Small release, all of it about clicking the right thing and then saying so when it can't.

Sending a message

• A field's own Send button is the one that gets clicked. The search for it stops at the next landmark, so a form can no longer pick up "Send feedback" in a footer or a Search button further up the page, and a button has to come after the field it belongs to. "Post" and "Reply" count as send buttons; "Submit query" and "Subscribe" no longer do.

Stale refs

• Acting on an element that was removed says so. Instead of re-finding whatever now has the same role and name and clicking that, the tool fails with "ref N was removed from the page. Take a new page_snapshot before acting on it again." Both have regression tests now.

Everything else

• Install links in the README and on the website use the foxhand address the add-on now lives at.
• Dependencies updated (zod 4.6.7, MCP SDK 1.32.2, express 5.3.0); nothing the helper ships has a known vulnerability.

The tools are reworked so agents can read and act on real pages on the first try, without working around them. Every change below was checked on live sites (Spiegel, GitHub, YouTube, Wikipedia, TodoMVC, react-select, MUI, Lexical, ProseMirror, Slate, CKEditor) as well as in the tests. The names now follow one pattern, <thing>_<verb>. Agents and prompts that call tools by their old names need updating.

Buttons the snapshot used to miss

• Buttons built from plain elements.
• Icon-only buttons have names, from their tooltip, SVG title, the icon's own name (fa-trash becomes "icon: trash"), a test id or a class.
• Closed shadow roots are read and acted on, not only open ones.
• Controls that only show on hover, like the ✕ on a to-do item, are listed (marked [on hover]) and can be clicked, although an add-on can't produce CSS :hover.
• Styled checkboxes and radios (a hidden input under a styled label) show as the checkbox, with its state.
• Unlabeled fields are named by the text beside them or, for a custom dropdown, the value it shows.

iframes from other sites

• Cookie banners, sign-in buttons, payment fields and embeds in cross-origin iframes are part of the snapshot.
• A consent dialog that closes itself after "Accept" is reported as done, not as a failure the agent would retry.

Snapshots with a shape

• Controls are nested under what they belong to: the landmark, dialog, form, list item, table row or card.
• An open modal, or an overlay covering the screen, is listed first and flagged in the header, so a long page can't push it out of the snapshot.
• Repeated buttons say which card they're in: each "Add to cart" on a shop page is labeled with its product, each "More actions" with its video, even when the cards are plain <div>s.

Typing like a person

• Every character is a key press: keydown, keypress, beforeinput, the edit, input and keyup.
• Rich editors keep the text: Lexical, Slate, ProseMirror, CKEditor and editors in same-origin frames.
• Clicks land on the element under the pointer, such as the icon inside a button, which is often where the page listens.
• Submitting a form presses its real submit button.

Renamed and merged

(The table of old and new names is in the full notes.)

tab_move is removed. The thought argument on every tool is gone too: the thought tool shows a note, and it stays on the next page action within 30 seconds. Otherwise the cursor describes each action itself.

Acting on pages

• Find elements by what they say.
• Refs last longer.
• Results say what changed.
• A name that isn't found lists the closest ones, including common synonyms ("Sign in" finds "Log in").
• Clicks at a point.
• page_type finds fields by label or placeholder and handles rich editors, checkboxes and selects.
• page_select opens custom dropdowns (comboboxes and listboxes) as well as <select>.

All the details: https://github.com/hamb1y/foxhand/releases/tag/v0.5.4