@liustack/modlens 3.20.0 → 3.21.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 3.21.0 - 2026-08-18
+
+- **Switching OpenAI-compatible gateways no longer costs a key ([#67](https://github.com/liustack/modlens/issues/67)).** The openai slot is the one slot users point at many different gateways, and switching meant overwriting `providers.openai` field by field, with the previous endpoint's key lost unless backed up by hand. `modlens config save openai <label>` snapshots the slot whole under a name; `modlens config use openai <label>` swaps a saved copy back in whole, never merged. A slot that no label holds refuses to be overwritten without `--discard`, so the silent key loss this exists to remove now takes saying so in as many words. The saved section is inert data: resolution, guards, the failover chain, and the environment bindings never read it, the effective view lists labels with keys masked, and older CLI versions carry it through their writes untouched. The issue's own proposal, named provider slots with a type field, was declined with reasons on the thread: it opens the closed provider registry every downstream consumer assumes, and reopens the mistyped-name trap 3.19.0 closed. Per-call routing and a dsh passthrough are likewise declined; endpoint choice stays user-owned configuration.
+
 ## 3.20.0 - 2026-08-18
 
 - **Windows: default-layout pnpm shims work ([#43](https://github.com/liustack/modlens/issues/43) closes for pnpm too).** pnpm with the isolated linker and `extendNodePath`, which is its default configuration, prepends a four-line NODE_PATH block to every shim, and the recogniser did not know the shape, so those shims were declined and still landed on the spawn `EINVAL` that 3.18.0 removed for npm. The block is now a recognised prefix of both pnpm shapes: the plan sets NODE_PATH to the hoisted directory when the child has none and prepends when it does, with cmd's own DEFINED semantics, and the directory value goes only into the child's environment, exactly where the shim itself puts it. Fixtures are verbatim generator output for the branch, multi-directory, and native forms. Found by the same review that shipped 3.19.0, which had recorded this as the known gap.

package/README.md

@@ -34,7 +34,7 @@ Issues are welcome any time: [open one](https://github.com/liustack/modlens/issu
 
 ## Highlights
 
-**🥇 The most capable vision plugin for DeepSeek Harness (dsh):** one command, `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.20.0`, and the text-only DeepSeek model behind dsh reads images through a native `modlens_read_image` tool. Updating is the same command again. The version is named rather than `@latest` on purpose: pnpm 11 holds back releases published in the last 24 hours and resolves the tag against what survives, so `@latest` would install whatever shipped a day ago ([details](docs/harness-setup.md#keeping-it-up-to-date)).
+**🥇 The most capable vision plugin for DeepSeek Harness (dsh):** one command, `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.21.0`, and the text-only DeepSeek model behind dsh reads images through a native `modlens_read_image` tool. Updating is the same command again. The version is named rather than `@latest` on purpose: pnpm 11 holds back releases published in the last 24 hours and resolves the tag against what survives, so `@latest` would install whatever shipped a day ago ([details](docs/harness-setup.md#keeping-it-up-to-date)).
 
 Pasting an image works two ways. **① Just paste.** On a text-only model the pasted image lands as a private temp file and its path enters the composer — the same interaction OpenCode and Pi ship — and the `modlens_read_image` tool takes it from there. **② Pick a `(modlens vision)` entry** in the model selector (it remembers your choice, so once is enough), then paste: the thumbnail stays visible in your message, closer to the Codex app feel, and the image is converted to structured evidence at request time, answered by the same underlying route. The plugin auto-discovers every provider route carrying text-only DeepSeek or GLM models and adds a wrapped entry per route (a stock install gets **`DeepSeek-V4-Flash (modlens vision)`** and **`DeepSeek-V4-Pro (modlens vision)`**; extra routes like opencode-go or zai get their own); the two families' own vision models are excluded automatically. Which paste route applies is the host's per-model call: only a model its metadata positively confirms text-only is taken over, anything unconfirmed is left alone, so vision models keep their native paste ([details](docs/harness-setup.md)).
 

package/README.zh-CN.md

@@ -34,7 +34,7 @@ DeepSeek 和 GLM 的主力对话模型是纯文本的，无法进行图片识别
 
 ## 亮点
 
-**🥇 全网最强的 DeepSeek Harness（dsh）外挂视觉识别插件：**一条命令 `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.20.0`，dsh 背后的纯文本 DeepSeek 模型即可通过原生 `modlens_read_image` 工具读图。更新就是再跑一遍同一条命令。这里点名版本号而不用 `@latest` 是有意的：pnpm 11 会扣住最近 24 小时内发布的版本，dist-tag 只在剩下的里面解析，用 `@latest` 装到的会是一天前发布的那个（[细节](docs/harness-setup.zh-CN.md#保持更新)）。
+**🥇 全网最强的 DeepSeek Harness（dsh）外挂视觉识别插件：**一条命令 `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.21.0`，dsh 背后的纯文本 DeepSeek 模型即可通过原生 `modlens_read_image` 工具读图。更新就是再跑一遍同一条命令。这里点名版本号而不用 `@latest` 是有意的：pnpm 11 会扣住最近 24 小时内发布的版本，dist-tag 只在剩下的里面解析，用 `@latest` 装到的会是一天前发布的那个（[细节](docs/harness-setup.zh-CN.md#保持更新)）。
 
 DeepSeek Harness 粘贴识图有两种玩法。
 
@@ -69,7 +69,7 @@ agy                                                           # 浏览器完成
 **DeepSeek Harness（dsh）用户不走 skill 流程**，本包就是原生 dsh 插件：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.20.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.21.0
 ```
 
 装完即有 `modlens_read_image` 工具，选「(modlens vision)」模型变体即可直接粘贴识图。引擎配置同样在 `~/.modlens`，详见[宿主接入](docs/harness-setup.zh-CN.md)。

package/dist/main.js

@@ -1770,6 +1770,9 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
       config2.providers[providerName][field] = value;
     }
   }
+  persistConfig(config2, configPath);
+}
+function persistConfig(config2, configPath) {
   fs.mkdirSync(path.dirname(configPath), { recursive: true });
   fs.writeFileSync(configPath, `${JSON.stringify(config2, null, 2)}
 `, { mode: 384 });
@@ -1778,6 +1781,79 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   } catch {
   }
 }
+const SAVED_LABEL = /^[a-z][a-z0-9-]*$/;
+function deepEqualJson(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((item, i) => deepEqualJson(item, b[i]));
+  }
+  if (a && b && typeof a === "object" && typeof b === "object") {
+    const ka = Object.keys(a).sort();
+    const kb = Object.keys(b).sort();
+    return ka.length === kb.length && ka.every(
+      (key, i) => key === kb[i] && deepEqualJson(
+        a[key],
+        b[key]
+      )
+    );
+  }
+  return false;
+}
+function savedSlotFor(slot) {
+  const folded = slot.trim().toLowerCase();
+  const canonical = providerAliases()[folded] ?? folded;
+  if (canonical !== "openai") {
+    throw new Error(
+      `Only the openai slot has saved copies; "${slot}" does not. It is the one slot users point at many different gateways.`
+    );
+  }
+  return canonical;
+}
+function saveProviderBundle(slot, label, configPath = CONFIG_PATH) {
+  const canonical = savedSlotFor(slot);
+  if (!SAVED_LABEL.test(label)) {
+    throw new Error(
+      `Labels are lowercase letters, digits and hyphens, starting with a letter: "${label}" is not.`
+    );
+  }
+  const config2 = loadConfigFile(configPath);
+  const snapshot = fileSettingsFor(canonical, config2);
+  if (Object.keys(snapshot).length === 0) {
+    throw new Error(
+      `Nothing to save: the ${canonical} slot is empty in ${configPath}. Configure it first (modlens config set openai.baseUrl <url>).`
+    );
+  }
+  config2.saved ??= {};
+  config2.saved[canonical] ??= {};
+  config2.saved[canonical][label] = snapshot;
+  persistConfig(config2, configPath);
+}
+function useProviderBundle(slot, label, discard = false, configPath = CONFIG_PATH) {
+  const canonical = savedSlotFor(slot);
+  const config2 = loadConfigFile(configPath);
+  const bundle = config2.saved?.[canonical]?.[label];
+  if (bundle === void 0) {
+    const known = Object.keys(config2.saved?.[canonical] ?? {}).sort();
+    throw new Error(
+      known.length === 0 ? `No saved copies exist for ${canonical} yet. Save the current one first: modlens config save openai <label>.` : `No saved copy named "${label}". Saved: ${known.join(", ")}.`
+    );
+  }
+  const current = fileSettingsFor(canonical, config2);
+  const currentSaved = Object.keys(current).length === 0 || Object.values(config2.saved?.[canonical] ?? {}).some(
+    (entry) => deepEqualJson(entry, current)
+  );
+  if (!currentSaved && !discard) {
+    throw new Error(
+      `The current ${canonical} settings are not saved under any label and would be lost. Save them first (modlens config save openai <label>) or pass --discard.`
+    );
+  }
+  for (const key of fileKeysFor(canonical, config2)) {
+    delete config2.providers?.[key];
+  }
+  config2.providers ??= {};
+  config2.providers[canonical] = { ...bundle };
+  persistConfig(config2, configPath);
+}
 function setGuardsValue(config2, field, value) {
   if (field === "denyModels" || field === "allowModels") {
     if (value.trim() === "") {
@@ -1866,6 +1942,22 @@ function renderEffectiveConfig(config2, env = process.env) {
   const effective = {
     providers
   };
+  const savedView = {};
+  for (const [slot, bundles] of Object.entries(config2.saved ?? {})) {
+    for (const label of Object.keys(bundles).sort()) {
+      const bundle = bundles[label];
+      const parts = [
+        bundle.model,
+        bundle.baseUrl,
+        bundle.apiKey !== void 0 ? `key ${maskKey(bundle.apiKey)}` : "no key"
+      ].filter(Boolean);
+      savedView[slot] ??= {};
+      savedView[slot][label] = parts.join(" @ ");
+    }
+  }
+  if (Object.keys(savedView).length > 0) {
+    effective.saved = savedView;
+  }
   if (config2.provider?.trim()) {
     effective.provider = config2.provider.trim();
   }
@@ -4654,7 +4746,7 @@ function parsePositiveInt(raw, flag) {
   }
   return Number.parseInt(raw, 10);
 }
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.20.0");
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.21.0");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`
@@ -4764,7 +4856,7 @@ program.command("doctor").description(
       configPath: CONFIG_PATH,
       // Lets doctor name an installed skill copy that is older than
       // the CLI reporting on it (issue #33).
-      version: "3.20.0"
+      version: "3.21.0"
     });
     const output = options.json ? JSON.stringify(report, null, 2) : renderDoctorReport(report);
     process.stdout.write(`${output}
@@ -4799,6 +4891,36 @@ config.command("init").description(`Create a starter config at ${CONFIG_PATH}`).
     process.exitCode = 1;
   }
 });
+config.command("save <slot> <label>").description(
+  "Snapshot a provider slot under a label (openai only), so switching gateways never loses a key"
+).action((slot, label) => {
+  try {
+    saveProviderBundle(slot, label);
+    process.stdout.write(`Saved the ${slot} slot as "${label}" in ${CONFIG_PATH}
+`);
+  } catch (error) {
+    process.stderr.write(
+      `Error: ${error instanceof Error ? error.message : String(error)}
+`
+    );
+    process.exitCode = 1;
+  }
+});
+config.command("use <slot> <label>").description(
+  "Replace a provider slot with a saved copy, whole. Refuses to drop unsaved settings without --discard"
+).option("--discard", "Overwrite the current slot even though it is not saved under any label").action((slot, label, options) => {
+  try {
+    useProviderBundle(slot, label, Boolean(options.discard));
+    process.stdout.write(`The ${slot} slot now holds "${label}" (${CONFIG_PATH})
+`);
+  } catch (error) {
+    process.stderr.write(
+      `Error: ${error instanceof Error ? error.message : String(error)}
+`
+    );
+    process.exitCode = 1;
+  }
+});
 config.command("set <key> [value]").description(
   "Set a value. Omit the value for an apiKey to enter it at a hidden prompt (out of argv and shell history), or to read one piped line (out of argv; the command feeding the pipe is yours to keep out of history)"
 ).action(async (key, value) => {

package/docs/harness-setup.md

@@ -55,7 +55,7 @@ OpenCode with DeepSeek: `opencode auth login`, pick DeepSeek and paste the key (
 dsh is different from the other harnesses: modlens plugs in as a native tool, not a prompt-triggered skill. The package itself is a dsh bundle, so one command installs it into a profile:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.20.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.21.0
 ```
 
 This registers a `modlens_read_image` tool whose schema reaches the model on every request (no trigger heuristics), runs the modlens CLI shipped inside the same package, and returns the structured evidence as the tool's canonical JSON output. Engines, reuse grants, and guard rules stay in `~/.modlens/config.json`, shared with every other harness. dsh is in developer preview and its plugin surface may change; the plugin keeps its touch small (raw tool registration, the llm adapter surface for the vision variants, the attachment reader, and one agent pre-step hook) and degrades loudly if any of them moves.
@@ -81,7 +81,7 @@ modlens ships often, and both install shapes freeze at whatever version they
 got. On dsh, re-run the install with the version named:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.20.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.21.0
 ```
 
 `npm view @liustack/modlens version` prints the current one, and this page is

package/docs/harness-setup.zh-CN.md

@@ -55,7 +55,7 @@ OpenCode 接 DeepSeek：执行 `opencode auth login`，选择 DeepSeek 并粘贴
 dsh 与其他 harness 不同：modlens 以原生工具的形式接入，而不是靠提示词触发的 skill。本包自身就是一个 dsh bundle，一条命令即可装进某个 profile：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.20.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.21.0
 ```
 
 这会注册一个 `modlens_read_image` 工具，它的 schema 随每次请求抵达模型（不靠触发启发式），运行同一个包里自带的 modlens CLI，并把结构化证据作为工具的标准 JSON 输出返回。引擎、复用授权和 guard 规则仍在 `~/.modlens/config.json` 里，与其他所有 harness 共享。dsh 还在开发者预览阶段，插件接口可能变化。这个插件刻意保持很小的接触面（原生工具注册、视觉变体所用的 llm 适配层、附件读取器，以及一个 agent 执行前钩子），其中任何一处变动，它都会大声报错而不是无声退化。
@@ -71,7 +71,7 @@ dsh 的网页用户面前没有终端，所以引擎设置有一张卡片，在*
 modlens 发布很频繁，而两种安装形态都会冻结在装进来的那个版本上。dsh 上重跑一遍安装即可，版本号要点名：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.20.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.21.0
 ```
 
 `npm view @liustack/modlens version` 可以查到当前版本号，本页的版本号则由发布流程自动写入。

package/docs/troubleshooting.md

@@ -163,7 +163,7 @@ simply lands on an older one. Name the exact version instead, which pnpm treats
 as a deliberate request rather than a resolution:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.20.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.21.0
 ```
 
 `npm view @liustack/modlens version` prints the current one. pnpm 11 installs a named
@@ -178,7 +178,7 @@ file:
 
 ```yaml
 minimumReleaseAgeExclude:
-  - '@liustack/modlens@3.20.0'
+  - '@liustack/modlens@3.21.0'
 ```
 
 Or lift the gate for a single command, which lifts it for everything that

package/docs/troubleshooting.zh-CN.md

@@ -144,7 +144,7 @@ dsh profile 装到的是旧版 modlens。`dsh.bundle` 声明从 3.9.0 起才存
 `@latest` 绕不开这一层，本页早先的说法是错的。冷静期先把候选版本过滤掉，dist-tag 才在剩下的里面解析，于是它直接落到了更旧的那个上。改成写死精确版本号，pnpm 会把它当作一次明确的指定，而不是一次解析：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.20.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.21.0
 ```
 
 `npm view @liustack/modlens version` 可以查到当前版本号。pnpm 11 会装上被点名的版本，11.1.3 起还会把它作为一条已批准的例外写进该 profile 的 `pnpm-workspace.yaml`，其余所有包和 modlens 以后的版本仍然留在窗口后面。
@@ -153,7 +153,7 @@ npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.20.0
 
 ```yaml
 minimumReleaseAgeExclude:
-  - '@liustack/modlens@3.20.0'
+  - '@liustack/modlens@3.21.0'
 ```
 
 或者只为这一条命令解除冷静期，注意它解除的是这条命令解析到的所有包，不只 modlens：

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@liustack/modlens",
-    "version": "3.20.0",
+    "version": "3.21.0",
     "description": "Plug-in vision for text-only LLMs, powered by the free Antigravity CLI",
     "type": "module",
     "bin": {

package/skills/modlens/SKILL.md

@@ -20,11 +20,11 @@ powershell -ExecutionPolicy Bypass -File <skill-dir>\scripts\run.ps1 <args>
 
 It resolves a working runtime (PATH `modlens`, then `npx`, then `bunx`) and forwards your arguments unchanged. Exit 78 means no runtime: relay the `nextSteps` from its stderr JSON instead of retrying.
 
-If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.20.0):
+If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.21.0):
 
-1. A `modlens` on `PATH` whose major version is 3 and is at least 3.20.0: `modlens <args>`.
-2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.20.0 modlens <args>`.
-3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.20.0 <args>`.
+1. A `modlens` on `PATH` whose major version is 3 and is at least 3.21.0: `modlens <args>`.
+2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.21.0 modlens <args>`.
+3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.21.0 <args>`.
 4. Otherwise tell the user no JavaScript runtime was found and that installing Node 22.19+ (https://nodejs.org) or Bun (https://bun.sh) is the next step. Do not claim modlens itself failed.
 
 `references/runtime.md` documents the pin and the diagnostic fields.

package/skills/modlens/references/configure.md

@@ -62,6 +62,7 @@ Field semantics:
 - `providers.<name>.<field>`: six fields exist, `apiKey`, `baseUrl`, `model`, `proxy`, `extraBody`, and `structuredOutput` (the openai route only). Every provider entry is optional, and every field inside it is optional. Alias keys are read too (settings saved under `gemini` are found when `gemini-api` resolves), with the canonical key winning on conflict.
 - `providers.<name>.extraBody`: a JSON object merged into the request body of the API providers (`gemini-api`, `openai`, `anthropic`), for whatever knobs that vendor has and modlens has no flag for. Turning thinking off is the usual reason, see the section below. Nested objects merge key by key, so adding one knob leaves the rest of that block alone. The fields carrying the image, the prompt, and each route's own enforcement machinery are refused with an error naming the field. `response_format` on the `openai` route is not one of them: setting it there deliberately replaces the schema modlens would otherwise send. The three CLI providers take no request body, so a run on `antigravity-cli`, `claude-cli` or `kimi-cli` ignores it and says so in `meta.warnings`.
 - `providers.openai.structuredOutput`: `true` asks an OpenAI-compatible gateway to enforce the vision contract itself, as `response_format: json_schema` in the strict form those endpoints require. Off by default, since a gateway without structured-output support answers 400 for the field. A `response_format` you set in `extraBody` wins over it.
+- `saved.openai.<label>`: named saved copies of the openai slot, written only by `modlens config save openai <label>` and swapped in whole by `modlens config use openai <label>`. Switching gateways used to mean overwriting `providers.openai` and losing the previous key; a saved copy is where it survives. `use` refuses to overwrite an active slot that no label holds (pass `--discard` to drop it deliberately), and nothing in resolution, guards, or the env bindings reads this section: the active slot stays the only openai route in any run.
 - `guards`: the invocation guard, for people who run both text-only and vision-capable models through the same client. Both lists hold glob patterns (`*` and `?`, case-insensitive, matched against the model name and `provider/model`), set with `modlens config set guards.denyModels '["gemini-3*"]'` or `guards.allowModels` (a JSON array or a comma-separated list, empty clears). Two ways to express the same intent, pick the shorter list:
   - `denyModels` alone: everything runs the engine except the listed vision models. Right when text-only models are the majority of what you plug in.
   - `allowModels` non-empty (allowlist mode): only the listed models run the engine, every other identified model is denied. Right for the actual 2026 landscape, where text-only models are the short list. A deny pattern still wins over an allow match, so a broad allow can have its vision variants carved out, as in the example above: `glm-5.*` allows the text line while `glm-*v*` catches `glm-5v-turbo`. Anchor allow patterns tightly (`deepseek-v4-*`, not `deepseek*`) so a vendor's next multimodal generation falls off the list and steps aside until you have checked it.

package/skills/modlens/references/runtime.md

@@ -8,7 +8,7 @@ shell syntax.
 
 ## Pinned version
 
-- Pinned CLI version: 3.20.0
+- Pinned CLI version: 3.21.0
 - npm package: `@liustack/modlens`
 - CLI binary name: `modlens`
 

package/skills/modlens/scripts/run.ps1

@@ -24,7 +24,7 @@ $ErrorActionPreference = 'Stop'
 # package.json version, and the release script rewrites it on every bump.
 $Package = '@liustack/modlens'
 $Bin = 'modlens'
-$Pinned = '3.20.0'
+$Pinned = '3.21.0'
 # -------------------------------------------------------------------------------
 
 $NativeNote = 'no native artifact is published for this tool yet; phase A ships npm launch paths only'

package/skills/modlens/scripts/run.sh

@@ -22,7 +22,7 @@ set -eu
 # package.json version, and the release script rewrites it on every bump.
 PKG="@liustack/modlens"
 BIN="modlens"
-PINNED="3.20.0"
+PINNED="3.21.0"
 # -------------------------------------------------------------------------------
 
 NATIVE_NOTE="no native artifact is published for this tool yet; phase A ships npm launch paths only"