Fix template sync after release

templates/plate-playground-template/.agents/AGENTS.md

@@ -14,22 +14,16 @@ When using the following skills, override the default behavior.
 
 - Do not create `task_plan.md`, `findings.md`, or `progress.md` at repo root. Merge that content into one file under `.claude/docs/plans/`. Example: `.claude/docs/plans/2026-03-11-task.md`
 
-`dev-browser`:
+Browser usage:
 
-- Use `dev-browser --connect http://127.0.0.1:9222` by default for browser work.
-- If `http://127.0.0.1:9222` is unavailable, use `browser-debug-setup` first.
-- Reuse the persistent debug browser/profile. Do not spin up disposable browser instances unless the user asks.
-- Do not close or stop the user's connected debug browser. Close named pages only when needed.
-- Keep scripts small and direct. Prefer `browser.getPage("persistent-main")` for the main app.
-- Use `dev-browser` instead of `agent-browser` or next-devtools `browser_eval`.
-- If `dev-browser` gets blocked by a human prompt or loops on the same step, stop and ask the user to unblock. After the unblock works:
-  - [Add browser learning]
+- Always try `[@browser-use](plugin://browser-use@openai-bundled)` first for browser usage.
+- Do not substitute Puppeteer, standalone Playwright, or raw Chrome DevTools for browser usage.
 
 `ce-*`:
 
 - **Git:** Never git add, commit, push, or create PR unless the user explicitly asks.
 - **PR:** Before creating or updating a PR, run the local verification that actually matters here. At minimum: `bun run typecheck`, `bun run lint:fix`, and `bun run build` if the task touched app behavior or build config.
-- **plan:** Include `dev-browser` in acceptance criteria for browser features.
+- **plan:** Include Browser Use in acceptance criteria for browser features.
 - **deepen-plan:** Context7 only when not covered by skills.
 - **work:** UI tasks require browser verification before marking complete. Never guess.
 
@@ -81,7 +75,7 @@ When using the following skills, override the default behavior.
 • Condition YES -> in_progress -> verify -> completed
 • NEVER git commit unless explicitly asked
 • Avoid unnecessary `bun dev`
-• Use Skill(dev-browser) for browser testing instead of next-devtools browser evaluation
+• Use Browser Use for browser testing instead of next-devtools browser evaluation
 
 **Verification Checklist:**
 

templates/plate-playground-template/.agents/rules/agent-browser-issue.mdc

@@ -1,5 +1,5 @@
 ---
-description: Open a concise GitHub follow-up for reusable dev-browser or agent-browser limitations. Use when browser automation is blocked by a likely tool-side issue that is worth fixing separately, especially for clicks, dropdowns, file inputs, focus traps, or other repeatable agent/browser failures.
+description: Open a concise GitHub follow-up for reusable browser-use limitations. Use when browser automation is blocked by a likely tool-side issue that is worth fixing separately, especially for clicks, dropdowns, file inputs, focus traps, or other repeatable agent/browser failures.
 argument-hint: '[browser block summary]'
 disable-model-invocation: true
 ---

templates/plate-playground-template/.agents/rules/dev-browser.mdc

@@ -0,0 +1,130 @@
+---
+description: Fallback browser automation with persistent Chrome state. Use only when Browser Use is unavailable or blocked.
+---
+
+# Dev Browser
+
+Use this only as the fallback browser path when `[@browser-use](plugin://browser-use@openai-bundled)` is unavailable or blocked.
+
+Do not substitute Puppeteer, standalone Playwright, or raw Chrome DevTools for this fallback path.
+
+## Installation
+
+```bash
+npm install -g dev-browser
+dev-browser install
+```
+
+Run `dev-browser --help` to learn more.
+
+## Plate Defaults
+
+- Use `dev-browser --connect http://127.0.0.1:9222` by default. Do not preflight `9222` first.
+- Only inspect `9222` after a direct `dev-browser --connect http://127.0.0.1:9222` attempt fails.
+- Reuse one persistent debug Chrome on `127.0.0.1:9222`. Do not spin up disposable browser instances unless the user asks.
+- Use a dedicated Chrome `--user-data-dir` for that debug browser, not the user's normal daily Chrome data dir.
+- Clone the signed-in Chrome profile into the dedicated debug dir, then launch the debug browser from that clone.
+- On macOS, launch the debug browser with `open -na "Google Chrome" --args ... --remote-debugging-port=9222` so it opens as a separate Chrome instance without hijacking the user's normal window.
+- Do not close or stop the user's connected debug browser. Leave that debug window open and reuse it. Close named pages only when needed.
+- Keep scripts small and direct. Prefer `browser.getPage("persistent-main")` for the main app.
+- Use `dev-browser` instead of `agent-browser` or next-devtools `browser_eval`.
+- For Plate registry/browser proof, prefer `/blocks/[id]-demo` over docs wrappers when that standalone demo route exists.
+- If `dev-browser` gets blocked by a human prompt or loops on the same step, stop and ask the user to unblock.
+
+## Fallback Setup
+
+Use this only after `dev-browser --connect http://127.0.0.1:9222` fails because no reusable debug Chrome is available or the CDP endpoint is broken.
+
+## Rules
+
+- Prefer one permanent debug browser/profile over disposable automation browsers.
+- Treat a custom `--user-data-dir` as mandatory, not optional. Chrome 136+ expects remote debugging to happen from a dedicated profile.
+- Keep auth in that profile. Do not fall back to cookie dumps or state files unless the user asks.
+- Use a separate signed-in Chrome profile for browser work, like `dev`. Do not use the user's normal daily `Default` profile as the source profile.
+- Clone that separate signed-in Chrome profile into the dedicated debug `--user-data-dir`; do not point `9222` straight at the user's daily Chrome data dir.
+- On macOS, use `open -na "Google Chrome" --args ...` for the debug browser. That starts a separate Chrome instance with the dedicated debug profile without touching the user's normal Chrome window.
+
+## Preferred Shape
+
+Use a dedicated browser/profile with:
+
+- `--remote-debugging-address=127.0.0.1`
+- `--remote-debugging-port=9222`
+- a persistent `--user-data-dir=<debug-profile-dir>`
+
+Sign in once in that dedicated browser and keep reusing it for agent work.
+
+Quick sanity check:
+
+```bash
+curl -sS http://127.0.0.1:9222/json/version
+```
+
+Healthy output includes a JSON object with `webSocketDebuggerUrl`. Empty output or `404` means the wrong process owns `9222`.
+
+Then verify:
+
+```bash
+dev-browser --connect http://127.0.0.1:9222 <<'EOF'
+const page = await browser.getPage("persistent-main");
+console.log(await page.title());
+EOF
+```
+
+If direct connect still cannot resolve CDP even though `/json/version` is healthy, connect with the exact websocket URL:
+
+```bash
+WS=$(curl -sS http://127.0.0.1:9222/json/version | jq -r '.webSocketDebuggerUrl')
+
+dev-browser --connect "$WS" <<'EOF'
+const page = await browser.getPage("persistent-main");
+console.log(await page.title());
+EOF
+```
+
+## Google Chrome Path
+
+Default setup on macOS:
+
+1. Pick a separate signed-in Chrome profile for agent work, like `dev`, not the daily `Default` profile.
+2. Map that human-facing Chrome profile name to the real folder in `Local State`.
+3. Clone that profile into the dedicated debug dir.
+4. Launch a separate Chrome instance on `9222`.
+5. Leave that debug window open and reuse it.
+
+```bash
+python3 - <<'PY'
+import json, pathlib
+p = pathlib.Path('~/Library/Application Support/Google/Chrome/Local State').expanduser()
+obj = json.loads(p.read_text())
+for key, val in obj.get('profile', {}).get('info_cache', {}).items():
+    print(f"{key}\tname={val.get('name')}\tgaia_name={val.get('gaia_name')}")
+PY
+
+# Example: if `dev` maps to `Profile 1`, clone `Profile 1`.
+mkdir -p "$HOME/.config/google-chrome-debug-profile/Default"
+rsync -a --delete \
+  --exclude='Singleton*' \
+  --exclude='DevToolsActivePort' \
+  --exclude='lockfile' \
+  "$HOME/Library/Application Support/Google/Chrome/Profile 1/" \
+  "$HOME/.config/google-chrome-debug-profile/Default/"
+cp "$HOME/Library/Application Support/Google/Chrome/Local State" \
+  "$HOME/.config/google-chrome-debug-profile/Local State"
+
+open -na "Google Chrome" --args \
+  --user-data-dir="$HOME/.config/google-chrome-debug-profile" \
+  --profile-directory="Default" \
+  --remote-debugging-address=127.0.0.1 \
+  --remote-debugging-port=9222
+```
+
+Do not point `9222` at the normal daily `Default` Chrome profile.
+
+If the wrong Chrome steals `9222`, identify it with:
+
+```bash
+lsof -nP -iTCP:9222 -sTCP:LISTEN
+```
+
+Kill that listener and relaunch the dedicated debug browser. Do not keep debugging against a stale `404` or empty `/json/version` owner.

templates/plate-playground-template/.agents/skills/agent-browser-issue/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: Open a concise GitHub follow-up for reusable dev-browser or agent-browser limitations. Use when browser automation is blocked by a likely tool-side issue that is worth fixing separately, especially for clicks, dropdowns, file inputs, focus traps, or other repeatable agent/browser failures.
+description: Open a concise GitHub follow-up for reusable browser-use limitations. Use when browser automation is blocked by a likely tool-side issue that is worth fixing separately, especially for clicks, dropdowns, file inputs, focus traps, or other repeatable agent/browser failures.
 argument-hint: '[browser block summary]'
 disable-model-invocation: true
 name: agent-browser-issue

templates/plate-playground-template/.agents/skills/codex-review/SKILL.md

@@ -0,0 +1,139 @@
+---
+name: codex-review
+description: "Codex autoreview/code review closeout: local dirty changes, PR branch vs main, parallel tests."
+---
+
+# Codex Review
+
+Run Codex's built-in code review as a closeout check. This is code review (`codex review`), not Guardian `auto_review` approval routing.
+
+Use when:
+- user asks for Codex review / autoreview / second-model review
+- after non-trivial code edits, before final/commit/ship
+- reviewing a local branch or PR branch after fixes
+
+## Contract
+
+- Treat review output as advisory. Never blindly apply it.
+- Verify every finding by reading the real code path and adjacent files.
+- Read dependency docs/source/types when the finding depends on external behavior.
+- Reject unrealistic edge cases, speculative risks, broad rewrites, and fixes that over-complicate the codebase.
+- Prefer small fixes at the right ownership boundary; no refactor unless it clearly improves the bug class.
+- Keep going until Codex review returns no accepted/actionable findings.
+- If a review-triggered fix changes code, rerun focused tests and rerun Codex review.
+- For security-audit suppression changes, verify accepted findings remain auditable: suppressed findings stay in structured output, active output keeps an unsuppressible suppression notice, and aggregate findings cannot hide unrelated active risk.
+- Never switch or override the review model. If the review hits model capacity, retry the same command a few times with the same model. The helper runs nested review in yolo/full-access mode by default; use `--no-yolo` only when intentionally testing sandbox behavior.
+- Stop as soon as the review command/helper exits 0 with no accepted/actionable findings. Do not run an extra direct `codex review` just to get a nicer "clean" line, a second opinion, or clearer closeout wording.
+- Treat the helper's successful exit plus absence of actionable findings as the clean review result, even if the underlying Codex CLI output is terse.
+- If rejecting a finding as intentional/not worth fixing, add a brief inline code comment only when it explains a real invariant or ownership decision that future reviewers should know.
+- If `gh`/Gitcrawl reports `database disk image is malformed`, run `gitcrawl doctor --json` once to let the portable cache repair before retrying review; do not bypass the shim unless repair fails and freshness requires live GitHub.
+- If Gitcrawl reports a portable manifest mismatch, source/runtime DB health error, or stale portable-store checkout, run `gitcrawl doctor --json` and inspect `source_db_health`, `runtime_db_health`, and `portable_store_status` before falling back to live GitHub.
+- Do not push just to review. Push only when the user requested push/ship/PR update.
+
+## Pick Target
+
+Dirty local work:
+
+```bash
+codex review --uncommitted
+```
+
+Use this only when the patch is actually unstaged/staged/untracked in the
+current checkout. For committed, pushed, or PR work, point Codex at the commit
+or branch diff instead; do not force `--mode local` / `--uncommitted` just
+because the helper docs mention dirty work first. A clean `--uncommitted` review
+only proves there is no local patch.
+
+Branch/PR work:
+
+```bash
+git fetch origin
+codex review --base origin/main
+```
+
+Do not pass any prompt with `--base`. Some Codex CLI versions reject both inline
+and stdin prompt forms, including helper commands shaped like
+`codex review --base <ref> -`, with `--base <BRANCH> cannot be used with
+[PROMPT]`. If the helper hits this error, run plain `codex review --base <ref>`
+and report that helper prompt injection was skipped.
+
+If an open PR exists, use its actual base:
+
+```bash
+base=$(gh pr view --json baseRefName --jq .baseRefName)
+codex review --base "origin/$base"
+```
+
+Committed single change:
+
+```bash
+codex review --commit HEAD
+```
+
+or with the helper:
+
+```bash
+/Users/steipete/Projects/agent-scripts/skills/codex-review/scripts/codex-review --mode commit --commit HEAD
+```
+
+Use commit review for already-landed or already-pushed work on `main`. Reviewing
+clean `main` against `origin/main` is usually an empty diff after push. For a
+small stack, review each commit explicitly or review the branch before merging
+with `--base`.
+
+## Parallel Closeout
+
+Format first if formatting can change line locations. Then it is OK to run tests and review in parallel:
+
+```bash
+scripts/codex-review --parallel-tests "<focused test command>"
+```
+
+Tradeoff: tests may force code changes that stale the review. If tests or review lead to code edits, rerun the affected tests and rerun review until no accepted/actionable findings remain. Once that rerun exits cleanly, stop; do not spend another long review cycle on redundant confirmation.
+
+## Context Efficiency
+
+Codex review is usually noisy. Default to a subagent filter when subagents are available. Ask it to run the review and return only:
+- actionable findings it accepts
+- findings it rejects, with one-line reason
+- exact files/tests to rerun
+
+Run inline only for tiny changes or when subagents are unavailable.
+
+## Helper
+
+Bundled helper:
+
+```bash
+~/.codex/skills/codex-review/scripts/codex-review --help
+```
+
+If installed from `agent-scripts`, path is:
+
+```bash
+/Users/steipete/Projects/agent-scripts/skills/codex-review/scripts/codex-review --help
+```
+
+The helper:
+- chooses dirty `--uncommitted` first
+- otherwise uses current PR base if `gh pr view` works
+- otherwise uses `origin/main` for non-main branches
+- auto-runs `PNPM_CONFIG_PM_ON_FAIL=ignore PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false PNPM_CONFIG_OFFLINE=true pnpm run check` in parallel when a repo has `package.json`, `pnpm-lock.yaml`, `node_modules`, and a `check` script; disable with `CODEX_REVIEW_AUTO_TESTS=0`
+- use `--mode commit --commit <ref>` for already-committed work, especially clean `main` after landing
+- should be left in `--mode auto` or forced to `--mode branch` for PR/branch work; do not force `--mode local` after committing
+- writes only to stdout unless `--output` or `CODEX_REVIEW_OUTPUT` is set
+- supports `--dry-run`, `--parallel-tests`, and commit refs
+- runs nested review with `--dangerously-bypass-approvals-and-sandbox` by default
+- branch mode may fail on Codex CLI versions that reject `--base` plus the helper's stdin prompt; on that exact parser error, rerun plain `codex review --base <ref>` instead of falling back to a non-Codex reviewer
+- keeps accepting `--full-access`; use `--no-yolo` or `CODEX_REVIEW_YOLO=0` to opt out
+- prints `codex-review clean: no accepted/actionable findings reported` when the selected review command exits 0
+
+## Final Report
+
+Include:
+- review command used
+- tests/proof run
+- findings accepted/rejected, briefly why
+- the clean review result from the final helper/review run, or why a remaining finding was consciously rejected
+
+Do not run another Codex review solely to improve the final report wording. If the final helper run exited 0 and produced no accepted/actionable findings, report that exact run as clean.