@anionex/dsh-vision-toolkit 0.1.6 → 0.1.8

package/src/index.ts

@@ -21,6 +21,7 @@ import {
   type VisionToolkitConfig,
 } from './config.ts'
 import { VisionToolExposure } from './exposure.ts'
+import { createPasteTakeoverResolver, installImageInputVariants } from './image-input-variants.ts'
 import { VisionToolkitRuntimeManager } from './runtime-manager.ts'
 import { VISION_TOOLS_SKILL } from './skill.ts'
 import { createVisionTools } from './tools.ts'
@@ -98,11 +99,27 @@ export async function apply(ctx: Context, config: VisionToolkitConfig = {}): Pro
   const pastedImages = new PastedImageBackend(ctx, {
     maxImageBytes: () => manager.status().activeConfig?.maxImageBytes ?? resolveConfig(settings.get()).maxImageBytes,
   })
-  installVisionToolkitWeb(ctx, backend, artifacts, pastedImages)
+  // Image-input variants register asynchronously once eligible routes exist;
+  // the runtime getter stays lazy so variants appear even when the runtime
+  // becomes ready after the first sweep.
+  const variants = installImageInputVariants(
+    ctx,
+    () => resolveConfig(settings.get()),
+    () => manager.ready ? manager.current() : undefined,
+  )
+  installVisionToolkitWeb(
+    ctx,
+    backend,
+    artifacts,
+    pastedImages,
+    createPasteTakeoverResolver(ctx, () => resolveConfig(settings.get())),
+  )
+  disposers.push(variants.dispose)
   disposers.push(settings.watch(async (next) => {
     try {
       await manager.reconfigure(next)
       ensureOperational()
+      variants.reconcile()
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
       ctx.logger.error('dsh-vision-toolkit: keeping the previous runtime after a refused Settings generation. %s', message)

package/src/paste-images.ts

@@ -11,6 +11,45 @@ import { sameOriginPost } from './web-request.ts'
 /** Exact route used by the browser paste integration. */
 export const PASTE_IMAGES_ROUTE = '/_dsh/vision-toolkit/paste-images'
 
+/**
+ * Exact route the browser paste integration asks before taking a paste over:
+ * `GET ?sessionId=&model=&provider=&modelId=` answers the verdict from the
+ * live Session's model route.
+ */
+export const PASTE_POLICY_ROUTE = '/_dsh/vision-toolkit/paste-policy'
+
+/**
+ * One exact model route the browser should switch the Session to before the
+ * native attachment flow: the image-input variant of the current text-only
+ * model. The variant declares image input, so the paste keeps the composer
+ * thumbnail and the durable session image.
+ */
+export interface PasteSwitchRoute {
+  /** The variant provider route (`vision-toolkit-` + upstream provider id). */
+  provider: string
+  /** The model id, identical to the upstream text-only model's id. */
+  model: string
+  /** The variant's selector display name (upstream name + variant suffix). */
+  label: string
+  /** The upstream reasoning effort, when the selection carries one. */
+  reasoningEffort?: string
+}
+
+/** The exact model route the browser read from the live model catalog. */
+export interface PasteSelectionQuery {
+  provider: string
+  model: string
+  reasoningEffort?: string
+}
+
+/** The paste-policy answer for one Session and model route. */
+export interface PasteVerdict {
+  /** Whether the browser should turn the paste into workspace paths instead of attachments. */
+  takeOver: boolean
+  /** When present, the browser switches to this route first, then lets the paste flow natively. */
+  autoSwitch?: PasteSwitchRoute
+}
+
 const MAX_NAME_BYTES = 180
 
 interface PasteImageResponse {

package/src/web-request.ts

@@ -1,7 +1,12 @@
 import type { IncomingMessage } from 'node:http'
 
-/** Accept state-changing requests only from the DSH Web application's origin. */
-export function sameOriginPost(req: IncomingMessage): boolean {
+/**
+ * Accept a request only from the DSH Web application's origin. Method-agnostic:
+ * the same fence guards state-changing POSTs and policy GETs.
+ * @param req - the incoming request whose headers carry the origin evidence.
+ * @returns whether the request may be answered.
+ */
+export function sameOriginRequest(req: IncomingMessage): boolean {
   const fetchSite = req.headers['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
   const origin = req.headers.origin
@@ -15,3 +20,8 @@ export function sameOriginPost(req: IncomingMessage): boolean {
     return false
   }
 }
+
+/** Accept state-changing requests only from the DSH Web application's origin. */
+export function sameOriginPost(req: IncomingMessage): boolean {
+  return sameOriginRequest(req)
+}

package/src/web.ts

@@ -7,13 +7,19 @@
 
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { Context } from '@deepseek-ai/cordis'
-import type { CredentialInfo } from '@deepseek-ai/dsh-credentials'
+import type { CredentialInfo, CredentialRef } from '@deepseek-ai/dsh-credentials'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { SettingsConflictError, type SettingsDescriptor } from '@deepseek-ai/dsh-settings'
 // Type-only import activates the optional webServer Context declaration.
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import { ArtifactAccessController, ARTIFACT_ROUTE_PREFIX } from './artifact-access.ts'
-import { PastedImageBackend, PASTE_IMAGES_ROUTE } from './paste-images.ts'
+import {
+  PastedImageBackend,
+  PASTE_IMAGES_ROUTE,
+  PASTE_POLICY_ROUTE,
+  type PasteSelectionQuery,
+  type PasteVerdict,
+} from './paste-images.ts'
 import {
   resolveConfig,
   VISION_TOOLKIT_SETTINGS_NAMESPACE,
@@ -27,7 +33,7 @@ import {
   type RuntimeManagerStatus,
 } from './runtime-manager.ts'
 import { PLUGIN_VERSION, UPSTREAM_COMMIT, UPSTREAM_REPOSITORY, UPSTREAM_VERSION } from './version.ts'
-import { sameOriginPost } from './web-request.ts'
+import { sameOriginPost, sameOriginRequest } from './web-request.ts'
 
 /** Exact route used by the browser Settings page. */
 export const SETTINGS_ROUTE = '/_dsh/vision-toolkit/settings'
@@ -70,7 +76,14 @@ interface HealthRequest {
   testConnection: boolean
 }
 
-type SettingsRequest = SaveRequest | HealthRequest
+interface CredentialRequest {
+  action: 'credential'
+  expectedRevision: number
+  ref: CredentialRef
+  value: string
+}
+
+type SettingsRequest = SaveRequest | HealthRequest | CredentialRequest
 
 interface JsonError {
   ok: false
@@ -101,6 +114,8 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
 }
 
+class CredentialReferenceConflictError extends Error {}
+
 function descriptorOf(ctx: Context): SettingsDescriptor {
   const descriptor = ctx.settings.describe().find(row => row.ns === VISION_TOOLKIT_SETTINGS_NAMESPACE)
   if (descriptor === undefined) throw new Error('vision-toolkit Settings namespace is not registered')
@@ -154,6 +169,27 @@ function parseRequest(value: unknown): SettingsRequest {
       value: value.value as VisionToolkitConfig,
     }
   }
+  if (value.action === 'credential') {
+    if (!Number.isSafeInteger(value.expectedRevision) || (value.expectedRevision as number) < 0) {
+      throw new TypeError('credential.expectedRevision must be a non-negative integer')
+    }
+    if (typeof value.ref !== 'string') throw new TypeError('credential.ref must be a string')
+    if (typeof value.value !== 'string') throw new TypeError('credential.value must be a string')
+    const secret = value.value.trim()
+    if (secret.length === 0) throw new TypeError('API key cannot be blank')
+    const first = secret[0]
+    const quoted = secret.length > 1 && (first === '"' || first === '\'' || first === '`') && secret.endsWith(first)
+    const environmentLine = /^[A-Z][A-Z0-9_]*=[^=]/u.test(secret)
+    if (quoted || environmentLine || !/^[\x21-\x7E]+$/u.test(secret)) {
+      throw new TypeError('paste only the API key, without a variable name, quotes, spaces, or line breaks')
+    }
+    return {
+      action: 'credential',
+      expectedRevision: value.expectedRevision as number,
+      ref: credentialRef(value.ref),
+      value: secret,
+    }
+  }
   throw new TypeError(`unsupported action: ${value.action}`)
 }
 
@@ -227,6 +263,26 @@ export class VisionToolkitWebBackend {
     return this.snapshot()
   }
 
+  private async saveCredential(request: CredentialRequest): Promise<VisionToolkitSettingsSnapshot> {
+    const descriptor = descriptorOf(this.ctx)
+    if (descriptor.revision !== request.expectedRevision) {
+      throw new SettingsConflictError(
+        VISION_TOOLKIT_SETTINGS_NAMESPACE,
+        request.expectedRevision,
+        descriptor.revision,
+      )
+    }
+    const resolved = resolveConfig(descriptor.value as VisionToolkitConfig)
+    const currentRef = credentialRef(String(resolved.provider.credential))
+    if (currentRef !== request.ref) {
+      throw new CredentialReferenceConflictError(
+        `credential reference changed from "${request.ref}" to "${currentRef}"; reload Settings and try again`,
+      )
+    }
+    await this.ctx.credentials.set(currentRef, request.value)
+    return this.snapshot()
+  }
+
   private async health(request: HealthRequest, req: IncomingMessage): Promise<VisionToolkitHealthResult> {
     if (!this.manager.ready) throw new Error('runtime is not ready; fix Settings and save a valid configuration first')
     const controller = new AbortController()
@@ -273,32 +329,117 @@ export class VisionToolkitWebBackend {
       return
     }
     try {
-      if (parsed.action === 'health') {
-        responseJson(res, 200, { ok: true, value: await this.health(parsed, req) })
-      } else {
-        responseJson(res, 200, { ok: true, value: await this.save(parsed) })
+      switch (parsed.action) {
+        case 'health':
+          responseJson(res, 200, { ok: true, value: await this.health(parsed, req) })
+          break
+        case 'save':
+          responseJson(res, 200, { ok: true, value: await this.save(parsed) })
+          break
+        case 'credential':
+          responseJson(res, 200, { ok: true, value: await this.saveCredential(parsed) })
+          break
       }
     } catch (error) {
-      const conflict = error instanceof SettingsConflictError
-      const code = conflict ? 'settings-conflict' : parsed.action === 'health' ? 'health-failed' : 'settings-rejected'
-      const status = conflict ? 409 : parsed.action === 'health' ? 503 : 400
+      const settingsConflict = error instanceof SettingsConflictError
+      const credentialConflict = error instanceof CredentialReferenceConflictError
+      const code = settingsConflict
+        ? 'settings-conflict'
+        : credentialConflict
+          ? 'credential-conflict'
+          : parsed.action === 'health'
+            ? 'health-failed'
+            : parsed.action === 'credential'
+              ? 'credential-rejected'
+              : 'settings-rejected'
+      const status = settingsConflict || credentialConflict ? 409 : parsed.action === 'health' ? 503 : 400
       this.ctx.logger.warn('dsh-vision-toolkit Web action=%s failed: %s', parsed.action, publicMessage(error))
       requestError(res, status, code, publicMessage(error))
     }
   }
 }
 
+/**
+ * Same-origin policy handler for the paste route: whether the browser should
+ * take a paste over into workspace paths, or let it flow natively after an
+ * optional automatic switch to the image-input variant. The optional `model`
+ * query carries the model-selector label the client currently shows; the
+ * optional `provider`/`modelId`/`reasoningEffort` queries carry the exact
+ * route the client read from the live model catalog, which the resolver
+ * prefers (a label alone cannot pick a provider). Unresolvable routes answer
+ * native — the safe default.
+ * @param resolve - resolves one live Session's paste verdict.
+ * @returns the HTTP handler.
+ */
+export function createPastePolicyHandler(
+  resolve: (sessionId: string, selection?: PasteSelectionQuery, modelLabel?: string) => Promise<PasteVerdict>,
+): (req: IncomingMessage, res: ServerResponse) => void {
+  return (req, res) => {
+    void (async () => {
+      try {
+        if (req.method !== 'GET') {
+          requestError(res, 405, 'method-not-allowed', 'Use GET')
+          return
+        }
+        if (!sameOriginRequest(req)) {
+          requestError(res, 403, 'origin-rejected', 'The request must originate from this DSH Web application')
+          return
+        }
+        let sessionId: string
+        let modelLabel: string | undefined
+        let selection: PasteSelectionQuery | undefined
+        try {
+          const url = new URL(req.url ?? PASTE_POLICY_ROUTE, 'http://dsh.internal')
+          const sessions = url.searchParams.getAll('sessionId')
+          if (sessions.length !== 1 || sessions[0] === undefined || sessions[0] === '') {
+            throw new TypeError('sessionId is required exactly once')
+          }
+          sessionId = sessions[0]!
+          const models = url.searchParams.getAll('model')
+          if (models.length > 1) throw new TypeError('model may be given at most once')
+          modelLabel = models[0]
+          const providers = url.searchParams.getAll('provider')
+          if (providers.length > 1) throw new TypeError('provider may be given at most once')
+          const modelIds = url.searchParams.getAll('modelId')
+          if (modelIds.length > 1) throw new TypeError('modelId may be given at most once')
+          const efforts = url.searchParams.getAll('reasoningEffort')
+          if (efforts.length > 1) throw new TypeError('reasoningEffort may be given at most once')
+          const provider = providers[0]
+          const modelId = modelIds[0]
+          if (provider !== undefined && modelId !== undefined && provider !== '' && modelId !== '') {
+            selection = {
+              provider,
+              model: modelId,
+              ...(efforts[0] === undefined || efforts[0] === '' ? {} : { reasoningEffort: efforts[0] }),
+            }
+          }
+        } catch (error) {
+          requestError(res, 400, 'invalid-request', publicMessage(error))
+          return
+        }
+        const verdict = await resolve(sessionId, selection, modelLabel)
+        responseJson(res, 200, { ok: true, value: verdict })
+      } catch (error) {
+        requestError(res, 500, 'policy-failed', publicMessage(error))
+      }
+    })()
+  }
+}
+
 /**
  * Attach optional Web routes whenever a webServer service is present.
  * @param ctx - plugin context owning route effects.
  * @param backend - Settings handler.
  * @param artifacts - signed Artifact handler.
+ * @param pastedImages - pasted-image workspace handler.
+ * @param pastePolicy - paste-policy verdict resolver (sessionId, selection, modelLabel).
  */
 export function installVisionToolkitWeb(
   ctx: Context,
   backend: VisionToolkitWebBackend,
   artifacts: ArtifactAccessController,
   pastedImages: PastedImageBackend,
+  pastePolicy: (sessionId: string, selection?: PasteSelectionQuery, modelLabel?: string) => Promise<PasteVerdict>,
 ): void {
   ctx.inject(['webServer'], (webCtx) => {
     webCtx.effect(() => {
@@ -318,7 +459,13 @@ export function installVisionToolkitWeb(
         path: PASTE_IMAGES_ROUTE,
         handler: (req, res) => pastedImages.handle(req, res),
       })
+      const disposePastePolicy = webCtx.webServer.register({
+        kind: 'exact',
+        path: PASTE_POLICY_ROUTE,
+        handler: createPastePolicyHandler(pastePolicy),
+      })
       return () => {
+        disposePastePolicy()
         disposePasteImages()
         disposeSettings()
         disposeArtifact()