debug-ui

A browser-based tool for checking the dev-3.0 web interface in a real headless browser, meaning a browser running without a visible window.

In plain words
What is it for?
Use it to reproduce interface bugs, click and type through screens, verify UI changes, capture screenshots, and inspect console errors.
Why use it?
It replaces guesswork about whether a page works or looks right with direct interaction, screenshots, and browser error checks.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/h0x91b/dev-3.0/debug-ui
Any agent
npx skills add h0x91b/dev-3.0 --skill debug-ui
Clone the repo
git clone --depth 1 https://github.com/h0x91b/dev-3.0

Made for: Claude Code, Codex.

Per session 93 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,789 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00093 $0.02789
Opus 5 $0.00046 $0.01394
Sonnet 5 $0.00019 $0.00558
Haiku 4.5 $0.00009 $0.00279

Measured 2d ago against content hash 7c3afafea80f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

debug-ui scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

The scoped root is stable per worktree, so a restart reuses the same board; `rm -rf` the printed

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

until curl -sf "http://localhost:$PORT/?token=$CODE" >/dev/null; do sleep 2; done
.claude/skills/debug-ui/SKILL.md · 153 lines

How it starts

The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.

debug-ui — QA the dev-3.0 UI in a real browser

See and drive the running dev-3.0 UI in headless Chromium — click, type, screenshot, read console errors — instead of guessing whether a UI change works. No desktop/native dependency; it works the same in a plain terminal session.

This is dev-internal tooling for the dev-3.0 repo — NOT one of the skills dev3 ships to its users (those live in src/bun/agent-skills.ts).

The whole flow

This task's dev-server is the web UI: bun run dev serves the full app in local remote mode at a stable per-machine token and a CLI-derivable port — no separate dev3 remote. The loop is always the same four beats: values → server → browser → clean up.

# 1. Values. AGENT_BROWSER_SESSION isolates THIS task's browser from every other agent's —
#    without it all agents share one global "default" session and stomp each other (see
#    Gotchas). Derived from the always-present $DEV3_TASK_ID, so this exact line is
#    copy-paste-safe at the top of ANY block that calls agent-browser.
export AGENT_BROWSER_SESSION="dev3-${DEV3_TASK_ID%%-*}"
CODE=$(cat "$HOME/.dev3.0/dev-web-access-code" 2>/dev/null || bun scripts/dev-web-code.ts)
PORT=${DEV3_PORT0:-$(dev3 dev-server status | grep -oE 'DEV3_PORT0=[0-9]+' | cut -d= -f2)}

# 2. Start a FRESH dev-server and wait for it to come up. (Skip the start only if one is
#    already running for THIS task — but see the build-snapshot gotcha: stale code needs a
#    restart, so when in doubt restart.)
dev3 dev-server start
until curl -sf "http://localhost:$PORT/?token=$CODE" >/dev/null; do sleep 2; done

# 3. Drive it. Every agent-browser call inherits AGENT_BROWSER_SESSION, so it all runs in
#    this task's own session. (Load /agent-browser for the full command set.) The screenshot
#    path is task-scoped too, so parallel agents never overwrite each other's PNG.
#    `&streamer=on` is MANDATORY: it enables streamer mode (privacy masking), so screenshots
#    can't leak the developer's real emails/accounts/paths/tunnel URLs (see Gotchas).
#    Keep `set viewport` BEFORE `open`, and keep the width ≥ 1024 for desktop QA — the app's
#    mobile gate reads `screen.width` (see Gotchas).
agent-browser set viewport 1440 900
agent-browser open "http://localhost:$PORT/?token=$CODE&streamer=on"
agent-browser wait --load networkidle
sleep 2                                       # networkidle can still land mid-render — let it settle
agent-browser snapshot -i -d 6                # prove it's DRIVABLE, not just screenshot-able
agent-browser screenshot "/tmp/dev3-ui-${DEV3_TASK_ID%%-*}.png"   # then Read it back to look
agent-browser errors                          # confirm no console errors

# 4. Always clean up what you started. `close` closes only THIS session's browser.
agent-browser close
dev3 dev-server stop          # the port frees a second or two later (graceful shutdown)

Read the full file on GitHub · 153 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 153 lines · 93 tokens per session scan C 7c3afafea80f

Subscribe to this mod's changes

debug-ui is a skill published in the GitHub repository h0x91b/dev-3.0 (248 stars, last pushed 3d ago), licensed Apache-2.0. It adds 93 tokens to every session and 2,789 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

separateweb-capture

Capture a URL into a full-page screenshot, cropped UI item PNGs, and a JSON manifest. Use when the user says separateweb capture , asks to capture a website, or wants UI extraction assets without running the SeparateWeb web app.

hashgraph-online/awesome-codex-plugins · 59 tokens

Preview

Create an interactive design-preview in a browser tab.

stagewise-io/stagewise · 11 tokens

plan-review

Multi-perspective review of a feature plan or requirements doc before development begins. Evaluates from strategy, design/UX, and engineering angles to catch gaps early.

mvschwarz/openrig · 35 tokens

ui-mockup

Create UI mockups at three fidelity levels — ASCII wireframes for quick iteration, standalone HTML mockups for delivery with requirements, and live prototypes for interaction testing.

mvschwarz/openrig · 37 tokens

brainstorm

Use when you have a feature idea but the scope or UX is still ambiguous — runs a lightweight Socratic design dialogue (3-5 AUQ rounds) and writes a spec markdown file. Use BEFORE /plan feature when product intent needs validation; skip to /plan feature when scope is already clear. HARD-GATE prevents any code work…

Kanevry/session-orchestrator · 78 tokens

tend-narrate

Author the article-style narrative body and inline SVG diagrams for a feature, subpage, or garden polyglot. Writes the narrative (markdown) and media (inline SVG / base64) fields. Trigger when a polyglot has slots + checks but its main content reads as a structured form rather than a focused essay — or after /tend run…

jahala/umbel · 100 tokens