v0.3.0

Release notes

Security

• Zip-bomb defense: decompressed byte totals are re-checked against the actual output; documents exceeding 256 MB are rejected (FILE_TOO_LARGE).
• Secret redaction extended to six previously missed forms: PGP/OpenSSH private-key PEM blocks, _authToken/authToken, stripe_key/openai_key, DATABASE_URL, export KEY=value lines, and passwordHash (camelCase).

Encoding

• GB18030/GBK decoding for Chinese text files, including 4-byte sequences (¥ etc.); random high-byte streams are rejected by a byte-level heuristic.
• ZIP entry names decode as UTF-8 when GPB bit 11 is set, else GB18030 with CP437 fallback.

Performance

• pdfjs-dist loaded on demand (legacy/pdf.min.mjs, 512 KB); non-PDF operations no longer pay PDF module startup cost.
• Parse results cached (LRU, 16 entries / 8 MB) with in-flight deduplication; cache keys are safe because storage is content-addressed.

Windows

• install.ps1 one-click installer (parameterized, idempotent; detects Node.js ≥ 20 and pnpm/npm).
• TAR_NOT_FOUND error with install guidance when bsdtar is absent; ZIP archives fall back to in-process parsing.
• Filename sanitization rejects Windows reserved characters and device names (CON, PRN, COM1-9, …).
• .gitattributes enforces CRLF checkout for .bat/.cmd/.ps1.
• Walkthrough: docs/WINDOWS-INSTALL.zh.md.

Quality

• Tests: 173 → 194 (vitest), tsc --noEmit clean.
• Formats: PDF, DOCX, XLSX, PPTX, legacy .doc/.xls, RTF, ODF, EPUB, ZIP/7z/RAR listing, HTML/XML/SVG, and plain text.

Assets

• install.ps1 — Windows installer.
• SHA256SUMS.txt — checksums.
• Source archives are GitHub-generated (below the asset list).

References

• DeepSeek Harness
• Node.js · pnpm
• PowerShell · libarchive bsdtar
• pdfjs-dist · fflate · file-type

Security policy: SECURITY.md. Third-party notices: THIRD_PARTY_NOTICES.md.

dsh-file-attachments v0.2.0

v0.2.0 — Auto-announcement, full-window intake, markup & audit hardening

Since v0.1.0: 19 commits, 173 tests (was 147), all official-seam conformance, zero core patches.

✨ New capabilities

• Auto-announcement — the moment a user message enters the inbox, every unannounced file is injected into the model's view through the official agent/pre-step waterfall, carrying its detected type (text/html, archive/zip, …) so the model picks the right reader immediately. A per-session watermark prevents repeats; the watermark is rebuilt from the durable session log after a restart, so files uploaded before a restart are announced exactly once, however old. The model now combines file content with the user's words automatically.
• Full-window drag & drop — dropping a non-image file anywhere in the window is taken over by the plugin (a "release to attach" overlay appears); the official "images only" blocker toast no longer fires. Image-only drags are untouched and keep the native pipeline.
• Markup recognition — HTML (.html/.htm), XML (.xml/.xsd/.rss) and SVG are detected by content and extension and read as text (HTML source is returned as plain text — never rendered, zero XSS surface). Markdown was already supported.

🛠 Fixes

• CJK archive names — bsdtar octal-escapes non-ASCII names on a pipe (\351\223\276…); the raw backslashes were misread as Windows separators and rejected the whole archive as an "absolute path". Names are now decoded, listing works, and CJK entries extract correctly. One hostile entry no longer hides the whole listing — it is skipped, extraction stays strictly whitelisted.
• Race-free announcement — the previous agent.inject() queue could miss a step whose batch was already claimed (observed in the field); the announcement now rides the pre-step waterfall, the only serial chain before request derivation.

🔒 Audit hardening (official-standard review)

• Uploads now verify the session exists (fail-closed), consistent with the read path.
• Origin whitelist accepts loopback-equivalent origins (127.0.0.1 / localhost / [::1]) on the same port; cross-site and cross-port requests are still rejected.
• Credential redaction extended to compound key names (aws_secret_access_key, apiKey, set-cookie) with segment-boundary matching that leaves public_key / monkey untouched.

📦 Distribution

• Prebuilt bundle: download dsh-file-attachments-0.2.0.zip below (see SHA256SUMS.txt).
• Installers unchanged (install.bat / install.command, or node scripts/install.mjs); idempotent.
• Web end: restart dsh web + hard-refresh. CLI/headless end: tools mount automatically through the shared profile.

📚 Official API conformance

agent/pre-step waterfall · MessageSourceMap.plugin · systemPrompt.section · tools.register / defineTool · webServer.register · sessionQuery.readSession · content-addressed storage design per @deepseek-ai/dsh-attachment. Full reference table with doc links in README.md.

Full changelog: v0.1.0...v0.2.0

dsh-file-attachments v0.1.0

Prebuilt bundle download: see attached zip and SHA256SUMS.txt. Extract, then double-click install.bat (Windows) or install.command (macOS/Linux).