@anionex/dsh-vision-toolkit 0.1.7 → 0.1.8

package/src/index.ts

@@ -21,6 +21,7 @@ import {
   type VisionToolkitConfig,
 } from './config.ts'
 import { VisionToolExposure } from './exposure.ts'
+import { createPasteTakeoverResolver, installImageInputVariants } from './image-input-variants.ts'
 import { VisionToolkitRuntimeManager } from './runtime-manager.ts'
 import { VISION_TOOLS_SKILL } from './skill.ts'
 import { createVisionTools } from './tools.ts'
@@ -98,11 +99,27 @@ export async function apply(ctx: Context, config: VisionToolkitConfig = {}): Pro
   const pastedImages = new PastedImageBackend(ctx, {
     maxImageBytes: () => manager.status().activeConfig?.maxImageBytes ?? resolveConfig(settings.get()).maxImageBytes,
   })
-  installVisionToolkitWeb(ctx, backend, artifacts, pastedImages)
+  // Image-input variants register asynchronously once eligible routes exist;
+  // the runtime getter stays lazy so variants appear even when the runtime
+  // becomes ready after the first sweep.
+  const variants = installImageInputVariants(
+    ctx,
+    () => resolveConfig(settings.get()),
+    () => manager.ready ? manager.current() : undefined,
+  )
+  installVisionToolkitWeb(
+    ctx,
+    backend,
+    artifacts,
+    pastedImages,
+    createPasteTakeoverResolver(ctx, () => resolveConfig(settings.get())),
+  )
+  disposers.push(variants.dispose)
   disposers.push(settings.watch(async (next) => {
     try {
       await manager.reconfigure(next)
       ensureOperational()
+      variants.reconcile()
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
       ctx.logger.error('dsh-vision-toolkit: keeping the previous runtime after a refused Settings generation. %s', message)

package/src/paste-images.ts

@@ -11,6 +11,45 @@ import { sameOriginPost } from './web-request.ts'
 /** Exact route used by the browser paste integration. */
 export const PASTE_IMAGES_ROUTE = '/_dsh/vision-toolkit/paste-images'
 
+/**
+ * Exact route the browser paste integration asks before taking a paste over:
+ * `GET ?sessionId=&model=&provider=&modelId=` answers the verdict from the
+ * live Session's model route.
+ */
+export const PASTE_POLICY_ROUTE = '/_dsh/vision-toolkit/paste-policy'
+
+/**
+ * One exact model route the browser should switch the Session to before the
+ * native attachment flow: the image-input variant of the current text-only
+ * model. The variant declares image input, so the paste keeps the composer
+ * thumbnail and the durable session image.
+ */
+export interface PasteSwitchRoute {
+  /** The variant provider route (`vision-toolkit-` + upstream provider id). */
+  provider: string
+  /** The model id, identical to the upstream text-only model's id. */
+  model: string
+  /** The variant's selector display name (upstream name + variant suffix). */
+  label: string
+  /** The upstream reasoning effort, when the selection carries one. */
+  reasoningEffort?: string
+}
+
+/** The exact model route the browser read from the live model catalog. */
+export interface PasteSelectionQuery {
+  provider: string
+  model: string
+  reasoningEffort?: string
+}
+
+/** The paste-policy answer for one Session and model route. */
+export interface PasteVerdict {
+  /** Whether the browser should turn the paste into workspace paths instead of attachments. */
+  takeOver: boolean
+  /** When present, the browser switches to this route first, then lets the paste flow natively. */
+  autoSwitch?: PasteSwitchRoute
+}
+
 const MAX_NAME_BYTES = 180
 
 interface PasteImageResponse {

package/src/web-request.ts

@@ -1,7 +1,12 @@
 import type { IncomingMessage } from 'node:http'
 
-/** Accept state-changing requests only from the DSH Web application's origin. */
-export function sameOriginPost(req: IncomingMessage): boolean {
+/**
+ * Accept a request only from the DSH Web application's origin. Method-agnostic:
+ * the same fence guards state-changing POSTs and policy GETs.
+ * @param req - the incoming request whose headers carry the origin evidence.
+ * @returns whether the request may be answered.
+ */
+export function sameOriginRequest(req: IncomingMessage): boolean {
   const fetchSite = req.headers['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
   const origin = req.headers.origin
@@ -15,3 +20,8 @@ export function sameOriginPost(req: IncomingMessage): boolean {
     return false
   }
 }
+
+/** Accept state-changing requests only from the DSH Web application's origin. */
+export function sameOriginPost(req: IncomingMessage): boolean {
+  return sameOriginRequest(req)
+}

package/src/web.ts

@@ -13,7 +13,13 @@ import { SettingsConflictError, type SettingsDescriptor } from '@deepseek-ai/dsh
 // Type-only import activates the optional webServer Context declaration.
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import { ArtifactAccessController, ARTIFACT_ROUTE_PREFIX } from './artifact-access.ts'
-import { PastedImageBackend, PASTE_IMAGES_ROUTE } from './paste-images.ts'
+import {
+  PastedImageBackend,
+  PASTE_IMAGES_ROUTE,
+  PASTE_POLICY_ROUTE,
+  type PasteSelectionQuery,
+  type PasteVerdict,
+} from './paste-images.ts'
 import {
   resolveConfig,
   VISION_TOOLKIT_SETTINGS_NAMESPACE,
@@ -27,7 +33,7 @@ import {
   type RuntimeManagerStatus,
 } from './runtime-manager.ts'
 import { PLUGIN_VERSION, UPSTREAM_COMMIT, UPSTREAM_REPOSITORY, UPSTREAM_VERSION } from './version.ts'
-import { sameOriginPost } from './web-request.ts'
+import { sameOriginPost, sameOriginRequest } from './web-request.ts'
 
 /** Exact route used by the browser Settings page. */
 export const SETTINGS_ROUTE = '/_dsh/vision-toolkit/settings'
@@ -353,17 +359,87 @@ export class VisionToolkitWebBackend {
   }
 }
 
+/**
+ * Same-origin policy handler for the paste route: whether the browser should
+ * take a paste over into workspace paths, or let it flow natively after an
+ * optional automatic switch to the image-input variant. The optional `model`
+ * query carries the model-selector label the client currently shows; the
+ * optional `provider`/`modelId`/`reasoningEffort` queries carry the exact
+ * route the client read from the live model catalog, which the resolver
+ * prefers (a label alone cannot pick a provider). Unresolvable routes answer
+ * native — the safe default.
+ * @param resolve - resolves one live Session's paste verdict.
+ * @returns the HTTP handler.
+ */
+export function createPastePolicyHandler(
+  resolve: (sessionId: string, selection?: PasteSelectionQuery, modelLabel?: string) => Promise<PasteVerdict>,
+): (req: IncomingMessage, res: ServerResponse) => void {
+  return (req, res) => {
+    void (async () => {
+      try {
+        if (req.method !== 'GET') {
+          requestError(res, 405, 'method-not-allowed', 'Use GET')
+          return
+        }
+        if (!sameOriginRequest(req)) {
+          requestError(res, 403, 'origin-rejected', 'The request must originate from this DSH Web application')
+          return
+        }
+        let sessionId: string
+        let modelLabel: string | undefined
+        let selection: PasteSelectionQuery | undefined
+        try {
+          const url = new URL(req.url ?? PASTE_POLICY_ROUTE, 'http://dsh.internal')
+          const sessions = url.searchParams.getAll('sessionId')
+          if (sessions.length !== 1 || sessions[0] === undefined || sessions[0] === '') {
+            throw new TypeError('sessionId is required exactly once')
+          }
+          sessionId = sessions[0]!
+          const models = url.searchParams.getAll('model')
+          if (models.length > 1) throw new TypeError('model may be given at most once')
+          modelLabel = models[0]
+          const providers = url.searchParams.getAll('provider')
+          if (providers.length > 1) throw new TypeError('provider may be given at most once')
+          const modelIds = url.searchParams.getAll('modelId')
+          if (modelIds.length > 1) throw new TypeError('modelId may be given at most once')
+          const efforts = url.searchParams.getAll('reasoningEffort')
+          if (efforts.length > 1) throw new TypeError('reasoningEffort may be given at most once')
+          const provider = providers[0]
+          const modelId = modelIds[0]
+          if (provider !== undefined && modelId !== undefined && provider !== '' && modelId !== '') {
+            selection = {
+              provider,
+              model: modelId,
+              ...(efforts[0] === undefined || efforts[0] === '' ? {} : { reasoningEffort: efforts[0] }),
+            }
+          }
+        } catch (error) {
+          requestError(res, 400, 'invalid-request', publicMessage(error))
+          return
+        }
+        const verdict = await resolve(sessionId, selection, modelLabel)
+        responseJson(res, 200, { ok: true, value: verdict })
+      } catch (error) {
+        requestError(res, 500, 'policy-failed', publicMessage(error))
+      }
+    })()
+  }
+}
+
 /**
  * Attach optional Web routes whenever a webServer service is present.
  * @param ctx - plugin context owning route effects.
  * @param backend - Settings handler.
  * @param artifacts - signed Artifact handler.
+ * @param pastedImages - pasted-image workspace handler.
+ * @param pastePolicy - paste-policy verdict resolver (sessionId, selection, modelLabel).
  */
 export function installVisionToolkitWeb(
   ctx: Context,
   backend: VisionToolkitWebBackend,
   artifacts: ArtifactAccessController,
   pastedImages: PastedImageBackend,
+  pastePolicy: (sessionId: string, selection?: PasteSelectionQuery, modelLabel?: string) => Promise<PasteVerdict>,
 ): void {
   ctx.inject(['webServer'], (webCtx) => {
     webCtx.effect(() => {
@@ -383,7 +459,13 @@ export function installVisionToolkitWeb(
         path: PASTE_IMAGES_ROUTE,
         handler: (req, res) => pastedImages.handle(req, res),
       })
+      const disposePastePolicy = webCtx.webServer.register({
+        kind: 'exact',
+        path: PASTE_POLICY_ROUTE,
+        handler: createPastePolicyHandler(pastePolicy),
+      })
       return () => {
+        disposePastePolicy()
         disposePasteImages()
         disposeSettings()
         disposeArtifact()