@liustack/modlens 3.17.0 → 3.17.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 3.17.2 - 2026-08-16
+
+- **dsh: reasoning blocks come back on the `(modlens vision)` models ([#49](https://github.com/liustack/modlens/issues/49)).** Sessions routed through a wrapper model lost the model's reasoning blocks and wrote the chain of thought straight into the answer text, measured by the reporter at roughly 57% of turns against a 1% baseline on the identical upstream route, and fixed the instant the session switched back. Nothing was wrong with the messages, which is why passing them through unchanged looked correct: dsh removes an assistant message's adapter-private replay state whenever the provider recorded on that message belongs to a different adapter instance than the one about to run, and a wrapper is a different instance by construction. That state is what carries reasoning continuity, so every turn the wrapper had produced arrived upstream without it, and the longer the conversation the more turns were affected. The copy sent over the wire now names upstream as the source of the turns upstream actually produced. The durable session log keeps the wrapper id, so the UI and the model selector still show the route you picked. This applies only where the wrapper id proves which upstream made those turns, which is what auto-discovery's `modlens-<provider>` naming does; a hand-configured upstream under some other id could be repointed between runs, and relabelling there would hand one adapter another adapter's private state, so it is left alone. Thanks to @mmyhj, who measured it across three sessions before and after the switch rather than reporting an impression.
+
+## 3.17.1 - 2026-08-16
+
+- **A model that closes its JSON early no longer fails the whole read ([#45](https://github.com/liustack/modlens/issues/45)).** On the `openai` route, qwen3-vl intermittently ends the object after `semantics`, keeps writing the fields it still owed, and adds a stray quote. Extraction sliced from the first `{` to the last `}`, so it swallowed the fragment and failed, and the read died as `non-JSON output`, which reads exactly like a truncation. Extraction now walks the braces with string literals and escapes accounted for and keeps the largest top-level balanced span that parses, so the recoverable object comes back and the schema check names the fields that are genuinely missing. The old first-brace-to-last-brace slice still runs first, so nothing it already read correctly changes. When nothing parses, the error stops guessing why: `finish_reason=length` points at `max_tokens`, a `stop` points at `openai.structuredOutput`, and anything else (`content_filter`, a gateway's own reason) is reported as the gateway's own early ending rather than described as normal. Errors about how output ended now show the end of it rather than the opening. Thanks to @abyss-stars, who captured the raw response through a proxy and came back to verify which half was still broken.
+- **A private endpoint can no longer reach your terminal through a gateway error.** Every error quoting model or gateway output is now redacted against both the configured key and the configured `baseUrl`, and redacted before it is clipped rather than after: a clip landing inside a hostname left nothing for an exact match to find. This covers the HTTP error body, the model content, the schema mismatch, and a `finish_reason` the gateway invented. The body previously masked only the key, so a private gateway hostname reached terminals, CI logs, and failover warnings.
+
 ## 3.17.0 - 2026-08-16
 
 - **Breaking: a provider takes its settings from one place, whole ([#42](https://github.com/liustack/modlens/issues/42)).** `GEMINI_API_KEY`, `OPENAI_API_KEY`, `OPENAI_BASE_URL`, `ANTHROPIC_API_KEY` and `ANTHROPIC_BASE_URL` used to override `~/.modlens/config.json` field by field. The reported failure was a configured Kimi endpoint answering 401, and the reason is worth stating precisely: a baseUrl and an apiKey are one credential, so taking the endpoint from the file and the key from an ambient variable built a pairing that existed in neither place, and nothing in the error named the environment as the source. Merging the other way round keeps that shape, which is why this is not a change of precedence: name a provider in the config file and the file is its source, name nothing and the environment is. A container or CI job that only exports variables keeps working exactly as before, both halves still matching. What changes is the mixture. If the file configures a provider and you were completing it from the environment, put the rest in the file: a key variable becomes `modlens config set <provider>.apiKey` at the hidden prompt, an endpoint variable becomes `modlens config set <provider>.baseUrl "$THE_VARIABLE"` (`$env:THE_VARIABLE` in PowerShell), and until you do, a run that names such a provider refuses with that exact command rather than quietly using the vendor's own endpoint. Naming a provider is about the key existing, not what it holds: an entry emptied down to `{}` still takes that provider off its variables, since the alternative is a file you edited quietly handing the provider back to the environment. `modlens config show` and `modlens doctor` label each provider with the source actually in effect. `MODLENS_MODEL`, `MODLENS_HARNESS` and the `HTTPS_PROXY` family are untouched: none is a credential, and none can be split from a matching half. This also defuses the documented `ANTHROPIC_BASE_URL` trap, where a shell that routed Claude Code through a text-only gateway silently sent vision requests there too. Thanks to @StarChen-Cycler for a report that arrived with the mechanism, a deterministic repro in both directions, and a patch.

package/README.md

@@ -34,7 +34,7 @@ Issues are welcome any time: [open one](https://github.com/liustack/modlens/issu
 
 ## Highlights
 
-**🥇 The first vision plugin for DeepSeek Harness (dsh):** one command, `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.0`, and the text-only DeepSeek model behind dsh reads images through a native `modlens_read_image` tool. Updating is the same command again. The version is named rather than `@latest` on purpose: pnpm 11 holds back releases published in the last 24 hours and resolves the tag against what survives, so `@latest` would install whatever shipped a day ago ([details](docs/harness-setup.md#keeping-it-up-to-date)).
+**🥇 The first vision plugin for DeepSeek Harness (dsh):** one command, `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.2`, and the text-only DeepSeek model behind dsh reads images through a native `modlens_read_image` tool. Updating is the same command again. The version is named rather than `@latest` on purpose: pnpm 11 holds back releases published in the last 24 hours and resolves the tag against what survives, so `@latest` would install whatever shipped a day ago ([details](docs/harness-setup.md#keeping-it-up-to-date)).
 
 Pasting an image works two ways. **① Just paste.** On a text-only model the pasted image lands as a private temp file and its path enters the composer — the same interaction OpenCode and Pi ship — and the `modlens_read_image` tool takes it from there. **② Pick a `(modlens vision)` entry** in the model selector (it remembers your choice, so once is enough), then paste: the thumbnail stays visible in your message, closer to the Codex app feel, and the image is converted to structured evidence at request time, answered by the same underlying route. The plugin auto-discovers every provider route carrying text-only DeepSeek or GLM models and adds a wrapped entry per route (a stock install gets **`DeepSeek-V4-Flash (modlens vision)`** and **`DeepSeek-V4-Pro (modlens vision)`**; extra routes like opencode-go or zai get their own); the two families' own vision models are excluded automatically. Which paste route applies is the host's per-model call: only a model its metadata positively confirms text-only is taken over, anything unconfirmed is left alone, so vision models keep their native paste ([details](docs/harness-setup.md)).
 
@@ -165,6 +165,13 @@ npx -y skills add liustack/vibemaster -g
 
 ⭐ If it helps, star [ModLens](https://github.com/liustack/modlens) and [VibeMaster](https://github.com/liustack/vibemaster). Stars are how the next developer finds them.
 
+## Key ecosystem partners
+
+The projects worth recommending in the DeepSeek Harness ecosystem.
+
+- 🛒 **[dsh-market](https://github.com/dsh-market/dsh-market)** — The plugin market inside DeepSeek Harness. Browse 800+ community plugins with category filters and screenshot previews, one-click install and update, and live theme switching. Most need no restart.
+  DeepSeek Harness 的可视化插件市场。设置页里直接逛社区全部 800+ 插件：分类筛选、截图预览、一键安装与更新、主题即点即换，装完多数免重启。
+
 ## Star History
 
 <a href="https://www.star-history.com/?repos=liustack%2Fmodlens&type=date&legend=top-left">

package/README.zh-CN.md

@@ -34,7 +34,7 @@ DeepSeek 和 GLM 的主力对话模型是纯文本的，无法进行图片识别
 
 ## 亮点
 
-**🥇 全网第一个支持 DeepSeek Harness（dsh）的外挂视觉识别插件：**一条命令 `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.0`，dsh 背后的纯文本 DeepSeek 模型即可通过原生 `modlens_read_image` 工具读图。更新就是再跑一遍同一条命令。这里点名版本号而不用 `@latest` 是有意的：pnpm 11 会扣住最近 24 小时内发布的版本，dist-tag 只在剩下的里面解析，用 `@latest` 装到的会是一天前发布的那个（[细节](docs/harness-setup.zh-CN.md#保持更新)）。
+**🥇 全网第一个支持 DeepSeek Harness（dsh）的外挂视觉识别插件：**一条命令 `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.2`，dsh 背后的纯文本 DeepSeek 模型即可通过原生 `modlens_read_image` 工具读图。更新就是再跑一遍同一条命令。这里点名版本号而不用 `@latest` 是有意的：pnpm 11 会扣住最近 24 小时内发布的版本，dist-tag 只在剩下的里面解析，用 `@latest` 装到的会是一天前发布的那个（[细节](docs/harness-setup.zh-CN.md#保持更新)）。
 
 DeepSeek Harness 粘贴识图有两种玩法。
 
@@ -69,7 +69,7 @@ agy                                                           # 浏览器完成
 **DeepSeek Harness（dsh）用户不走 skill 流程**，本包就是原生 dsh 插件：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.2
 ```
 
 装完即有 `modlens_read_image` 工具，选「(modlens vision)」模型变体即可直接粘贴识图。引擎配置同样在 `~/.modlens`，详见[宿主接入](docs/harness-setup.zh-CN.md)。
@@ -177,6 +177,13 @@ Codex 桌面 App 中识别一张推文截图。作者、配文、照片内容（
 
 ⭐ 如果它对你有用，请给 [ModLens](https://github.com/liustack/modlens) 一个 star，这是其他开发者找到它的方式。
 
+## 重要生态伙伴
+
+DeepSeek Harness 生态里最值得推荐的项目。
+
+- 🛒 **[dsh-market](https://github.com/dsh-market/dsh-market)** — DeepSeek Harness 的可视化插件市场。设置页里直接逛社区全部 800+ 插件：分类筛选、截图预览、一键安装与更新、主题即点即换，装完多数免重启。
+  The plugin market inside DeepSeek Harness. Browse 800+ community plugins with category filters and screenshot previews, one-click install and update, and live theme switching. Most need no restart.
+
 ## Star History
 
 <a href="https://www.star-history.com/?repos=liustack%2Fmodlens&type=date&legend=top-left">

package/dist/main.js

@@ -773,13 +773,62 @@ function parseBraceSlice(trimmed) {
   const first = trimmed.indexOf("{");
   const last = trimmed.lastIndexOf("}");
   if (first >= 0 && last > first) {
-    return tryParseJson(trimmed.slice(first, last + 1));
+    const whole = tryParseJson(trimmed.slice(first, last + 1));
+    if (whole !== null) {
+      return whole;
+    }
+  }
+  return parseLongestBalancedObject(trimmed);
+}
+function parseLongestBalancedObject(text) {
+  const spans = [];
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+    } else if (char === "{") {
+      if (depth === 0) {
+        start = i;
+      }
+      depth++;
+    } else if (char === "}") {
+      if (depth > 0) {
+        depth--;
+        if (depth === 0 && start >= 0) {
+          spans.push([start, i + 1]);
+          start = -1;
+        }
+      }
+    }
+  }
+  for (const [from, to] of spans.sort((a, b) => b[1] - b[0] - (a[1] - a[0]))) {
+    const parsed = tryParseJson(text.slice(from, to));
+    if (parsed !== null) {
+      return parsed;
+    }
   }
   return null;
 }
 function truncate(text, max = 300) {
   return text.length > max ? `${text.slice(0, max)}...` : text;
 }
+function tail(text, max = 300) {
+  return text.length > max ? `...${text.slice(-max)}` : text;
+}
 function parseExtraBody(raw, origin) {
   const parsed = parseJsonOrExplain(raw, origin);
   if (!isPlainObject(parsed)) {
@@ -1429,11 +1478,10 @@ ${JSON_TEMPLATE_INSTRUCTION}`;
     },
     options.settings?.proxy
   );
+  const quote = (shown, clip = truncate) => clip(redactSecrets(shown, [apiKey, baseUrl]));
   if (!response.ok) {
     const body = await response.text();
-    throw new Error(
-      `OpenAI-compatible API error ${response.status}: ${truncate(redactSecrets(body, [apiKey]))}`
-    );
+    throw new Error(`OpenAI-compatible API error ${response.status}: ${quote(body)}`);
   }
   const payload = await response.json();
   const text = payload.choices?.[0]?.message?.content;
@@ -1442,13 +1490,17 @@ ${JSON_TEMPLATE_INSTRUCTION}`;
   }
   const rawResult = extractJson(text);
   if (rawResult === null) {
-    throw new Error(`OpenAI-compatible API returned non-JSON output: ${truncate(text)}`);
+    const finishReason = payload.choices?.[0]?.finish_reason;
+    const advice = finishReason === "length" ? `The answer was cut off (finish_reason=length). Raise the limit, e.g. modlens config set openai.extraBody '{"max_tokens":4096}'.` : finishReason === void 0 || finishReason === "stop" ? "The answer ended normally but no complete JSON object could be read from it. Ask the gateway to enforce the shape: modlens config set openai.structuredOutput true." : `The gateway ended the answer with finish_reason=${quote(finishReason, (t) => truncate(t, 80))}, so it may be incomplete for a reason of its own. Check what that reason means for this endpoint before changing the request.`;
+    throw new Error(
+      `OpenAI-compatible API returned non-JSON output. ${advice} Output ended with: ${quote(text, tail)}`
+    );
   }
   const result = normalizeVisionResult(rawResult);
   const missing = missingSchemaFields(result);
   if (missing.length > 0) {
     throw new Error(
-      `OpenAI-compatible API returned JSON that does not match the vision schema (wrong or missing: ${missing.join(", ")}). Retry, or switch to gemini-api / anthropic for enforced schemas. Got: ${truncate(text)}`
+      `OpenAI-compatible API returned JSON that does not match the vision schema (wrong or missing: ${missing.join(", ")}). Retry, or switch to gemini-api / anthropic for enforced schemas. Got: ${quote(text)}`
     );
   }
   return {
@@ -3565,11 +3617,11 @@ function readWindowedLines(file, maxBytes = WINDOW_BYTES) {
     }
     const head = Buffer.alloc(maxBytes);
     fs.readSync(fd, head, 0, maxBytes, 0);
-    const tail = Buffer.alloc(maxBytes);
-    fs.readSync(fd, tail, 0, maxBytes, size - maxBytes);
+    const tail2 = Buffer.alloc(maxBytes);
+    fs.readSync(fd, tail2, 0, maxBytes, size - maxBytes);
     const headLines = head.toString("utf-8").split("\n");
     headLines.pop();
-    const tailLines = tail.toString("utf-8").split("\n");
+    const tailLines = tail2.toString("utf-8").split("\n");
     tailLines.shift();
     return [...headLines, ...tailLines];
   } catch {
@@ -4366,7 +4418,7 @@ function parsePositiveInt(raw, flag) {
   }
   return Number.parseInt(raw, 10);
 }
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.17.0");
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.17.2");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`
@@ -4476,7 +4528,7 @@ program.command("doctor").description(
       configPath: CONFIG_PATH,
       // Lets doctor name an installed skill copy that is older than
       // the CLI reporting on it (issue #33).
-      version: "3.17.0"
+      version: "3.17.2"
     });
     const output = options.json ? JSON.stringify(report, null, 2) : renderDoctorReport(report);
     process.stdout.write(`${output}

package/docs/harness-setup.md

@@ -55,7 +55,7 @@ OpenCode with DeepSeek: `opencode auth login`, pick DeepSeek and paste the key (
 dsh is different from the other harnesses: modlens plugs in as a native tool, not a prompt-triggered skill. The package itself is a dsh bundle, so one command installs it into a profile:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.2
 ```
 
 This registers a `modlens_read_image` tool whose schema reaches the model on every request (no trigger heuristics), runs the modlens CLI shipped inside the same package, and returns the structured evidence as the tool's canonical JSON output. Engines, reuse grants, and guard rules stay in `~/.modlens/config.json`, shared with every other harness. dsh is in developer preview and its plugin surface may change; the plugin keeps its touch small (raw tool registration, the llm adapter surface for the vision variants, the attachment reader, and one agent pre-step hook) and degrades loudly if any of them moves.
@@ -81,7 +81,7 @@ modlens ships often, and both install shapes freeze at whatever version they
 got. On dsh, re-run the install with the version named:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.2
 ```
 
 `npm view @liustack/modlens version` prints the current one, and this page is

package/docs/harness-setup.zh-CN.md

@@ -55,7 +55,7 @@ OpenCode 接 DeepSeek：执行 `opencode auth login`，选择 DeepSeek 并粘贴
 dsh 与其他 harness 不同：modlens 以原生工具的形式接入，而不是靠提示词触发的 skill。本包自身就是一个 dsh bundle，一条命令即可装进某个 profile：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.17.2
 ```
 
 这会注册一个 `modlens_read_image` 工具，它的 schema 随每次请求抵达模型（不靠触发启发式），运行同一个包里自带的 modlens CLI，并把结构化证据作为工具的标准 JSON 输出返回。引擎、复用授权和 guard 规则仍在 `~/.modlens/config.json` 里，与其他所有 harness 共享。dsh 还在开发者预览阶段，插件接口可能变化。这个插件刻意保持很小的接触面（原生工具注册、视觉变体所用的 llm 适配层、附件读取器，以及一个 agent 执行前钩子），其中任何一处变动，它都会大声报错而不是无声退化。
@@ -71,7 +71,7 @@ dsh 的网页用户面前没有终端，所以引擎设置有一张卡片，在*
 modlens 发布很频繁，而两种安装形态都会冻结在装进来的那个版本上。dsh 上重跑一遍安装即可，版本号要点名：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.2
 ```
 
 `npm view @liustack/modlens version` 可以查到当前版本号，本页的版本号则由发布流程自动写入。

package/docs/troubleshooting.md

@@ -163,7 +163,7 @@ simply lands on an older one. Name the exact version instead, which pnpm treats
 as a deliberate request rather than a resolution:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.2
 ```
 
 `npm view @liustack/modlens version` prints the current one. pnpm 11 installs a named
@@ -178,7 +178,7 @@ file:
 
 ```yaml
 minimumReleaseAgeExclude:
-  - '@liustack/modlens@3.17.0'
+  - '@liustack/modlens@3.17.2'
 ```
 
 Or lift the gate for a single command, which lifts it for everything that

package/docs/troubleshooting.zh-CN.md

@@ -144,7 +144,7 @@ dsh profile 装到的是旧版 modlens。`dsh.bundle` 声明从 3.9.0 起才存
 `@latest` 绕不开这一层，本页早先的说法是错的。冷静期先把候选版本过滤掉，dist-tag 才在剩下的里面解析，于是它直接落到了更旧的那个上。改成写死精确版本号，pnpm 会把它当作一次明确的指定，而不是一次解析：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.2
 ```
 
 `npm view @liustack/modlens version` 可以查到当前版本号。pnpm 11 会装上被点名的版本，11.1.3 起还会把它作为一条已批准的例外写进该 profile 的 `pnpm-workspace.yaml`，其余所有包和 modlens 以后的版本仍然留在窗口后面。
@@ -153,7 +153,7 @@ npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.17.0
 
 ```yaml
 minimumReleaseAgeExclude:
-  - '@liustack/modlens@3.17.0'
+  - '@liustack/modlens@3.17.2'
 ```
 
 或者只为这一条命令解除冷静期，注意它解除的是这条命令解析到的所有包，不只 modlens：

package/dsh/index.js

@@ -452,6 +452,58 @@ function registerPasteRoute(ctx, host, ownProviders) {
  *   deepseek-official wrap keeps its historical `deepseek-modlens` id, so a
  *   selector remembering that provider survives the upgrade.
  */
+/**
+ * Whether this wrapper id proves, by itself, which upstream produced the
+ * turns recorded under it.
+ *
+ * Auto-discovery mints `modlens-<upstream>` (and `deepseek-modlens` for
+ * `deepseek-official`), so the id carries its own provenance and cannot drift.
+ * A hand-configured `upstream` under some other id can be repointed between
+ * runs, and then history recorded under that id was produced by a provider
+ * that is no longer the one behind it. Relabelling there would hand one
+ * adapter another adapter's private replay state, which at best fails the
+ * request. Unprovable means no relabelling, so those setups keep exactly the
+ * behaviour they have today rather than gaining a worse one.
+ */
+function wrapperIdEncodes(wrapperId, upstream) {
+  return wrapperId === `modlens-${upstream}` || (wrapperId === 'deepseek-modlens' && upstream === 'deepseek-official')
+}
+
+/**
+ * Re-label our own turns as the upstream provider's before delegating.
+ *
+ * dsh drops an assistant message's adapter-private replayState whenever the
+ * provider recorded on that message belongs to a different adapter instance
+ * than the one about to run (LlmService.forAdapter, an identity comparison).
+ * This wrapper is a different instance by construction, so every turn it
+ * produced reached upstream stripped of the state that carries reasoning
+ * continuity, and the model answered without engaging thinking mode:
+ * reasoning blocks went missing and the chain of thought landed inline in the
+ * text (issue #49). Nothing about the message content differed, which is why
+ * passing messages through unchanged looked correct.
+ *
+ * Renaming is the truth rather than a trick, but only where the id proves it
+ * (see wrapperIdEncodes): these turns are upstream's own work, produced by
+ * upstream's adapter, and the replayState in them is upstream's to read. Only
+ * the copy going over the wire is relabelled. The durable session log keeps
+ * the wrapper id, so the UI and the model selector still show the chosen route.
+ */
+function restoreUpstreamSource(messages, wrapperId, upstream) {
+  if (!wrapperIdEncodes(wrapperId, upstream)) {
+    return messages
+  }
+  let changed = false
+  const out = messages.map((message) => {
+    const source = message?.source
+    if (message?.role !== 'assistant' || source?.kind !== 'model' || source.provider !== wrapperId) {
+      return message
+    }
+    changed = true
+    return { ...message, source: { ...source, provider: upstream } }
+  })
+  return changed ? out : messages
+}
+
 function registerVisionProvider(ctx, config, ownProviders) {
   // Wrap only the text-only members of these families. Their own vision
   // models (present or future: deepseek-vl/ocr/janus, glm-4.5v, glm-5v-...)
@@ -512,7 +564,8 @@ function registerVisionProvider(ctx, config, ownProviders) {
           // Cached per attachment, since the same history rides every step.
           const self = this
           return (async function* () {
-            const messages = await convertImagesToEvidence(ctx, options.messages, options.signal, self)
+            const converted = await convertImagesToEvidence(ctx, options.messages, options.signal, self)
+            const messages = restoreUpstreamSource(converted, providerId, upstream)
             yield* ctx.llm.stream({ ...options, provider: upstream, messages })
           })()
         },

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@liustack/modlens",
-    "version": "3.17.0",
+    "version": "3.17.2",
     "description": "Plug-in vision for text-only LLMs, powered by the free Antigravity CLI",
     "type": "module",
     "bin": {

package/skills/modlens/SKILL.md

@@ -20,11 +20,11 @@ powershell -ExecutionPolicy Bypass -File <skill-dir>\scripts\run.ps1 <args>
 
 It resolves a working runtime (PATH `modlens`, then `npx`, then `bunx`) and forwards your arguments unchanged. Exit 78 means no runtime: relay the `nextSteps` from its stderr JSON instead of retrying.
 
-If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.17.0):
+If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.17.2):
 
-1. A `modlens` on `PATH` whose major version is 3 and is at least 3.17.0: `modlens <args>`.
-2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.17.0 modlens <args>`.
-3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.17.0 <args>`.
+1. A `modlens` on `PATH` whose major version is 3 and is at least 3.17.2: `modlens <args>`.
+2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.17.2 modlens <args>`.
+3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.17.2 <args>`.
 4. Otherwise tell the user no JavaScript runtime was found and that installing Node 22.19+ (https://nodejs.org) or Bun (https://bun.sh) is the next step. Do not claim modlens itself failed.
 
 `references/runtime.md` documents the pin and the diagnostic fields.

package/skills/modlens/references/runtime.md

@@ -8,7 +8,7 @@ shell syntax.
 
 ## Pinned version
 
-- Pinned CLI version: 3.17.0
+- Pinned CLI version: 3.17.2
 - npm package: `@liustack/modlens`
 - CLI binary name: `modlens`
 

package/skills/modlens/scripts/run.ps1

@@ -24,7 +24,7 @@ $ErrorActionPreference = 'Stop'
 # package.json version, and the release script rewrites it on every bump.
 $Package = '@liustack/modlens'
 $Bin = 'modlens'
-$Pinned = '3.17.0'
+$Pinned = '3.17.2'
 # -------------------------------------------------------------------------------
 
 $NativeNote = 'no native artifact is published for this tool yet; phase A ships npm launch paths only'

package/skills/modlens/scripts/run.sh

@@ -22,7 +22,7 @@ set -eu
 # package.json version, and the release script rewrites it on every bump.
 PKG="@liustack/modlens"
 BIN="modlens"
-PINNED="3.17.0"
+PINNED="3.17.2"
 # -------------------------------------------------------------------------------
 
 NATIVE_NOTE="no native artifact is published for this tool yet; phase A ships npm launch paths only"