@anionex/dsh-vision-toolkit 0.1.7 → 0.1.9

package/src/index.ts

@@ -21,6 +21,7 @@ import {
   type VisionToolkitConfig,
 } from './config.ts'
 import { VisionToolExposure } from './exposure.ts'
+import { createPasteTakeoverResolver, installImageInputVariants } from './image-input-variants.ts'
 import { VisionToolkitRuntimeManager } from './runtime-manager.ts'
 import { VISION_TOOLS_SKILL } from './skill.ts'
 import { createVisionTools } from './tools.ts'
@@ -98,11 +99,27 @@ export async function apply(ctx: Context, config: VisionToolkitConfig = {}): Pro
   const pastedImages = new PastedImageBackend(ctx, {
     maxImageBytes: () => manager.status().activeConfig?.maxImageBytes ?? resolveConfig(settings.get()).maxImageBytes,
   })
-  installVisionToolkitWeb(ctx, backend, artifacts, pastedImages)
+  // Image-input variants register asynchronously once eligible routes exist;
+  // the runtime getter stays lazy so variants appear even when the runtime
+  // becomes ready after the first sweep.
+  const variants = installImageInputVariants(
+    ctx,
+    () => resolveConfig(settings.get()),
+    () => manager.ready ? manager.current() : undefined,
+  )
+  installVisionToolkitWeb(
+    ctx,
+    backend,
+    artifacts,
+    pastedImages,
+    createPasteTakeoverResolver(ctx, () => resolveConfig(settings.get())),
+  )
+  disposers.push(variants.dispose)
   disposers.push(settings.watch(async (next) => {
     try {
       await manager.reconfigure(next)
       ensureOperational()
+      variants.reconcile()
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
       ctx.logger.error('dsh-vision-toolkit: keeping the previous runtime after a refused Settings generation. %s', message)

package/src/paste-images.ts

@@ -11,6 +11,45 @@ import { sameOriginPost } from './web-request.ts'
 /** Exact route used by the browser paste integration. */
 export const PASTE_IMAGES_ROUTE = '/_dsh/vision-toolkit/paste-images'
 
+/**
+ * Exact route the browser paste integration asks before taking a paste over:
+ * `GET ?sessionId=&model=&provider=&modelId=` answers the verdict from the
+ * live Session's model route.
+ */
+export const PASTE_POLICY_ROUTE = '/_dsh/vision-toolkit/paste-policy'
+
+/**
+ * One exact model route the browser should switch the Session to before the
+ * native attachment flow: the image-input variant of the current text-only
+ * model. The variant declares image input, so the paste keeps the composer
+ * thumbnail and the durable session image.
+ */
+export interface PasteSwitchRoute {
+  /** The variant provider route (`vision-toolkit-` + upstream provider id). */
+  provider: string
+  /** The model id, identical to the upstream text-only model's id. */
+  model: string
+  /** The variant's selector display name (upstream name + variant suffix). */
+  label: string
+  /** The upstream reasoning effort, when the selection carries one. */
+  reasoningEffort?: string
+}
+
+/** The exact model route the browser read from the live model catalog. */
+export interface PasteSelectionQuery {
+  provider: string
+  model: string
+  reasoningEffort?: string
+}
+
+/** The paste-policy answer for one Session and model route. */
+export interface PasteVerdict {
+  /** Whether the browser should turn the paste into workspace paths instead of attachments. */
+  takeOver: boolean
+  /** When present, the browser switches to this route first, then lets the paste flow natively. */
+  autoSwitch?: PasteSwitchRoute
+}
+
 const MAX_NAME_BYTES = 180
 
 interface PasteImageResponse {

package/src/runtime.ts

@@ -9,6 +9,7 @@
 import { createHash, randomUUID } from 'node:crypto'
 import { readFile, rm, stat, writeFile } from 'node:fs/promises'
 import { basename, extname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import type { Context } from '@deepseek-ai/cordis'
 import type { ResolvedCredential } from '@deepseek-ai/dsh-credentials'
 import { SaxesParser } from 'saxes'
@@ -49,6 +50,8 @@ import {
 import { PLUGIN_VERSION } from './version.ts'
 
 const SVG_NAMESPACE = 'http://www.w3.org/2000/svg'
+const VISION_MODEL_TEST_IMAGE = fileURLToPath(new URL('../assets/vision-model-test.png', import.meta.url))
+const VISION_MODEL_TEST_PROMPT = 'This is an explicit service readiness test. Reply with one short sentence confirming that you received the image.'
 
 function svgDocumentPathCount(svg: string): number | undefined {
   const parser = new SaxesParser({ xmlns: true })
@@ -444,9 +447,11 @@ export interface VisionToolkitHealthResult {
     artifactDirectory: HealthCheck
     tempDirectory: HealthCheck
     service: HealthCheck
+    model: HealthCheck
   }
   healthy: boolean
   connectionTested: boolean
+  modelTested: boolean
 }
 
 /** Shared per-call execution options. */
@@ -764,6 +769,10 @@ export class VisionToolkitRuntime {
         `credential ${this.config.provider.credential} is not configured; set it through DSH credentials`,
       )
     }
+    return this.visionEnv(resolved)
+  }
+
+  private visionEnv(resolved: ResolvedCredential): UpstreamEnvironment {
     return {
       VISION_API_KEY: resolved.value,
       VISION_BASE_URL: this.config.provider.baseUrl,
@@ -1690,8 +1699,8 @@ export class VisionToolkitRuntime {
     }
   }
 
-  /** health: inspect local readiness and optionally probe the configured `/models` endpoint. */
-  async health(testConnection: boolean, options: ToolCallOptions): Promise<VisionToolkitHealthResult> {
+  /** Health: inspect local readiness, optionally probe `/models`, and explicitly test one real multimodal request. */
+  async health(testConnection: boolean, options: ToolCallOptions, testModel = false): Promise<VisionToolkitHealthResult> {
     return this.runOperation('vision_toolkit_health', options, async (operation) => {
       const info = this.upstreamVersion
       const python: HealthCheck = { status: 'ok', detail: `${info.pythonVersion} via ${info.python}` }
@@ -1733,6 +1742,10 @@ export class VisionToolkitRuntime {
         status: 'not_tested',
         detail: 'Connection was not tested; pass testConnection=true to query the configured /models endpoint',
       }
+      let model: HealthCheck = {
+        status: 'not_tested',
+        detail: 'Vision model was not tested; run an explicit model test to send the bundled diagnostic image',
+      }
       if (testConnection) {
         if (resolvedCredential === undefined) {
           service = { status: 'error', detail: 'Connection test skipped because the configured credential is unavailable' }
@@ -1775,7 +1788,32 @@ export class VisionToolkitRuntime {
           }
         }
       }
-      const checks = { python, dependencies, chrome, credential, artifactDirectory, tempDirectory, service }
+      if (testModel) {
+        if (resolvedCredential === undefined) {
+          model = { status: 'error', detail: 'Vision model test skipped because the configured credential is unavailable' }
+        } else {
+          try {
+            const result = await this.runUpstream(
+              'glance',
+              [VISION_MODEL_TEST_IMAGE, '-q', VISION_MODEL_TEST_PROMPT],
+              operation,
+              this.visionEnv(resolvedCredential),
+            )
+            if (result.stdout.trim().length === 0) {
+              throw new VisionToolkitError('output', 'glance: vision API returned an empty description')
+            }
+            model = {
+              status: 'ok',
+              detail: `Vision model ${this.config.provider.model} completed a multimodal request`,
+            }
+          } catch (error) {
+            if (operation.signal.aborted) throw error
+            const detail = error instanceof Error ? error.message : String(error)
+            model = { status: 'error', detail: `Vision model test failed: ${detail.slice(0, 600)}` }
+          }
+        }
+      }
+      const checks = { python, dependencies, chrome, credential, artifactDirectory, tempDirectory, service, model }
       const healthy = Object.values(checks).every(check => check.status !== 'error')
       return {
         pluginVersion: PLUGIN_VERSION,
@@ -1783,6 +1821,7 @@ export class VisionToolkitRuntime {
         checks,
         healthy,
         connectionTested: testConnection,
+        modelTested: testModel,
       }
     })
   }

package/src/web-request.ts

@@ -1,7 +1,12 @@
 import type { IncomingMessage } from 'node:http'
 
-/** Accept state-changing requests only from the DSH Web application's origin. */
-export function sameOriginPost(req: IncomingMessage): boolean {
+/**
+ * Accept a request only from the DSH Web application's origin. Method-agnostic:
+ * the same fence guards state-changing POSTs and policy GETs.
+ * @param req - the incoming request whose headers carry the origin evidence.
+ * @returns whether the request may be answered.
+ */
+export function sameOriginRequest(req: IncomingMessage): boolean {
   const fetchSite = req.headers['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
   const origin = req.headers.origin
@@ -15,3 +20,8 @@ export function sameOriginPost(req: IncomingMessage): boolean {
     return false
   }
 }
+
+/** Accept state-changing requests only from the DSH Web application's origin. */
+export function sameOriginPost(req: IncomingMessage): boolean {
+  return sameOriginRequest(req)
+}

package/src/web.ts

@@ -13,7 +13,13 @@ import { SettingsConflictError, type SettingsDescriptor } from '@deepseek-ai/dsh
 // Type-only import activates the optional webServer Context declaration.
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import { ArtifactAccessController, ARTIFACT_ROUTE_PREFIX } from './artifact-access.ts'
-import { PastedImageBackend, PASTE_IMAGES_ROUTE } from './paste-images.ts'
+import {
+  PastedImageBackend,
+  PASTE_IMAGES_ROUTE,
+  PASTE_POLICY_ROUTE,
+  type PasteSelectionQuery,
+  type PasteVerdict,
+} from './paste-images.ts'
 import {
   resolveConfig,
   VISION_TOOLKIT_SETTINGS_NAMESPACE,
@@ -27,7 +33,7 @@ import {
   type RuntimeManagerStatus,
 } from './runtime-manager.ts'
 import { PLUGIN_VERSION, UPSTREAM_COMMIT, UPSTREAM_REPOSITORY, UPSTREAM_VERSION } from './version.ts'
-import { sameOriginPost } from './web-request.ts'
+import { sameOriginPost, sameOriginRequest } from './web-request.ts'
 
 /** Exact route used by the browser Settings page. */
 export const SETTINGS_ROUTE = '/_dsh/vision-toolkit/settings'
@@ -68,6 +74,7 @@ interface SaveRequest {
 interface HealthRequest {
   action: 'health'
   testConnection: boolean
+  testModel: boolean
 }
 
 interface CredentialRequest {
@@ -150,7 +157,10 @@ function parseRequest(value: unknown): SettingsRequest {
   if (!isRecord(value) || typeof value.action !== 'string') throw new TypeError('request action is required')
   if (value.action === 'health') {
     if (typeof value.testConnection !== 'boolean') throw new TypeError('health.testConnection must be boolean')
-    return { action: 'health', testConnection: value.testConnection }
+    const testModel = value.testModel === undefined ? false : value.testModel
+    if (typeof testModel !== 'boolean') throw new TypeError('health.testModel must be boolean')
+    if (testModel && !value.testConnection) throw new TypeError('health.testModel requires health.testConnection')
+    return { action: 'health', testConnection: value.testConnection, testModel }
   }
   if (value.action === 'save') {
     if (!Number.isSafeInteger(value.expectedRevision) || (value.expectedRevision as number) < 0) {
@@ -288,7 +298,7 @@ export class VisionToolkitWebBackend {
         signal: controller.signal,
         workspace: process.cwd(),
         sessionId: 'vision-toolkit-settings',
-      })
+      }, request.testModel)
     } finally {
       req.off('aborted', abort)
       req.socket.off('close', abort)
@@ -353,17 +363,87 @@ export class VisionToolkitWebBackend {
   }
 }
 
+/**
+ * Same-origin policy handler for the paste route: whether the browser should
+ * take a paste over into workspace paths, or let it flow natively after an
+ * optional automatic switch to the image-input variant. The optional `model`
+ * query carries the model-selector label the client currently shows; the
+ * optional `provider`/`modelId`/`reasoningEffort` queries carry the exact
+ * route the client read from the live model catalog, which the resolver
+ * prefers (a label alone cannot pick a provider). Unresolvable routes answer
+ * native — the safe default.
+ * @param resolve - resolves one live Session's paste verdict.
+ * @returns the HTTP handler.
+ */
+export function createPastePolicyHandler(
+  resolve: (sessionId: string, selection?: PasteSelectionQuery, modelLabel?: string) => Promise<PasteVerdict>,
+): (req: IncomingMessage, res: ServerResponse) => void {
+  return (req, res) => {
+    void (async () => {
+      try {
+        if (req.method !== 'GET') {
+          requestError(res, 405, 'method-not-allowed', 'Use GET')
+          return
+        }
+        if (!sameOriginRequest(req)) {
+          requestError(res, 403, 'origin-rejected', 'The request must originate from this DSH Web application')
+          return
+        }
+        let sessionId: string
+        let modelLabel: string | undefined
+        let selection: PasteSelectionQuery | undefined
+        try {
+          const url = new URL(req.url ?? PASTE_POLICY_ROUTE, 'http://dsh.internal')
+          const sessions = url.searchParams.getAll('sessionId')
+          if (sessions.length !== 1 || sessions[0] === undefined || sessions[0] === '') {
+            throw new TypeError('sessionId is required exactly once')
+          }
+          sessionId = sessions[0]!
+          const models = url.searchParams.getAll('model')
+          if (models.length > 1) throw new TypeError('model may be given at most once')
+          modelLabel = models[0]
+          const providers = url.searchParams.getAll('provider')
+          if (providers.length > 1) throw new TypeError('provider may be given at most once')
+          const modelIds = url.searchParams.getAll('modelId')
+          if (modelIds.length > 1) throw new TypeError('modelId may be given at most once')
+          const efforts = url.searchParams.getAll('reasoningEffort')
+          if (efforts.length > 1) throw new TypeError('reasoningEffort may be given at most once')
+          const provider = providers[0]
+          const modelId = modelIds[0]
+          if (provider !== undefined && modelId !== undefined && provider !== '' && modelId !== '') {
+            selection = {
+              provider,
+              model: modelId,
+              ...(efforts[0] === undefined || efforts[0] === '' ? {} : { reasoningEffort: efforts[0] }),
+            }
+          }
+        } catch (error) {
+          requestError(res, 400, 'invalid-request', publicMessage(error))
+          return
+        }
+        const verdict = await resolve(sessionId, selection, modelLabel)
+        responseJson(res, 200, { ok: true, value: verdict })
+      } catch (error) {
+        requestError(res, 500, 'policy-failed', publicMessage(error))
+      }
+    })()
+  }
+}
+
 /**
  * Attach optional Web routes whenever a webServer service is present.
  * @param ctx - plugin context owning route effects.
  * @param backend - Settings handler.
  * @param artifacts - signed Artifact handler.
+ * @param pastedImages - pasted-image workspace handler.
+ * @param pastePolicy - paste-policy verdict resolver (sessionId, selection, modelLabel).
  */
 export function installVisionToolkitWeb(
   ctx: Context,
   backend: VisionToolkitWebBackend,
   artifacts: ArtifactAccessController,
   pastedImages: PastedImageBackend,
+  pastePolicy: (sessionId: string, selection?: PasteSelectionQuery, modelLabel?: string) => Promise<PasteVerdict>,
 ): void {
   ctx.inject(['webServer'], (webCtx) => {
     webCtx.effect(() => {
@@ -383,7 +463,13 @@ export function installVisionToolkitWeb(
         path: PASTE_IMAGES_ROUTE,
         handler: (req, res) => pastedImages.handle(req, res),
       })
+      const disposePastePolicy = webCtx.webServer.register({
+        kind: 'exact',
+        path: PASTE_POLICY_ROUTE,
+        handler: createPastePolicyHandler(pastePolicy),
+      })
       return () => {
+        disposePastePolicy()
         disposePasteImages()
         disposeSettings()
         disposeArtifact()