dsh-browser-playwright-codex 0.8.0 → 0.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (26) hide show
  1. package/CHANGELOG.md +28 -0
  2. package/NOTICE.md +10 -10
  3. package/README.md +12 -12
  4. package/assets/swarm-rebuild.js +3864 -0
  5. package/lib/challenge.d.ts +7 -4
  6. package/lib/challenge.js +28 -6
  7. package/lib/client.js +28 -2
  8. package/lib/config.d.ts +1 -1
  9. package/lib/config.js +1 -2
  10. package/lib/errors.d.ts +17 -0
  11. package/lib/errors.js +28 -0
  12. package/lib/gates-patch.d.ts +41 -1
  13. package/lib/gates-patch.js +103 -5
  14. package/lib/injected.js +45 -0
  15. package/lib/page-actions.d.ts +24 -0
  16. package/lib/page-actions.js +41 -10
  17. package/lib/session.js +55 -9
  18. package/lib/snapshot-render.js +52 -7
  19. package/lib/swarm-contract.d.ts +11 -5
  20. package/lib/swarm-contract.js +11 -5
  21. package/lib/swarm-curtain.js +2 -2
  22. package/lib/swarm-intro.js +7 -5
  23. package/lib/tool-types.d.ts +10 -0
  24. package/lib/tool.js +6 -2
  25. package/lib/types.d.ts +6 -0
  26. package/package.json +15 -12
package/CHANGELOG.md CHANGED
@@ -1,3 +1,31 @@
1
+ ## 0.8.1 — 2026-11-11
2
+
3
+ 一句话摘要：**快照第一次真正"看得见状态"**——填进去的值、勾选状态进快照也进页面指纹，正常的填字和勾选不再被误报成"疑似反爬墙"；密码 / 验证码 / 卡号即使有值也绝不进快照。顺带削掉真实站点快照里最贵的一类垃圾（跳转包裹 URL、同一 href 的重复打印），并让 `browser_evaluate` 返回非标量时给出能照着改的错误。**另外：进场动画重新随包分发——作者 Dhvanil Patel 于 2026-11-11 邮件书面许可打包与修改，默认仍然关闭。**
4
+
5
+ ### Restored
6
+
7
+ - **`assets/swarm-rebuild.js` 回到 npm 包**：Dhvanil Patel 于 2026-11-11 邮件书面许可本项目**打包 + 修改**（原话 "you are welcome to bundle and modify it as needed"），`package.json#files` 重新列入 `assets/`（原始基线 `assets/swarm-rebuild.upstream.js` 仍只留在仓库）。**功能保持默认关闭**（`swarm.enabled: false`），在设置卡里打开才播。署名与许可切分见 `README.md` 的 Credits 与 `NOTICE.md` §3。
8
+ - **许可不是 MIT**：邮件许可只覆盖本项目随插件分发，没有附 MIT 许可文本，也不给第三方通用许可。第三方想复用得自己去问两位作者（Joel Califa / Dhvanil Patel）。
9
+
10
+ ### Fixed
11
+
12
+ - **填字 / 勾选不再被误报成"疑似反爬墙"**：`snapshotFingerprint` 原来只比 url / title / refs / role=name，`checked` / `selected` / 值的变化都不算"页面变了"，正常的填字、勾选会触发 no-progress 兜底并劝用户去看窗口。现在 `scan` 收集这些状态、指纹纳入，填字和勾选算成真实变化。
13
+ - **快照显示输入框 / 文本域里的值**：`BrowserNode` / `ChallengeNode` 新增 `value`，模型填完能看见填了什么；`<textarea>`（角色是 `textarea`，不是 `textbox`）也覆盖；`<select>` 不打印 value（它的名字已经显示当前选项）；`<option>` 只在 value 属性与文本不同时才带。
14
+ - **`role="combobox"` 的输入框按标签判定**：排除 value 只针对真正的 `<select>`，不再按 role 排除——自动补全搜索框常带显式 `role="combobox"`，按 role 判会把它们的值也一起藏掉。
15
+ - **密码 / 一次性验证码 / 卡号绝不进快照**：读取 value 前先过 `isCredentialEl`（`type=password`，或 autocomplete 含 `current-password` / `new-password` / `one-time-code` / `cc-*`），与 `browser_fill` 的凭据判据一致。
16
+ - **`<option>` 的名字不再被整段 select 文本污染**：`closest('label')` 会把外层 label 的全部文字塞进每个 option，下拉里所有选项名字原来看起来一模一样。
17
+ - **no-progress 文案改成实话**：不再猜"反爬墙"、不再要求用户去看窗口，改成"这次动作没有带来可见变化；如果是提交 / 搜索 / 跳转，页面可能还在渲染，再拍一次快照确认"。
18
+
19
+ ### Performance
20
+
21
+ - **跳转包裹 URL 不再打印 160 字符**：`/ck/a?`、`/url?q=`、`l.php?u=` 这类知名跳转端点渲染成 `-> (redirect wrapper)`。实测 Bing 搜索结果页每次快照省约 6,080 字符（约 1,520 token）。
22
+ - **同一快照内重复 href 只打印第一次**：第二次起渲染 `-> (same as e1)`，只去重显示、不合并 ref，点击行为完全不变。实测百度结果页 552 → 263 字节，ref 4 → 4 一个不少。
23
+
24
+ ### Changed
25
+
26
+ - **`browser_evaluate` 返回非标量时归一化**：数组转 JSON 字符串，`undefined` / 函数转成说明文字并附改法；对象 / 字符串 / 数字 / 布尔 / null 原样返回。DSH 执行器那层的 `value is not lossless JSON` 不再让人靠猜。
27
+ - **新增测试**：`tests/normalize-evaluate.test.ts`、`tests/value-privacy.test.ts`、`tests/combobox-value.test.ts`，分别钉住归一化、凭据不泄漏（有牙齿：去掉守卫立刻红）、`role=combobox` 与 `<textarea>` 的 value 显示。
28
+
1
29
  ## 0.8.0 — 2026-11-10
2
30
 
3
31
  一句话摘要：**动效资产被移出 npm 发布包，swarm 默认关掉**——这是主动选的合规路径，不是修 bug：那套资产的授权状态不允许再分发，与其在授权上纠缠，不如不让它随包出去。代码一行没删，本地开发者把资产放回 `assets/` 打开开关就还是完整功能；代价是 npm 用户升级后默认看不到这个效果。顺带把 0.7.9 那批修复一起封进来——npm 上的 `latest` 一直停在 0.7.8，`v0.7.9` 只是本地 tag，所以从 0.7.8 直接升上来的用户会一次拿到两个版本的全部内容。
package/NOTICE.md CHANGED
@@ -24,28 +24,28 @@ Covers only the two analysis documents produced *for this repository*:
24
24
 
25
25
  Share and adapt for **non-commercial** purposes with attribution and share-alike; commercial use is not permitted. Legal code: [`LICENSE-DOCS`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/LICENSE-DOCS) (the licence text lives in the repository; it is not part of the npm tarball).
26
26
 
27
- Note the deliberate boundary: these two documents are **not shipped in the npm package** — only `README.md`, `CHANGELOG.md`, `SECURITY.md` and `NOTICE.md` travel with the plugin, and all four are MIT (§1). As of 0.8.0 the third-party file described in §3 is **not** in the tarball either (see §3), so everything the package does ship is MIT.
27
+ Note the deliberate boundary: these two documents are **not shipped in the npm package** — only `README.md`, `CHANGELOG.md`, `SECURITY.md` and `NOTICE.md` travel with the plugin, and all four are MIT (§1). As of 0.8.1 the tarball also carries the third-party file described in §3, under its own written permission — that file is **not** MIT, and §1 does not cover it.
28
28
 
29
- ## 3. The intro effect asset — third-party code, no longer distributed in the npm package
29
+ ## 3. The intro effect asset — third-party code, bundled with written permission
30
30
 
31
- `assets/swarm-rebuild.js` (**as of 0.8.0 no longer packed into the npm tarball** — `package.json#files` no longer lists `assets/`; it lives in the repository only) is **not** this project's work. The position, stated plainly:
31
+ `assets/swarm-rebuild.js` (**shipped again in the npm tarball as of 0.8.1** — `package.json#files` lists `assets/`, minus the pristine baseline) is **not** this project's work. The position, stated plainly:
32
32
 
33
33
  1. **We hold written permission from Joel Califa for the effect and its choreography** (2026-11-08, on file; his one condition was that he be credited). That credit is in [`README.md`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/README.md#credits--the-intro-effect) and in the settings card.
34
- 2. **The specific script comes from a repository that declares no licence**, and its author has been asked and had not replied as of 2026-11-09 (issue #12). His permission covers his own work; it does not license someone else's code.
35
- 3. **This project claims and grants no rights in that file.** It stopped travelling with the npm package in 0.8.0 for exactly this reason. If either author objects to it remaining in the repository, the file — and the feature that injects it — will be removed on request.
34
+ 2. **We hold written permission from Dhvanil Patel for the script** (email, 2026-11-11, on file): he is "happy for you to use and adapt the animation", and answers "yes, you are welcome to bundle and modify it as needed". **Bundling and modification are both covered.** No MIT (or other OSI) licence was granted — the grant is that written email, not a licence text, and it does **not** give third parties a general licence to extract and re-use the file.
35
+ 3. **This project claims and grants no rights in that file.** It travels inside this package under that permission only. If either author withdraws it, the file — and the feature that injects it — will be removed on request.
36
36
 
37
37
  | Origin | What | Status |
38
38
  |---|---|---|
39
39
  | [califa/swarm-site](https://github.com/califa/swarm-site) — **Joel Califa** | The effect itself: the page wiped white, the swarm of cursors, and the choreography that draws boxes, text and images back. The published copy declares no licence. | Written permission, 2026-11-08, condition: credit. Done. |
40
- | [DhvanilPatel/swarm-cursors](https://github.com/DhvanilPatel/swarm-cursors) — **Dhvanil Patel** | `swarm-rebuild/swarm.js` at commit `3d49e0ac` (2026-11-06). That repository declares no licence ("None yet") and its README says the original Swarm was released without one. | Asked (issue #12), no reply as of 2026-11-09. |
40
+ | [DhvanilPatel/swarm-cursors](https://github.com/DhvanilPatel/swarm-cursors) — **Dhvanil Patel** | `swarm-rebuild/swarm.js` at commit `3d49e0ac` (2026-11-06). That repository declares no licence ("None yet") and its README says the original Swarm was released without one. | Written permission by email, 2026-11-11: bundle + modify. Bounded to this project. |
41
41
 
42
- **Modified, and the modification is disclosed.** `assets/swarm-rebuild.js` is that upstream file **with seven changes**, applied by [`scripts/swarm-patch.mjs`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/scripts/swarm-patch.mjs): (1) the vendor's own bottom control bar is removed; (2) its four DOM fields are pointed at off-screen placeholders so the rest of the code keeps working; (3) its per-frame HUD refresh returns early; (4) the end-of-playback button updates are null-guarded — that last one is a real crash fix: without it the asset throws as soon as the animation completes; (5) scanning waits for the plugin's go-ahead (so the snapshot is taken before the page is scrolled); (6) the white background no longer fades in over 0.5 s, and on early starts the scroll environment is re-detected once after the page loads; (7) its final self-start is deferred until `<html>` exists, so the whole engine can run from `addInitScript` before the page's own scripts. The pristine upstream file ships **in the repository only** (`assets/swarm-rebuild.upstream.js`, SHA-256 `6a30f19d…c7bfe`), as does the patched `assets/swarm-rebuild.js` itself since 0.8.0 — neither reaches npm — so anyone can diff what we changed and regenerate the patched file with `npm run swarm:patch` — or check that it still matches with `npm run swarm:check`.
42
+ **Modified, and the modification is disclosed.** `assets/swarm-rebuild.js` is that upstream file **with seven changes**, applied by [`scripts/swarm-patch.mjs`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/scripts/swarm-patch.mjs): (1) the vendor's own bottom control bar is removed; (2) its four DOM fields are pointed at off-screen placeholders so the rest of the code keeps working; (3) its per-frame HUD refresh returns early; (4) the end-of-playback button updates are null-guarded — that last one is a real crash fix: without it the asset throws as soon as the animation completes; (5) scanning waits for the plugin's go-ahead (so the snapshot is taken before the page is scrolled); (6) the white background no longer fades in over 0.5 s, and on early starts the scroll environment is re-detected once after the page loads; (7) its final self-start is deferred until `<html>` exists, so the whole engine can run from `addInitScript` before the page's own scripts. The patched file ships inside the npm package as of 0.8.1, while the pristine upstream baseline stays **in the repository only** (`assets/swarm-rebuild.upstream.js`, SHA-256 `6a30f19d…c7bfe`) — so anyone can diff what we changed and regenerate the patched file with `npm run swarm:patch`, or check that it still matches with `npm run swarm:check`.
43
43
 
44
- **运行方式也被改了**：本项目不是等网页加载完再运行这份第三方脚本，而是通过 Playwright 的 `addInitScript` 把它放到**网页自己的脚本之前**执行（只在顶层文档、且带一个 30 秒内有效的 `window.name` 标记时启动），启动时机再由 `window.__dshSwarmGo` 放行控制。也就是说，第三方作品的启动流程、注入时机和运行上下文都由本项目重新安排过；原作者的授权仍在问询中，尚未回复。
44
+ **运行方式也被改了**：本项目不是等网页加载完再运行这份第三方脚本，而是通过 Playwright 的 `addInitScript` 把它放到**网页自己的脚本之前**执行（只在顶层文档、且带一个 30 秒内有效的 `window.name` 标记时启动），启动时机再由 `window.__dshSwarmGo` 放行控制。也就是说，第三方作品的启动流程、注入时机和运行上下文都由本项目重新安排过；这一步同样落在 Dhvanil 邮件许可的「modify」范围内。
45
45
 
46
- **中文**：`assets/swarm-rebuild.js` **改过**（0.8.0 起不再随 npm 包分发，只留在仓库），改动共七处 —— ①删掉原版自带的底部控制条；②把它的四个界面字段指向离屏占位元素（否则下游代码会抛错）；③让每帧的界面刷新提前返回；④播完那一下设置按钮显示状态的代码加空值保护（这一处是**真崩溃修复**：不改的话动画一播完就抛错）；⑤扫描改成等插件放行、开场至少停 2.8 秒（拍快照前不滚页面）；⑥白底去掉 0.5 秒淡入、第一帧就盖死，提前启动时页面加载完再重认一次滚动环境；⑦结尾自启动改成「等 `<html>` 出现」，这样整台引擎能在网页脚本之前就跑起来。两个文件都只放在仓库里（原始基线 `assets/swarm-rebuild.upstream.js` 与补丁产物，SHA-256 可核对），npm 包内一个都没有，所以任何人都能 diff 出我们改了什么，用 `npm run swarm:patch` 复原生成、用 `npm run swarm:check` 校验。
46
+ **中文**：`assets/swarm-rebuild.js` **改过**（0.8.1 起重新随 npm 包分发；原始基线只留在仓库），改动共七处 —— ①删掉原版自带的底部控制条；②把它的四个界面字段指向离屏占位元素（否则下游代码会抛错）；③让每帧的界面刷新提前返回；④播完那一下设置按钮显示状态的代码加空值保护（这一处是**真崩溃修复**：不改的话动画一播完就抛错）；⑤扫描改成等插件放行、开场至少停 2.8 秒（拍快照前不滚页面）；⑥白底去掉 0.5 秒淡入、第一帧就盖死，提前启动时页面加载完再重认一次滚动环境；⑦结尾自启动改成「等 `<html>` 出现」，这样整台引擎能在网页脚本之前就跑起来。**打包和修改都已获得 Dhvanil Patel 邮件书面许可（2026-11-11）**；许可只覆盖本项目随插件分发，不是给第三方的通用许可，也没有附 MIT 许可文本。补丁产物随包走，原始基线 `assets/swarm-rebuild.upstream.js` 留在仓库（SHA-256 可核对），所以任何人都能 diff 出我们改了什么，用 `npm run swarm:patch` 复原生成、用 `npm run swarm:check` 校验。
47
47
 
48
- What this means for you: §1 (MIT) does **not** cover `assets/swarm-rebuild.js`. If you re-use that file, ask the two authors yourself — nothing here gives you a licence to it.
48
+ What this means for you: §1 (MIT) does **not** cover `assets/swarm-rebuild.js`; it travels in the package under the authors' written permission to this project. That permission is **not** a licence to you — if you want to re-use that file elsewhere, ask the two authors yourself.
49
49
 
50
50
  ## 4. Third-party content that is **not** redistributed here
51
51
 
package/README.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # dsh-browser-playwright-codex
2
2
 
3
- [![npm 版本](https://img.shields.io/npm/v/dsh-browser-playwright-codex?label=npm)](https://www.npmjs.com/package/dsh-browser-playwright-codex) [![License](https://img.shields.io/npm/l/dsh-browser-playwright-codex)](LICENSE) [![Node](https://img.shields.io/node/v/dsh-browser-playwright-codex)](package.json) [![最新发布](https://img.shields.io/github/v/release/miqian-nomad/dsh-browser-playwright-codex)](https://github.com/miqian-nomad/dsh-browser-playwright-codex/releases)
3
+ [![CI](https://github.com/miqian-nomad/dsh-browser-playwright-codex/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/miqian-nomad/dsh-browser-playwright-codex/actions/workflows/ci.yml) [![npm 版本](https://img.shields.io/npm/v/dsh-browser-playwright-codex?label=npm)](https://www.npmjs.com/package/dsh-browser-playwright-codex) [![npm 下载](https://img.shields.io/npm/dm/dsh-browser-playwright-codex?label=%E4%B8%8B%E8%BD%BD)](https://www.npmjs.com/package/dsh-browser-playwright-codex) [![License](https://img.shields.io/npm/l/dsh-browser-playwright-codex)](LICENSE) [![Node](https://img.shields.io/node/v/dsh-browser-playwright-codex)](package.json) [![最新发布](https://img.shields.io/github/v/release/miqian-nomad/dsh-browser-playwright-codex)](https://github.com/miqian-nomad/dsh-browser-playwright-codex/releases) [![](https://img.shields.io/badge/powered_by-dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white)](https://github.com/deepseek-ai/deepseek-harness)
4
4
 
5
- > [![dsh.so 安装验证 · harness 0.2.0-rc.1](https://www.dsh.so/badge/install/dsh-browser-playwright-codex@0.2.0-rc.1.svg)](https://www.dsh.so/zh/artifact/dsh-browser-playwright-codex/) [![dsh.so 风险](https://www.dsh.so/badge/dsh-browser-playwright-codex.svg)](https://www.dsh.so/zh/artifact/dsh-browser-playwright-codex/)
5
+ > [![dsh.so 安装验证 · harness 0.2.2-rc.1](https://www.dsh.so/badge/install/dsh-browser-playwright-codex@0.2.2-rc.1.svg)](https://www.dsh.so/zh/artifact/dsh-browser-playwright-codex/) [![dsh.so 风险](https://www.dsh.so/badge/dsh-browser-playwright-codex.svg)](https://www.dsh.so/zh/artifact/dsh-browser-playwright-codex/)
6
6
 
7
7
  **一句话**：让 AI 用你**已经登录的账号**在真实网页上干活 —— 填表、抓取列表、多标签查后台；浏览器窗口就在你桌面上、你随时看得见。原生弹框会被挂起、**绝不替你点「确定」**（机制级）；验证码/挑战页会被识别出来，并以提示要求模型停下交给你（**提示不是阻断**）。登录/二次验证**没有探测器**，靠模型从快照看出来并停下；密码、一次性验证码、卡号字段 `browser_fill` **直接拒绝**——这类字由你本人在窗口里输。
8
8
 
@@ -70,12 +70,12 @@ dsh plugin --profile <name> add github:miqian-nomad/dsh-browser-playwright-codex
70
70
  dsh plugin --profile <name> add link:<absolute path to this directory>
71
71
  ```
72
72
 
73
- **Compatibility.** Built and tested against DSH `0.2.0-rc.1`. The dependency ranges are **floors, not
74
- wildcards**: peers `@deepseek-ai/cordis` `>=4.0.4`, `@deepseek-ai/dsh-llm` `>=0.2.0-rc.1`,
75
- `@deepseek-ai/dsh-tools` `>=0.2.0-rc.1`, and the direct dependency `@deepseek-ai/schemastery` `^3.18.4`. The
73
+ **Compatibility.** Built and tested against DSH `0.2.2-rc.1`. The dependency ranges are **floors, not
74
+ wildcards**: peers `@deepseek-ai/cordis` `>=4.1.0`, `@deepseek-ai/dsh-llm` `>=0.2.2-rc.1`,
75
+ `@deepseek-ai/dsh-tools` `>=0.2.2-rc.1`, and the direct dependency `@deepseek-ai/schemastery` `^3.19.0`. The
76
76
  floors exist so an empty project cannot resolve a very old `0.0.1-rc.*` build, while a newer harness still
77
77
  installs. One cost of npm's prerelease rules: a prerelease whose `[major, minor, patch]` tuple differs from
78
- `0.2.0` (for example `0.2.1-rc.*`) is outside a `>=0.2.0-rc.1` range, so you may see a **peer warning** — a
78
+ `0.2.2` (for example `0.2.3-rc.*`) is outside a `>=0.2.2-rc.1` range, so you may see a **peer warning** — a
79
79
  warning, not an install failure (pnpm does not enforce peer ranges strictly by default). After a harness
80
80
  upgrade, `npm run doctor` re-checks that every named export this plugin imports still exists — that is the
81
81
  fast way to tell "the harness moved" from "the plugin broke".
@@ -384,7 +384,7 @@ Measured with ``npm run cost`` (per-turn, resident in the system prompt):
384
384
  |---|---|---|---|
385
385
  | Schema defaults (`Config({})`, no patch layer) | 16 | 11,283 | ≈ 3,134 |
386
386
  | Shipped bundle layer (this package's `cordis.patch.yml`: both power gates off) | 16 | 11,283 | ≈ 3,134 |
387
- | Everything registered (`registerDisabledTools: true`, plus `extract`) | 21 | 15,886 | ≈ 4,413 |
387
+ | Everything registered (`registerDisabledTools: true`, plus `extract`) | 21 | 16,146 | ≈ 4,485 |
388
388
 
389
389
  This paragraph describes the 0.6.0 change; the table above is today's measurement. Three things changed
390
390
  there, and only one of them was about size. (1) The click family was rewritten so each rule is stated once
@@ -464,20 +464,20 @@ The scenario suites originally surfaced four hazards, now fixed and regression-t
464
464
 
465
465
  ## Credits — the intro effect
466
466
 
467
- The first-open effect (the page is wiped white, then a swarm of cursors draws the boxes, text and images back) is **not this project's work**, and its code is one third-party file — **repository-only since 0.8.0, no longer in the npm package**:
467
+ The first-open effect (the page is wiped white, then a swarm of cursors draws the boxes, text and images back) is **not this project's work**, and its code is one third-party file — **shipped inside the npm package again as of 0.8.1, with the authors' written permission** (still off by default):
468
468
 
469
469
  - **The effect and its choreography** — [Swarm](https://github.com/califa/swarm-site) by **Joel Califa** ([swarm.joelcalifa.com](https://swarm.joelcalifa.com)). Used with his written permission (2026-11-08), on his one condition: **credit him** — this section is that credit.
470
- - **The code** — `assets/swarm-rebuild.js`, from [`DhvanilPatel/swarm-cursors`](https://github.com/DhvanilPatel/swarm-cursors) at commit `3d49e0ac` (2026-11-06, file `swarm-rebuild/swarm.js`), **with seven changes** (all in [`scripts/swarm-patch.mjs`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/scripts/swarm-patch.mjs): the vendor's own control bar removed, its four DOM fields retargeted at off-screen placeholders, the per-frame HUD refresh short-circuited, the end-of-playback updates null-guarded — that one fixes a crash the removal would otherwise cause — scanning gated on the plugin's go-ahead, the 0.5 s white fade-in dropped, and its self-start deferred until `<html>` exists. The pristine baseline stays in the repository as `assets/swarm-rebuild.upstream.js`, SHA-256 `6a30f19d…c7bfe`).
470
+ - **The code** — `assets/swarm-rebuild.js`, from [`DhvanilPatel/swarm-cursors`](https://github.com/DhvanilPatel/swarm-cursors) at commit `3d49e0ac` (2026-11-06, file `swarm-rebuild/swarm.js`), **with seven changes** (all in [`scripts/swarm-patch.mjs`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/scripts/swarm-patch.mjs): the vendor's own control bar removed, its four DOM fields retargeted at off-screen placeholders, the per-frame HUD refresh short-circuited, the end-of-playback updates null-guarded — that one fixes a crash the removal would otherwise cause — scanning gated on the plugin's go-ahead, the 0.5 s white fade-in dropped, and its self-start deferred until `<html>` exists. **Dhvanil Patel granted written permission by email on 2026-11-11 to bundle and modify it**; that grant covers this plugin, not third-party re-use, and comes with no MIT licence text. The pristine baseline stays in the repository as `assets/swarm-rebuild.upstream.js`, SHA-256 `6a30f19d…c7bfe`).
471
471
 
472
472
  The exact licensing split, and what is still outstanding, is recorded in [`NOTICE.md`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/NOTICE.md).
473
473
 
474
- **中文**：首次打开网页的「进场特效」——页面被抹白，再由一群光标把方框、文字、图片一笔一笔画回来——**不是本项目自己的作品**。动效与编排出自 **Joel Califa** 的 [Swarm](https://github.com/califa/swarm-site)，他于 2026-11-08 书面同意本项目使用，唯一条件是**署名**，此节即为署名；代码取自 [DhvanilPatel/swarm-cursors](https://github.com/DhvanilPatel/swarm-cursors) 的 `assets/swarm-rebuild.js`（改过七处）。**从 0.8.0 起这份资产只在仓库里，不进 npm 包**，也默认关闭。许可切分与仍在等的事见 `NOTICE.md`。
474
+ **中文**：首次打开网页的「进场特效」——页面被抹白，再由一群光标把方框、文字、图片一笔一笔画回来——**不是本项目自己的作品**。动效与编排出自 **Joel Califa** 的 [Swarm](https://github.com/califa/swarm-site)，他于 2026-11-08 书面同意本项目使用，唯一条件是**署名**，此节即为署名；代码取自 [DhvanilPatel/swarm-cursors](https://github.com/DhvanilPatel/swarm-cursors) 的 `assets/swarm-rebuild.js`（改过七处）。**Dhvanil Patel 于 2026-11-11 邮件书面许可本项目打包与修改**，所以从 **0.8.1 起这份资产重新随 npm 包分发**（仍默认关闭）；该许可只覆盖本插件，不附 MIT 许可文本。许可切分与仍在等的事见 `NOTICE.md`。
475
475
 
476
476
  ## License
477
477
 
478
- MIT — **except `assets/swarm-rebuild.js`** (repository-only, not in the npm package as of 0.8.0), which is third-party work: see [Credits](#credits--the-intro-effect) above and [`NOTICE.md`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/NOTICE.md) §3. This project grants no rights in that file.
478
+ MIT — **except `assets/swarm-rebuild.js`** (third-party work, shipped in the package as of 0.8.1 under the authors' written permission — no MIT licence text), which is covered by [Credits](#credits--the-intro-effect) above and [`NOTICE.md`](https://github.com/miqian-nomad/dsh-browser-playwright-codex/blob/main/NOTICE.md) §3. This project grants no rights in that file.
479
479
 
480
- **中文**：插件本体与随包文档是 MIT；**`assets/swarm-rebuild.js` 除外**（它只在仓库里，0.8.0 起不进 npm 包），它是第三方作品，本项目不对它主张也不授予任何权利，详见上文 Credits 与 `NOTICE.md` §3。
480
+ **中文**：插件本体与随包文档是 MIT；**`assets/swarm-rebuild.js` 除外**（第三方作品，**0.8.1 起在作者书面许可下重新随包分发**，无 MIT 许可文本），本项目不对它主张也不授予任何权利，详见上文 Credits 与 `NOTICE.md` §3。
481
481
 
482
482
 
483
483
  <!-- changelog:today -->