diff --git a/issues/requires-security-review-nostr-tools-upgrade.md b/issues/requires-security-review-nostr-tools-upgrade.md
new file mode 100644
index 00000000..90497334
--- /dev/null
+++ b/issues/requires-security-review-nostr-tools-upgrade.md
@@ -0,0 +1,29 @@
+# Security Review: Upgrade nostr-tools to 2.19.4
+
+## Issue
+There is a version mismatch between the declared dependency in `package.json` and the runtime import in the browser.
+
+- **`package.json`**: `"nostr-tools": "^2.19.4"`
+- **`js/nostrToolsBootstrap.js`**: Hardcodes `2.17.0` from `esm.sh` and `jsdelivr`.
+
+## Symptoms
+The browser console logs numerous errors from relays indicating invalid commands:
+```
+console:debug: NOTICE from wss://relay.damus.io/: ERROR: bad msg: unknown cmd @ https://esm.sh/nostr-tools@2.17.0/es2022/nostr-tools.mjs:1
+console:debug: NOTICE from wss://relay.primal.net/: ERROR: bad msg: unknown cmd @ https://esm.sh/nostr-tools@2.17.0/es2022/nostr-tools.mjs:1
+```
+This suggests that the client (running `2.17.0`) might be constructing messages (e.g. NIP-45 `COUNT` or others) in a way that is incompatible with the relays or missing protocol updates present in `2.19.4`.
+
+## Policy
+`AGENTS.md` states:
+> Upgrades to cryptographic or protocol libraries (specifically `nostr-tools`) are restricted and require manual review; automatic upgrades are prohibited to prevent breaking NIP implementations.
+
+## Action Required
+A manual security review is required to update `js/nostrToolsBootstrap.js` to match the version in `package.json` (`2.19.4`).
+
+## Secondary Finding
+The following resource fails to load (404):
+```
+https://pub-ca50f43da1364bf6a552b90443fcdc64.r2.dev/bitvid-logo-loop.mp4
+```
+This appears to be a missing content asset.
diff --git a/scripts/agent/debug_frontend.py b/scripts/agent/debug_frontend.py
index 0441d740..978798d4 100644
--- a/scripts/agent/debug_frontend.py
+++ b/scripts/agent/debug_frontend.py
@@ -1,23 +1,37 @@
+import asyncio
+from playwright.async_api import async_playwright
 import sys
-from playwright.sync_api import sync_playwright
 
-def run():
-    with sync_playwright() as p:
-        browser = p.chromium.launch()
-        page = browser.new_page()
+async def run():
+    async with async_playwright() as p:
+        browser = await p.chromium.launch()
+        page = await browser.new_page()
 
-        page.on("console", lambda msg: print(f"console:{msg.type}: {msg.text}"))
+        # Listen for console logs with location
+        def handle_console(msg):
+            loc = msg.location
+            print(f"console:{msg.type}: {msg.text} @ {loc['url']}:{loc['lineNumber']}")
+
+        page.on("console", handle_console)
+
+        # Listen for exceptions
         page.on("pageerror", lambda exc: print(f"pageerror: {exc}"))
-        page.on("requestfailed", lambda req: print(f"requestfailed: {req.url} - {req.failure}"))
+
+        # Listen for failed requests
+        page.on("requestfailed", lambda req: print(f"requestfailed: {req.url} {req.failure}"))
+
+        # Listen for 404s specifically
+        page.on("response", lambda res: print(f"response:{res.status}: {res.url}") if res.status >= 400 else None)
 
         try:
-            page.goto("http://localhost:8000")
-            # Wait a bit for JS to execute and errors to appear
-            page.wait_for_timeout(5000)
+            print("Navigating to http://localhost:8000...")
+            await page.goto("http://localhost:8000")
+            # Wait a bit for initialization
+            await page.wait_for_timeout(5000)
         except Exception as e:
-            print(f"Error navigating: {e}")
+            print(f"Navigation error: {e}")
         finally:
-            browser.close()
+            await browser.close()
 
 if __name__ == "__main__":
-    run()
+    asyncio.run(run())