v0.1.3 — Audit plugins with images and fonts

dsh-developer 0.1.3 fixes repository audits failing on images and fonts. Adding our own PNG logo exposed the bug: the scanner treated every file as UTF-8 source.

• Doctor, profile preflight, upstream impact, source migration and compatibility checks now accept recognized PNG, JPEG, GIF, WebP, ICO, WOFF, WOFF2, TTF and OTF assets.
• Asset bytes count toward snapshot limits and freshness fingerprints. Changing an image invalidates the audit just like changing source.
• Compressed asset data no longer triggers the text-only entropy heuristic. Explicit credential markers are still checked; assets are not decoded or treated as executable source.
• Isolated Build/Apply transfers retain their existing UTF-8-only contract. The amber-wrench logo is included in both READMEs.

Validation: 779 local tests passed, with 33 optional integrations skipped. Static Doctor and real DSH 0.1.5-rc.2 Web preflight passed. Clean-profile install/uninstall checks passed on both reviewed DSH 0.1.5-rc.2 and 0.1.6-alpha.1. The packed plugin passed all three native cases in both Web and headless profiles on rc.2: the real PNG, asset evidence and rejection of binary executable source.

All 18 CI jobs passed on both main and the v0.1.3 tag, including Windows, macOS and Ubuntu checks and native development against npm latest, next and alpha.

Install or update in DSH Web:

dsh plugin --profile web add 'github:builtin-pb/dsh-developer#v0.1.3' --ignore-scripts

Restart DSH after installation. The attached archive and SHA256SUMS provide the same release without build scripts.

Post-publication checks: the public Git tag and archive URL both installed version 0.1.3 into fresh Web profiles with scripts disabled and identical logo bytes. The public archive matched the tested archive and checksum. The publicly installed CLI also passed all three native Web asset cases against that download.