v3.4.1 - double-load regression fix + delivery audit

Runtime marker version 8. Fixes the plugin+diskpatch coexistence regression (same-version guard now yields instead of disabling the running instance). Full delivery audit: bundle publish fields, install docs for other users, CI green. See CHANGELOG.md.

v3.4.0 - out-of-tree profile bundle + instant theme follow

Runtime marker version 7. See CHANGELOG.md. P0-1 dual-form release: profile bundle (dsh plugin --profile web add dsh-html-render) with host-side KaTeX asset route + systemPrompt fence contract + bundled skill; client half wraps the same kernel via ModuleLoader. P1-3 instant theme follow (0-delay dark/light switch). Disk-patch form remains as compat channel.

v3.3.0 - N1-N7 remediation + cache-busting

Runtime marker version 6. See CHANGELOG.md for the full N1-N7 fix list.

v3.2.0 - audit fixes + cross-platform installer

v3.2.0 - Audit fixes (toolbar buttons, channel-2 sandbox, security hardening)

Full remediation of the 2026-09 deep review (A/B/C/D/E/F/G lists), runtime marker version 5.

Critical fixes

• A1: ??/??/?? toolbar buttons referenced an undefined variable - now work
• A2 + B1: channel 2 (bare <div class="mdt"> fragments) no longer uses shadow DOM + innerHTML in the parent origin - unified into the same sandboxed-iframe pipeline
• B2: new-tab preview uses a CSP with sandbox allow-scripts - the top-level tab is opaque too
• B3: postMessage now carries a mount id (O(1) lookup) + ev.source verification
• B4: KaTeX maxExpand/maxSize + per-formula length + per-fence count caps + result LRU cache
• B6: vendor/katex VERSION + SHA256SUMS, verified in CI

Other notable

• Cross-platform Node installer install.mjs (Windows/Linux/macOS, npm/pnpm/bun/global paths)
• PS installer: last-</body> injection, atomic writes, stale-backup discard on uninstall
• KaTeX/CSS load retry (?3 exponential backoff) + __dshHtmlRenderer.resetKatex()
• 30s streaming-stuck timeout, _pending frame replay, oversized-fence lifecycle
• SECURITY.md / CONTRIBUTING.md / .gitignore / package.json, version-consistency CI
• Deferred (documented in CHANGELOG): incremental DOM scanning, Playwright e2e, ESLint suite

Install (local/self-hosted DSH):

node install.mjs          # cross-platform, or .\install-dsh-html.ps1 on Windows
node install.mjs --check

Then Ctrl+F5 the DSH web GUI and paste a ```dsh-html fence.

v3.1.0 - KaTeX formula safety + seamless theming

dsh-html-render v3.1.0

Inline HTML + KaTeX rendering for DeepSeek Harness (DSH) chats: the model writes a ```dsh-html fence, the chat renders real HTML - styles, local scripts, math - borderless, theme-adaptive, height-accurate.

Highlights

• KaTeX formulas ($...$ / $$...$$) pre-rendered locally, zero network, never shows raw source
• Sandbox: allow-scripts opaque origin + CSP (no network / no iframe / no parent access)
• Theme-adaptive: background/text sampled from the host chat, dark mode seamless
• Height: content-edge measurement + fonts.ready re-report + polling - no scrollbars, no self-growth
• v3.1: formula-safe tokenizer (never touches tags/script/pre/code, CJK currency guard), KaTeX-missing fallback (fence never hangs), truncation indicator, noopener tabs, upgrade-safe backup, -All multi-dist, CI

Install (local/self-hosted DSH only)

powershell -ExecutionPolicy Bypass -File .\install-dsh-html.ps1

Then Ctrl+F5 the DSH web GUI and paste a ```dsh-html fence. See README for -Check / -Uninstall / -All and the 5-family style library in skills/dsh-html-usage.