Timeout is now a true cancellation: conversions observe an abort signal, so ffmpeg children are killed and page loops stop instead of running behind an already-returned result.
All outputs (images, data, PDF text, page rasters, PDF→DOCX) are written through scratch files and published atomically; a failed page cleans up the pages already written.
Windows ffmpeg/ffprobe downloads now install pinned, sha256-verified FFmpeg 6.1.1 static builds (ffmpeg-static, npmmirror binary CDN with a byte-identical GitHub fallback) instead of the 2018-era FFmpeg 4.1 npm packages; a current system ffmpeg keeps priority for untrusted media.
outputRoots resolves symlinks (real-path) before confinement, and isSameFile detects symlink aliases of the input.
Resource limits are configurable and enforced: maxInputMb (default 2048), maxPdfPages (default 200, applies to implicit full-document rasterization; explicit pages override it) and maxOutputPixels (default 16 MP, clamped per page with a warning).

pages option for PDF conversions (convert_file, batch_convert): select pages with ranges like 1-3,5,8-10; outputs keep their real page numbers (doc-3.png), text joins the selected pages.
OCR for PDF → TXT: ocr: true (optionally ocr_lang, default chi_sim+eng) rasterizes the pages and recognizes them. Engine priority: a locally installed Tesseract CLI, then the bundled tesseract.js (language data downloads into the plugin cache on first use). Intended for scanned PDFs — inspect_file flags those via likelyScanned.
install_ocr_dependencies: explicit download of tesseract.js language data (~10-30 MB per language) into the plugin cache. Conversions never download language data implicitly — without a cached pack they fail with guidance, and a local Tesseract missing a language reads as missing_dependency too.
install_ocr_dependencies renamed flow hardened; cached installs are recorded in a manifest.json (version, sha256, size, install date) and flag themselves for a force: true upgrade when they predate it.
Security test suite: symlink aliases of the input, symlink escape of outputRoots, oversized SVG, malformed PDF, corrupt media, long file names, concurrent same-output writes and oversized JSON.

Assets 2

Releases: zzy-12345678/dsh-file-convert

Release list