dsh-codex-connect-plus v0.1.0-alpha.2

Alpha.2 fixes the Web GUI boot failure reported by external testers.

Key fixes and hardening:

• Removed Host-only dsh-attachment and dsh-tools runtime imports from lib/client.js
• Added a browser-safe image-tool contract module
• Added a build-time DSH client purity gate and simulated frozen module-table load
• CI now rebuilds before tests, rejects tracked/untracked lib drift, and covers Node 22.19.0 plus Node 24
• Package checks now verify every relative lib import resolves in the tarball
• Unified OAuth, search, and image error redaction
• Rejected symlink/junction image-output parents and canonical output paths outside session cwd
• Added prompt and provider-returned image-count bounds
• Clarified credential permissions, unpublished API status, upstream risk, and service terms

Validation:

• 19 test files / 78 tests
• Client bundle runtime requires: react, react/jsx-runtime only
• Local DSH 0.1.0-rc.5 isolated-profile boot passed
• Both GitHub CI matrix jobs passed

SHA-256 (attached tgz): 35B0639D8FECC66D387B7B9139C356AA0604DB5EBEA9C5229481C244CA45E897

This remains an Alpha prerelease. Codex Images uses an unpublished, changeable ChatGPT/Codex application backend rather than a public or supported OpenAI Platform API.