@anionex/dsh-vision-toolkit 0.1.6 → 0.1.8

package/lib/client.js

@@ -24,9 +24,17 @@ const en = {
     settingsIntro: 'Configure the pinned visual engineering runtime, its external vision endpoint, and local safety limits.',
     externalNotice: 'Remote tools send the selected image bytes to the configured external vision API. Local crop, trace, pixel diff, palette, foreground extraction, and HTML rendering do not upload images.',
     provider: 'Vision service',
-    providerHint: 'Choose the API protocol, then provide the service address, model, and credential used by online vision features.',
+    providerHint: 'Choose the API protocol, then provide the service address, model, and API key used by online vision features.',
     baseUrl: 'Base URL',
-    credential: 'Credential reference',
+    apiKey: 'API key',
+    apiKeyPlaceholderMissing: 'Paste the API key',
+    apiKeyPlaceholderConfigured: 'Saved; leave blank to keep it',
+    apiKeyHint: 'The key is stored in DSH Credentials and is never shown again after saving.',
+    apiKeyLocked: 'The current key comes from a read-only source and cannot be replaced here.',
+    apiKeyBlank: 'The API key cannot contain only spaces.',
+    apiKeyInvalid: 'Paste only the key, without a variable name, quotes, spaces, or line breaks.',
+    credential: 'Credential name',
+    credentialHint: 'Advanced: the API key is stored under this name. Keep VISION_API_KEY unless another plugin configuration requires a different reference.',
     model: 'Model',
     protocol: 'API protocol',
     anthropicThinking: 'Anthropic thinking',
@@ -48,7 +56,7 @@ const en = {
     saving: 'Validating runtime…',
     reload: 'Reload',
     saved: 'Settings validated and applied.',
-    readOnly: 'The active Settings provider is read-only.',
+    readOnly: 'Service settings are read-only. A writable API key can still be saved.',
     configured: 'Configured',
     missing: 'Missing',
     source: 'Source',
@@ -62,7 +70,7 @@ const en = {
     connectionHint: 'Connection testing explicitly sends the configured credential to GET /models. It uploads no image and creates no completion.',
     saveBeforeTesting: 'Save service changes before testing the connection.',
     advanced: 'Advanced settings',
-    advancedHint: 'Provider compatibility, output language, resource limits, runtime source, Python, and additional readable directories.',
+    advancedHint: 'Credential name, provider compatibility, output language, resource limits, runtime source, Python, and additional readable directories.',
     pluginVersion: 'Plugin',
     upstreamVersion: 'Upstream',
     activeGeneration: 'Runtime generation',
@@ -153,9 +161,17 @@ const zh = {
     settingsIntro: '在这里设置视觉模型服务、工具运行环境，以及图片和文件的本地访问范围。',
     externalNotice: '使用图像理解、目标定位、界面检测或文字识别等在线功能时，所选图片会发送到下方配置的视觉服务。图片裁剪、轮廓描摹、像素对比、主色提取、前景提取和网页截图均在本机完成，不会上传图片。',
     provider: '在线视觉服务',
-    providerHint: '选择接口协议后，填写在线视觉功能使用的 API 地址、模型名称和密钥名称。',
+    providerHint: '选择接口协议后，填写在线视觉功能使用的 API 地址、模型名称和 API 密钥。',
     baseUrl: 'API 地址',
-    credential: 'API 密钥名称',
+    apiKey: 'API 密钥',
+    apiKeyPlaceholderMissing: '粘贴 API 密钥',
+    apiKeyPlaceholderConfigured: '已保存；留空表示不修改',
+    apiKeyHint: '密钥会保存到 DSH 凭据存储，保存后不会在页面中回显。',
+    apiKeyLocked: '当前密钥来自只读配置，无法在此替换。',
+    apiKeyBlank: 'API 密钥不能只包含空格。',
+    apiKeyInvalid: '请只粘贴密钥本身，不要包含变量名、引号、空格或换行。',
+    credential: '凭据名称',
+    credentialHint: '高级用法：API 密钥会按此名称保存。除非其他插件配置要求不同名称，否则保持 VISION_API_KEY。',
     model: '模型名称',
     protocol: 'API 协议',
     anthropicThinking: 'Anthropic thinking',
@@ -177,7 +193,7 @@ const zh = {
     saving: '正在检查并应用…',
     reload: '重新加载',
     saved: '设置已保存并生效。',
-    readOnly: '当前设置由只读配置提供，无法在此修改。',
+    readOnly: '服务设置来自只读配置；如果 API 密钥可写，仍可在此保存密钥。',
     configured: '已就绪',
     missing: '未配置',
     source: '配置来源',
@@ -191,7 +207,7 @@ const zh = {
     connectionHint: '“检查本地环境”只检查本机依赖和目录；“测试服务连接”会携带已配置的 API 密钥请求 /models，但不会上传图片或调用模型。',
     saveBeforeTesting: '修改服务配置后，请先保存，再测试连接。',
     advanced: '高级设置',
-    advancedHint: '服务兼容参数、结果语言、资源限制、运行环境来源、Python 和额外可读目录。一般无需修改。',
+    advancedHint: '凭据名称、服务兼容参数、结果语言、资源限制、运行环境来源、Python 和额外可读目录。一般无需修改。',
     pluginVersion: '插件版本',
     upstreamVersion: '工具包版本',
     activeGeneration: '本次运行已应用',
@@ -541,18 +557,48 @@ class VisionSettingsController {
             return;
         void this.load();
     }
-    async save(value, expectedRevision) {
+    async save(value, expectedRevision, credentialValue, writeSettings) {
         this.set({ ...this.state, action: 'save', error: undefined, message: undefined });
+        let snapshot = this.state.snapshot;
         try {
-            const snapshot = await apiRequest({
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ action: 'save', expectedRevision, value }),
-            });
+            if (writeSettings) {
+                snapshot = await apiRequest({
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ action: 'save', expectedRevision, value }),
+                });
+            }
+            if (snapshot === undefined)
+                throw new Error('Vision Toolkit Settings are unavailable');
+            if (credentialValue !== undefined) {
+                try {
+                    snapshot = await apiRequest({
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({
+                            action: 'credential',
+                            expectedRevision: snapshot.settings.revision,
+                            ref: snapshot.credential.ref,
+                            value: credentialValue,
+                        }),
+                    });
+                }
+                catch (error) {
+                    this.set({
+                        status: 'ready',
+                        snapshot,
+                        health: this.state.health,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    return false;
+                }
+            }
             this.set({ status: 'ready', snapshot, health: this.state.health, message: 'saved' });
+            return true;
         }
         catch (error) {
             this.set({ ...this.state, action: undefined, error: error instanceof Error ? error.message : String(error) });
+            return false;
         }
     }
     async runHealth(testConnection) {
@@ -596,6 +642,18 @@ function positiveInteger(raw, label, t) {
         throw new Error(t('positiveInteger', { field: label }));
     return value;
 }
+function apiKeyFailure(value, t) {
+    if (value.length === 0)
+        return undefined;
+    const trimmed = value.trim();
+    if (trimmed.length === 0)
+        return t('apiKeyBlank');
+    const quoted = trimmed.length > 1 && ['"', '\'', '`'].includes(trimmed[0] ?? '') && trimmed.endsWith(trimmed[0] ?? '');
+    const environmentLine = /^[A-Z][A-Z0-9_]*=[^=]/u.test(trimmed);
+    if (quoted || environmentLine || !/^[\x21-\x7E]+$/u.test(trimmed))
+        return t('apiKeyInvalid');
+    return undefined;
+}
 function valueOf(draft, t) {
     return {
         provider: {
@@ -709,6 +767,7 @@ function LoadedSettings({ controller, t }) {
     const state = (0, react_1.useSyncExternalStore)(controller.subscribe, controller.snapshot, controller.snapshot);
     const snapshot = state.snapshot;
     const [draft, setDraft] = (0, react_1.useState)(undefined);
+    const [apiKey, setApiKey] = (0, react_1.useState)('');
     const [draftError, setDraftError] = (0, react_1.useState)(undefined);
     (0, react_1.useEffect)(() => { if (state.status === 'idle')
         void controller.load(); }, [controller, state.status]);
@@ -725,16 +784,26 @@ function LoadedSettings({ controller, t }) {
     const update = (key, value) => setDraft(current => current === undefined ? current : { ...current, [key]: value });
     const save = () => {
         try {
+            const keyFailure = apiKeyFailure(apiKey, t);
+            if (keyFailure !== undefined) {
+                setDraftError(keyFailure);
+                return;
+            }
+            const credentialValue = apiKey.length === 0 ? undefined : apiKey.trim();
             setDraftError(undefined);
-            void controller.save(valueOf(draft, t), snapshot.settings.revision);
+            void controller.save(valueOf(draft, t), snapshot.settings.revision, credentialValue, snapshot.writable).then(saved => { if (saved)
+                setApiKey(''); });
         }
         catch (error) {
             setDraftError(error instanceof Error ? error.message : String(error));
         }
     };
     const busy = state.action !== undefined;
+    const credentialMatchesSnapshot = draft.credential.trim() === snapshot.credential.ref;
+    const keyLocked = credentialMatchesSnapshot && !snapshot.credential.writable;
+    const canSave = snapshot.writable || (apiKey.length > 0 && !keyLocked);
     const runtimeErrorTitle = snapshot.runtime.ready ? t('runtimeCandidateRejected') : t('runtimeUnavailable');
-    return ((0, jsx_runtime_1.jsxs)("div", { className: "dvt-settings", children: [(0, jsx_runtime_1.jsx)("div", { className: "dvt-alert notice", children: t('externalNotice') }), !snapshot.writable ? (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert warning", children: t('readOnly') }) : null, draftError === undefined ? null : (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert error", children: draftError }), state.error === undefined ? null : (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert error", children: state.error }), state.message === 'saved' ? (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert success", children: t('saved') }) : null, snapshot.runtime.lastError === undefined ? null : (0, jsx_runtime_1.jsxs)("div", { className: "dvt-alert error", children: [(0, jsx_runtime_1.jsx)("strong", { children: runtimeErrorTitle }), (0, jsx_runtime_1.jsx)("span", { children: snapshot.runtime.lastError })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel dvt-essential", children: [(0, jsx_runtime_1.jsxs)("div", { className: "dvt-panel-title", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("h3", { children: t('provider') }), (0, jsx_runtime_1.jsx)("p", { children: t('providerHint') })] }), (0, jsx_runtime_1.jsx)("span", { className: `dvt-badge ${snapshot.credential.configured ? 'ok' : 'error'}`, children: snapshot.credential.configured ? t('configured') : t('missing') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [(0, jsx_runtime_1.jsx)(Field, { label: t('protocol'), children: (0, jsx_runtime_1.jsxs)("select", { value: draft.protocol, onChange: (event) => { update('protocol', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "openai", children: "OpenAI Chat Completions" }), (0, jsx_runtime_1.jsx)("option", { value: "anthropic", children: "Anthropic Messages" })] }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('baseUrl'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { value: draft.baseUrl, onChange: (event) => { update('baseUrl', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('model'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { value: draft.model, onChange: (event) => { update('model', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('credential'), hint: snapshot.credential.source === undefined ? undefined : t('sourceHint', { source: t('source'), value: credentialSource(snapshot.credential.source, t) }), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { value: draft.credential, onChange: (event) => { update('credential', event.target.value); } }) })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-save-row", children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "primary", disabled: !snapshot.writable || busy, onClick: save, children: state.action === 'save' ? t('saving') : t('save') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", disabled: busy, onClick: () => { void controller.load(); }, children: t('reload') })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsxs)("div", { className: "dvt-panel-title", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("h3", { children: t('health') }), (0, jsx_runtime_1.jsx)("p", { children: t('connectionHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-actions", children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { size: "sm", variant: "outline", disabled: busy || !snapshot.runtime.ready, onClick: () => { void controller.runHealth(false); }, children: state.action === 'health' ? t('testing') : t('runHealth') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { size: "sm", variant: "primary", disabled: busy || !snapshot.runtime.ready, onClick: () => { void controller.runHealth(true); }, children: state.action === 'connection' ? t('testing') : t('testConnection') })] })] }), (0, jsx_runtime_1.jsx)("p", { className: "dvt-muted", children: t('saveBeforeTesting') }), state.health === undefined ? (0, jsx_runtime_1.jsx)("p", { className: "dvt-muted", children: t('notTested') }) : (0, jsx_runtime_1.jsx)("div", { className: "dvt-health-grid", children: Object.entries(state.health.checks).map(([name, check]) => (0, jsx_runtime_1.jsxs)("div", { "data-status": check.status, children: [(0, jsx_runtime_1.jsx)("span", { children: t(HEALTH_NAME_KEYS[name] ?? 'health') }), (0, jsx_runtime_1.jsx)("strong", { children: t(HEALTH_STATUS_KEYS[check.status]) }), (0, jsx_runtime_1.jsx)("p", { children: healthDetail(name, check.detail, t) })] }, name)) })] }), (0, jsx_runtime_1.jsxs)("details", { className: "dvt-advanced", children: [(0, jsx_runtime_1.jsxs)("summary", { children: [(0, jsx_runtime_1.jsxs)("span", { children: [(0, jsx_runtime_1.jsx)("strong", { children: t('advanced') }), (0, jsx_runtime_1.jsx)("small", { children: t('advancedHint') })] }), (0, jsx_runtime_1.jsx)("span", { className: "dvt-details-chevron", "aria-hidden": "true", children: "\u2304" })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-advanced-body", children: [(0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsx)("div", { className: "dvt-panel-title", children: (0, jsx_runtime_1.jsx)("h3", { children: t('provider') }) }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [draft.protocol === 'anthropic' ? (0, jsx_runtime_1.jsx)(Field, { label: t('anthropicThinking'), hint: t('anthropicThinkingHint'), children: (0, jsx_runtime_1.jsxs)("select", { "aria-label": t('anthropicThinking'), value: draft.anthropicThinking, onChange: (event) => { update('anthropicThinking', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "omit", children: "omit (widest compatibility)" }), (0, jsx_runtime_1.jsx)("option", { value: "disabled", children: "disabled (model support required)" }), (0, jsx_runtime_1.jsx)("option", { value: "adaptive", children: "adaptive (model support required)" })] }) }) : null, (0, jsx_runtime_1.jsx)(Field, { label: t('userAgent'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { value: draft.userAgent, onChange: (event) => { update('userAgent', event.target.value); } }) })] })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsx)("div", { className: "dvt-panel-title", children: (0, jsx_runtime_1.jsx)("h3", { children: t('limits') }) }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [(0, jsx_runtime_1.jsx)(Field, { label: t('language'), children: (0, jsx_runtime_1.jsxs)("select", { value: draft.language, onChange: (event) => { update('language', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "zh", children: "\u4E2D\u6587" }), (0, jsx_runtime_1.jsx)("option", { value: "en", children: "English" })] }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('timeout'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.timeoutMs, onChange: (event) => { update('timeoutMs', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('maxBytes'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.maxImageBytes, onChange: (event) => { update('maxImageBytes', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('maxPixels'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.maxImagePixels, onChange: (event) => { update('maxImagePixels', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('concurrency'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.concurrency, onChange: (event) => { update('concurrency', event.target.value); } }) })] })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsxs)("div", { className: "dvt-panel-title", children: [(0, jsx_runtime_1.jsx)("h3", { children: t('runtime') }), (0, jsx_runtime_1.jsx)("span", { className: `dvt-badge ${snapshot.runtime.ready ? 'ok' : 'error'}`, children: snapshot.runtime.ready ? snapshot.runtime.upstream?.source === 'managed' ? t('runtimeManaged') : snapshot.runtime.upstream?.source === 'external' ? t('runtimeExternal') : t('runtimeReady') : t('runtimeUnavailable') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [(0, jsx_runtime_1.jsx)(Field, { label: t('runtimeMode'), children: (0, jsx_runtime_1.jsxs)("select", { value: draft.runtimeMode, onChange: (event) => { update('runtimeMode', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "managed", children: t('runtimeManaged') }), (0, jsx_runtime_1.jsx)("option", { value: "external", children: t('runtimeExternal') })] }) }), draft.runtimeMode === 'external' ? (0, jsx_runtime_1.jsx)(Field, { label: t('toolkitPath'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { value: draft.toolkitPath, onChange: (event) => { update('toolkitPath', event.target.value); } }) }) : null, (0, jsx_runtime_1.jsx)(Field, { label: t('python'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { placeholder: "python3", value: draft.python, onChange: (event) => { update('python', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('allowedDirs'), hint: t('allowedDirsHint'), children: (0, jsx_runtime_1.jsx)("textarea", { rows: 3, value: draft.allowedDirs, onChange: (event) => { update('allowedDirs', event.target.value); } }) })] }), snapshot.runtime.upstream === undefined ? null : (0, jsx_runtime_1.jsxs)("div", { className: "dvt-runtime-facts", children: [(0, jsx_runtime_1.jsx)("code", { children: snapshot.runtime.upstream.path }), (0, jsx_runtime_1.jsxs)("code", { children: [snapshot.runtime.upstream.python, " \u00B7 ", snapshot.runtime.upstream.pythonVersion] }), (0, jsx_runtime_1.jsx)("code", { children: snapshot.runtime.upstream.runtimeHome })] })] })] })] }), (0, jsx_runtime_1.jsxs)("footer", { className: "dvt-settings-footer", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "dvt-kicker", children: t('pluginKind') }), (0, jsx_runtime_1.jsx)("h2", { children: t('settingsTitle') }), (0, jsx_runtime_1.jsx)("p", { children: t('settingsIntro') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-release", children: [(0, jsx_runtime_1.jsxs)("span", { children: [t('pluginVersion'), " ", (0, jsx_runtime_1.jsx)("strong", { children: snapshot.release.pluginVersion })] }), (0, jsx_runtime_1.jsxs)("span", { children: [t('upstreamVersion'), " ", (0, jsx_runtime_1.jsx)("strong", { children: snapshot.release.upstreamVersion })] }), (0, jsx_runtime_1.jsxs)("span", { children: [t('activeGeneration'), " ", (0, jsx_runtime_1.jsx)("strong", { children: t('activeGenerationValue', { generation: snapshot.runtime.generation }) })] })] })] })] }));
+    return ((0, jsx_runtime_1.jsxs)("div", { className: "dvt-settings", children: [(0, jsx_runtime_1.jsx)("div", { className: "dvt-alert notice", children: t('externalNotice') }), !snapshot.writable ? (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert warning", children: t('readOnly') }) : null, draftError === undefined ? null : (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert error", children: draftError }), state.error === undefined ? null : (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert error", children: state.error }), state.message === 'saved' ? (0, jsx_runtime_1.jsx)("div", { className: "dvt-alert success", children: t('saved') }) : null, snapshot.runtime.lastError === undefined ? null : (0, jsx_runtime_1.jsxs)("div", { className: "dvt-alert error", children: [(0, jsx_runtime_1.jsx)("strong", { children: runtimeErrorTitle }), (0, jsx_runtime_1.jsx)("span", { children: snapshot.runtime.lastError })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel dvt-essential", children: [(0, jsx_runtime_1.jsxs)("div", { className: "dvt-panel-title", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("h3", { children: t('provider') }), (0, jsx_runtime_1.jsx)("p", { children: t('providerHint') })] }), (0, jsx_runtime_1.jsx)("span", { className: `dvt-badge ${snapshot.credential.configured ? 'ok' : 'error'}`, children: snapshot.credential.configured ? t('configured') : t('missing') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [(0, jsx_runtime_1.jsx)(Field, { label: t('protocol'), children: (0, jsx_runtime_1.jsxs)("select", { disabled: !snapshot.writable || busy, value: draft.protocol, onChange: (event) => { update('protocol', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "openai", children: "OpenAI Chat Completions" }), (0, jsx_runtime_1.jsx)("option", { value: "anthropic", children: "Anthropic Messages" })] }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('baseUrl'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { disabled: !snapshot.writable || busy, value: draft.baseUrl, onChange: (event) => { update('baseUrl', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('model'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { disabled: !snapshot.writable || busy, value: draft.model, onChange: (event) => { update('model', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('apiKey'), hint: keyLocked ? t('apiKeyLocked') : snapshot.credential.source === undefined ? t('apiKeyHint') : `${t('apiKeyHint')} ${t('sourceHint', { source: t('source'), value: credentialSource(snapshot.credential.source, t) })}`, children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { "aria-label": t('apiKey'), type: "password", autoComplete: "new-password", disabled: busy || keyLocked, placeholder: snapshot.credential.configured ? t('apiKeyPlaceholderConfigured') : t('apiKeyPlaceholderMissing'), value: apiKey, onChange: (event) => { setApiKey(event.target.value); setDraftError(undefined); } }) })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-save-row", children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "primary", disabled: !canSave || busy, onClick: save, children: state.action === 'save' ? t('saving') : t('save') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { variant: "outline", disabled: busy, onClick: () => { void controller.load(); }, children: t('reload') })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsxs)("div", { className: "dvt-panel-title", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("h3", { children: t('health') }), (0, jsx_runtime_1.jsx)("p", { children: t('connectionHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-actions", children: [(0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { size: "sm", variant: "outline", disabled: busy || !snapshot.runtime.ready, onClick: () => { void controller.runHealth(false); }, children: state.action === 'health' ? t('testing') : t('runHealth') }), (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Button, { size: "sm", variant: "primary", disabled: busy || !snapshot.runtime.ready, onClick: () => { void controller.runHealth(true); }, children: state.action === 'connection' ? t('testing') : t('testConnection') })] })] }), (0, jsx_runtime_1.jsx)("p", { className: "dvt-muted", children: t('saveBeforeTesting') }), state.health === undefined ? (0, jsx_runtime_1.jsx)("p", { className: "dvt-muted", children: t('notTested') }) : (0, jsx_runtime_1.jsx)("div", { className: "dvt-health-grid", children: Object.entries(state.health.checks).map(([name, check]) => (0, jsx_runtime_1.jsxs)("div", { "data-status": check.status, children: [(0, jsx_runtime_1.jsx)("span", { children: t(HEALTH_NAME_KEYS[name] ?? 'health') }), (0, jsx_runtime_1.jsx)("strong", { children: t(HEALTH_STATUS_KEYS[check.status]) }), (0, jsx_runtime_1.jsx)("p", { children: healthDetail(name, check.detail, t) })] }, name)) })] }), (0, jsx_runtime_1.jsxs)("details", { className: "dvt-advanced", children: [(0, jsx_runtime_1.jsxs)("summary", { children: [(0, jsx_runtime_1.jsxs)("span", { children: [(0, jsx_runtime_1.jsx)("strong", { children: t('advanced') }), (0, jsx_runtime_1.jsx)("small", { children: t('advancedHint') })] }), (0, jsx_runtime_1.jsx)("span", { className: "dvt-details-chevron", "aria-hidden": "true", children: "\u2304" })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-advanced-body", children: [(0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsx)("div", { className: "dvt-panel-title", children: (0, jsx_runtime_1.jsx)("h3", { children: t('provider') }) }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [(0, jsx_runtime_1.jsx)(Field, { label: t('credential'), hint: t('credentialHint'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { "aria-label": t('credential'), disabled: !snapshot.writable || busy, value: draft.credential, onChange: (event) => { update('credential', event.target.value); } }) }), draft.protocol === 'anthropic' ? (0, jsx_runtime_1.jsx)(Field, { label: t('anthropicThinking'), hint: t('anthropicThinkingHint'), children: (0, jsx_runtime_1.jsxs)("select", { "aria-label": t('anthropicThinking'), value: draft.anthropicThinking, onChange: (event) => { update('anthropicThinking', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "omit", children: "omit (widest compatibility)" }), (0, jsx_runtime_1.jsx)("option", { value: "disabled", children: "disabled (model support required)" }), (0, jsx_runtime_1.jsx)("option", { value: "adaptive", children: "adaptive (model support required)" })] }) }) : null, (0, jsx_runtime_1.jsx)(Field, { label: t('userAgent'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { value: draft.userAgent, onChange: (event) => { update('userAgent', event.target.value); } }) })] })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsx)("div", { className: "dvt-panel-title", children: (0, jsx_runtime_1.jsx)("h3", { children: t('limits') }) }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [(0, jsx_runtime_1.jsx)(Field, { label: t('language'), children: (0, jsx_runtime_1.jsxs)("select", { value: draft.language, onChange: (event) => { update('language', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "zh", children: "\u4E2D\u6587" }), (0, jsx_runtime_1.jsx)("option", { value: "en", children: "English" })] }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('timeout'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.timeoutMs, onChange: (event) => { update('timeoutMs', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('maxBytes'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.maxImageBytes, onChange: (event) => { update('maxImageBytes', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('maxPixels'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.maxImagePixels, onChange: (event) => { update('maxImagePixels', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('concurrency'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { inputMode: "numeric", value: draft.concurrency, onChange: (event) => { update('concurrency', event.target.value); } }) })] })] }), (0, jsx_runtime_1.jsxs)("section", { className: "dvt-panel", children: [(0, jsx_runtime_1.jsxs)("div", { className: "dvt-panel-title", children: [(0, jsx_runtime_1.jsx)("h3", { children: t('runtime') }), (0, jsx_runtime_1.jsx)("span", { className: `dvt-badge ${snapshot.runtime.ready ? 'ok' : 'error'}`, children: snapshot.runtime.ready ? snapshot.runtime.upstream?.source === 'managed' ? t('runtimeManaged') : snapshot.runtime.upstream?.source === 'external' ? t('runtimeExternal') : t('runtimeReady') : t('runtimeUnavailable') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-form-grid", children: [(0, jsx_runtime_1.jsx)(Field, { label: t('runtimeMode'), children: (0, jsx_runtime_1.jsxs)("select", { value: draft.runtimeMode, onChange: (event) => { update('runtimeMode', event.target.value); }, children: [(0, jsx_runtime_1.jsx)("option", { value: "managed", children: t('runtimeManaged') }), (0, jsx_runtime_1.jsx)("option", { value: "external", children: t('runtimeExternal') })] }) }), draft.runtimeMode === 'external' ? (0, jsx_runtime_1.jsx)(Field, { label: t('toolkitPath'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { value: draft.toolkitPath, onChange: (event) => { update('toolkitPath', event.target.value); } }) }) : null, (0, jsx_runtime_1.jsx)(Field, { label: t('python'), children: (0, jsx_runtime_1.jsx)(dsh_client_ui_primitives_1.Input, { placeholder: "python3", value: draft.python, onChange: (event) => { update('python', event.target.value); } }) }), (0, jsx_runtime_1.jsx)(Field, { label: t('allowedDirs'), hint: t('allowedDirsHint'), children: (0, jsx_runtime_1.jsx)("textarea", { rows: 3, value: draft.allowedDirs, onChange: (event) => { update('allowedDirs', event.target.value); } }) })] }), snapshot.runtime.upstream === undefined ? null : (0, jsx_runtime_1.jsxs)("div", { className: "dvt-runtime-facts", children: [(0, jsx_runtime_1.jsx)("code", { children: snapshot.runtime.upstream.path }), (0, jsx_runtime_1.jsxs)("code", { children: [snapshot.runtime.upstream.python, " \u00B7 ", snapshot.runtime.upstream.pythonVersion] }), (0, jsx_runtime_1.jsx)("code", { children: snapshot.runtime.upstream.runtimeHome })] })] })] })] }), (0, jsx_runtime_1.jsxs)("footer", { className: "dvt-settings-footer", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("span", { className: "dvt-kicker", children: t('pluginKind') }), (0, jsx_runtime_1.jsx)("h2", { children: t('settingsTitle') }), (0, jsx_runtime_1.jsx)("p", { children: t('settingsIntro') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "dvt-release", children: [(0, jsx_runtime_1.jsxs)("span", { children: [t('pluginVersion'), " ", (0, jsx_runtime_1.jsx)("strong", { children: snapshot.release.pluginVersion })] }), (0, jsx_runtime_1.jsxs)("span", { children: [t('upstreamVersion'), " ", (0, jsx_runtime_1.jsx)("strong", { children: snapshot.release.upstreamVersion })] }), (0, jsx_runtime_1.jsxs)("span", { children: [t('activeGeneration'), " ", (0, jsx_runtime_1.jsx)("strong", { children: t('activeGenerationValue', { generation: snapshot.runtime.generation }) })] })] })] })] }));
 }
 const CSS = `
 .dvt-tool{margin:4px 0;border:1px solid var(--dsw-alias-border-l1);border-radius:12px;background:var(--dsw-alias-bg-layer-1);overflow:hidden;box-shadow:var(--dsw-shadow-lv1)}
@@ -826,7 +895,7 @@ function apply(ctx) {
 __modules["./paste-images.js"] = function(module, exports, require, __load_) {
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PasteImageController = exports.PASTE_IMAGES_ROUTE = void 0;
+exports.PasteImageController = exports.PASTE_POLICY_ROUTE = exports.PASTE_IMAGES_ROUTE = void 0;
 exports.PasteImageDock = PasteImageDock;
 exports.installPasteImages = installPasteImages;
 const jsx_runtime_1 = require("react/jsx-runtime");
@@ -834,9 +903,12 @@ const jsx_runtime_1 = require("react/jsx-runtime");
 const react_1 = require("react");
 const SOURCE = 'vision-toolkit-pasted-image';
 exports.PASTE_IMAGES_ROUTE = '/_dsh/vision-toolkit/paste-images';
+exports.PASTE_POLICY_ROUTE = '/_dsh/vision-toolkit/paste-policy';
 const MAX_IMAGES = 20;
 const MAX_IMAGE_BYTES = 20 * 1024 * 1024;
 const MAX_BATCH_BYTES = 80 * 1024 * 1024;
+/** A confirmed paste verdict older than this is unknown again, even while a refresh is in flight. */
+const VERDICT_MAX_AGE_MS = 15000;
 const CORDIS_ORIGINAL = Symbol.for('cordis.original');
 function registryIdentity(registry) {
     let current = registry;
@@ -875,6 +947,25 @@ function imageFiles(data) {
     const candidates = itemFiles.length > 0 ? itemFiles : Array.from(data.files);
     return candidates.filter(file => file.type.toLowerCase().startsWith('image/'));
 }
+/**
+ * The selector label the model picker currently shows, or '' when none is
+ * readable. Matches the host ModelSelect trigger aria-labels ("Select model,
+ * current …" / "选择模型，当前 …"); any other label wording falls back to the
+ * session-header verdict, which is stale until the next request.
+ */
+function currentModelLabel() {
+    const buttons = document.querySelectorAll('button[aria-label]');
+    for (const button of buttons) {
+        const label = button.getAttribute('aria-label') ?? '';
+        if (/select model|current model|选择模型/iu.test(label))
+            return label;
+    }
+    return '';
+}
+/** Verdict cache key: the model label is part of the answer, so a switch invalidates it. */
+function verdictKey(sessionId, modelLabel) {
+    return `${sessionId}|${modelLabel}`;
+}
 function validateImages(files) {
     if (files.length > MAX_IMAGES)
         throw new Error(`Paste at most ${MAX_IMAGES} images at a time`);
@@ -906,6 +997,9 @@ class PasteImageController {
     records = new Map();
     listeners = new Set();
     revision = 0;
+    verdicts = new Map();
+    /** Guards the synthetic replay paste from re-entering capture interception. */
+    replaying = false;
     constructor(ctx) {
         this.ctx = ctx;
     }
@@ -1005,30 +1099,246 @@ class PasteImageController {
             throw error;
         }
     }
-    handlePaste(event) {
-        const files = imageFiles(event.clipboardData);
-        if (files.length === 0)
+    /**
+     * The host's verdict for one Session and selector label, when fresh. The
+     * last CONFIRMED answer is authoritative while a background refresh is in
+     * flight (the paste acts on what the host last said; the refresh only
+     * covers the next paste). A label that changed since the confirmation
+     * answers undefined, so the native attachment flow stays the default.
+     * @param sessionId - the live Session the paste belongs to.
+     * @param modelLabel - the model-selector label currently shown.
+     * @returns the fresh confirmed verdict, or undefined when unconfirmed.
+     */
+    verdictFor(sessionId, modelLabel) {
+        const entry = this.verdicts.get(verdictKey(sessionId, modelLabel));
+        if (entry === undefined || entry.at === 0)
+            return undefined;
+        if (Date.now() - entry.at > VERDICT_MAX_AGE_MS)
+            return undefined;
+        return { takeOver: entry.takeOver, ...(entry.autoSwitch === undefined ? {} : { autoSwitch: entry.autoSwitch }) };
+    }
+    /**
+     * The exact model route the live model catalog reports for one Session.
+     * Unreadable routes answer undefined, so the verdict falls back to the
+     * selector label alone.
+     * @param sessionId - the live Session id.
+     * @returns the current provider/model selection, when readable.
+     */
+    async readSelection(sessionId) {
+        const connection = this.ctx.get('connection');
+        if (connection === undefined)
+            return undefined;
+        try {
+            const { result } = await connection.api.sessions.models({ sessionId });
+            if (!result.ok)
+                return undefined;
+            const current = result.value.current;
+            if (current === undefined || current === null || current.provider === '' || current.model === '')
+                return undefined;
+            return {
+                provider: current.provider,
+                model: current.model,
+                ...(current.reasoningEffort === undefined ? {} : { reasoningEffort: current.reasoningEffort }),
+            };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Ask the host what to do with a paste for the current model, and cache the
+     * answer per Session and selector label. A model switch changes the label,
+     * which changes the cache key, so a stale verdict never outlives the model
+     * it described. The exact selection rides along when the live model catalog
+     * is readable, so the host can answer with an auto-switch route; a 404
+     * simply leaves the verdict unconfirmed; the next focus or paste retries.
+     * @param sessionId - the live Session to ask about.
+     * @param modelLabel - the model-selector label currently shown.
+     */
+    refreshVerdict(sessionId, modelLabel) {
+        const key = verdictKey(sessionId, modelLabel);
+        const cached = this.verdicts.get(key);
+        // Dedupe only on an in-flight request, never on freshness: the host's
+        // model route can change under an unchanged Session id.
+        if (cached?.pending)
+            return;
+        const entry = {
+            pending: true,
+            takeOver: cached ? cached.takeOver : false,
+            at: cached ? cached.at : 0,
+            ...(cached?.autoSwitch === undefined ? {} : { autoSwitch: cached.autoSwitch }),
+        };
+        this.verdicts.set(key, entry);
+        void (async () => {
+            const selection = await this.readSelection(sessionId);
+            const query = new URLSearchParams({ sessionId });
+            if (modelLabel !== '')
+                query.set('model', modelLabel);
+            if (selection !== undefined) {
+                query.set('provider', selection.provider);
+                query.set('modelId', selection.model);
+                if (selection.reasoningEffort !== undefined)
+                    query.set('reasoningEffort', selection.reasoningEffort);
+            }
+            let request;
+            try {
+                request = fetch(`${exports.PASTE_POLICY_ROUTE}?${query.toString()}`);
+            }
+            catch {
+                // No fetch surface (test runtime, pre-fetch bootstrap): leave the
+                // verdict unconfirmed rather than letting the paste listener die.
+                entry.pending = false;
+                return;
+            }
+            request
+                .then((response) => {
+                if (response.status === 404) {
+                    // Route not mounted yet (plugin load race, hot reload): forget every
+                    // verdict and retry on the next focus or paste instead of standing
+                    // down for the page lifetime.
+                    this.verdicts.clear();
+                    return null;
+                }
+                if (!response.ok)
+                    throw new Error(`paste policy ${response.status}`);
+                return response.json();
+            })
+                .then((body) => {
+                entry.pending = false;
+                if (body !== null) {
+                    entry.takeOver = body.value.takeOver === true;
+                    if (body.value.autoSwitch !== undefined)
+                        entry.autoSwitch = body.value.autoSwitch;
+                    else
+                        delete entry.autoSwitch;
+                    entry.at = Date.now();
+                }
+            })
+                .catch(() => {
+                entry.pending = false;
+            });
+        })();
+    }
+    /**
+     * Switch one Session to the route the host validated, through the same
+     * model-directory seat the selector uses when present (so the shared UI
+     * state moves with the session), falling back to the raw RPC.
+     * @param sessionId - the live Session id.
+     * @param route - the validated variant route.
+     */
+    async switchModel(sessionId, route) {
+        const directories = this.ctx.get('modelDirectories');
+        if (directories !== undefined) {
+            // The label is a display hint; the seat only needs the exact route.
+            await directories.directoryFor(sessionId).select({
+                provider: route.provider,
+                model: route.model,
+                ...(route.reasoningEffort === undefined ? {} : { reasoningEffort: route.reasoningEffort }),
+            });
+            return;
+        }
+        const connection = this.ctx.get('connection');
+        if (connection === undefined)
+            throw new Error('No model switch channel is available in this Web application');
+        const { result } = await connection.api.sessions.selectModel({
+            sessionId,
+            provider: route.provider,
+            model: route.model,
+            ...(route.reasoningEffort === undefined ? {} : { reasoningEffort: route.reasoningEffort }),
+        });
+        if (!result.ok)
+            throw new Error(`${result.error?.code ?? 'select-model-failed'}: ${result.error?.message ?? 'unknown error'}`);
+    }
+    /**
+     * Replay a swallowed paste as a synthetic clipboard event so the composer's
+     * own intake (limits, thumbnails, keyboard) runs with the captured files.
+     * @returns false when the environment cannot construct a clipboard payload.
+     */
+    replayPaste(target, files, text) {
+        let data;
+        try {
+            data = new DataTransfer();
+            for (const file of files)
+                data.items.add(file);
+            if (text !== '')
+                data.setData('text/plain', text);
+        }
+        catch {
             return false;
-        const target = event.target;
-        if (!(target instanceof HTMLTextAreaElement) || target.closest('[data-composer-card]') === null)
+        }
+        let event;
+        try {
+            event = new ClipboardEvent('paste', {
+                clipboardData: data,
+                bubbles: true,
+                cancelable: true,
+            });
+        }
+        catch {
             return false;
-        event.preventDefault();
-        event.stopPropagation();
-        event.stopImmediatePropagation();
-        const sessionId = this.ctx.sessions.list.getSnapshot().current;
-        if (sessionId === undefined)
-            return true;
+        }
+        if (event.clipboardData === null || event.clipboardData.files.length === 0)
+            return false;
+        this.replaying = true;
+        try {
+            target.dispatchEvent(event);
+        }
+        finally {
+            this.replaying = false;
+        }
+        return true;
+    }
+    /**
+     * Auto-switch flow: switch the Session to the image-input variant, announce
+     * it, then replay the paste into the composer's native intake. A failed
+     * switch, or an environment that cannot replay clipboard bytes, degrades to
+     * the path takeover with the same files.
+     * @param sessionId - the live Session id.
+     * @param target - the composer textarea the paste landed on.
+     * @param files - the captured image files.
+     * @param text - same-paste text, replayed alongside the files.
+     * @param route - the validated variant route to switch to.
+     */
+    async autoSwitchPaste(sessionId, target, files, text, route) {
+        const input = this.inputFor(sessionId);
+        try {
+            await this.switchModel(sessionId, route);
+            input.notify('info', `Switched to ${route.label || `${route.model} (Vision Toolkit)`}; pasted images now keep the native attachment flow`);
+        }
+        catch (error) {
+            input.notify('error', `Model switch failed; images will be sent as workspace paths: ${message(error)}`);
+            this.takeoverPaste(sessionId, target, files, text);
+            return;
+        }
+        // Replaying lets the composer's own intake run (thumbnail, limits,
+        // keyboard); if the environment cannot replay clipboard bytes, the
+        // images still land as workspace paths.
+        const before = input.state.getSnapshot().imageIds.length;
+        const replayed = this.replayPaste(target, files, text);
+        const after = input.state.getSnapshot().imageIds.length;
+        if (!replayed || after <= before) {
+            this.takeoverPaste(sessionId, target, files, text);
+        }
+    }
+    /**
+     * Path-takeover flow: insert the same-paste text and every image as a text
+     * reference that serializes to the image's workspace path on send.
+     * @param sessionId - the live Session id.
+     * @param target - the composer textarea the paste landed on.
+     * @param files - the captured image files.
+     * @param text - same-paste text.
+     */
+    takeoverPaste(sessionId, target, files, text) {
         const input = this.inputFor(sessionId);
         const snapshot = input.state.getSnapshot();
         if (snapshot.phase !== 'plain')
-            return true;
+            return;
         const start = Math.max(0, Math.min(target.selectionStart ?? snapshot.draft.length, snapshot.draft.length));
         const end = Math.max(start, Math.min(target.selectionEnd ?? start, snapshot.draft.length));
-        const text = (event.clipboardData?.getData('text/plain') ?? '').replaceAll('\uFFFC', '');
         try {
             let cursor = this.insertText(input, text, start, end);
             validateImages(files);
-            cursor = this.insertRecords(String(sessionId), input, files, cursor);
+            cursor = this.insertRecords(sessionId, input, files, cursor);
             requestAnimationFrame(() => {
                 target.focus({ preventScroll: true });
                 target.setSelectionRange(cursor, cursor);
@@ -1037,6 +1347,45 @@ class PasteImageController {
         catch (error) {
             input.notify('error', message(error));
         }
+    }
+    handlePaste(event) {
+        if (this.replaying)
+            return false;
+        const files = imageFiles(event.clipboardData);
+        if (files.length === 0)
+            return false;
+        const target = event.target;
+        if (!(target instanceof HTMLTextAreaElement) || target.closest('[data-composer-card]') === null)
+            return false;
+        const sessionId = this.ctx.sessions.list.getSnapshot().current;
+        if (sessionId === undefined)
+            return false;
+        const modelLabel = currentModelLabel();
+        this.refreshVerdict(sessionId, modelLabel);
+        // Only a fresh host verdict acts; the native attachment flow stays the
+        // default while the host is unconfirmed.
+        const verdict = this.verdictFor(sessionId, modelLabel);
+        if (verdict === undefined)
+            return false;
+        // An image-capable model (the variant routes included) keeps its native
+        // paste: no switch, no takeover.
+        if (verdict.takeOver === false && verdict.autoSwitch === undefined)
+            return false;
+        event.preventDefault();
+        event.stopPropagation();
+        event.stopImmediatePropagation();
+        const input = this.inputFor(sessionId);
+        if (input.state.getSnapshot().phase !== 'plain')
+            return true;
+        const text = (event.clipboardData?.getData('text/plain') ?? '').replaceAll('\uFFFC', '');
+        if (verdict.autoSwitch !== undefined) {
+            // The text-only model has an image-input variant: switch first, then
+            // let the paste flow natively so the thumbnail and durable session
+            // image are preserved.
+            void this.autoSwitchPaste(sessionId, target, files, text, verdict.autoSwitch);
+            return true;
+        }
+        this.takeoverPaste(sessionId, target, files, text);
         return true;
     }
     remove(sessionId, occurrence) {
@@ -1183,8 +1532,18 @@ function installPasteImages(ctx) {
     });
     ctx.effect(() => {
         const listener = (event) => { controller.handlePaste(event); };
+        // A focus-time prefetch has the verdict ready before the first paste can land.
+        const onFocusIn = () => {
+            const sessionId = ctx.sessions.list.getSnapshot().current;
+            if (sessionId !== undefined)
+                controller.refreshVerdict(String(sessionId), currentModelLabel());
+        };
         document.addEventListener('paste', listener, true);
-        return () => { document.removeEventListener('paste', listener, true); };
+        document.addEventListener('focusin', onFocusIn, true);
+        return () => {
+            document.removeEventListener('paste', listener, true);
+            document.removeEventListener('focusin', onFocusIn, true);
+        };
     }, 'dsh-vision-toolkit: clipboard image capture');
     ctx.slots.inject('conversation.input.dock', () => ctx.slots.register({
         name: 'conversation.input.dock',