Release 0.7.0 · Fakek0f3sT/dsh-mcp-diff

Security and robustness hardening plus reviewer UX features.

Security

Workspace containment for open-file links: every path this plugin forwards to the host opener is resolved and gated — absolute targets, ~ paths, .. traversal, or a bash call working outside the workspace render as plain text. Rendered content can no longer trigger an open of an arbitrary host file.
CI hygiene: workflow actions pinned to commit SHAs, push filtered to main, concurrency group.

bash parser rewritten: linear heredoc extraction (a 10k-marker command froze the tab for ~10s, now ~50ms), several heredocs on one line parse sequentially, quoted spans and comments no longer claim phantom writes, sed -i claims only its own segment's files, tee --append, fd-prefixed redirects (2> err.log), /dev skip narrowed to stream sinks (> /dev/sda stays visible).
diff render bounded: max 400 rows by default with a footer, LCS bails to del-all/add-all past 1M dp cells, parse memoized per command.
failed MCP edit/write cards now show the red outcome dot instead of reading as a clean diff; links suppressed when a cd shifts the base or the target is dynamic.

Copy actions on every diff card: copy the rendered diff, the bash command, or the real server patch (settled edit_file, fence-stripped, git apply-able).
Wrap toggle for long lines and per-card show all N override of the render cap.
Risk annotations: plain terminal cards badge unambiguous destructive signatures (rm -rf, chmod 777, git reset --hard, git clean -f, curl … | sh, mkfs, dd of=, shred).
Honest write flavor in the badge (append vs write), Inspect affordance on mutation cards.