dsh-browser 0.3.0 — registry-based index resolution, reload-safe content script

dsh-browser 0.3.0 — the bridge plugin and the extension

Two artifacts, same release:

• dightendless-dsh-bridge-browser-0.3.0.tgz — the DSH plugin (bridge-browser),
  prebuilt, so no build step and no allowlisting are needed.
• dsh-browser-extension-0.3.0.zip — the Chrome/Edge extension, already built.
  Unzip it, then load the folder through Load unpacked.

dsh plugin --profile web add https://github.com/DightEndless/dsh-browser/releases/download/v0.3.0/dightendless-dsh-bridge-browser-0.3.0.tgz

What changed since 0.2.0

A page can no longer move the target of an approved click. browser_click_at,
browser_hover and browser_drag resolved a snapshot number through the
data-dsh-el attribute, which is a DOM attribute — any page script could read it,
move it, or invent one that querySelector finds first, and the point the user
approved would land somewhere else. The number now resolves through the content
script's element registry, which lives in the extension's isolated world where the
page has no reach. Verified live: with a forged data-dsh-el="1" planted at (6, 6)
ahead of the real element, the tool still acted on the real element at (831, 792).

Reloading the extension no longer litters the error list. The content script left
running in open tabs after a reload had a dead chrome.runtime, and calling into it
throws "Extension context invalidated" synchronously — a .catch() never saw it.
Every call out now checks the context first, and the selection watcher disposes itself
once it finds it has been orphaned.

browser_batch fails the call when a step fails. It used to answer ok with the
failure described in the text, so a broken batch read as a success in the harness and
in the panel while every other tool reported its own failure. The per-step report now
travels in the error message, so the model still sees which step failed and what the
page said.

The extension build stopped dropping files on non-ASCII paths. fs.cpSync to a
destination whose path holds non-ASCII characters crashed the process after the
bundles were written, which produced a dist folder that looked complete and was not.
The build now copies through a tested helper and asserts every path the manifest
references exists.

The package README was stale in the 0.2.0 tarball — it predated the fork's identity
work, so it still pointed its installer commands at the upstream repository. The 0.3.0
tarball carries the corrected README: fork disclosure, this repository's installers,
and the tool list that includes hover, coordinate clicks, drag, batches, whole-page
screenshots, upload, image addresses and multi-browser switching. The 0.2.0 asset was
also rebuilt in place, so its URL installs correctly too.

Requirements

Chrome 116+ (or Edge), DSH on the 0.2.0-rc.2 line or newer within 0.2.x, and —
only for the installer route — Node.js 22+ with pnpm.

Three ways to install

1. Plugin from this release (one command, nothing to build) — the line above.
2. Extension only — download dsh-browser-extension-0.3.0.zip, unzip, then
   chrome://extensions → Load unpacked → pick the unzipped folder.
3. Everything from source — the installer in the README clones the repository,
   builds both halves and registers the plugin bundle.

Then open the side panel on any page and ask: the model sees a numbered inventory of
what is on screen and acts through those numbers.