@anionex/dsh-vision-toolkit 0.1.5

package/src/version.ts

@@ -0,0 +1,37 @@
+/**
+ * Plugin and pinned upstream version facts. The upstream snapshot is fixed at
+ * build time and recorded in package.json's `dsh.visionToolkit` metadata so
+ * the runtime, tool results, and docs all report the same source commit.
+ * @module dsh-vision-toolkit/version
+ */
+
+import { readFileSync } from 'node:fs'
+
+interface VisionToolkitPackageMetadata {
+  version: string
+  dsh?: {
+    visionToolkit?: {
+      upstreamRepository?: string
+      upstreamVersion?: string
+      upstreamCommit?: string
+    }
+  }
+}
+
+const metadata = JSON.parse(
+  readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
+) as VisionToolkitPackageMetadata
+
+const visionToolkit = metadata.dsh?.visionToolkit
+
+/** Plugin package version. */
+export const PLUGIN_VERSION = metadata.version
+
+/** Pinned upstream repository URL. */
+export const UPSTREAM_REPOSITORY = visionToolkit?.upstreamRepository ?? 'https://github.com/Anionex/agent-vision-toolkit'
+
+/** Pinned upstream release tag. */
+export const UPSTREAM_VERSION = visionToolkit?.upstreamVersion ?? 'v0.1.0+snapshot.8ccf9d7'
+
+/** Pinned upstream source commit. */
+export const UPSTREAM_COMMIT = visionToolkit?.upstreamCommit ?? '8ccf9d7d89bc395ad7dd19dde840401a5b84623d'

package/src/web-request.ts

@@ -0,0 +1,17 @@
+import type { IncomingMessage } from 'node:http'
+
+/** Accept state-changing requests only from the DSH Web application's origin. */
+export function sameOriginPost(req: IncomingMessage): boolean {
+  const fetchSite = req.headers['sec-fetch-site']
+  if (fetchSite === 'cross-site') return false
+  const origin = req.headers.origin
+  if (origin === undefined) return fetchSite === 'same-origin' || fetchSite === 'same-site' || fetchSite === 'none'
+  const host = req.headers.host
+  if (host === undefined) return false
+  try {
+    const parsed = new URL(origin)
+    return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && parsed.host === host
+  } catch {
+    return false
+  }
+}

package/src/web.ts

@@ -0,0 +1,329 @@
+/**
+ * Optional Web-profile routes: signed Artifact delivery plus a same-origin
+ * Settings/health endpoint. The browser never receives credential values and
+ * connection tests run only after an explicit POST action.
+ * @module dsh-vision-toolkit/web
+ */
+
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { Context } from '@deepseek-ai/cordis'
+import type { CredentialInfo } from '@deepseek-ai/dsh-credentials'
+import { credentialRef } from '@deepseek-ai/dsh-credentials'
+import { SettingsConflictError, type SettingsDescriptor } from '@deepseek-ai/dsh-settings'
+// Type-only import activates the optional webServer Context declaration.
+import type {} from '@deepseek-ai/dsh-host-webserver'
+import { ArtifactAccessController, ARTIFACT_ROUTE_PREFIX } from './artifact-access.ts'
+import { PastedImageBackend, PASTE_IMAGES_ROUTE } from './paste-images.ts'
+import {
+  resolveConfig,
+  VISION_TOOLKIT_SETTINGS_NAMESPACE,
+  type ResolvedVisionToolkitConfig,
+  type VisionToolkitConfig,
+} from './config.ts'
+import type { VisionToolkitHealthResult } from './runtime.ts'
+import {
+  VisionToolkitRuntimeManager,
+  type PreparedRuntimeGeneration,
+  type RuntimeManagerStatus,
+} from './runtime-manager.ts'
+import { PLUGIN_VERSION, UPSTREAM_COMMIT, UPSTREAM_REPOSITORY, UPSTREAM_VERSION } from './version.ts'
+import { sameOriginPost } from './web-request.ts'
+
+/** Exact route used by the browser Settings page. */
+export const SETTINGS_ROUTE = '/_dsh/vision-toolkit/settings'
+
+/** Public Settings snapshot; credential values are deliberately impossible here. */
+export interface VisionToolkitSettingsSnapshot {
+  schemaVersion: 1
+  writable: boolean
+  settings: {
+    value: VisionToolkitConfig
+    user?: unknown
+    base?: unknown
+    revision: number
+    applies: 'live'
+  }
+  credential: {
+    ref: string
+    configured: boolean
+    source?: string
+    writable: boolean
+  }
+  runtime: RuntimeManagerStatus
+  release: {
+    pluginVersion: string
+    upstreamRepository: string
+    upstreamVersion: string
+    upstreamCommit: string
+  }
+  artifactRouteAvailable: boolean
+}
+
+interface SaveRequest {
+  action: 'save'
+  expectedRevision: number
+  value: VisionToolkitConfig
+}
+
+interface HealthRequest {
+  action: 'health'
+  testConnection: boolean
+}
+
+type SettingsRequest = SaveRequest | HealthRequest
+
+interface JsonError {
+  ok: false
+  error: { code: string; message: string }
+}
+
+interface JsonSuccess<T> {
+  ok: true
+  value: T
+}
+
+type JsonResponse<T> = JsonSuccess<T> | JsonError
+
+/** Minimal runtime-manager face used by the Web route and its tests. */
+export interface WebRuntimeManager {
+  readonly ready: boolean
+  current(): ReturnType<VisionToolkitRuntimeManager['current']>
+  prepareCandidate(raw: VisionToolkitConfig): Promise<PreparedRuntimeGeneration>
+  activateCandidate(candidate: PreparedRuntimeGeneration): void
+  recordFailure(error: unknown): void
+  status(): RuntimeManagerStatus
+}
+
+/** Callback invoked when a Settings save makes the first runtime available. */
+export type RuntimeActivated = () => void
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function descriptorOf(ctx: Context): SettingsDescriptor {
+  const descriptor = ctx.settings.describe().find(row => row.ns === VISION_TOOLKIT_SETTINGS_NAMESPACE)
+  if (descriptor === undefined) throw new Error('vision-toolkit Settings namespace is not registered')
+  return descriptor
+}
+
+function responseJson<T>(res: ServerResponse, status: number, body: JsonResponse<T>): void {
+  const bytes = Buffer.from(JSON.stringify(body))
+  res.setHeader('Content-Type', 'application/json; charset=utf-8')
+  res.setHeader('Content-Length', String(bytes.length))
+  res.setHeader('Cache-Control', 'no-store')
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+  res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'")
+  res.writeHead(status)
+  res.end(bytes)
+}
+
+function requestError(res: ServerResponse, status: number, code: string, message: string): void {
+  responseJson(res, status, { ok: false, error: { code, message } })
+}
+
+async function readJson(req: IncomingMessage, maxBytes = 64 * 1024): Promise<unknown> {
+  const contentType = req.headers['content-type']?.split(';', 1)[0]?.trim().toLowerCase()
+  if (contentType !== 'application/json') throw new TypeError('Content-Type must be application/json')
+  const chunks: Buffer[] = []
+  let bytes = 0
+  for await (const chunk of req) {
+    const part = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    bytes += part.length
+    if (bytes > maxBytes) throw new RangeError(`request body exceeds ${maxBytes} bytes`)
+    chunks.push(part)
+  }
+  if (chunks.length === 0) throw new TypeError('request body is empty')
+  return JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown
+}
+
+function parseRequest(value: unknown): SettingsRequest {
+  if (!isRecord(value) || typeof value.action !== 'string') throw new TypeError('request action is required')
+  if (value.action === 'health') {
+    if (typeof value.testConnection !== 'boolean') throw new TypeError('health.testConnection must be boolean')
+    return { action: 'health', testConnection: value.testConnection }
+  }
+  if (value.action === 'save') {
+    if (!Number.isSafeInteger(value.expectedRevision) || (value.expectedRevision as number) < 0) {
+      throw new TypeError('save.expectedRevision must be a non-negative integer')
+    }
+    if (!isRecord(value.value)) throw new TypeError('save.value must be an object')
+    return {
+      action: 'save',
+      expectedRevision: value.expectedRevision as number,
+      value: value.value as VisionToolkitConfig,
+    }
+  }
+  throw new TypeError(`unsupported action: ${value.action}`)
+}
+
+function publicMessage(error: unknown): string {
+  if (error instanceof Error) return error.message
+  return String(error)
+}
+
+/** Same-origin Settings and health handler. */
+export class VisionToolkitWebBackend {
+  constructor(
+    private readonly ctx: Context,
+    private readonly manager: WebRuntimeManager,
+    private readonly artifacts: ArtifactAccessController,
+    private readonly onRuntimeActivated: RuntimeActivated,
+  ) {}
+
+  private async credential(config: ResolvedVisionToolkitConfig): Promise<CredentialInfo> {
+    return this.ctx.credentials.describe(credentialRef(String(config.provider.credential)))
+  }
+
+  /** Build the current settings/runtime/credential snapshot without secrets. */
+  async snapshot(): Promise<VisionToolkitSettingsSnapshot> {
+    const descriptor = descriptorOf(this.ctx)
+    const value = descriptor.value as VisionToolkitConfig
+    const resolved = resolveConfig(value)
+    const credential = await this.credential(resolved)
+    return {
+      schemaVersion: 1,
+      writable: this.ctx.settings.writable,
+      settings: {
+        value,
+        ...(descriptor.user === undefined ? {} : { user: descriptor.user }),
+        ...(descriptor.base === undefined ? {} : { base: descriptor.base }),
+        revision: descriptor.revision,
+        applies: 'live',
+      },
+      credential: {
+        ref: String(resolved.provider.credential),
+        configured: credential.configured,
+        ...(credential.source === undefined ? {} : { source: credential.source }),
+        writable: credential.writable,
+      },
+      runtime: this.manager.status(),
+      release: {
+        pluginVersion: PLUGIN_VERSION,
+        upstreamRepository: UPSTREAM_REPOSITORY,
+        upstreamVersion: UPSTREAM_VERSION,
+        upstreamCommit: UPSTREAM_COMMIT,
+      },
+      artifactRouteAvailable: this.artifacts.routeAvailable,
+    }
+  }
+
+  private async save(request: SaveRequest): Promise<VisionToolkitSettingsSnapshot> {
+    if (!this.ctx.settings.writable) throw new Error('settings provider is read-only')
+    let candidate: PreparedRuntimeGeneration
+    try {
+      candidate = await this.manager.prepareCandidate(request.value)
+    } catch (error) {
+      this.manager.recordFailure(error)
+      throw error
+    }
+    await this.ctx.settings.replace(
+      VISION_TOOLKIT_SETTINGS_NAMESPACE,
+      request.value as object,
+      request.expectedRevision,
+    )
+    this.manager.activateCandidate(candidate)
+    this.onRuntimeActivated()
+    return this.snapshot()
+  }
+
+  private async health(request: HealthRequest, req: IncomingMessage): Promise<VisionToolkitHealthResult> {
+    if (!this.manager.ready) throw new Error('runtime is not ready; fix Settings and save a valid configuration first')
+    const controller = new AbortController()
+    const abort = (): void => { controller.abort() }
+    req.once('aborted', abort)
+    req.socket.once('close', abort)
+    try {
+      return await this.manager.current().health(request.testConnection, {
+        signal: controller.signal,
+        workspace: process.cwd(),
+        sessionId: 'vision-toolkit-settings',
+      })
+    } finally {
+      req.off('aborted', abort)
+      req.socket.off('close', abort)
+    }
+  }
+
+  /** Handle the exact Settings route. */
+  async handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
+    if (req.method === 'GET') {
+      try {
+        responseJson(res, 200, { ok: true, value: await this.snapshot() })
+      } catch (error) {
+        this.ctx.logger.warn('dsh-vision-toolkit Settings snapshot failed: %s', publicMessage(error))
+        requestError(res, 503, 'settings-unavailable', 'Vision Toolkit Settings are unavailable')
+      }
+      return
+    }
+    if (req.method !== 'POST') {
+      res.setHeader('Allow', 'GET, POST')
+      requestError(res, 405, 'method-not-allowed', 'Use GET or POST')
+      return
+    }
+    if (!sameOriginPost(req)) {
+      requestError(res, 403, 'origin-rejected', 'The request must originate from this DSH Web application')
+      return
+    }
+    let parsed: SettingsRequest
+    try {
+      parsed = parseRequest(await readJson(req))
+    } catch (error) {
+      requestError(res, error instanceof RangeError ? 413 : 400, 'invalid-request', publicMessage(error))
+      return
+    }
+    try {
+      if (parsed.action === 'health') {
+        responseJson(res, 200, { ok: true, value: await this.health(parsed, req) })
+      } else {
+        responseJson(res, 200, { ok: true, value: await this.save(parsed) })
+      }
+    } catch (error) {
+      const conflict = error instanceof SettingsConflictError
+      const code = conflict ? 'settings-conflict' : parsed.action === 'health' ? 'health-failed' : 'settings-rejected'
+      const status = conflict ? 409 : parsed.action === 'health' ? 503 : 400
+      this.ctx.logger.warn('dsh-vision-toolkit Web action=%s failed: %s', parsed.action, publicMessage(error))
+      requestError(res, status, code, publicMessage(error))
+    }
+  }
+}
+
+/**
+ * Attach optional Web routes whenever an webServer service is present.
+ * @param ctx - plugin context owning route effects.
+ * @param backend - Settings handler.
+ * @param artifacts - signed Artifact handler.
+ */
+export function installVisionToolkitWeb(
+  ctx: Context,
+  backend: VisionToolkitWebBackend,
+  artifacts: ArtifactAccessController,
+  pastedImages: PastedImageBackend,
+): void {
+  ctx.inject(['webServer'], (webCtx) => {
+    webCtx.effect(() => {
+      const detach = artifacts.attachRoute()
+      const disposeArtifact = webCtx.webServer.register({
+        kind: 'prefix',
+        path: ARTIFACT_ROUTE_PREFIX,
+        handler: (req, res) => artifacts.handle(req, res),
+      })
+      const disposeSettings = webCtx.webServer.register({
+        kind: 'exact',
+        path: SETTINGS_ROUTE,
+        handler: (req, res) => backend.handle(req, res),
+      })
+      const disposePasteImages = webCtx.webServer.register({
+        kind: 'exact',
+        path: PASTE_IMAGES_ROUTE,
+        handler: (req, res) => pastedImages.handle(req, res),
+      })
+      return () => {
+        disposePasteImages()
+        disposeSettings()
+        disposeArtifact()
+        detach()
+      }
+    }, 'dsh-vision-toolkit: Web routes')
+  })
+}

package/vendor/agent-vision-toolkit/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable user-facing changes to agent-vision-toolkit are documented in this file.
+
+## [0.1.0] - 2026-08-07
+
+### Added
+
+- Five vision CLIs — `glance`, `ground`, `detect`, `trace`, and `crop` — plus the `vision-tools` agent skill.
+- Optional seamless integration: a local proxy for Codex and Claude Code, and single-file native extensions for Pi, Oh My Pi, and OpenCode.
+- Pasted-image and tool-fetched image support with task-aware focus hints, parallel multi-image descriptions, per-request caching, and honest failure notes.
+- Vision playbooks for long-screenshot OCR, UI restoration, graphic restoration, structure recovery, and GUI operation.
+- Community contribution, conduct, support, and security policies.
+- Structured issue forms and a pull request template.
+- GitHub funding configuration and continuous integration checks.
+- A bilingual funding policy and sponsorship-use statement.

package/vendor/agent-vision-toolkit/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anionex
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.