@RCYD857/857-dsh-file-attach

hintFor() (line 387: `return hints.find((candidate) => basenameOf(candidate).toLowerCase() === wanted)`) accepts any absolute path from the drag payload's text/uri-list or text/plain whose basename matches the dropped file, and resolveItem() commits that path as the attachment's mention without any size/hash check (unlike the locate route, which checks name+size+hash). A crafted payload that carries a file plus a same-named path makes the send boundary inject that arbitrary local path into the prompt, so the model reads a different (potentially sensitive) file than the chip shows; the card dis

The injected stylesheet hides every element with _mask in its class name, and createPlatformMaskSweeper() additionally removes them (observer.observe(document.body, { childList: true, subtree: true })). Any other platform or third-party UI that happens to use such a CSS-module class is silently disabled for the whole app. It is an intentional override of another package's drop mask, with a functional rather than a demonstrated data-exposure impact.