wizz-method 2.18.0 → 2.19.1

package/src/skills-lib/{enhance-prompt → wizz-enhance-prompt}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: enhance-prompt
+name: wizz-enhance-prompt
 description: Transforms vague UI ideas into polished, Stitch-optimized prompts. Enhances specificity, adds UI/UX keywords, injects design system context, and structures output for better generation results. Use when the user wants to polish a UI prompt before sending it to Stitch, improve a prompt that produced poor results, or turn a vague UI idea into a structured, design-system-aware prompt.
 allowed-tools:
   - "Read"

package/src/skills-lib/{find-skills → wizz-find-skills}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: find-skills
+name: wizz-find-skills
 description: Helps users discover and install agent skills OR MCP servers when they ask questions like "how do I do X", "find a skill for X", "adicione essa skill", "adicione esse MCP", "is there a skill/mcp that can...", or express interest in extending capabilities. Use when the user is looking for functionality that might exist as an installable skill or MCP server.
 ---
 

package/src/skills-lib/wizz-huashu-design/references/sfx-library.md

@@ -12,7 +12,7 @@
 > 仓库和已下载的缓存中）。用某个 SFX 前先 `ls assets/sfx/<category>/` 确认文件存在；
 > 缺失就跑 `npx --yes wizz-method fetch-assets --bundle huashu-audio --dest
 > assets`（路径相对本 skill 根目录）。离线时手动下载
-> `npx wizz-method fetch-assets --bundle huashu-audio` (2 partes em `https://wizz-assets.junior-aec.workers.dev/huashu-audio-1.tar.gz` e `.../huashu-audio-2.tar.gz`)
+> `npx wizz-method fetch-assets --bundle huashu-audio` (2 partes em `https://assets.wizzcomms.com/huashu-audio-1.tar.gz` e `.../huashu-audio-2.tar.gz`)
 > 解压到 `assets/`，能力不受影响，只是首次用要等下载。
 
 ---

package/src/skills-lib/wizz-huashu-design/scripts/add-music.sh

@@ -83,7 +83,7 @@ if [ ! -f "$MUSIC" ]; then
   echo "✗ Music not found: $MUSIC" >&2
   echo "  Available moods: $(ls "$ASSETS_DIR" 2>/dev/null | grep -E '^bgm-.*\.mp3$' | sed 's/^bgm-//;s/\.mp3$//' | tr '\n' ' ')" >&2
   echo "  Offline or npx failed? Download manually:" >&2
-  echo "    npx wizz-method fetch-assets --bundle huashu-audio  (https://wizz-assets.junior-aec.workers.dev/huashu-audio-{1,2}.tar.gz)" >&2
+  echo "    npx wizz-method fetch-assets --bundle huashu-audio  (https://assets.wizzcomms.com/huashu-audio-{1,2}.tar.gz)" >&2
   echo "  and extract it into: $ASSETS_DIR" >&2
   exit 1
 fi

package/src/skills-lib/wizz-huashu-design/scripts/html2pptx.js

@@ -913,43 +913,8 @@ function writeElement(slide, pres, el) {
   }
 }
 
-module.exports = async function html2pptx(htmlFile, pres, options) {
-  options = options || {};
-  const absHtmlPath = path.isAbsolute(htmlFile) ? htmlFile : path.resolve(process.cwd(), htmlFile);
-  const tmpDir = options.tmpDir || process.env.TMPDIR || '/tmp';
-
-  function finalizeError(rawMessage) {
-    let message = rawMessage;
-    if (!message.startsWith(htmlFile)) {
-      message = `${htmlFile}: ${message}`;
-    }
-    return new Error(message);
-  }
-
-  let browser;
-  let extraction;
-  try {
-    const launchOptions = { env: Object.assign({}, process.env, { TMPDIR: tmpDir }) };
-    if (process.platform === 'darwin') launchOptions.channel = 'chrome';
-    browser = await chromium.launch(launchOptions);
-    const page = await browser.newPage();
-    await page.goto('file://' + absHtmlPath);
-
-    const initialBodySize = await page.evaluate(() => {
-      const cs = getComputedStyle(document.body);
-      return { width: parseFloat(cs.width), height: parseFloat(cs.height) };
-    });
-    await page.setViewportSize({
-      width: Math.max(1, Math.round(initialBodySize.width)),
-      height: Math.max(1, Math.round(initialBodySize.height)),
-    });
-
-    extraction = await page.evaluate(extractPageDataInBrowser);
-  } finally {
-    if (browser) await browser.close();
-  }
-
-  // ---- 整页级校验（第 5 节），和提取阶段收集到的错误合并 ----
+// 整页级校验（第 5 节）：和提取阶段收集到的错误合并，返回错误文案数组。纯函数，不碰浏览器。
+function validatePage(extraction, pres) {
   const errors = extraction.errors.slice();
 
   const widthOverflowPx = Math.max(0, extraction.body.scrollWidth - extraction.body.width - 1);
@@ -989,6 +954,46 @@ module.exports = async function html2pptx(htmlFile, pres, options) {
       }
     }
   }
+  return errors;
+}
+
+module.exports = async function html2pptx(htmlFile, pres, options) {
+  options = options || {};
+  const absHtmlPath = path.isAbsolute(htmlFile) ? htmlFile : path.resolve(process.cwd(), htmlFile);
+  const tmpDir = options.tmpDir || process.env.TMPDIR || '/tmp';
+
+  function finalizeError(rawMessage) {
+    let message = rawMessage;
+    if (!message.startsWith(htmlFile)) {
+      message = `${htmlFile}: ${message}`;
+    }
+    return new Error(message);
+  }
+
+  let browser;
+  let extraction;
+  try {
+    const launchOptions = { env: Object.assign({}, process.env, { TMPDIR: tmpDir }) };
+    if (process.platform === 'darwin') launchOptions.channel = 'chrome';
+    browser = await chromium.launch(launchOptions);
+    const page = await browser.newPage();
+    await page.goto('file://' + absHtmlPath);
+
+    const initialBodySize = await page.evaluate(() => {
+      const cs = getComputedStyle(document.body);
+      return { width: parseFloat(cs.width), height: parseFloat(cs.height) };
+    });
+    await page.setViewportSize({
+      width: Math.max(1, Math.round(initialBodySize.width)),
+      height: Math.max(1, Math.round(initialBodySize.height)),
+    });
+
+    extraction = await page.evaluate(extractPageDataInBrowser);
+  } finally {
+    if (browser) await browser.close();
+  }
+
+  const errors = validatePage(extraction, pres);
 
   if (errors.length > 0) {
     let message;
@@ -1017,3 +1022,6 @@ module.exports = async function html2pptx(htmlFile, pres, options) {
 
   return { slide, placeholders: extraction.placeholders };
 };
+
+// Expostos só para teste (funções puras, sem browser).
+module.exports._internals = { toPt, toIn, stripFileProtocol, previewTextOf, writeElement, validatePage };

package/src/skills-lib/wizz-huashu-design/scripts/mix-voiceover.sh

@@ -80,7 +80,7 @@ if [ -n "$BGM" ] && [ ! -f "$BGM" ]; then
   echo "✗ BGM 文件不存在: $BGM" >&2
   echo "  可用 mood: $(ls "$ASSETS_DIR" 2>/dev/null | grep -E '^bgm-.*\.mp3$' | sed 's/^bgm-//;s/\.mp3$//' | tr '\n' ' ')" >&2
   echo "  离线，或 npx 失败？手动下载：" >&2
-  echo "    npx wizz-method fetch-assets --bundle huashu-audio  (https://wizz-assets.junior-aec.workers.dev/huashu-audio-{1,2}.tar.gz)" >&2
+  echo "    npx wizz-method fetch-assets --bundle huashu-audio  (https://assets.wizzcomms.com/huashu-audio-{1,2}.tar.gz)" >&2
   echo "  解压到：$ASSETS_DIR" >&2
   exit 1
 fi

package/src/skills-lib/wizz-huashu-design/scripts/narrate-pipeline.mjs

@@ -308,8 +308,14 @@ async function main() {
   console.error(`  cue 数:    ${totalCues}`);
 }
 
-main().catch((err) => {
-  console.error(`narrate-pipeline 失败：${err.message}`);
-  console.error(err.stack);
-  process.exit(1);
-});
+// Só executa quando chamado como script; importar o módulo (testes) não dispara o pipeline.
+const isMain = process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  main().catch((err) => {
+    console.error(`narrate-pipeline 失败：${err.message}`);
+    console.error(err.stack);
+    process.exit(1);
+  });
+}
+
+export { parseArgs, parseScript, splitByCues };

package/src/skills-lib/wizz-huashu-design/scripts/test_scripts.py

@@ -0,0 +1,209 @@
+"""Testes (unittest, stdlib) das partes puras de fetch_images.py e verify.py.
+
+Rede e browser ficam de fora: a API da Wikimedia e o download são trocados por
+mocks. Rodam via `python3 -m unittest discover` (test/test-python-skills.js).
+"""
+import contextlib
+import io
+import os
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+import fetch_images  # noqa: E402
+import verify  # noqa: E402
+
+
+class FakeResponse:
+    """Resposta mínima de urlopen usada como context manager."""
+
+    def __init__(self, payload=b"IMG"):
+        self._payload = payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+    def read(self):
+        return self._payload
+
+
+def page(title, thumb=None, url=None, lic="CC BY-SA 4.0", artist="<a href='x'>Ana</a> Silva"):
+    info = {
+        "descriptionurl": "https://commons.example/" + title,
+        "extmetadata": {"LicenseShortName": {"value": lic}, "Artist": {"value": artist}},
+    }
+    if thumb:
+        info["thumburl"] = thumb
+    if url:
+        info["url"] = url
+    return {"title": title, "imageinfo": [info]}
+
+
+class SafeNameTest(unittest.TestCase):
+    def test_replaces_unsafe_chars(self):
+        self.assertEqual(fetch_images._safe("Petronas Towers/KL"), "Petronas_Towers_KL")
+
+    def test_keeps_word_chars_dash_dot(self):
+        self.assertEqual(fetch_images._safe("a-b.c_d"), "a-b.c_d")
+
+    def test_truncates_to_60(self):
+        self.assertEqual(len(fetch_images._safe("x" * 200)), 60)
+
+
+class FetchTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.out = self.tmp.name
+
+    def run_fetch(self, pages, query="Langkawi beach", count=2, width=1600, urlopen=None):
+        data = {"query": {"pages": pages}}
+        stack = contextlib.ExitStack()
+        stack.enter_context(mock.patch.object(fetch_images, "_api_get", return_value=data))
+        opener = urlopen or (lambda req, timeout=0: FakeResponse())
+        stack.enter_context(mock.patch.object(fetch_images.urllib.request, "urlopen", side_effect=opener))
+        with stack:
+            buf = io.StringIO()
+            with contextlib.redirect_stdout(buf), contextlib.redirect_stderr(io.StringIO()):
+                got = fetch_images.fetch(query, self.out, count, width)
+        return got, buf.getvalue()
+
+    def test_downloads_thumb_and_prints_license_and_clean_artist(self):
+        pages = {"1": page("File:Beach one.jpg", thumb="https://up.example/t/beach.jpg?x=1")}
+        got, out = self.run_fetch(pages)
+        self.assertEqual(len(got), 1)
+        self.assertTrue(os.path.exists(got[0]))
+        self.assertTrue(got[0].startswith(self.out))
+        self.assertTrue(got[0].endswith(".jpg"), "extensão vem da URL sem a query string")
+        self.assertIn("CC BY-SA 4.0", out)
+        self.assertIn("Ana Silva", out)
+        self.assertNotIn("<a", out, "tags HTML do autor são removidas")
+        self.assertIn("https://commons.example/File:Beach one.jpg", out)
+
+    def test_filename_has_query_and_title_without_file_prefix(self):
+        got, _ = self.run_fetch({"1": page("File:Nice view.png", thumb="https://up.example/x.png")}, query="Petronas Towers")
+        name = os.path.basename(got[0])
+        self.assertTrue(name.startswith("Petronas_Towers_"), name)
+        self.assertNotIn("File_", name)
+        self.assertTrue(name.endswith(".png"))
+
+    def test_falls_back_to_url_when_no_thumb_and_default_ext_jpg(self):
+        got, _ = self.run_fetch({"1": page("File:a", url="https://up.example/noext")})
+        self.assertEqual(len(got), 1)
+        self.assertTrue(got[0].endswith(".jpg"))
+
+    def test_skips_pages_without_any_image_url(self):
+        got, _ = self.run_fetch({"1": page("File:nada")})
+        self.assertEqual(got, [])
+
+    def test_respects_count(self):
+        pages = {str(i): page(f"File:img{i}.jpg", thumb=f"https://up.example/{i}.jpg") for i in range(5)}
+        got, _ = self.run_fetch(pages, count=2)
+        self.assertEqual(len(got), 2)
+
+    def test_missing_metadata_uses_question_mark(self):
+        bare = {"title": "File:x.jpg", "imageinfo": [{"thumburl": "https://up.example/x.jpg"}]}
+        _, out = self.run_fetch({"1": bare})
+        self.assertIn("| ? | ?", out)
+
+    def test_api_failure_returns_empty_list(self):
+        with mock.patch.object(fetch_images, "_api_get", side_effect=OSError("boom")):
+            with contextlib.redirect_stderr(io.StringIO()) as err:
+                got = fetch_images.fetch("q", self.out, 2, 800)
+        self.assertEqual(got, [])
+        self.assertIn("FAIL search", err.getvalue())
+
+    def test_no_pages_returns_empty_and_warns(self):
+        with mock.patch.object(fetch_images, "_api_get", return_value={"query": {}}):
+            with contextlib.redirect_stderr(io.StringIO()) as err:
+                got = fetch_images.fetch("q", self.out, 2, 800)
+        self.assertEqual(got, [])
+        self.assertIn("EMPTY", err.getvalue())
+
+    def test_download_failure_is_skipped_not_fatal(self):
+        def opener(req, timeout=0):
+            raise OSError("download caiu")
+
+        got, _ = self.run_fetch({"1": page("File:a.jpg", thumb="https://up.example/a.jpg")}, urlopen=opener)
+        self.assertEqual(got, [])
+
+    def test_requests_send_compliant_user_agent_and_width(self):
+        seen = {}
+
+        def fake_api(params):
+            seen.update(params)
+            return {"query": {"pages": {}}}
+
+        with mock.patch.object(fetch_images, "_api_get", side_effect=fake_api):
+            with contextlib.redirect_stderr(io.StringIO()):
+                fetch_images.fetch("Georgetown", self.out, 3, 1200)
+        self.assertEqual(seen["gsrsearch"], "Georgetown")
+        self.assertEqual(seen["gsrlimit"], 3)
+        self.assertEqual(seen["iiurlwidth"], 1200)
+        self.assertEqual(seen["gsrnamespace"], 6)
+        self.assertIn("huashu-design", fetch_images.UA)
+
+    def test_module_clears_proxy_env(self):
+        for key in ("ALL_PROXY", "HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "all_proxy"):
+            self.assertNotIn(key, os.environ)
+
+
+class MainTest(unittest.TestCase):
+    def run_main(self, argv, fetch_result):
+        with mock.patch.object(sys, "argv", ["fetch_images.py", *argv]):
+            with mock.patch.object(fetch_images, "fetch", return_value=fetch_result) as fetch:
+                with contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()):
+                    try:
+                        fetch_images.main()
+                        code = None
+                    except SystemExit as exc:
+                        code = exc.code
+        return code, fetch
+
+    def test_exit_1_when_nothing_downloaded(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            code, _ = self.run_main(["--query", "a", "b", "--out", os.path.join(tmp, "img")], [])
+        self.assertEqual(code, 1)
+
+    def test_success_creates_out_dir_and_passes_defaults(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            out = os.path.join(tmp, "novo", "img")
+            code, fetch = self.run_main(["--query", "a", "b", "--out", out], ["f.jpg"])
+            self.assertIsNone(code)
+            self.assertTrue(os.path.isdir(out))
+        self.assertEqual(fetch.call_count, 2, "um fetch por query")
+        fetch.assert_any_call("a", out, 2, 1600)
+
+    def test_custom_count_and_width(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            out = os.path.join(tmp, "img")
+            _, fetch = self.run_main(["--query", "x", "--out", out, "--count", "4", "--width", "800"], ["f"])
+        fetch.assert_called_once_with("x", out, 4, 800)
+
+    def test_requires_query_and_out(self):
+        with mock.patch.object(sys, "argv", ["fetch_images.py"]):
+            with contextlib.redirect_stderr(io.StringIO()):
+                with self.assertRaises(SystemExit) as ctx:
+                    fetch_images.main()
+        self.assertEqual(ctx.exception.code, 2)
+
+
+class ParseViewportTest(unittest.TestCase):
+    def test_parses_width_x_height(self):
+        self.assertEqual(verify.parse_viewport("1440x900"), {"width": 1440, "height": 900})
+        self.assertEqual(verify.parse_viewport("375x667"), {"width": 375, "height": 667})
+
+    def test_rejects_malformed(self):
+        for bad in ("1440", "axb", "1x2x3", ""):
+            with self.assertRaises(ValueError, msg=bad):
+                verify.parse_viewport(bad)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/src/skills-lib/wizz-huashu-design/scripts/tts-doubao.mjs

@@ -28,8 +28,7 @@ import { randomUUID } from 'node:crypto';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const SKILL_ROOT = path.resolve(__dirname, '..');
 
-function loadEnv() {
-  const envPath = path.join(SKILL_ROOT, '.env');
+function loadEnv(envPath = path.join(SKILL_ROOT, '.env')) {
   if (!fs.existsSync(envPath)) return;
   const text = fs.readFileSync(envPath, 'utf8');
   for (const line of text.split('\n')) {
@@ -45,7 +44,6 @@ function loadEnv() {
     if (!(key in process.env)) process.env[key] = val;
   }
 }
-loadEnv();
 
 function parseArgs(argv) {
   const args = { speed: '1.0', encoding: 'mp3' };
@@ -90,16 +88,9 @@ function getDuration(filePath) {
   }
 }
 
-async function tts({ text, voice, speed, encoding }) {
-  const apiKey = process.env.DOUBAO_TTS_API_KEY;
-  const cluster = process.env.DOUBAO_TTS_CLUSTER || 'volcano_icl';
-  const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v1/tts';
-  const voiceId = voice || process.env.DOUBAO_TTS_VOICE_ID;
-
-  if (!apiKey) throw new Error('缺 DOUBAO_TTS_API_KEY（检查 .env）');
-  if (!voiceId) throw new Error('缺 DOUBAO_TTS_VOICE_ID（检查 .env 或用 --voice 传）');
-
-  const body = {
+/** Corpo da requisição à API do Doubao (puro, sem rede). */
+function buildTtsBody({ cluster, voiceId, encoding, speed, text, reqid = randomUUID() }) {
+  return {
     app: { cluster },
     user: { uid: 'wizz-huashu-design' },
     audio: {
@@ -108,11 +99,36 @@ async function tts({ text, voice, speed, encoding }) {
       speed_ratio: parseFloat(speed),
     },
     request: {
-      reqid: randomUUID(),
+      reqid,
       text,
       operation: 'query',
     },
   };
+}
+
+/** Valida a resposta JSON do Doubao e devolve o áudio decodificado (Buffer). */
+function parseTtsResponse(json) {
+  // 豆包标准返回：{ code, message, data: "<base64 audio>", ... }
+  // code === 3000 表示成功
+  if (json.code !== undefined && json.code !== 3000) {
+    throw new Error(`API 返回错误 code=${json.code} msg=${json.message || JSON.stringify(json)}`);
+  }
+  if (!json.data) {
+    throw new Error(`API 响应无 data 字段：${JSON.stringify(json).slice(0, 500)}`);
+  }
+  return Buffer.from(json.data, 'base64');
+}
+
+async function tts({ text, voice, speed, encoding }) {
+  const apiKey = process.env.DOUBAO_TTS_API_KEY;
+  const cluster = process.env.DOUBAO_TTS_CLUSTER || 'volcano_icl';
+  const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v1/tts';
+  const voiceId = voice || process.env.DOUBAO_TTS_VOICE_ID;
+
+  if (!apiKey) throw new Error('缺 DOUBAO_TTS_API_KEY（检查 .env）');
+  if (!voiceId) throw new Error('缺 DOUBAO_TTS_VOICE_ID（检查 .env 或用 --voice 传）');
+
+  const body = buildTtsBody({ cluster, voiceId, encoding, speed, text });
 
   const res = await fetch(endpoint, {
     method: 'POST',
@@ -128,16 +144,7 @@ async function tts({ text, voice, speed, encoding }) {
     throw new Error(`HTTP ${res.status}: ${errText.slice(0, 500)}`);
   }
 
-  const json = await res.json();
-  // 豆包标准返回：{ code, message, data: "<base64 audio>", ... }
-  // code === 3000 表示成功
-  if (json.code !== undefined && json.code !== 3000) {
-    throw new Error(`API 返回错误 code=${json.code} msg=${json.message || JSON.stringify(json)}`);
-  }
-  if (!json.data) {
-    throw new Error(`API 响应无 data 字段：${JSON.stringify(json).slice(0, 500)}`);
-  }
-  return Buffer.from(json.data, 'base64');
+  return parseTtsResponse(await res.json());
 }
 
 async function main() {
@@ -178,7 +185,14 @@ async function main() {
   console.log(JSON.stringify(result));
 }
 
-main().catch((err) => {
-  console.error(`TTS 失败：${err.message}`);
-  process.exit(1);
-});
+// Só executa quando chamado como script; importar o módulo (testes) não lê .env nem chama a API.
+const isMain = process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  loadEnv();
+  main().catch((err) => {
+    console.error(`TTS 失败：${err.message}`);
+    process.exit(1);
+  });
+}
+
+export { parseArgs, loadEnv, buildTtsBody, parseTtsResponse };

package/src/skills-lib/wizz-ig-profile-optimizer/SKILL.md

@@ -18,7 +18,7 @@ All text delivered is Brazilian Portuguese with "você", and no em dash in anyth
 
 1. **Read the profile.** `scripts/capture-profile.sh <@> <out_dir>` (out_dir under `_wizz-output/`) saves `profile.png` and `profile.json` (NAME, bio and link as text, follower and post counts). **Open the image.** Logged out, Instagram may hide highlights, the category label and the pin marks: ask for a screenshot of those parts instead of guessing them.
 2. **Pull what the Method already knows**, before judging:
-   - Positioning, audience and tone from the project's Cérebro (`/cerebro ver`).
+   - Positioning, audience and tone from the project's Cérebro (`/wizz-cerebro ver`).
    - Highlights already made in the project (for example a `posts/highlights/` folder).
    - The offer from `wizz-offer-forge`, when one exists: the link and one pin depend on it.
    - Real performance: with Buffer connected, `get_aggregated_post_metrics` and the post list give the best posts by saves, shares and reach. Without it, ask which posts did best; never pick pins by guess.

package/src/skills-lib/wizz-inicio-de-projeto/SKILL.md

@@ -87,7 +87,7 @@ Before the first file of a new project, and on the first use of the method in an
 
 1. `node _wizz/hooks/wizz-arrumar.js layout` proposes it from what already exists (types: `codigo`, `scripts`, `dados`, `docs`, `midia`, `arquivo`; a type mapped to `.` lives at the root, e.g. a Next.js app at the root).
 2. Show the proposal to the owner in **one line** and record it with `node _wizz/hooks/wizz-arrumar.js layout --gravar [tipo=pasta ...]`. It creates each new folder with a short README.
-3. An existing project with loose files at the root: `wizz-arrumar.js planejar` writes a `.tsv` manifest; review it and run `wizz-arrumar.js aplicar <manifesto> --testes "<test command>" --refs <auto-memory dir>`. It moves, rewrites references in code, docs and memories, runs the tests before and after, and writes `desfazer.sh`.
+3. An existing project with loose files at the root: `wizz-arrumar.js planejar` writes a `.tsv` manifest; review it and run `wizz-arrumar.js aplicar <manifesto> --testes "<test command>" --refs <auto-memory dir>`. It moves, rewrites references in code, docs and memories, runs the tests before and after, and writes an undo: `wizz-arrumar.js desfazer <run folder>` on any OS, or the `desfazer.sh` (`desfazer.cmd` on Windows) shortcut. `--testes` accepts only known test runners (npm/pnpm/yarn/bun test, npx vitest|jest, pytest, go/cargo/make test); any other command needs `--testes-livre`.
 
 From then on the `wizz-artifact-guard.js` hook points out any file born loose at the root and the command that moves it. Full duty in the wizz module's `_shared/organizacao.md`.
 

package/src/skills-lib/wizz-launch-readiness/SKILL.md

@@ -8,8 +8,8 @@ description: >
   ready to launch?", "pre-launch audit", "broad release checklist", "what's left
   before going to production", considering the whole project (not just the site). Output: a diagnosis
   prioritized by severity (red blocks launch, orange high, yellow medium, green ok), never
-  blind fixing. Different from security-audit-pentest (hunts vulnerabilities with proof of exploitation)
-  and site-launch-kit (executes the 15 rounds for ONE site): this DIAGNOSES the whole project and points to
+  blind fixing. Different from wizz-security-audit-pentest (hunts vulnerabilities with proof of exploitation)
+  and wizz-site-launch-kit (executes the 15 rounds for ONE site): this DIAGNOSES the whole project and points to
   the right fix owner per finding. Persists the result in a dated section of project-context.md.
 ---
 
@@ -17,7 +17,7 @@ description: >
 
 Seven checking areas, each a closed pass: single scope, standardized output, its own cutoff rule. At the end, a merge step consolidates everything into a prioritized diagnosis and writes the summary to the project's `project-context.md`.
 
-This is not a build skill (that's `wizz-premium-landing-ui-researcher` / `wizz-taste-skill` / `wizz-agent-dev`), not the vulnerability-hunting methodology (that's `security-audit-pentest`), and it doesn't execute the 15 corrective rounds for a site (that's `site-launch-kit`): this is a broad, prioritized diagnosis to decide whether it's ready to launch.
+This is not a build skill (that's `wizz-premium-landing-ui-researcher` / `wizz-taste-skill` / `wizz-agent-dev`), not the vulnerability-hunting methodology (that's `wizz-security-audit-pentest`), and it doesn't execute the 15 corrective rounds for a site (that's `wizz-site-launch-kit`): this is a broad, prioritized diagnosis to decide whether it's ready to launch.
 
 ## Stage gate (read BEFORE running)
 
@@ -25,7 +25,7 @@ Read the project's stage: `grep -m1 '^stage:' {project-root}/**/project-context.
 
 - **`mvp` or `production`:** run the full audit. This is exactly what the skill exists for.
 - **`prototype` or no `project-context.md` file:** stop before running. Reply that the project is still too early for a launch audit (little or nothing built yet to audit) and point to the right path for this stage: `wizz-inicio-de-projeto`, `wizz-forge-idea`, or `wizz-decision-maker` to define the product first. Only proceed if the user explicitly insists, and in that case warn that the findings will come back full of PENDING ITEMS due to lack of built surface.
-- **`maintenance`:** normally not the use case (product already launched, running). Only makes sense if the request is about a NEW batch starting from scratch (a big feature, a new product within the same repo): confirm this before running; otherwise, point to `security-audit-pentest` (periodic pentest) or the `wizz-router`'s "360° Audit" mode (broad audit of a codebase already in production, not about a launch event).
+- **`maintenance`:** normally not the use case (product already launched, running). Only makes sense if the request is about a NEW batch starting from scratch (a big feature, a new product within the same repo): confirm this before running; otherwise, point to `wizz-security-audit-pentest` (periodic pentest) or the `wizz-router`'s "360° Audit" mode (broad audit of a codebase already in production, not about a launch event).
 
 ## Common contract (applies to all 7 areas)
 
@@ -81,8 +81,8 @@ After the 7:
 
 ## Relationship with other skills
 
-- **`security-audit-pentest`**: security deep dive. Area 02 here is a light sweep (exposed surface); findings that need proof of exploitation ("how it's exploited") go to `security-audit-pentest`, they aren't redone here.
-- **`site-launch-kit`**: when the surface of the finding is a SITE (CTA, social proof, Open Graph, local schema, robots/sitemap, site LGPD, measurement), the fix owner is `site-launch-kit`. This skill doesn't repeat the 15 rounds: it only points to which round resolves the finding.
+- **`wizz-security-audit-pentest`**: security deep dive. Area 02 here is a light sweep (exposed surface); findings that need proof of exploitation ("how it's exploited") go to `wizz-security-audit-pentest`, they aren't redone here.
+- **`wizz-site-launch-kit`**: when the surface of the finding is a SITE (CTA, social proof, Open Graph, local schema, robots/sitemap, site LGPD, measurement), the fix owner is `wizz-site-launch-kit`. This skill doesn't repeat the 15 rounds: it only points to which round resolves the finding.
 - **`wizz-seo-audit`**: broad ranking/traffic/Core Web Vitals diagnosis. Area 03 here is only basic indexability (can the site be found), not a full SEO audit.
 - **`wizz-router`'s "360° Audit" mode**: a broad audit of a project already in production, by technical area (code, database, design, growth...), without the "we're about to launch" framing or the stage gate. Use wizz-launch-readiness for the launch event; use 360° mode for a mature project's general health.
 
@@ -90,5 +90,5 @@ After the 7:
 
 - Doesn't fix anything on its own; it points to the fix owner.
 - Doesn't decide GO/NO-GO on behalf of the project owner; delivers the prioritized reading.
-- Doesn't replace `security-audit-pentest` for deep security or `site-launch-kit` for executing the 15 site rounds.
+- Doesn't replace `wizz-security-audit-pentest` for deep security or `wizz-site-launch-kit` for executing the 15 site rounds.
 - Doesn't run on a project with no built surface (discovery/ideation stage).

package/src/skills-lib/wizz-launch-readiness/references/02-seguranca.md

@@ -1,6 +1,6 @@
 # Area 02 · Security
 
-A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities with proof of exploitation. A finding that requires a concrete payload to prove (mass assignment, IDOR, injection) is NOT dug into here: log the suspicion as 🟠 and point to `security-audit-pentest` as the owner of the deep dive.
+A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities with proof of exploitation. A finding that requires a concrete payload to prove (mass assignment, IDOR, injection) is NOT dug into here: log the suspicion as 🟠 and point to `wizz-security-audit-pentest` as the owner of the deep dive.
 
 ## Objective checks
 
@@ -11,11 +11,11 @@ A sweep of the exposed SURFACE before launch, not a hunt for vulnerabilities wit
 5. **CORS too open.** `Access-Control-Allow-Origin: *` on an API that accepts credentials/tokens is 🔴; without credentials is 🟡.
 6. **Rate limiting missing on a sensitive route.** Login, signup, password recovery, or an endpoint that costs money (AI, SMS, email) with no limit at all is 🟠; point to `wizz-web-security` as the fixer.
 7. **Dependency with a known critical CVE on the production path.** Reinforces finding #7 from area 01 if it applies specifically to an auth/crypto lib: escalate to 🔴.
-8. **Unproven indication of mass assignment, IDOR, or injection.** An update field that accepts the client's entire object with no allowlist, or a query built by string concatenation: log as 🟠 "suspicion, needs proof of exploitation" and point to `security-audit-pentest`.
+8. **Unproven indication of mass assignment, IDOR, or injection.** An update field that accepts the client's entire object with no allowlist, or a query built by string concatenation: log as 🟠 "suspicion, needs proof of exploitation" and point to `wizz-security-audit-pentest`.
 
 ## Cutoff rule
 
-This area NEVER delivers "how to exploit it" with a real payload: that is exclusively `security-audit-pentest`'s scope. If during the sweep you'd already have the payload ready, still don't include it here: log the suspicion and the reference, to avoid duplicating the two skills' output format.
+This area NEVER delivers "how to exploit it" with a real payload: that is exclusively `wizz-security-audit-pentest`'s scope. If during the sweep you'd already have the payload ready, still don't include it here: log the suspicion and the reference, to avoid duplicating the two skills' output format.
 
 ## Output format
 

package/src/skills-lib/wizz-launch-readiness/references/03-seo-descoberta.md

@@ -1,16 +1,16 @@
 # Area 03 · SEO / Discoverability
 
-Checks whether the product CAN be found on launch day. This is not a ranking, traffic, or Core Web Vitals diagnosis (that's `wizz-seo-audit`), and when the surface is a SITE, it doesn't repeat the execution rounds (that's `site-launch-kit`, rounds 08 to 13): here it only confirms whether basic indexability exists.
+Checks whether the product CAN be found on launch day. This is not a ranking, traffic, or Core Web Vitals diagnosis (that's `wizz-seo-audit`), and when the surface is a SITE, it doesn't repeat the execution rounds (that's `wizz-site-launch-kit`, rounds 08 to 13): here it only confirms whether basic indexability exists.
 
 If the project has no indexable public web surface (e.g., mobile-only app, internal tool), respond `ITEM DOES NOT APPLY` with a 1-line justification and stop.
 
 ## Objective checks
 
-1. **`robots.txt` present and not blocking everything.** Missing is 🟠; present but blocking `Disallow: /` in production by mistake is 🔴. Point to `site-launch-kit` (round 13) as the fixer.
+1. **`robots.txt` present and not blocking everything.** Missing is 🟠; present but blocking `Disallow: /` in production by mistake is 🔴. Point to `wizz-site-launch-kit` (round 13) as the fixer.
 2. **Sitemap present and referenced in `robots.txt`.** Missing is 🟠.
-3. **Unique title and meta description on the main public pages.** A default/repeated title (e.g., the same title on every page) is 🟠. Point to `site-launch-kit` (round 08).
-4. **Open Graph configured.** Without `og:title`/`og:image`/`og:description`, the share preview (WhatsApp, social) comes out broken. It's 🟡, but escalates to 🟠 if the launch's main acquisition channel is social/WhatsApp. Point to `site-launch-kit` (round 09).
-5. **Basic structured business data.** Absence isn't a standalone blocker, but if the business depends on appearing in Google local/rich snippets, it's 🟡. Point to `site-launch-kit` (round 12) or `wizz-schema-markup`.
+3. **Unique title and meta description on the main public pages.** A default/repeated title (e.g., the same title on every page) is 🟠. Point to `wizz-site-launch-kit` (round 08).
+4. **Open Graph configured.** Without `og:title`/`og:image`/`og:description`, the share preview (WhatsApp, social) comes out broken. It's 🟡, but escalates to 🟠 if the launch's main acquisition channel is social/WhatsApp. Point to `wizz-site-launch-kit` (round 09).
+5. **Basic structured business data.** Absence isn't a standalone blocker, but if the business depends on appearing in Google local/rich snippets, it's 🟡. Point to `wizz-site-launch-kit` (round 12) or `wizz-schema-markup`.
 6. **Canonical and non-duplicated indexing.** Multiple URLs serving the same content without `rel=canonical` is 🟡.
 7. **Domain/DNS resolving to the right production environment.** A domain configured but pointing to the staging/preview environment is 🔴 (also an infra finding, see area 07; log only the discoverability part here: whether the search engine has already indexed the wrong domain).
 

package/src/skills-lib/wizz-launch-readiness/references/04-analytics-medicao.md

@@ -6,7 +6,7 @@ Checks whether the team will be able to KNOW if the launch worked. A launch with
 
 1. **Analytics tool installed and firing.** No GA4/pixel/equivalent tool loading on the public pages at all is 🔴 if the launch depends on measuring acquisition; 🟠 otherwise.
 2. **Main conversion event configured.** The event that represents the launch's goal (signup, purchase, lead, download) not firing or not existing is 🔴.
-3. **Thank-you/confirmation page event.** A post-conversion page with no "confirmed conversion" event (distinct from just "visited the page") is 🟠. Overlaps with `site-launch-kit` round 15 when the surface is a site.
+3. **Thank-you/confirmation page event.** A post-conversion page with no "confirmed conversion" event (distinct from just "visited the page") is 🟠. Overlaps with `wizz-site-launch-kit` round 15 when the surface is a site.
 4. **Trackable traffic source/UTM.** Launch campaigns without standardized UTM is 🟡: it measures what happened, but not where it came from.
 5. **Production error monitoring (Sentry or equivalent).** A project that already uses an error tool but it's not active in the production environment is 🟠. A project that never adopted one at all is 🟡 (not a recommendation to adopt Sentry now, just logging a gap: the adoption decision belongs to the team).
 6. **Downtime/uptime alert.** No alert configured for when the product goes down on launch day (when traffic is most sensitive) is 🟠.