oh-my-opencode 5.0.0-beta.62 → 5.0.0-beta.64

package/packages/omo-codex/plugin/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "@sisyphuslabs/omo-codex-plugin",
-	"version": "5.0.0-beta.62",
+	"version": "5.0.0-beta.64",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@sisyphuslabs/omo-codex-plugin",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"workspaces": [
 				"components/comment-checker",
 				"components/git-bash",
@@ -90,7 +90,7 @@
 		},
 		"components/comment-checker": {
 			"name": "@code-yeongyu/codex-comment-checker",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"bin": {
 				"omo-comment-checker": "dist/cli.js"
@@ -111,7 +111,7 @@
 		},
 		"components/git-bash": {
 			"name": "@sisyphuslabs/codex-git-bash-hook",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"bin": {
 				"omo-git-bash-hook": "dist/cli.js"
 			},
@@ -125,7 +125,7 @@
 		},
 		"components/lazycodex-executor-verify": {
 			"name": "@code-yeongyu/codex-lazycodex-executor-verify",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"bin": {
 				"lazycodex-executor-verify": "dist/cli.js"
@@ -142,7 +142,7 @@
 		},
 		"components/lsp": {
 			"name": "@code-yeongyu/codex-lsp",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"dependencies": {
 				"@code-yeongyu/lsp-daemon": "file:../../../../lsp-daemon",
@@ -163,7 +163,7 @@
 		},
 		"components/rules": {
 			"name": "@code-yeongyu/codex-rules",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"dependencies": {
 				"picomatch": "^4.0.7"
@@ -185,7 +185,7 @@
 		},
 		"components/teammode": {
 			"name": "@sisyphuslabs/codex-teammode",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"devDependencies": {
 				"@types/node": "^26.2.0",
 				"bun-types": "^1.4.2",
@@ -198,7 +198,7 @@
 		},
 		"components/telemetry": {
 			"name": "@code-yeongyu/codex-telemetry",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"bin": {
 				"omo-telemetry": "dist/cli.js"
@@ -216,7 +216,7 @@
 		},
 		"components/ultrawork": {
 			"name": "@code-yeongyu/codex-ultrawork",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"bin": {
 				"omo-ultrawork": "dist/cli.js"
@@ -234,7 +234,7 @@
 		},
 		"components/ulw-execute-continuation": {
 			"name": "@code-yeongyu/codex-ulw-execute-continuation",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"bin": {
 				"omo-ulw-execute-continuation": "dist/cli.js"
@@ -251,7 +251,7 @@
 		},
 		"components/ulw-loop": {
 			"name": "@code-yeongyu/codex-ulw-loop",
-			"version": "5.0.0-beta.62",
+			"version": "5.0.0-beta.64",
 			"license": "MIT",
 			"bin": {
 				"omo-ulw-loop": "dist/cli.js",

package/packages/omo-codex/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sisyphuslabs/omo-codex-plugin",
-  "version": "5.0.0-beta.62",
+  "version": "5.0.0-beta.64",
   "description": "Aggregate Codex plugin root for OMO components.",
   "type": "module",
   "packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/scripts/sync-skills.d.mts

@@ -0,0 +1,4 @@
+export function getSkillOutputManifest(): Promise<{
+  readonly root: string
+  readonly names: readonly string[]
+}>

package/packages/omo-codex/plugin/scripts/sync-skills.mjs

@@ -274,6 +274,19 @@ async function adaptSkillForCodex(skillName) {
 	await writeCodexSkillDisplayMetadata(skillName);
 }
 
+// Read-only inventory shared by generation and shipped-payload validation.
+export async function getSkillOutputManifest() {
+	const sharedSkillEntries = await readdir(sharedSkillsRoot, { withFileTypes: true });
+	const sharedSkillNames = sharedSkillEntries
+		.filter((entry) => entry.isDirectory())
+		.map((entry) => entry.name)
+		.sort();
+	return {
+		root: skillsRoot,
+		names: [...new Set([...componentSkillNames, ...sharedSkillNames])],
+	};
+}
+
 async function syncSkills() {
 	await rm(skillsRoot, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
 	await mkdir(skillsRoot, { recursive: true });
@@ -292,13 +305,8 @@ async function syncSkills() {
 	);
 	await adaptSkillForCodex("ultrawork");
 
-	const sharedSkillEntries = await readdir(sharedSkillsRoot, { withFileTypes: true });
-	const sharedSkillNames = sharedSkillEntries
-		.filter((entry) => entry.isDirectory())
-		.map((entry) => entry.name)
-		.sort();
-
-	for (const skillName of sharedSkillNames) {
+	const { names } = await getSkillOutputManifest();
+	for (const skillName of names) {
 		if (componentSkillNames.has(skillName)) continue;
 		const sharedSkillSource = join(sharedSkillsRoot, skillName);
 		await cp(sharedSkillSource, join(skillsRoot, skillName), {

package/packages/omo-codex/plugin/skills/ast-grep/SKILL.md

@@ -11,6 +11,18 @@ This skill ships a Python wrapper at `scripts/ast_grep_helper.py` and platform i
 
 ---
 
+## OmO native: the ast-grep MCP tools (fastest path, no CLI needed)
+
+OmO native also registers a bundled ast-grep MCP server. Its three tools are **deferred**: they are absent from the resident tool list and activate automatically the first time you call them by name — no `tool_search` round trip needed.
+
+- `mcp__ast_grep_search({ pattern, language, paths })` — AST-shape search, the MCP equivalent of `sg run -p`. Prefer this over shelling out to `sg` for one-off lookups: no install, no PATH issues.
+- `mcp__ast_grep_rewrite({ pattern, rewrite, language, paths, apply })` — preview matches (`apply: false`, the default) or apply the rewrite (`apply: true`). Same two-pass discipline as `sg run -r`: preview first, then apply.
+- `mcp__ast_grep_scan({ paths })` — run project YAML rules (`sgconfig.yml`, `rules/`), the MCP equivalent of `sg scan`.
+
+Same pattern language as the CLI: `$VAR` matches one AST node, `$$$VAR` matches zero or more, and the pattern is code, not regex. `paths` accepts a file or directory list; `language` is required for patterns that are ambiguous across languages.
+
+---
+
 ## When to use this skill
 
 Use it whenever the user's question is about **code structure**, not bytes:

package/packages/omo-codex/plugin/skills/debugging/references/tools/playwright-cli.md

@@ -1,194 +1,112 @@
-# Playwright CLI — Browser QA That Actually Drives a Browser
+# Browser QA — Scripts from js eval
 
-**https://playwright.dev/ · https://github.com/microsoft/playwright**
-
-For any browser-served web UI bug, this is the correct tool. Not curl. Not imagination. Not a headless HTTP library. A real browser with a real rendering engine, real JS execution, real cookies, real service workers, real viewport.
-
-**In Phase 8 Manual QA for browser products, using Playwright is not optional.** Curl cannot catch: CSS that breaks at specific viewport widths, hydration mismatches, client-side router bugs, cookie/session interactions, service-worker caching, JS-triggered navigations. All of those are common bug classes. Drive a browser.
-
-> Note: `microsoft/playwright-cli` is the legacy repo; the current tooling lives in `@playwright/test` (npm) and `playwright` (pip), which include the `playwright` CLI. Use those — the legacy `playwright-cli` package is deprecated.
-
----
+A browser UI bug needs a rendered browser, not curl. Use two tiers from the
+js-eval kernel: `new Bun.WebView()` on Bun >= 1.4 for ordinary captures (macOS
+uses WebKit; Linux/Windows need installed Chrome/Chromium/Edge), otherwise a
+written `playwright-core` script against local Chrome. Use the script tier for
+Chrome semantics, stealth, traces, keyboard events, or authenticated profiles.
+In Codex, prefer `browser:control-in-app-browser` for ordinary page control.
 
 ## When to reach for Playwright
 
-| Bug symptom | Use Playwright? |
-|---|---|
-| Form submit produces wrong result | ✅ — Playwright drives the form exactly as a user does |
-| Page blank in prod, fine locally | ✅ — hydration/env differences need a real browser |
-| CSS looks wrong at a specific width | ✅ — use `--viewport-size` |
-| Click doesn't fire / wrong handler | ✅ — Playwright fires real DOM events |
-| Flash of unstyled content / loading glitch | ✅ — use trace viewer to see frames |
-| API returns wrong data | ❌ — use curl, this isn't a browser bug |
-| Backend returns wrong status code | ❌ — use curl |
-| Client hits a URL that returns 500 | ✅ but also ❌ — Playwright shows the call + response + failure effect on UI |
-
----
+Use the script tier for forms, hydration, responsive CSS, cookie/session flows,
+service workers, or client-side navigation. For a backend-only status/body bug,
+use HTTP. WebView is headless, WebKit has no CDP, and `type()` emits no keyboard
+events; choose real Chrome when these distinctions affect the reproduction.
 
 ## Install (per-project)
 
-Playwright installs browser binaries separately from the npm package.
-
-```bash
-# In the project
-npm init playwright@latest             # interactive; picks TS/JS + browsers + config
-# Or if Playwright is already a dep:
-npx playwright install                 # downloads browsers
-npx playwright install chromium        # just chromium
-npx playwright install --with-deps     # also installs OS deps (Linux)
-```
-
-Python:
-```bash
-pip install playwright
-playwright install
-```
+Reuse installed `playwright-core`. If absent, the user can install the script
+dependency once with `bun add playwright-core`. Chrome must already be installed;
+report an absent executable rather than downloading a managed browser. Write the
+script beside the dependency so normal module resolution works.
 
----
+For stealth, use the ultimate-browsing reference `references/chrome-stealth.md`:
+its optional plugins are user-installed once in the engine directory and executed
+as a script, not injected into WebView.
 
 ## The four things you'll actually use
 
-### 1. `codegen` — record a session, generate the script
-
-The fastest way to create a repro. Opens a real browser; your clicks / typing become a Playwright script you can paste into a test.
-
-```bash
-npx playwright codegen https://your-app.local
-npx playwright codegen --viewport-size=375,667 https://your-app.local    # iPhone SE size
-npx playwright codegen --device="iPhone 14" https://your-app.local
-```
-
-Click / type / navigate in the browser; watch the script build in the side panel. Copy the generated script into your journal as the repro for Phase 8.
-
-### 2. A one-shot Playwright script — reproduce + capture
-
-Usually the Phase 8 QA artifact. Save to `/tmp/debug-repro.spec.ts` (journal it):
-
-```ts
-// /tmp/debug-repro.spec.ts
-import { test, expect } from '@playwright/test';
-
-test('refinement chat shows non-empty response when env var set', async ({ page }) => {
-  await page.goto('http://localhost:3000/chat');
-  await page.fill('textarea[name="message"]', 'Add a logging step');
-  await page.click('button[type=submit]');
-
-  // Wait for the response to appear (not just the spinner to disappear)
-  const response = page.locator('[data-testid="assistant-reply"]');
-  await expect(response).toBeVisible({ timeout: 30_000 });
-  await expect(response).not.toBeEmpty();
-
-  // Capture evidence
-  await page.screenshot({ path: '/tmp/debug-after-fix.png', fullPage: true });
-  console.log(await response.textContent());
-});
-```
-
-Run it with tracing enabled for rich post-mortem:
-
-```bash
-npx playwright test /tmp/debug-repro.spec.ts --trace on --headed
-```
-
-### 3. `PWDEBUG=1` — step through the script with Playwright Inspector
-
-```bash
-PWDEBUG=1 npx playwright test /tmp/debug-repro.spec.ts
+### 1. Write a reproduction script
+
+Record the exact URL, inputs, viewport, expected UI state, and output artifact.
+For auth, CLONE the user-data directory and use `launchPersistentContext` on the
+clone. NEVER launch against or clear data from the live profile.
+
+### 2. Reproduce + capture
+
+```js
+// debug-repro.mjs
+import { chromium } from 'playwright-core';
+const [url, pngPath, tracePath] = process.argv.slice(2);
+const browser = await chromium.launch({ channel: 'chrome', headless: true });
+try {
+  const context = await browser.newContext({ viewport: { width: 1280, height: 720 } });
+  await context.tracing.start({ screenshots: true, snapshots: true });
+  try {
+    const page = await context.newPage();
+    page.on('pageerror', error => console.error(error));
+    await page.goto(url, { waitUntil: 'load', timeout: 30000 });
+    // Add the scenario's actions and locator/state assertions here.
+    await page.screenshot({ path: pngPath });
+    console.log(pngPath);
+  } finally {
+    await context.tracing.stop({ path: tracePath });
+    await context.close();
+  }
+} finally {
+  await browser.close();
+}
 ```
 
-Opens the Playwright Inspector alongside the browser. You can step through Playwright actions, see the DOM state at each step, and edit selectors on the fly.
-
-Use this when the script doesn't reproduce cleanly and you need to watch it run.
+A screenshot alone is not a reproduction assertion. Use locators for the exact
+observable state; fail the script when that state is absent.
 
-### 4. `show-trace` — post-mortem on a failed run
+### 3. Run from the js-eval kernel
 
-```bash
-npx playwright show-trace trace.zip
-# or from the test-results dir:
-npx playwright show-trace test-results/<test-name>/trace.zip
+```js
+const { promisify } = await import('node:util')
+const { execFile } = await import('node:child_process')
+const result = await promisify(execFile)('node', [scriptPath, url, pngPath, tracePath], { timeout: 60000 })
+console.log(result.stdout)
 ```
 
-Scrubs through a recorded session: timeline, DOM snapshot at each action, network, console, source. When a test failed on CI but passed locally, this is the single best artifact.
+### 4. Inspect the trace
 
----
+Retain the trace ZIP for the project's existing trace viewer and inspect the PNG.
+Trace snapshots, network events, and screenshots identify where the UI diverged.
+Keep auth-bearing traces private; do not upload them to public viewers.
 
 ## Headless vs headed during debugging
 
-Always add `--headed` when debugging. Headless browsers sometimes behave subtly differently (font rendering, viewport, media permissions). For QA evidence, run headed and screenshot.
-
-```bash
-npx playwright test --headed
-npx playwright test --headed --project=chromium     # pin the browser
-```
-
----
+Use `headless: false` with an available display when reproducing headed-only
+behavior. State which mode produced the evidence; do not claim a headless capture
+proves desktop-browser permissions or window behavior.
 
 ## Catching the silent-failure patterns Playwright is good at
 
-```ts
-// Toast that flashes and disappears
-page.on('console', msg => console.log('[browser console]', msg.type(), msg.text()));
-
-// Unhandled page errors (uncaught exceptions in the page JS)
-page.on('pageerror', err => console.error('[page error]', err));
-
-// Network failures — e.g., backend returned 500 but UI shows nothing
-page.on('response', async resp => {
-  if (!resp.ok()) {
-    console.warn(`[network ${resp.status()}] ${resp.url()} — ${await resp.text()}`);
-  }
-});
-
-// Request that never came back
-page.on('requestfailed', req => {
-  console.error('[request failed]', req.url(), req.failure()?.errorText);
-});
-```
-
-Add these listeners to the top of the debug script. They surface a lot of the "UI showed nothing" class of bug.
-
----
+Subscribe before triggering the action: `page.on('pageerror', ...)`,
+`page.on('requestfailed', ...)`, or a bounded `page.waitForResponse(...)` promise.
+Await that specific response/state rather than sleeping or waiting for generic
+network idleness. Propagate failed assertions and process exit codes.
 
 ## Viewport and device emulation
 
-CSS bugs that only appear at specific sizes, or layout bugs on mobile:
-
-```ts
-// At test level
-test.use({ viewport: { width: 375, height: 667 } });
-
-// Per-page
-await page.setViewportSize({ width: 375, height: 667 });
-
-// Predefined devices
-import { devices } from '@playwright/test';
-test.use({ ...devices['iPhone 14'] });
-```
-
----
+Use `page.setViewportSize({ width: 375, height: 667 })` for a narrow capture.
+`devices` comes from `playwright-core`; apply the desired preset when creating
+a context. Match the reference's pixel scale as well as its viewport.
 
 ## Gotchas
 
-- **Wait for state, not for time.** `await page.waitForTimeout(2000)` is flaky. Use `await expect(locator).toBeVisible()` or `page.waitForResponse(urlPattern)`.
-- **Stale selectors re-resolve.** Playwright's locators re-find the element on each action, unlike Puppeteer's handles. Don't over-think it.
-- **Service workers persist across test runs in headed mode.** If you see cached behavior from a previous run, add `await context.clearCookies()` + clear storage before the test.
-- **Installing on CI requires `--with-deps`** on Linux images that lack the browser's shared-library deps.
-- **Parallel tests share a browser process by default**; if one test polls a debugger port, others may interfere. Use `workers: 1` for debugging.
-
----
+- Wait for state, not time: locator visibility or the exact response is the signal.
+- Locators re-resolve after UI changes; stale element handles do not.
+- Fresh task-owned contexts avoid cached state leaking between runs.
+- Auth belongs in a private clone, never the live browser profile.
+- Give every run its own output directory and bounded process lifetime.
 
 ## Phase 9 cleanup specifics
 
-```bash
-# Remove trace files from debug runs
-rm -rf playwright-report/ test-results/ trace.zip
-
-# Remove debug spec files from /tmp
-rm -f /tmp/debug-*.spec.ts
-
-# Remove screenshot captures
-rm -f /tmp/debug-*.png
-
-# If you installed browsers just for this session (rare):
-# Don't remove them — they're useful for future sessions. They live in ~/Library/Caches/ms-playwright (macOS) or ~/.cache/ms-playwright (Linux).
-```
+Close WebView/browser contexts even on failure, stop the fixture server, and remove
+only this run's temporary scripts and profile clone. Preserve requested PNG/trace
+artifacts, then record the cleanup receipt. Do not kill unrelated browsers or
+remove a user's installed Chrome.

package/packages/omo-codex/plugin/skills/frontend/SKILL.md

@@ -146,7 +146,7 @@ Domains: `product` `style` `typography` `color` `landing` `chart` `ux` `react` `
 | Situation | Load |
 |---|---|
 | Brand/style not among the 70 in `references/design/`, or the user says "Open Design" | `open-design` skill — the local nexu-io/open-design library (137+ design skills, 150+ design systems) |
-| Driving a browser for the Design QA phase | `agent-browser` skill |
+| Driving a browser for the Design QA phase | `visual-qa` skill: Bun.WebView / local-Chrome `playwright-core` scripts from js eval; Codex in-app browser |
 | Pure TypeScript/logic work with zero visual surface | `programming` skill alone — this skill adds nothing there |
 
 ## Activation

package/packages/omo-codex/plugin/skills/frontend/references/design/aside.md

@@ -1,7 +1,7 @@
 # Design System Inspired by Aside
 
 > Category: Developer Tools & IDEs
-> AI browser agent. Bright product-app marketing, custom display type, soft squircle controls, agent-browser product framing.
+> AI browser agent. Bright product-app marketing, custom display type, soft squircle controls, browser-product framing.
 
 ## Provenance
 

package/packages/omo-codex/plugin/skills/frontend/references/design/clone-from-url.md

@@ -8,7 +8,7 @@ A `DESIGN.md` whose every token, interaction state, and motion value was read fr
 
 ## Phase 1 — Extract the runtime truth (never guess a value)
 
-Drive a real browser: Codex `browser:control-in-app-browser` first, otherwise the project's `agent-browser` / playwright / dev-browser tooling. Do NOT parse CSS files — minification, CORS, CSS-in-JS, and Tailwind utilities make source unreliable. `getComputedStyle` returns what the browser ACTUALLY rendered, so it is the only source of truth.
+Drive a real browser from js eval: `new Bun.WebView()` on Bun >= 1.4 (macOS default; Linux/Windows need installed Chrome/Chromium/Edge), otherwise write and run a `playwright-core` script against local Chrome (`channel: "chrome"`). Use that script lane for Chrome semantics, stealth, trace, or auth, with persistent contexts on CLONED profiles only. Codex: `browser:control-in-app-browser`. Do NOT parse CSS files — minification, CORS, CSS-in-JS, and Tailwind utilities make source unreliable. `getComputedStyle` returns what the browser ACTUALLY rendered, so it is the only source of truth.
 
 Sweep the page and read, for every meaningful element and every repeated pattern:
 

package/packages/omo-codex/plugin/skills/frontend/scripts/perfection/lighthouse-audit.py

@@ -11,8 +11,8 @@
 # ─── How to run ───
 # 1. Install uv (if not installed):
 #      curl -LsSf https://astral.sh/uv/install.sh | sh
-# 2. Install Playwright browsers (one-time):
-#      uv run --with playwright python -m playwright install chromium
+# 2. Chrome must already be installed locally:
+#      The script uses channel="chrome"; it downloads no browser.
 # 3. Run:
 #      uv run lighthouse-audit.py https://example.com
 #      uv run lighthouse-audit.py https://example.com --desktop-only

package/packages/omo-codex/plugin/skills/review-work/SKILL.md

@@ -169,7 +169,7 @@ You are the QA lane. Do not delegate hands-on QA to a sub-agent: the orchestrato
 2. **Pick the channel that faithfully exercises the surface** and capture the artifact:
    - HTTP: `curl -i` (or an API request context) - status line, headers, body.
    - CLI / TUI: a real pty - drive the command and keep the transcript; for color or layout evidence render through a browser-based terminal, never a `tmux capture-pane` dump.
-   - Web: the real page in a real browser - the harness's in-process surface (a `Bun.WebView` / `playwright-core` code cell, or Codex's Browser plugin) or the agent-browser CLI - action log plus screenshot.
+   - Web: from js eval, use `new Bun.WebView()` on Bun >= 1.4 (macOS default; Linux/Windows need Chrome/Chromium/Edge). Otherwise, or for Chrome semantics, stealth, trace, or auth, write and run a `playwright-core` script against local Chrome (`channel: "chrome"`; persistent context on a CLONED profile). Codex: `browser:control-in-app-browser`. Capture action log plus screenshot.
    - Desktop / GUI: OS-level automation against the running app - action log plus screenshot.
    - Library / SDK: a script that imports and exercises the public API - transcript.
    - Data-shaped work (migrations, configs, generated files): the resulting artifact itself, diffed or dumped.

package/packages/omo-codex/plugin/skills/ultimate-browsing/ATTRIBUTION.md

@@ -1,8 +1,7 @@
 # ATTRIBUTION / NOTICE
 
 This skill (`ultimate-browsing`, part of `@oh-my-opencode/shared-skills`) ships
-project-original content, one vendored-and-modified upstream engine, plus two
-third-party tools that it installs at runtime (it does NOT vendor their source).
+project-original content and one vendored-and-modified upstream engine.
 Each component's provenance, license, and required notices are reproduced below.
 
 ---
@@ -50,83 +49,3 @@ license obligation:
 These reference platform-native CLIs and public APIs by name (e.g. `xhs`, `yt-dlp`,
 `agent-reach`, `mcporter`, Jina Reader, V2EX public API). Those are external tools the
 user installs separately; this skill includes none of their source.
-
----
-
-## 3. CloakBrowser (CloakHQ) — Tier-2 stealth Chromium (runtime dependency)
-
-The Tier-2 stealth browser is **CloakBrowser**, installed at runtime via `pip`
-(`pip install cloakbrowser`). No CloakBrowser source is vendored in this repository.
-
-- Source: https://github.com/CloakHQ/CloakBrowser
-- Pinned runtime version: **0.5.7** (documented in `references/chrome-stealth.md`;
-  this is a documented version string, not an automated drift check).
-- Wrapper source license: MIT License.
-- Binary license: the compiled CloakBrowser Chromium binary downloaded by
-  `cloakbrowser.ensure_binary()` is governed by the separate CloakBrowser
-  Binary License:
-  https://github.com/CloakHQ/CloakBrowser/blob/main/BINARY-LICENSE.md
-- Redistribution note: this npm package does not redistribute the CloakBrowser
-  binary, does not repackage it, and does not include it in `skills/` or
-  `dist/skills`. Users who run the Tier-2 setup download the binary directly
-  from CloakHQ's official distribution channels and must comply with that
-  binary license.
-
-MIT wrapper source license:
-
-```
-MIT License
-
-Copyright (c) 2026 CloakHQ
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
----
-
-## 4. agent-browser (vercel-labs) — Tier-2 CDP automation CLI (runtime dependency)
-
-The Tier-2 automation CLI is **agent-browser**, installed at runtime via `npm`
-(`bun add -g agent-browser`). No agent-browser source is vendored in this repository.
-
-- Source: https://github.com/vercel-labs/agent-browser
-- Pinned runtime version: **0.34.0** (documented in `references/chrome-stealth.md`;
-  documented version string, no automated drift check).
-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use
-  these files except in compliance with the License. You may obtain a copy of the
-  License at:
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software distributed under
-  the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-  KIND, either express or implied. See the License for the specific language governing
-  permissions and limitations under the License.
-
-- **Changes (Apache-2.0 §4(b)):** none. agent-browser is installed unmodified at
-  runtime; no agent-browser source file is copied, modified, or redistributed by this
-  skill. This skill only documents how to invoke the upstream CLI.
-
-- **NOTICE:** the upstream agent-browser distribution may include a `NOTICE` file. As
-  this skill redistributes no agent-browser source, no upstream NOTICE content is
-  bundled here; consult the upstream repository for its `NOTICE` file when present.
-
-- **Trademark notice:** "agent-browser" and "Vercel" are referenced by name for
-  identification only. No trademark license is granted under the Apache License 2.0
-  (Section 6).