulo (testes) não lê .env nem chama a API.
+const isMain = process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  loadEnv();
+  main().catch((err) => {
+    console.error(`TTS 失败：${err.message}`);
+    process.exit(1);
+  });
+}
+
+export { parseArgs, loadEnv, buildTtsBody, parseTtsResponse };

package/src/skills-lib/wizz-ig-profile-optimizer/SKILL.md

@@ -18,7 +18,7 @@ All text delivered is Brazilian Portuguese with "você", and no em dash in anyth
 
 1. **Read the profile.** `scripts/capture-profile.sh <@> <out_dir>` (out_dir under `_wizz-output/`) saves `profile.png` and `profile.json` (NAME, bio and link as text, follower and post counts). **Open the image.** Logged out, Instagram may hide highlights, the category label and the pin marks: ask for a screenshot of those parts instead of guessing them.
 2. **Pull what the Method already knows**, before judging:
-   - Positioning, audience and tone from the project's Cérebro (`/cerebro ver`).
+   - Positioning, audience and tone from the project's Cérebro (`/wizz-cerebro ver`).
    - Highlights already made in the project (for example a `posts/highlights/` folder).
    - The offer from `wizz-offer-forge`, when one exists: the link and one pin depend on it.
    - Real performance: with Buffer connected, `get_aggregated_post_metrics` and the post list give the best posts by saves, shares and reach. Without it, ask which posts did best; never pick pins by guess.

package/src/skills-lib/wizz-inicio-de-projeto/SKILL.md

@@ -87,7 +87,7 @@ Before the first file of a new project, and on the first use of the method in an
 
 1. `node _wizz/hooks/wizz-arrumar.js layout` proposes it from what already exists (types: `codigo`, `scripts`, `dados`, `docs`, `midia`, `arquivo`; a type mapped to `.` lives at the root, e.g. a Next.js app at the root).
 2. Show the proposal to the owner in **one line** and record it with `node _wizz/hooks/wizz-arrumar.js layout --gravar [tipo=pasta ...]`. It creates each new folder with a short README.
-3. An existing project with loose files at the root: `wizz-arrumar.js planejar` writes a `.tsv` manifest; review it and run `wizz-arrumar.js aplicar <manifesto> --testes "<test command>" --refs <auto-memory dir>`. It moves, rewrites references in code, docs and memories, runs the tests before and after, and writes `desfazer.sh`.
+3. An existing project with loose files at the root: `wizz-arrumar.js planejar` writes a `.tsv` manifest; review it and run `wizz-arrumar.js aplicar <manifesto> --testes "<test command>" --refs <auto-memory dir>`. It moves, rewrites references in code, docs and memories, runs the tests before and after, and writes an undo: `wizz-arrumar.js desfazer <run folder>` on any OS, or the `desfazer.sh` (`desfazer.cmd` on Windows) shortcut. `--testes` accepts only known test runners (npm/pnpm/yarn/bun test, npx vitest|jest, pytest, go/cargo/make test); any other command needs `--testes-livre`.
 
 From then on the `wizz-artifact-guard.js` hook points out any file born loose at the root and the command that moves it. Full duty in the wizz module's `_shared/organizacao.md`.
 

package/src/skills-lib/wizz-launch-readiness/SKILL.md

@@ -8,8 +8,8 @@ description: >
   ready to launch?", "pre-launch audit", "broad release checklist", "what's left
   before going to production", considering the whole project (not just the site). Output: a diagnosis
   prioritized by severity (red blocks launch, orange high, yellow medium, green ok), never
-  blind fixing. Different from security-audit-pentest (hunts vulnerabilities with proof of exploitation)
-  and site-launch-kit (executes the 15 rounds for ONE site): this DIAGNOSES the whole project and points to
+  blind fixing. Different from wizz-security-audit-pentest (hunts vulnerabilities with proof of exploitation)
+  and wizz-site-launch-kit (executes the 15 rounds for ONE site): this DIAGNOSES the whole project and points to
   the right fix owner per finding. Persists the result in a dated section of project-context.md.
 ---
 
@@ -17,7 +17,7 @@ description: >
 
 Seven checking areas, each a closed pass: single scope, standardized output, its own cutoff rule. At the end, a merge step consolidates everything into a prioritized diagnosis and writes the summary to the project's `project-context.md`.
 
-This is not a build skill (that's `wizz-premium-landing-ui-researcher` / `wizz-taste-skill` / `wizz-agent-dev`), not the vulnerability-hunting methodology (that's `security-audit-pentest`), and it doesn't execute the 15 corrective rounds for a site (that's `site-launch-kit`): this is a broad, prioritized diagnosis to decide whether it's ready to launch.
+This is not a build skill (that's `wizz-premium-landing-ui-researcher` / `wizz-taste-skill` / `wizz-agent-dev`), not the vulnerability-hunting methodology (that's `wizz-security-audit-pentest`), and it doesn't execute the 15 corrective rounds for a site (that's `wizz-site-launch-kit`): this is a broad, prioritized diagnosis to decide whether it's ready to launch.
 
 ## Stage gate (read BEFORE running)
 
@@ -25,7 +25,7 @@ Read the project's stage: `grep -m1 '^stage:' {project-root}/**/project-context.
 
 - **`mvp` or `production`:** run the full audit. This is exactly what the skill exists for.
 - **`prototype` or no `project-context.md` file:** stop before running. Reply that the project is still too early for a launch audit (little or nothing built yet to audit) and point to the right path for this stage: `wizz-inicio-de-projeto`, `wizz-forge-idea`, or `wizz-decision-maker` to define the product first. Only proceed if the user explicitly insists, and in that case warn that the findings will come back full of PENDING ITEMS due to lack of built surface.
-- **`maintenance`:** normally not the use case (product already launched, running). Only makes sense if the request is about a NEW batch starting from scratch (a big feature, a new product within the same repo): confirm this before running; otherwise, point to `security-audit-pentest` (periodic pentest) or the `wizz-router`'s "360° Audit" mode (broad audit of a codebase already in production, not about a launch event).
+- **`maintenance`:** normally not the use case (product already launched, running). Only makes sense if the request is about a NEW batch starting from scratch (a big feature, a new product within the same repo): confirm this before running; otherwise, point to `wizz-security-audit-pentest` (periodic pentest) or the `wizz-router`'s "360° Audit" mode (broad audit of a codebase already in production, not about a launch event).
 
 ## Common contract (applies to all 7 areas)
 
@@ -81,8 +81,8 @@ After the 7:
 
 ## Relationship with other skills
 
-- **`security-audit-pentest`**: security deep dive. Area 02 here is a light sweep (exposed surface); findings that need proof of exploitation ("how it's exploited") go to `security-audit-pentest`, they aren't redone here.
-- **`site-launch-kit`**: when the surface of the finding is a SITE (CTA, social proof, Open Graph, local schema, robots/sitemap, site LGPD, measurement), the fix owner is `site-launch-kit`. This skill doesn't repeat the 15 rounds: it only points to which round resolves the finding.
+- **`wizz-security-audit-pentest`**: security deep dive. Area 02 here is a light sweep (exposed surface); findings that need proof of exploitation ("how it's exploited") go to `wizz-security-audit-pentest`, they aren't redone here.
+- **`wizz-site-launch-kit`**: when the surface of the finding is a SITE (CTA, social proof, Open Graph, local schema, robots/sitemap, site LGPD, measurement), the fix owner is `wizz-site-launch-kit`. This skill doesn't repeat the 15 rounds: it only points to which round resolves the finding.
 - **`wizz-seo-audit`**: broad ranking/traffic/Core Web Vitals diagnosis. Area 03 here is only basic indexability (can the site be found), not a full SEO audit.
 - **`wizz-router`'s "360° Audit" mode**: a broad audit of a project already in production, by technical area (code, database, design, growth...), without the "we're about to launch" framing or the stage gate. Use wizz-launch-readiness for the launch event; use 360° mode for a mature project's general health.
 
@@ -90,5 +90,5 @@ After the 7:
 
 - Doesn't fix anything on its own; it points to the fix owner.
 - Doesn't decide GO/NO-GO on behalf of the project owner; delivers the prioritized reading.
-- Doesn't replace `security-audit-pentest` for deep security or `site-launch-kit` for executing the 15 site rounds.
+- Doesn't replace `wizz-security-audit-pentest` for deep security or `wizz-site-launch-kit` for executing the 15 site rounds.
 - Doesn't run on a project with no built surface (discovery/ideation stage).

package/src/skills-lib/wizz-launch-readiness/references/02-seguranca.md

@@ -1,6 +1,6 @@
 # Area 02 · Security
 
-A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities with proof of exploitation. A finding that requires a concrete payload to prove (mass assignment, IDOR, injection) is NOT dug into here: log the suspicion as 🟠 and point to `security-audit-pentest` as the owner of the deep dive.
+A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities with proof of exploitation. A finding that requires a concrete payload to prove (mass assignment, IDOR, injection) is NOT dug into here: log the suspicion as 🟠 and point to `wizz-security-audit-pentest` as the owner of the deep dive.
 
 ## Objective checks
 
@@ -11,11 +11,11 @@ A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities wit
 5. **CORS too open.** `Access-Control-Allow-Origin: *` on an API that accepts credentials/tokens is 🔴; without credentials is 🟡.
 6. **Rate limiting missing on a sensitive route.** Login, signup, password recovery, or an endpoint that costs money (AI, SMS, email) with no limit at all is 🟠; point to `wizz-web-security` as the fixer.
 7. **Dependency with a known critical CVE on the production path.** Reinforces finding #7 from area 01 if it applies specifically to an auth/crypto lib: escalate to 🔴.
-8. **Unproven indication of mass assignment, IDOR, or injection.** An update field that accepts the client's entire object with no allowlist, or a query built by string concatenation: log as 🟠 "suspicion, needs proof of exploitation" and point to `security-audit-pentest`.
+8. **Unproven indication of mass assignment, IDOR, or injection.** An update field that accepts the client's entire object with no allowlist, or a query built by string concatenation: log as 🟠 "suspicion, needs proof of exploitation" and point to `wizz-security-audit-pentest`.
 
 ## Cutoff rule
 
-This area NEVER delivers "how to exploit it" with a real payload: that is exclusively `security-audit-pentest`'s scope. If during the sweep you'd already have the payload ready, still don't include it here: log the suspicion and the reference, to avoid duplicating the two skills' output format.
+This area NEVER delivers "how to exploit it" with a real payload: that is exclusively `wizz-security-audit-pentest`'s scope. If during the sweep you'd already have the payload ready, still don't include it here: log the suspicion and the reference, to avoid duplicating the two skills' output format.
 
 ## Output format
 

package/src/skills-lib/wizz-launch-readiness/references/03-seo-descoberta.md

@@ -1,16 +1,16 @@
 # Area 03 · SEO / Discoverability
 
-Checks whether the product CAN be found on launch day. This is not a ranking, traffic, or Core Web Vitals diagnosis (that's `wizz-seo-audit`), and when the surface is a SITE, it doesn't repeat the execution rounds (that's `site-launch-kit`, rounds 08 to 13): here it only confirms whether basic indexability exists.
+Checks whether the product CAN be found on launch day. This is not a ranking, traffic, or Core Web Vitals diagnosis (that's `wizz-seo-audit`), and when the surface is a SITE, it doesn't repeat the execution rounds (that's `wizz-site-launch-kit`, rounds 08 to 13): here it only confirms whether basic indexability exists.
 
 If the project has no indexable public web surface (e.g., mobile-only app, internal tool), respond `ITEM DOES NOT APPLY` with a 1-line justification and stop.
 
 ## Objective checks
 
-1. **`robots.txt` present and not blocking everything.** Missing is 🟠; present but blocking `Disallow: /` in production by mistake is 🔴. Point to `site-launch-kit` (round 13) as the fixer.
+1. **`robots.txt` present and not blocking everything.** Missing is 🟠; present but blocking `Disallow: /` in production by mistake is 🔴. Point to `wizz-site-launch-kit` (round 13) as the fixer.
 2. **Sitemap present and referenced in `robots.txt`.** Missing is 🟠.
-3. **Unique title and meta description on the main public pages.** A default/repeated title (e.g., the same title on every page) is 🟠. Point to `site-launch-kit` (round 08).
-4. **Open Graph configured.** Without `og:title`/`og:image`/`og:description`, the share preview (WhatsApp, social) comes out broken. It's 🟡, but escalates to 🟠 if the launch's main acquisition channel is social/WhatsApp. Point to `site-launch-kit` (round 09).
-5. **Basic structured business data.** Absence isn't a standalone blocker, but if the business depends on appearing in Google local/rich snippets, it's 🟡. Point to `site-launch-kit` (round 12) or `wizz-schema-markup`.
+3. **Unique title and meta description on the main public pages.** A default/repeated title (e.g., the same title on every page) is 🟠. Point to `wizz-site-launch-kit` (round 08).
+4. **Open Graph configured.** Without `og:title`/`og:image`/`og:description`, the share preview (WhatsApp, social) comes out broken. It's 🟡, but escalates to 🟠 if the launch's main acquisition channel is social/WhatsApp. Point to `wizz-site-launch-kit` (round 09).
+5. **Basic structured business data.** Absence isn't a standalone blocker, but if the business depends on appearing in Google local/rich snippets, it's 🟡. Point to `wizz-site-launch-kit` (round 12) or `wizz-schema-markup`.
 6. **Canonical and non-duplicated indexing.** Multiple URLs serving the same content without `rel=canonical` is 🟡.
 7. **Domain/DNS resolving to the right production environment.** A domain configured but pointing to the staging/preview environment is 🔴 (also an infra finding, see area 07; log only the discoverability part here: whether the search engine has already indexed the wrong domain).
 

package/src/skills-lib/wizz-launch-readiness/references/04-analytics-medicao.md

@@ -6,7 +6,7 @@ Checks whether the team will be able to KNOW if the launch worked. A launch with
 
 1. **Analytics tool installed and firing.** No GA4/pixel/equivalent tool loading on the public pages at all is 🔴 if the launch depends on measuring acquisition; 🟠 otherwise.
 2. **Main conversion event configured.** The event that represents the launch's goal (signup, purchase, lead, download) not firing or not existing is 🔴.
-3. **Thank-you/confirmation page event.** A post-conversion page with no "confirmed conversion" event (distinct from just "visited the page") is 🟠. Overlaps with `site-launch-kit` round 15 when the surface is a site.
+3. **Thank-you/confirmation page event.** A post-conversion page with no "confirmed conversion" event (distinct from just "visited the page") is 🟠. Overlaps with `wizz-site-launch-kit` round 15 when the surface is a site.
 4. **Trackable traffic source/UTM.** Launch campaigns without standardized UTM is 🟡: it measures what happened, but not where it came from.
 5. **Production error monitoring (Sentry or equivalent).** A project that already uses an error tool but it's not active in the production environment is 🟠. A project that never adopted one at all is 🟡 (not a recommendation to adopt Sentry now, just logging a gap: the adoption decision belongs to the team).
 6. **Downtime/uptime alert.** No alert configured for when the product goes down on launch day (when traffic is most sensitive) is 🟠.

package/src/skills-lib/wizz-launch-readiness/references/05-conteudo-prova-social.md

@@ -1,20 +1,20 @@
 # Area 05 · Content / Copy / Social Proof
 
-Checks whether what is written and shown is REAL and ready — not whether the copy is good (that's `wizz-copywriting`/`wizz-copy-editing`). Central rule, inherited from `site-launch-kit`: no invented business data passes as compliant. Whatever is missing becomes a PENDING ITEM, never a guess filled in by estimation.
+Checks whether what is written and shown is REAL and ready — not whether the copy is good (that's `wizz-copywriting`/`wizz-copy-editing`). Central rule, inherited from `wizz-site-launch-kit`: no invented business data passes as compliant. Whatever is missing becomes a PENDING ITEM, never a guess filled in by estimation.
 
 ## Objective checks
 
 1. **Placeholder text in production.** `Lorem ipsum`, `TODO`, `[insert here]`, `{{LIKE THIS}}`, or any visible marker on a page/screen that's going live is 🔴.
-2. **Real social proof.** A testimonial, rating, or client logo without a verifiable source (a generic name like "Satisfied customer", a rating with no origin, a company logo that isn't actually a client) is 🔴: fake social proof is a reputational and sometimes legal risk. Point to `site-launch-kit` (round 04) when the surface is a site.
+2. **Real social proof.** A testimonial, rating, or client logo without a verifiable source (a generic name like "Satisfied customer", a rating with no origin, a company logo that isn't actually a client) is 🔴: fake social proof is a reputational and sometimes legal risk. Point to `wizz-site-launch-kit` (round 04) when the surface is a site.
 3. **Current price, timeline, contact info.** A price/plan/phone/email/hours that diverges from what the business actually does is 🔴. Don't validate this "by estimate": if you have no way to confirm the real data, mark it PENDING and ask — never accept what's already written as correct by default.
-4. **Real image vs. generic stock.** A generic stock photo in a context that should be authentic (team, product, location) is 🟡, escalating to 🟠 if the sector depends on visual trust (health, in-person service, financial). Point to `site-launch-kit` (round 06).
+4. **Real image vs. generic stock.** A generic stock photo in a context that should be authentic (team, product, location) is 🟡, escalating to 🟠 if the sector depends on visual trust (health, in-person service, financial). Point to `wizz-site-launch-kit` (round 06).
 5. **Product/brand name consistency.** The product name spelled differently across pages (e.g., "MeJu" vs. "Me Ju" vs. "meju") is 🟡.
-6. **Main CTA and message present and clear.** No main CTA above the fold on the landing page is 🔴 when the launch's goal depends on direct conversion. Point to `site-launch-kit` (round 01).
-7. **FAQ or objection-handling content ready for expected volume.** No FAQ when the product has a known recurring objection is 🟡. Point to `site-launch-kit` (round 05) or `wizz-copywriting`.
+6. **Main CTA and message present and clear.** No main CTA above the fold on the landing page is 🔴 when the launch's goal depends on direct conversion. Point to `wizz-site-launch-kit` (round 01).
+7. **FAQ or objection-handling content ready for expected volume.** No FAQ when the product has a known recurring objection is 🟡. Point to `wizz-site-launch-kit` (round 05) or `wizz-copywriting`.
 
 ## Cutoff rule
 
-Never fill in missing business data "to unblock the diagnosis". If it can't be confirmed (price, testimonial, address, timeline), the item becomes PENDING with "who to get it from / how to get it", same as `site-launch-kit`. Marking 🟢 without checking the real content is worse than marking PENDING.
+Never fill in missing business data "to unblock the diagnosis". If it can't be confirmed (price, testimonial, address, timeline), the item becomes PENDING with "who to get it from / how to get it", same as `wizz-site-launch-kit`. Marking 🟢 without checking the real content is worse than marking PENDING.
 
 ## Output format
 

package/src/skills-lib/wizz-launch-readiness/references/06-legal-lgpd.md

@@ -4,7 +4,7 @@ Checks basic legal exposure before launch. This isn't a legal opinion (that requ
 
 ## Objective checks
 
-1. **Privacy policy exists and is accessible.** Total absence, in a product that collects personal data (signup, form, analytics cookie), is 🔴. Point to `site-launch-kit` (round 14) when the surface is a site.
+1. **Privacy policy exists and is accessible.** Total absence, in a product that collects personal data (signup, form, analytics cookie), is 🔴. Point to `wizz-site-launch-kit` (round 14) when the surface is a site.
 2. **Privacy policy matches what the product actually does.** A generic copied document that doesn't reflect the real app (e.g., mentions data that isn't collected, or omits data that is) is 🔴: an incorrect policy is worse than none, because it creates a false legal commitment. Read the content, don't just confirm the file exists.
 3. **Terms of use present when there's a transaction or user account.** Absence is 🟠.
 4. **Cookie/tracking consent implemented when there's a non-essential cookie.** Analytics/pixel firing with no cookie notice at all is 🟠.

package/src/skills-lib/wizz-launch-readiness/references/08-fusao-priorizacao.md

@@ -7,7 +7,7 @@ Takes the 7 tables from the areas (01 to 07) and merges them into a single diagn
 1. **Paste the 7 tables** (or whichever ran, if any was marked `ITEM DOES NOT APPLY`).
 2. **Dedup by cross-origin.** The same problem can show up in two areas (e.g., a domain pointing to the wrong environment appears in area 03 and area 07). Keep a single row, citing both source areas.
 3. **Sort by severity first** (🔴 at the top, 🟢 at the bottom), and within the same severity, by estimated fix effort (lowest effort first): resolve first whatever is closest to go-live.
-4. **Group by fix owner.** Several 🔴 findings going to the same owner (e.g., 3 findings for `site-launch-kit`) form a single block in the delivery, to become a single dispatch.
+4. **Group by fix owner.** Several 🔴 findings going to the same owner (e.g., 3 findings for `wizz-site-launch-kit`) form a single block in the delivery, to become a single dispatch.
 5. **Count pending items separately.** MANUAL VERIFICATION PENDING is not a severity: it's "can't be known yet". List it separately, with what's needed to turn it into a real verdict.
 
 ## Final table

package/src/skills-lib/wizz-offer-forge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: wizz-offer-forge
-description: Forges irresistible direct-response and info-product offers by integrating a unique mechanism, offer thesis, value stacking, reverse guarantee, price anchoring, and a creative matrix for paid traffic. Use when the user wants to create a new offer from scratch, restructure an existing offer that isn't converting, stack high-perception bonuses, define an aggressive guarantee, or translate audience research (Piva/VoC) into a sales machine. Do NOT use for raw audience research (use pesquisa-de-publico-do-piva) or final page copywriting (use wizz-copywriting).
+description: Forges irresistible direct-response and info-product offers by integrating a unique mechanism, offer thesis, value stacking, reverse guarantee, price anchoring, and a creative matrix for paid traffic. Use when the user wants to create a new offer from scratch, restructure an existing offer that isn't converting, stack high-perception bonuses, define an aggressive guarantee, or translate audience research (Piva/VoC) into a sales machine. Do NOT use for raw audience research (use wizz-pesquisa-de-publico-do-piva) or final page copywriting (use wizz-copywriting).
 ---
 
 # Wizz Offer Forge
@@ -31,10 +31,10 @@ A master artifact `OFFER-SPEC.md` containing:
 
 **Before asking anything, read what already exists.** A good offer is born from the result of the previous one, not from a blank page.
 
-If the `cerebro` skill is installed, run `/cerebro ver` for the project and grep by theme in `_decisions/`. Look specifically for: a previous offer to the same audience, a price already tested, a guarantee already used, and any logged decision that forbids a certain path. Bring back what you found as input and state in your reply where it came from. Without the skill installed, skip this block and proceed with the questions below.
+If the `wizz-cerebro` skill is installed, run `/wizz-cerebro ver` for the project and grep by theme in `_decisions/`. Look specifically for: a previous offer to the same audience, a price already tested, a guarantee already used, and any logged decision that forbids a certain path. Bring back what you found as input and state in your reply where it came from. Without the skill installed, skip this block and proceed with the questions below.
 
 Then, consult existing context or ask the user:
-1. **Prior Audience Research:** Is there a report from the `pesquisa-de-publico-do-piva` skill or VoC notes? If so, import it as primary input. If not, define the Avatar, Latent Pain, and initial Awareness Level.
+1. **Prior Audience Research:** Is there a report from the `wizz-pesquisa-de-publico-do-piva` skill or VoC notes? If so, import it as primary input. If not, define the Avatar, Latent Pain, and initial Awareness Level.
 2. **Business Model:** Low-ticket (R$ 10 to R$ 97), Mid front-end (R$ 197 to R$ 497), or High-ticket / Mentorship (R$ 1,000 to R$ 10,000+)?
 3. **Delivery Vehicle:** Recorded course, community, templates/tools, live mentorship, SaaS, or hybrid?
 

package/src/skills-lib/{pesquisa-de-publico-do-piva → wizz-pesquisa-de-publico-do-piva}/README.md

@@ -42,7 +42,7 @@ Unzip the `pesquisa-de-publico-do-piva/` folder into `~/.claude/skills/` (to use
 Open a conversation, attach your offer document (`.docx`, `.pdf`, `.md` or `.txt`) and write:
 
 ```
-/pesquisa-de-publico-do-piva
+/wizz-pesquisa-de-publico-do-piva
 ```
 
 Or, without the slash, anything in that spirit:

package/src/skills-lib/{pesquisa-de-publico-do-piva → wizz-pesquisa-de-publico-do-piva}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: pesquisa-de-publico-do-piva
+name: wizz-pesquisa-de-publico-do-piva
 description: Generates a complete audience research arsenal for an infoproduct offer and paid traffic, from an offer document (.docx/.md/.txt/.pdf). Produces six chained reports — VoC, Schwartz Psychographic Profile, Levels of Awareness, Trend Report, Angle Matrix and Lexicon — compiled into a tab-navigable HTML dashboard. Use when the user sends an offer and asks for audience research, VoC, voice of customer, angle matrix, audience lexicon, persona pain points, or a copy arsenal for direct traffic. Do NOT use for technical research on libraries/code (use context7), broad B2B market research (use deep-research), or visual UI research (use wizz-premium-landing-ui-researcher). Methodology by @soupiva.
 ---
 

package/src/skills-lib/wizz-router/SKILL.md

@@ -20,7 +20,7 @@ You are the **Director / entry point** — not the orchestrator (that's `wizz-ma
 
 **Installation scope note:** this is the only skill in the catalog where **global** installation (`~/.claude/skills/wizz-router`) is the operationally correct default, not an exception to the "prefer local" rule (`skills-registry.yaml`, Installation Doctrine, rule 1) — its reason for existing is to route even outside a Wizz project. It stays in sync with the global `wizz-router-enforce.js` hook via `npm run sync:global`.
 
-**Token economy:** the `rtk-rewrite.sh` hook already handles RTK automatically (don't run `rtk --version` on every routing). Before reading raw files, prefer `/cerebro ver` or a specific `grep`.
+**Token economy:** the `rtk-rewrite.sh` hook already handles RTK automatically (don't run `rtk --version` on every routing). Before reading raw files, prefer `/wizz-cerebro ver` or a specific `grep`.
 
 ## Triage and delegation (the Director's core job)
 
@@ -72,7 +72,7 @@ This gate does NOT fire for an open-scope request. "My site is bad, sort it out"
 
 **The counterpart, and this is what is left for the maestro:** a request **of open scope, which the request itself does not delimit** — "how do I improve the signup conversion rate", "the sales page gets plenty of visits and almost nobody buys", "my sales page converts badly, improve it". There the scope has to be discovered before anything is delivered, and discovering scope is the Manager's work. The deciding difference is not the size of the request, it is whether **the request already states what the delivery is**.
 
-**And the counterpart has one exception: a single entry already delimits the scope.** If the whole outcome being asked for fits the `when:` of ONE catalogue entry, and what leaves at the end is that entry's own deliverable — a plan, a recommendation, an audit — then the scope is not open, the catalogue delimited it, and the request goes to that entry's area. "A plan to reduce churn" is `wizz-churn-prevention`; "I want ChatGPT and Perplexity to cite us" is `wizz-ai-seo`; "what to check before going live" is `site-launch-kit`. It stops being the exception the moment delivering the outcome means changing what other areas own: "improve the signup conversion rate" ends up in copy, UI and code, so it comes back to the maestro through the area clause. Ask which single entry would deliver it whole — if it takes two, the scope really is open. (Owner's decision, 2026-09-18.)
+**And the counterpart has one exception: a single entry already delimits the scope.** If the whole outcome being asked for fits the `when:` of ONE catalogue entry, and what leaves at the end is that entry's own deliverable — a plan, a recommendation, an audit — then the scope is not open, the catalogue delimited it, and the request goes to that entry's area. "A plan to reduce churn" is `wizz-churn-prevention`; "I want ChatGPT and Perplexity to cite us" is `wizz-ai-seo`; "what to check before going live" is `wizz-site-launch-kit`. It stops being the exception the moment delivering the outcome means changing what other areas own: "improve the signup conversion rate" ends up in copy, UI and code, so it comes back to the maestro through the area clause. Ask which single entry would deliver it whole — if it takes two, the scope really is open. (Owner's decision, 2026-09-18.)
 
 **Changing the product's code is `dev`, even when the subject is visual.** "Adjust the secondary button's colour", "fix the mobile spacing": the delivery is a commit, so it is the dev area — `designer` decides what the look should be, it does not ship the change. Ask which artifact leaves at the end: a file in the repo → dev; a decision, a spec or a piece of art → the area that owns it. **Exception: new or rebuilt screens.** When the request asks to BUILD screens in code (a new app, page, dashboard or panel, or a whole screen rebuilt in the product), the visual decision has not been made yet, so `designer` comes first and the sequence is design → dev (2 areas → maestro): the designer runs its research gate before any screen is coded. A tweak to an existing screen (a price, a label, a spacing) stays dev, and redesigning a section with no build asked for (a hero, a card) stays designer.
 
@@ -105,4 +105,4 @@ When detecting "auditoria completa / revisa tudo / 360 / análise geral", follow
 
 ## Memory Duty (at the end)
 
-After non-obvious bugs, architecture decisions, gotchas, or user corrections: record them in the project's `CLAUDE.md` ("Learnings" section) and in Cerebro (`/cerebro decisao` or `/cerebro salvar`). Remind the user if relevant.
+After non-obvious bugs, architecture decisions, gotchas, or user corrections: record them in the project's `CLAUDE.md` ("Learnings" section) and in Cerebro (`/wizz-cerebro decisao` or `/wizz-cerebro salvar`). Remind the user if relevant.