v0.2.1 — review-fix release
v0.2.1 — review-fix release (first tagged release)
Addresses the six blocking findings from the dshoneys/awesome-dshoneys#1 community review. Full detail in CHANGELOG.md.
Privacy & safety
passthroughnow defaults tofalse(OCR every image; vision passthrough is opt-in)- Local attachment filenames are no longer forwarded in
<image_ocr>blocks - Missing attachments are replaced with a refusal text block (fail-closed, never a raw
image) - Unload/HMR restores the original
resolveModelInfo/listModels/adapter.streammethods - On timeout/teardown the OCR child is terminated and awaited before temp-dir removal; removal retries once and logs
tesseractBinparsing is quote-aware —"C:\Program Files\Tesseract-OCR\tesseract.exe"works- Startup temp sweep only removes our own
mkdtemp-shaped directories
Reproducibility & CI
- Scoped package name
@maxwell-feng/dsh-tesseract-ocr - Pinned dev dependencies + committed
package-lock.json - GitHub Actions CI:
npm ci+ 18 standalone tests + real Tesseract smoke on Ubuntu
Docs: README / README.zh-CN / agents-install / cordis.patch.yml aligned with the new privacy defaults.
Verified: all standalone tests pass; CI green; deployed to Ubuntu 26.04 and Windows hosts.