dsh-file-attachments v0.2.0

v0.2.0 — Auto-announcement, full-window intake, markup & audit hardening

Since v0.1.0: 19 commits, 173 tests (was 147), all official-seam conformance, zero core patches.

✨ New capabilities

• Auto-announcement — the moment a user message enters the inbox, every unannounced file is injected into the model's view through the official agent/pre-step waterfall, carrying its detected type (text/html, archive/zip, …) so the model picks the right reader immediately. A per-session watermark prevents repeats; the watermark is rebuilt from the durable session log after a restart, so files uploaded before a restart are announced exactly once, however old. The model now combines file content with the user's words automatically.
• Full-window drag & drop — dropping a non-image file anywhere in the window is taken over by the plugin (a "release to attach" overlay appears); the official "images only" blocker toast no longer fires. Image-only drags are untouched and keep the native pipeline.
• Markup recognition — HTML (.html/.htm), XML (.xml/.xsd/.rss) and SVG are detected by content and extension and read as text (HTML source is returned as plain text — never rendered, zero XSS surface). Markdown was already supported.

🛠 Fixes

• CJK archive names — bsdtar octal-escapes non-ASCII names on a pipe (\351\223\276…); the raw backslashes were misread as Windows separators and rejected the whole archive as an "absolute path". Names are now decoded, listing works, and CJK entries extract correctly. One hostile entry no longer hides the whole listing — it is skipped, extraction stays strictly whitelisted.
• Race-free announcement — the previous agent.inject() queue could miss a step whose batch was already claimed (observed in the field); the announcement now rides the pre-step waterfall, the only serial chain before request derivation.

🔒 Audit hardening (official-standard review)

• Uploads now verify the session exists (fail-closed), consistent with the read path.
• Origin whitelist accepts loopback-equivalent origins (127.0.0.1 / localhost / [::1]) on the same port; cross-site and cross-port requests are still rejected.
• Credential redaction extended to compound key names (aws_secret_access_key, apiKey, set-cookie) with segment-boundary matching that leaves public_key / monkey untouched.

📦 Distribution

• Prebuilt bundle: download dsh-file-attachments-0.2.0.zip below (see SHA256SUMS.txt).
• Installers unchanged (install.bat / install.command, or node scripts/install.mjs); idempotent.
• Web end: restart dsh web + hard-refresh. CLI/headless end: tools mount automatically through the shared profile.

📚 Official API conformance

agent/pre-step waterfall · MessageSourceMap.plugin · systemPrompt.section · tools.register / defineTool · webServer.register · sessionQuery.readSession · content-addressed storage design per @deepseek-ai/dsh-attachment. Full reference table with doc links in README.md.

Full changelog: v0.1.0...v0.2.0