@softspark/dsh-file-preview

Read-only file preview inside a DeepSeek Harness conversation. Click a file the agent produced or mentioned and it opens in the browser, instead of launching a desktop application.

Works on the published harness. No patch, no fork, no modified checkout.

What's New in v2.0.0

• DSH 0.1.2-rc.1 support through its Session Remote opener and immutable host event snapshots.
• Enforced 70% coverage, filesystem authorization integration tests, and browser registration tests.
• Complete post-release SOP and published browser TypeScript declarations.

Version 2 requires DSH 0.1.2-rc.1. Keep plugin 1.0.0 when using DSH 0.1.1-rc.2.

Contents

• Why
• Requirements
• Install
• What it previews
• How it claims a click
• Security
• Documentation
• Contributing

Why

Without it, opening a file from a conversation hands the path to the host operating system. That is the wrong gesture when the harness runs on a remote machine, in a container, or when the file is a diff you want to glance at without leaving the page.

Requirements

• Node.js 22.19.0 or newer
• DeepSeek Harness 0.1.2-rc.1
• pnpm for the profile plugin manager

Install

dsh plugin --profile web add @softspark/dsh-file-preview --save-exact

Restart DSH. The package registers both of its rows itself.

What it previews

Kind	Formats	Bound
Text and code	.txt .md .json .yaml .toml .csv .ts .js .py .go .rs .sql and more	1 MiB
Markup	.html .svg, sanitised to an allowlist	1 MiB
Images	.png .jpg .gif .webp	8 MiB
Documents	.pdf	8 MiB

Anything else reaches the harness's own opener untouched, exactly as before the plugin was installed.

How it claims a click

Every conversation file-open in DSH 0.1.2 reaches remote.session.openWorkspacePath({ path }). The browser half wraps its getter while preserving the native request, cancellation signal, and caller context. Removing the package restores the original descriptor.

If a future harness stops exposing that method, the plugin refuses to mount rather than silently swallowing clicks.

Security

A preview must not become an arbitrary host-file read. Authorization is computed on the host from session facts alone: a file is readable when it sits inside the addressed session's workspace, or when that same session produced it through a successful write or edit. Failures never carry file bytes, and both refusal grounds return the same code so a rejection cannot be used to probe for a file's existence.

Full model in kb/reference/security.md and SECURITY.md.

Documentation

Document	Purpose
Architecture	The two halves and the interception seam
Security model	Authorization, bounds, sanitization
Setup	Install and confirm
Common issues	Why a preview refuses or does not open
Release SOP	How a version ships
Post-release SOP	Registry provenance, browser behavior, and authorization checks

Contributing

See CONTRIBUTING. pnpm run verify is the gate.

License

Apache-2.0. See LICENSE and NOTICE.

Changelog

See CHANGELOG.md for the full release history.