npm - @jidekaixin2dian/dsh-file-actions - Versions diffs - 0.1.13 → 0.1.15 - Mend

@jidekaixin2dian/dsh-file-actions 0.1.13 → 0.1.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -1,71 +1,104 @@
-# Changelog
-## 0.1.13 — 2026-10-24
-- 渠道对齐：0.1.12 的 GitHub Release 资产早于安全修复（tag 停在 `6aa0b38`），而 npm 0.1.12 已包含修复；自 0.1.13 起两个渠道从同一提交构建。代码与 0.1.12（npm）一致，仅升版本号。
-- 发布链：npm 改用 Trusted Publishing（OIDC，无 token、无 OTP），`npm publish --provenance` 附带 SLSA 来源证明。
-## 0.1.12 — 2026-10-24
-- 「复制文件内容」作用于会话工作区之外的文件时先弹确认框，说明该文件不属于本对话；拒绝则不读取任何字节。工作区内的复制行为不变。缓解聊天文本被注入绝对路径后的诱导复制。
-- 移除菜单调试用的 `window.__dfaDebug` 全局对象；错误路径保留 `console.warn`。
-- 新增 `npm-publish.yml`：手动触发的 npm 发布 workflow，先跑测试再 `npm publish --provenance`（OIDC 来源证明），action 按 SHA 固定。
-## 0.1.11 — 2026-10-24
-- 新增 npm 分发渠道，包名保留 `@jidekaixin2dian/dsh-file-actions`，GitHub Release 安装方式继续可用。
-- 明确公开发布到官方 npm registry；中英文文档补充 DSH 安装、固定版本与仅下载命令。
-- 插件功能与 0.1.10 相同，无新增运行时依赖或构建步骤。
-## 0.1.10 — 2026-10-23
-- 移除其他产品对标表述；中文显示名改为「文件与链接操作」，保留包名与英文名 File Actions。
-- 明确文件引用显示探测状态与可重试错误；猜测路径先验证再接管右键，Shift+右键保留原生菜单。
-- 按文件类型保存首选应用；关联列表优先排列首选、系统默认和编辑器，保留全部应用。
-- 区分应用查询中、空结果和失败重试，预留菜单行，异步缩略图不再重绘操作区域。
-- 字号跟随页面根字号，窄视口约束菜单宽度；修复搜索无结果时键盘仍可能执行隐藏应用的问题。
-## 0.1.9
-- 插件面板显示中文名与中文简介（`locale/zh.json`、`locale/en.json` 的 `meta.title` / `meta.description`），卡片和详情不再回落到英文 package.json 描述。
-## 0.1.8
-- 菜单与提示条加一层按主题计算的可读性底：液态玻璃/壁纸主题下文字不再被背景冲淡，玻璃感保留。
-## 0.1.7
-- 蓝色引用统一：GitHub 等网页链接也走同一个菜单，给「打开链接 / 复制链接 / 复制链接文字」。
-- 修掉与 Toolgate 同时安装时的启动报错：两个浏览器 bundle 都在顶层声明 `const factory`，DSH 合并加载时冲突；现在各自隔离作用域，并补了重复加载的回归测试。
-- 一并包含 0.1.6 的未发布修复：HTML/SVG 预览改用独立来源的 sandbox 帧、资源地址优先于子元素提示、切换点击时取消过期菜单、缩略图缓存按会话/路径/版本、可复现的真实宿主与浏览器检查。
-## 0.1.6
-- HTML/SVG 预览与 DSH 页面隔离（sandbox 帧，保留脚本执行），清空 popup opener。
-- 保留 POSIX 根与资源地址的 Session 身份；资源地址优先于子元素 title；POSIX 路径区分大小写。
-- 取消过期菜单、卸载时回收缩略图 URL、缩略图按会话/路径/版本缓存并拒绝不完整数据。
-- 增加可复现的真实宿主/浏览器 CI 与归档安装检查；可选全 Web 工具改用官方 CLI 与自有进程校验。
-## 0.1.5
-资源链接、带装饰的文件名、字幕与媒体分类。
-## 0.1.4
-`dsh-resource://` 链接、字幕、视频与音频类型。
-## 0.1.3
-「打开方式」搜索、滚动渐隐、图片缩略图、市场预览图。
-## 0.1.2
-菜单视觉重做：文件身份头部、键盘提示、子菜单表头。
-## 0.1.1
-自审修复：复制上限、焦点与滚动、无扩展名文件。
-## 0.1.0
-首个版本。
+# Changelog
+## 0.1.15 — 2026-10-25
+- 审查修复：工作区外复制在确认不可用或异常时拒绝读取；无效 UTF-8 不再静默替换后报告成功；分块下载核对版本、路径、偏移和大小，读取期间变化会中止。
+- HTML/SVG 默认静态预览，关闭脚本与外部资源；可信内容可显式启用脚本与联网，同时保留 opaque-origin sandbox。
+- 修复 Blob 缩略图缓存按 URL 长度计费的问题，改按实际字节控制 16 MiB 预算；修复应用筛选后的悬停/键盘索引，补齐相对行号引用、点文件、Dockerfile 和 UNC 链接识别。
+- 持久化关联缓存先展示、后台校验；失效关联不再继续启动，打开失败清缓存但不重放动作。
+- 声明最低宿主 `engines.dsh >=0.2.1-rc.2`；默认宿主 pin 更新到 rc.3，保留 rc.2 验证；CI 两系统均测这两个版本。浏览器 fixture 使用安全端口范围，避免随机命中 Chromium 禁用端口。
+- npm 发布要求从同一版本 tag 调度，tag 已合入 main 且四项 Validation 检查成功；调度 ref/SHA 与源码一致，校验并直接发布同一份 GitHub Release 归档。
+- 行内代码视为显式引用：聊天里蓝色文件名冷右键（不先悬停）就能打开菜单；`pre` 代码块内仍按猜测处理。
+- 关联应用查询失败时不再渲染「应用查询失败，点击重试」死行，也不再留永远灰着的编辑器占位。宿主枚举应用时只要碰到一个坏掉的系统关联就会整批抛错（典型是卸载残留的 ProgID，如没有 `shell\open\command` 的 `XIUXIU`），此时菜单只保留能用的动作，下一次右键自动重试；查询进行中仍保留占位行，避免下方行跳动。
+- 关联应用查询提速：悬停即预取、按扩展名做 in-flight 去重、成功结果缓存 10 分钟（空结果 15 秒）、超时 8 秒改为 6 秒。
+- 菜单跟随滚动按行位移精确平移，不再因重新计算落点触发边缘夹紧而漂移。
+- 类型与图标补齐到 20 类（code / data / subtitle / font / design / model / disk / exec / video / audio 等），24 格图标按类着色。
+- 视频读首帧做预览缩略图（取片长 10%，封顶 3 秒，限 8 MB）。
+- 「首选应用」的星标从 `★/☆` 文字字形换成同套 24 格矢量图标：未选空心、选中实心蓝，字重与行内其它图标一致（文字字形会跟着页面字体变粗变细）。
+- 「打开方式」子菜单首次打开时顶部圆角被粘性表头盖成直角（滚动后顶部遮罩淡出表头才显得圆）；菜单改为把子元素裁剪进圆角盒，首开即圆角。
+- 浮窗跟随与尺寸：滚动时菜单按行位移滑行，子菜单不再被关掉而是跟着自己那一行走（偏移用 `offsetLeft/offsetTop` 捕获，入场动画期间也不会漂 2–6px，滚动跟走用 rAF 合并）；定位距指针 2px，两边按余量取较宽的一侧并把高度封顶到该侧余量（菜单 `min(余量, 74vh, 520px)`，子菜单 `min(余量, 56vh, 400px)`）——装不下时在面板内部滚动，不再夹紧回来盖住指针所在行；宽度改为内容自适应并收在 15–26em（子菜单 17–23em）；缩略图 `clamp(76px,15vh,118px)`；入场改为 110ms 缩放淡入。
+- 预览不再和文件名行叠在一起：缩略图改成独立的圆角块（`overflow:hidden` + 绝对定位 `object-fit:contain`）。视频首帧 188px 曾溢出 137px 的容器、压在文件名与大小上；`max-height:100%` 在网格里没约束住它。图片与视频走同一套。
+- 视觉对齐统一到一条左轴线（菜单边缘内 13px）：预览块、类型图标、行图标、分隔线、页脚分隔线、子菜单表头与搜索框左右缘全部对齐；头部分隔线不再比其它分隔线长。
+- 预览可点击看大图：点缩略图弹出遮罩层（Esc / 点图关闭），先于菜单响应 Esc，菜单不关；视频标注为「首帧」并指引用「在浏览器中播放」看完整视频。
+- 键盘：Tab / Shift+Tab 在菜单内逐行移动（焦点不再跑出菜单）；大图打开时由遮罩层独占 Esc/Enter/空格。
+- 关联应用结果持久化到 localStorage（24 小时、上限 512 KB、按最近使用优先，图标过大自动降级为纯列表）：实测首次枚举 **1820 ms** → 同页再次 **13 ms** → 刷新后 **15 ms**；读入时校验条目，避免脏数据渲染成空行。
+- 「另存为…」与「在浏览器中打开」改为分块读取：宿主单次读有 2 MB 上限，超过就报「读取失败」——4.9 MB 的 `成片.mp4` 因此只能失败。实测修复后完整下载 5,087,432 字节；总读取上限 64 MB，超出提示「文件过大」。
+- 预览带来源路径守卫：迟到的解码结果只会画到它所属的文件上，切换文件不会再看到上一个文件的图。
+- 体积与开销：删除无引用的图标与文案、把「主菜单/子菜单」两套定位逻辑合并为 `fitPanel()`（同时统一了边距与封顶规则）；缩略图缓存从「最多 12 个」改为**按字节封顶 16 MB**（原先最坏可驻留约 96 MB 的对象 URL）。静置开销实测：500 次指针事件 10 ms → 9 ms（约 18 µs/次），滚动跟随偏移不变。
+- 字典去重：ZH/EN 的 `kinds` 删除重复的 `video` / `audio`，新增「字典不允许重复键」静态测试。
+## 0.1.14 — 2026-10-24
+- 图标整套重画（24 格、统一描边）。
+- Shift+右键从「让位」改为「页面先处理，无人处理则回退」，不再出现按了没反应。
+## 0.1.13 — 2026-10-24
+- 渠道对齐：0.1.12 的 GitHub Release 资产早于安全修复（tag 停在 `6aa0b38`），而 npm 0.1.12 已包含修复；自 0.1.13 起两个渠道从同一提交构建。代码与 0.1.12（npm）一致，仅升版本号。
+- 发布链：npm 改用 Trusted Publishing（OIDC，无 token、无 OTP），`npm publish --provenance` 附带 SLSA 来源证明。
+## 0.1.12 — 2026-10-24
+- 「复制文件内容」作用于会话工作区之外的文件时先弹确认框，说明该文件不属于本对话；拒绝则不读取任何字节。工作区内的复制行为不变。缓解聊天文本被注入绝对路径后的诱导复制。
+- 移除菜单调试用的 `window.__dfaDebug` 全局对象；错误路径保留 `console.warn`。
+- 新增 `npm-publish.yml`：手动触发的 npm 发布 workflow，先跑测试再 `npm publish --provenance`（OIDC 来源证明），action 按 SHA 固定。
+## 0.1.11 — 2026-10-24
+- 新增 npm 分发渠道，包名保留 `@jidekaixin2dian/dsh-file-actions`，GitHub Release 安装方式继续可用。
+- 明确公开发布到官方 npm registry；中英文文档补充 DSH 安装、固定版本与仅下载命令。
+- 插件功能与 0.1.10 相同，无新增运行时依赖或构建步骤。
+## 0.1.10 — 2026-10-23
+- 移除其他产品对标表述；中文显示名改为「文件与链接操作」，保留包名与英文名 File Actions。
+- 明确文件引用显示探测状态与可重试错误；猜测路径先验证再接管右键，Shift+右键保留原生菜单。
+- 按文件类型保存首选应用；关联列表优先排列首选、系统默认和编辑器，保留全部应用。
+- 区分应用查询中、空结果和失败重试，预留菜单行，异步缩略图不再重绘操作区域。
+- 字号跟随页面根字号，窄视口约束菜单宽度；修复搜索无结果时键盘仍可能执行隐藏应用的问题。
+## 0.1.9
+- 插件面板显示中文名与中文简介（`locale/zh.json`、`locale/en.json` 的 `meta.title` / `meta.description`），卡片和详情不再回落到英文 package.json 描述。
+## 0.1.8
+- 菜单与提示条加一层按主题计算的可读性底：液态玻璃/壁纸主题下文字不再被背景冲淡，玻璃感保留。
+## 0.1.7
+- 蓝色引用统一：GitHub 等网页链接也走同一个菜单，给「打开链接 / 复制链接 / 复制链接文字」。
+- 修掉与 Toolgate 同时安装时的启动报错：两个浏览器 bundle 都在顶层声明 `const factory`，DSH 合并加载时冲突；现在各自隔离作用域，并补了重复加载的回归测试。
+- 一并包含 0.1.6 的未发布修复：HTML/SVG 预览改用独立来源的 sandbox 帧、资源地址优先于子元素提示、切换点击时取消过期菜单、缩略图缓存按会话/路径/版本、可复现的真实宿主与浏览器检查。
+## 0.1.6
+- HTML/SVG 预览与 DSH 页面隔离（sandbox 帧，保留脚本执行），清空 popup opener。
+- 保留 POSIX 根与资源地址的 Session 身份；资源地址优先于子元素 title；POSIX 路径区分大小写。
+- 取消过期菜单、卸载时回收缩略图 URL、缩略图按会话/路径/版本缓存并拒绝不完整数据。
+- 增加可复现的真实宿主/浏览器 CI 与归档安装检查；可选全 Web 工具改用官方 CLI 与自有进程校验。
+## 0.1.5
+资源链接、带装饰的文件名、字幕与媒体分类。
+## 0.1.4
+`dsh-resource://` 链接、字幕、视频与音频类型。
+## 0.1.3
+「打开方式」搜索、滚动渐隐、图片缩略图、市场预览图。
+## 0.1.2
+菜单视觉重做：文件身份头部、键盘提示、子菜单表头。
+## 0.1.1
+自审修复：复制上限、焦点与滚动、无扩展名文件。
+## 0.1.0
+首个版本。

package/LICENSE CHANGED Viewed

@@ -1,21 +1,21 @@
-MIT License
-Copyright (c) 2026 jidekaixin2dian
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+Copyright (c) 2026 jidekaixin2dian
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md CHANGED Viewed

@@ -1,124 +1,129 @@
-# dsh-file-actions
-[中文](README.md)
-**0.1.11** adds npm distribution, retaining the file verification feedback, preferred applications, menu stability and font scaling from 0.1.10. See [npm](https://www.npmjs.com/package/@jidekaixin2dian/dsh-file-actions), [Releases](https://github.com/jidekaixin2dian/dsh-file-actions/releases/latest) and the [Changelog](CHANGELOG.md).
-Right-click files and links to open, reveal, copy or save them.
-![File context menu](assets/preview-dark.png)
-## Install
-Quit the DSH desktop app completely, then run:
-```powershell
-dsh plugin --profile desktop add @jidekaixin2dian/dsh-file-actions --registry=https://registry.npmjs.org
-```
-Reopen DSH to activate it. The explicit npm registry avoids mirror synchronization delays. Append `@0.1.11` to the package name to install that exact version.
-GitHub Release installation remains available:
-```powershell
-dsh plugin --profile desktop add https://github.com/jidekaixin2dian/dsh-file-actions/releases/latest/download/dsh-file-actions.tgz
-```
-To download the npm archive without installing the plugin:
-```powershell
-npm pack @jidekaixin2dian/dsh-file-actions --registry=https://registry.npmjs.org
-```
-A plain `npm install` does not register the plugin with DSH; use `dsh plugin` above. To follow source instead, use `dsh plugin --profile desktop add github:jidekaixin2dian/dsh-file-actions`.
-To remove it: dsh plugin --profile desktop remove @jidekaixin2dian/dsh-file-actions, then reopen DSH.
-## Using it
-Right-click a file name in any of these places:
-- inline code in the transcript (blue, dotted underline)
-- delivery cards and the changed-files list
-- file links in tool-call rows (read, write, edit)
-- the right Sidebar file tree
-- the document preview title
-- web links with the same blue style (GitHub releases, discussions, …)
-![Open with](assets/preview-open-with.png)
-The rows follow the file type:
-| File | What you get |
-|---|---|
-| Code, text, config, subtitles | open, open in editor, open with, reveal, copy path, copy relative path, copy file name, copy contents, save as |
-| Markdown, HTML, SVG, PDF, images | the same plus *Open in browser*; images and SVG also show a thumbnail |
-| Video, audio | open, open with, play in browser (mp4 / mov / webm, mp3 / wav / flac …), save as |
-| Office, archives, design files, 3D, disk images, binaries | open, open with, reveal, copy path, save as |
-| Folders | open folder, reveal, copy path, copy relative path |
-| Web links | open link, copy link, copy link text, copy as Markdown |
-*Open with* keeps every registered application, ordered by preferred application, system default, editors, then other applications. A search box appears above seven entries.
-Click ☆ beside an application to prefer it for that file type; click ★ to clear it. Keyboard users can select an application and press `Shift+Enter`. Preferences stay in this browser and do not change OS associations. An unavailable preferred application falls back to an available editor.
-Explicit file references show progress and a retryable error when verification fails. Guessed text paths are verified on hover or focus; until verified, they retain the native menu. Hold `Shift` while right-clicking to keep the native menu anywhere.
-![Search applications](assets/preview-search.png)
-Image files get a thumbnail:
-![Image thumbnail](assets/preview-image.png)
-Keyboard works too: `Shift+F10` or the menu key opens the same menu, `↑ ↓` move, `→` enters the submenu, `Enter` runs, `Esc` closes.
-Readable on a wallpaper with a liquid-glass theme — the menu paints a near-opaque base under the themed layer:
-![Readability over a wallpaper](assets/preview-glass.png)
-![Light theme](assets/preview-light.png)
-## Limitations
-- Not a native menu. Text follows the page root font size and page zoom, not the operating system text-size setting directly.
-- *Open with* only lists registered applications. Preferences do not change OS defaults.
-- Opening an editor currently opens the file only; the pinned Host API does not accept line or column positions.
-- Save as uses the browser's download dialog with the original file name.
-- Copy contents is capped at 2 MiB. Save as and browser previews use the host complete-file cap (32 MiB by default on DSH 0.2.1-rc.2); larger files must be opened externally.
-- HTML/SVG previews retain scripts in an opaque-origin sandbox. They cannot access the DSH page or cookies. Relative sibling assets and actions that require top navigation or same-origin storage may not work.
-- Web UI only — the terminal build has nothing to right-click.
-## FAQ
-**Why does the native menu appear?** Plain prose and editable fields keep it. Guessed file paths are verified on hover or focus; cold or failed guesses retain the native menu. Explicit file references show a reason and a retry action on failure.
-**Is *Open with* unavailable?** Loading, empty results and failed queries are shown separately. Click a failed query to retry.
-**Nothing opens in the browser?** The popup may have been blocked; allow popups and retry.
-**How do I choose an application?** Click ☆ in *Open with*. Without a preference, the shortcut uses a recognised editor. *Open file* continues to use the system default.
-## Development and verification
-Node >=24, Git and pnpm:
-```sh
-npm ci --ignore-scripts
-npm test
-npm run setup:host
-npm run test:host
-npm run pack:check
-```
-The pinned host is DSH **0.2.1-rc.2** (`687f282e8625c6b8d11ff58211a90524be2e4317`). `DFA_HOST` can reuse a clean checkout at that exact commit. Windows uses headless Edge; Linux needs `npx --no-install playwright install --with-deps chromium`. CI runs both systems. No runtime dependencies or build step are added to the plugin.
-The browser suite uses the actual client bundle and real WorkspaceFiles over synthetic references. It checks Session identity, sandboxed script isolation, a real 3 MiB download and unload behavior. A separate browser suite uses deterministic Remote responses for native-menu fallback, preferences, asynchronous stability, search and large text. This is not a complete Desktop or OS application-launch test. Optional full-Web drivers and historical assertion counts are documented in [test-e2e](test-e2e/README.md).
-## Releases
-- [Latest release](https://github.com/jidekaixin2dian/dsh-file-actions/releases/latest)
-- [Announcement](https://github.com/deepseek-ai/deepseek-harness/discussions/10576)
-## License
-MIT
+# dsh-file-actions
+[中文](README.md)
+**0.1.15** improves inline references, video previews and menu interaction, and fixes file-read integrity, preview isolation and application caches. npm and GitHub Release use the same verified archive, with npm provenance. See [npm](https://www.npmjs.com/package/@jidekaixin2dian/dsh-file-actions), [Releases](https://github.com/jidekaixin2dian/dsh-file-actions/releases/latest) and the [Changelog](CHANGELOG.md).
+Right-click files and links to open, reveal, copy or save them.
+![File context menu](assets/preview-dark.png)
+## Install
+Requires DSH `>=0.2.1-rc.2` (CI continuously verifies both 0.2.1-rc.2 and 0.2.1-rc.3) and Node >=24. Quit the DSH desktop app completely, then run:
+```powershell
+dsh plugin --profile desktop add @jidekaixin2dian/dsh-file-actions --registry=https://registry.npmjs.org
+```
+Reopen DSH to activate it. The explicit npm registry avoids mirror synchronization delays. Append `@0.1.11` to the package name to install that exact version.
+GitHub Release installation remains available:
+```powershell
+dsh plugin --profile desktop add https://github.com/jidekaixin2dian/dsh-file-actions/releases/latest/download/dsh-file-actions.tgz
+```
+To download the npm archive without installing the plugin:
+```powershell
+npm pack @jidekaixin2dian/dsh-file-actions --registry=https://registry.npmjs.org
+```
+A plain `npm install` does not register the plugin with DSH; use `dsh plugin` above. To follow source instead, use `dsh plugin --profile desktop add github:jidekaixin2dian/dsh-file-actions`.
+To remove it: dsh plugin --profile desktop remove @jidekaixin2dian/dsh-file-actions, then reopen DSH.
+## Using it
+Right-click a file name in any of these places:
+- inline code in the transcript (blue, dotted underline)
+- delivery cards and the changed-files list
+- file links in tool-call rows (read, write, edit)
+- the right Sidebar file tree
+- the document preview title
+- web links with the same blue style (GitHub releases, discussions, …)
+![Open with](assets/preview-open-with.png)
+The rows follow the file type:
+| File | What you get |
+|---|---|
+| Code, text, config, subtitles | open, open in editor, open with, reveal, copy path, copy relative path, copy file name, copy contents, save as |
+| Markdown, HTML, SVG, PDF, images | the same plus *Open in browser*; images and SVG also show a thumbnail |
+| Video, audio | open, open with, play in browser (mp4 / mov / webm, mp3 / wav / flac …), save as |
+| Office, archives, design files, 3D, disk images, binaries | open, open with, reveal, copy path, save as |
+| Folders | open folder, reveal, copy path, copy relative path |
+| Web links | open link, copy link, copy link text, copy as Markdown |
+The link menu:
+![Link menu](assets/preview-link.png)
+*Open with* keeps every registered application, ordered by preferred application, system default, editors, then other applications. A search box appears above seven entries.
+Click the star beside an application to prefer it for that file type; click again to clear it. Keyboard users can press `Shift+Enter`. Preferences stay in this browser and do not change OS associations. Stored associations paint immediately and are validated in the background. An unavailable preference falls back to an available editor shortcut. Failed opens refresh associations without automatically repeating the action.
+Explicit file references show progress and a retryable error when verification fails. Guessed text paths are verified on hover or focus; until verified, they retain the native menu. `Shift` lets the page handle a right-click first; if nobody handles it, the plugin falls back to its own menu.
+![Search applications](assets/preview-search.png)
+Image files get a thumbnail:
+![Image thumbnail](assets/preview-image.png)
+Keyboard works too: `Shift+F10` or the menu key opens the same menu, `↑ ↓` move, `→` enters the submenu, `Enter` runs, `Esc` closes.
+Readable on a wallpaper with a liquid-glass theme — the menu paints a near-opaque base under the themed layer:
+![Readability over a wallpaper](assets/preview-glass.png)
+![Light theme](assets/preview-light.png)
+## Limitations
+- Not a native menu. Text follows the page root font size and page zoom, not the operating system text-size setting directly.
+- *Open with* only lists registered applications. Preferences do not change OS defaults.
+- Opening an editor currently opens the file only; the pinned Host API does not accept line or column positions.
+- Save as uses the browser's download dialog with the original file name.
+- Copy contents is capped at 2 MiB and accepts valid UTF-8 only. Other encodings require an editor. Copies outside the workspace require confirmation; unavailable confirmation cancels the read.
+- Save as and browser previews read chunks up to 64 MiB total and stop if the file version changes. Larger files must be opened externally.
+- HTML/SVG previews initially disable scripts, forms, automatic refresh and external resource loading. Trusted files can opt in to scripts and network access using the preview button. The opaque-origin sandbox still blocks access to DSH DOM/cookies. Relative sibling assets, top navigation and same-origin storage may not work. Clicking a link inside a file is an explicit user navigation.
+- Web UI only — the terminal build has nothing to right-click.
+## FAQ
+**Why does the native menu appear?** Plain prose and editable fields keep it. Guessed file paths are verified on hover or focus; cold or failed guesses retain the native menu. Explicit file references show a reason and a retry action on failure.
+**Is *Open with* unavailable?** Loading keeps placeholders; empty or failed results hide the association rows. Another right-click retries. Broken OS associations can fail the entire Host query; the plugin does not repair registry entries.
+**Nothing opens in the browser?** The popup may have been blocked; allow popups and retry.
+**How do I choose an application?** Click the star in *Open with*. Without a preference, the shortcut uses a recognised editor. *Open file* continues to use the system default.
+## Development and verification
+Node >=24, Git and pnpm:
+```sh
+npm ci --ignore-scripts
+npm test
+npm run setup:host
+npm run test:host
+npm run pack:check
+```
+The default pinned host is DSH **0.2.1-rc.3** (`1f81c047fc48fa190a683e469daa699857e9afe8`). Set `DFA_HOST_VERSION=rc.2` to verify the minimum supported host (`687f282e8625c6b8d11ff58211a90524be2e4317`). `DFA_HOST` can reuse the matching clean checkout. Windows uses headless Edge; Linux needs `npx --no-install playwright install --with-deps chromium`. CI covers rc.2/rc.3 on both systems. The plugin still has no runtime dependencies or build step.
+The browser suite uses the actual client bundle and real WorkspaceFiles over synthetic references. It checks Session identity, sandboxed script isolation, a real 3 MiB download and unload behavior. A separate browser suite uses deterministic Remote responses for native-menu fallback, preferences, asynchronous stability, search and large text. This is not a complete Desktop or OS application-launch test. Optional full-Web drivers and historical assertion counts are documented in [test-e2e](test-e2e/README.md).
+## Releases
+- [Latest release](https://github.com/jidekaixin2dian/dsh-file-actions/releases/latest)
+- [Announcement](https://github.com/deepseek-ai/deepseek-harness/discussions/10576)
+## License
+MIT