dsh-web-recon

The usual way an agent works a web back-office is screenshot, locate button, click, screenshot again—dozens of screenshots per workflow, thousands of tokens each, a redesign wipes everything, and the next session repeats the two-hour grind. dsh-web-recon takes a different shortcut: beneath the buttons there is already an HTTP API, and beneath the pixels an accessibility tree, both of which are far cheaper and far more stable.

It does one thing well: a single reconnaissance pass over a single-page application, with no button clicked, extracts the system's real API endpoints, authentication scheme, and noteworthy controls into a durable JSON playbook. web_replay then calls those endpoints directly from inside a dedicated browser, letting the browser natively handle cookies, CSRF, and CORS. Credentials never pass through the plugin, never printed, never stored. State-changing requests (POST/PUT/PATCH/DELETE) are refused by default and require explicit user consent. A dedicated browser, an origin allow-list with timestamped audit, and summary-only output form the security boundary.

Built for anyone who operates the same web admin panel, reporting system, or internal tool on a recurring basis. Learn it once, follow the playbook every session after, instead of guessing at the screen again.