@liustack/modlens 3.8.0 → 3.9.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 3.9.0 - 2026-08-13
+
+- **The first plug-in vision plugin for DeepSeek Harness (dsh).** The npm package is now also a dsh bundle: `dsh plugin --profile <name> add @liustack/modlens` is the whole install. It registers a native `read_image` tool (schema in every model request, so there is no trigger heuristic at all) that spawns the modlens CLI shipped in the same package, declares the vision schema as its canonical output contract, and renders evidence text for the model. Phase 2 rides `agent/pre-step`: images pasted or dropped into the dsh Web UI are read automatically and enter the step as modlens evidence blocks, with failed reads degrading to an explanatory note instead of rejecting the step (`autoRead: false` in the plugin row turns this off). The plugin imports no dsh packages (raw JSON-Schema tool registration, node builtins only), which is also the smallest possible surface against developer-preview churn. Verified end to end on a real dsh headless profile: the DeepSeek model called `read_image` and quoted the exact transcription back.
+- **Grok Build joins as the fifth reusable harness.** `reuse.grok` grants the local Grok CLI login as an engine: discovery reads `~/.grok` (OAuth evidence in auth.json, model ids from models_cache.json judged by the builtin vision table), and the route drives headless `grok -p` with `--json-schema` (which accepts this project's schema unmodified; the structuredOutput field carries the conforming answer) and `--allow Read`, following the claude-cli template since headless grok has no image-attach flag. Verified live: an exact OCR read through a real SuperGrok login. The agent region order becomes antigravity, codex, opencode, grok, pi-cli, claude-cli.
+
 ## 3.8.0 - 2026-08-13
 
 - **Reuse: per-harness grants for the logins already on your machine.** A signed-in Codex, an OpenCode vision model, or credentials held by pi can now serve as vision engines, each behind one explicit yes recorded as `reuse.<claude|codex|opencode|pi>` (true grants, false means never ask again, absent means never asked; `claude` absent counts as granted since `claude-cli` predates the model, and `reuse.claude false` now removes it from the chain). pi credentials with an exactly-supported api shape (`openai-completions`, `anthropic-messages`) and a printable API key run through the existing inline providers with every guard intact; OAuth logins and other shapes (Responses, Vertex) drive pi itself (`pi -p` with the `@file` attachment), and codex (`codex exec -i`) and opencode (`opencode run -f`) join as agent routes. Reused engines get no priority: one chain, two regions, speed-class placement only, and every reused answer adds a `meta.warnings` line naming whose quota it spent. Keys are fetched at call time, live only in memory, and no subprocess output ever travels into an error message.

package/README.md

@@ -32,6 +32,8 @@ Issues are welcome any time: [open one](https://github.com/liustack/modlens/issu
 
 ## Highlights
 
+**🥇 The first plug-in vision plugin for DeepSeek Harness (dsh):** one command, `dsh plugin --profile web add @liustack/modlens`, and the text-only DeepSeek model behind dsh reads images, as a native `read_image` tool plus automatic reading of pasted images.
+
 **Paste an image and it reads it.** No saving to a file and passing a path first.
 
 - **Zero-config start.** Reuses what Claude Code, Codex, OpenCode, or Pi already have set up: the multimodal models on your machine go straight to work. Nothing at all? Antigravity CLI is a free no-key channel, and a free Gemini key brings a read down to 5-10 seconds.

package/README.zh-CN.md

@@ -32,6 +32,8 @@ DeepSeek 和 GLM 没有视觉能力，无法进行图片识别。ModLens 借助
 
 ## 亮点
 
+**🥇 全网第一个支持 DeepSeek Harness（dsh）的外挂视觉识别插件：**一条命令 `dsh plugin --profile web add @liustack/modlens`，dsh 背后的纯文本 DeepSeek 模型即可读图，原生 `read_image` 工具加粘贴图片自动识别。
+
 **直接粘贴图片识别** 无需先保存成文件再提供路径。
 
 - **零配置起手。** 复用 Claude Code、Codex、OpenCode、Pi 已配置，直接复用你本机的其他多模态模型。什么都没有？Antigravity CLI 是免 key 的免费通道，配一个免费 Gemini key 可将识别耗时降至 5 到 10 秒。
@@ -55,6 +57,14 @@ agy                                                           # 浏览器完成
 
 安装还会盘点本机其他 harness CLI（Codex、OpenCode、Pi）里可触达的视觉能力，并逐个询问是否允许 modlens 复用。获准的登录态与你自己配的引擎平级入池，每次复用都会在结果里标明花的是谁的额度。
 
+**DeepSeek Harness（dsh）用户不走 skill 流程**，本包就是原生 dsh 插件：
+
+```sh
+dsh plugin --profile web add @liustack/modlens
+```
+
+装完即有 `read_image` 工具和粘贴图片自动识别。引擎配置同样在 `~/.modlens`，详见[宿主接入](docs/harness-setup.md)。
+
 ## 用法
 
 装好之后不需要记任何命令。正常聊天，粘贴图片或给出图片路径，提问即可，skill 自动触发：图片交给视觉引擎，答案基于读到的内容返回。

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+# dsh bundle layer: mount the modlens vision plugin (see dsh/index.js).
+- insert:
+    - id: modlens
+      name: '@liustack/modlens/dsh'

package/dist/main.js

@@ -28175,7 +28175,7 @@ function listProviders() {
   return [...new Set(Object.values(PROVIDERS).map((provider) => provider.name))];
 }
 const STRING_FIELDS = ["apiKey", "baseUrl", "model"];
-const REUSE_HARNESSES = ["claude", "codex", "opencode", "pi"];
+const REUSE_HARNESSES = ["claude", "codex", "opencode", "pi", "grok"];
 const CONFIG_DIR = path.join(os.homedir(), ".modlens");
 const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 const ENV_BINDINGS = {
@@ -28253,7 +28253,7 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
     const dot = dottedKey.indexOf(".");
     if (dot <= 0 || dot === dottedKey.length - 1) {
       throw new Error(
-        `Invalid config key: ${dottedKey}. Use "provider", "reuse.<claude|codex|opencode|pi>", "guards.<denyModels|allowModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
+        `Invalid config key: ${dottedKey}. Use "provider", "reuse.<claude|codex|opencode|pi|grok>", "guards.<denyModels|allowModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
       );
     }
     const providerName = dottedKey.slice(0, dot);
@@ -28614,6 +28614,41 @@ function probeCodex(env, home) {
     }
   });
 }
+function probeGrok(env, home) {
+  return timed(() => {
+    const cliPath = findOnPath("grok", env);
+    const base = { harness: "grok", cliFound: cliPath !== null };
+    if (!cliPath) {
+      return { ...base, visionModels: [], source: "none" };
+    }
+    const grokHome = path.join(home, ".grok");
+    let loggedIn = false;
+    try {
+      const auth = readJson(path.join(grokHome, "auth.json"));
+      loggedIn = Object.keys(auth).length > 0;
+    } catch {
+    }
+    try {
+      const cache2 = readJson(path.join(grokHome, "models_cache.json"));
+      const vision = Object.keys(cache2.models ?? {}).filter((id) => isVisionModel(id));
+      return {
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: vision.length > 0 ? vision : ["default"],
+        source: "builtin-table"
+      };
+    } catch {
+      return {
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: ["default"],
+        source: "builtin-table"
+      };
+    }
+  });
+}
 function probePi(env, home) {
   return timed(() => {
     const cliPath = findOnPath("pi", env);
@@ -28705,7 +28740,8 @@ function discoverAuto(options = {}) {
     probeClaude(env),
     probeCodex(env, home),
     probeOpencode(env, runCli),
-    probePi(env, home)
+    probePi(env, home),
+    probeGrok(env, home)
   ];
   const cachedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
@@ -28859,6 +28895,67 @@ ${JSON_TEMPLATE_INSTRUCTION}`;
     }
   };
 }
+function grokCliRoute(modelId) {
+  return {
+    name: "grok-cli",
+    defaultModel: modelId,
+    isolateWorkdir: true,
+    reuseNote: "this read reused the local Grok CLI login and spent that account's quota.",
+    buildInvocation: (options) => {
+      if (options.imageKind === "remote") {
+        throw new Error(
+          "grok-cli route reads local files only. Remote URLs stay on the inline providers."
+        );
+      }
+      const prompt = buildVisionPrompt({
+        imageSource: options.imageSource,
+        imageKind: "local",
+        extraPrompt: options.extraPrompt
+      });
+      const args = [
+        "-p",
+        prompt,
+        "--output-format",
+        "json",
+        "--json-schema",
+        visionResultSchemaJson(),
+        "--allow",
+        "Read"
+      ];
+      const model = options.model || modelId;
+      if (model && model !== "default") {
+        args.push("-m", model);
+      }
+      return {
+        command: options.providerBin || "grok",
+        args,
+        cwd: path.resolve(options.workdir || path.dirname(options.imageSource))
+      };
+    },
+    parseOutput: (stdout) => {
+      const envelope = parseJsonLoose(stdout);
+      if (!envelope || typeof envelope !== "object") {
+        throw new Error(
+          "grok produced no JSON envelope. Check the Grok login (run: grok)."
+        );
+      }
+      const result = envelope.structuredOutput ?? (typeof envelope.text === "string" ? extractJson(envelope.text) : null);
+      if (result === null || result === void 0) {
+        throw new Error(
+          `grok returned no structured output: ${truncate(envelope.text ?? "")}`
+        );
+      }
+      return {
+        result,
+        meta: {
+          conversationId: envelope.sessionId ?? null,
+          durationSeconds: null,
+          usage: envelope.usage ?? null
+        }
+      };
+    }
+  };
+}
 const PI_API_TARGETS = {
   "openai-completions": "openai",
   "anthropic-messages": "anthropic"
@@ -29028,7 +29125,7 @@ function reuseProviders(kind, config2, options = {}) {
     } catch {
     }
   }
-  if (kind === "local" && (grants.codex === true || grants.opencode === true)) {
+  if (kind === "local" && (grants.codex === true || grants.opencode === true || grants.grok === true)) {
     try {
       const discovery = options.discovery ?? discoverAuto({ env, home });
       const codex = discovery.probes.find((probe) => probe.harness === "codex");
@@ -29039,6 +29136,10 @@ function reuseProviders(kind, config2, options = {}) {
       if (grants.opencode === true && opencode?.cliFound && opencode.visionModels[0]) {
         agents.push(opencodeCliRoute(opencode.visionModels[0]));
       }
+      const grok = discovery.probes.find((probe) => probe.harness === "grok");
+      if (grants.grok === true && grok?.cliFound && grok.loggedIn !== false && grok.visionModels[0]) {
+        agents.push(grokCliRoute(grok.visionModels[0]));
+      }
     } catch {
     }
   }
@@ -29164,7 +29265,8 @@ function composeChain(kind, config2, autoOptions) {
 const REUSE_KEY_BY_HARNESS = {
   codex: "codex",
   opencode: "opencode",
-  pi: "pi"
+  pi: "pi",
+  grok: "grok"
 };
 function reuseHint(config2, autoOptions) {
   try {
@@ -30458,7 +30560,7 @@ function recoverPastedImages(options = {}) {
   return result;
 }
 const program = new Command();
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.8.0");
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.9.0");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`

package/docs/cli.md

@@ -93,6 +93,6 @@ Five providers: `antigravity-cli` (no key), `gemini-api` (fastest free route), `
 Other subcommands:
 
 - `modlens guard [--model <id>]`: should the engine run for the active model at all? Exit 0 allow, 1 deny, verdict as JSON.
-- `modlens config <init|set|show>`: keys are `provider`, `reuse.<claude|codex|opencode|pi>`, `guards.<denyModels|allowModels|denyWhenUnknown>`, and `<provider>.<apiKey|baseUrl|model|extraBody>`.
+- `modlens config <init|set|show>`: keys are `provider`, `reuse.<claude|codex|opencode|pi|grok>`, `guards.<denyModels|allowModels|denyWhenUnknown>`, and `<provider>.<apiKey|baseUrl|model|extraBody>`.
 - `modlens doctor`: Node and node:sqlite, provider readiness, the failover chains for this machine, the detected harness, the guard's rules with a live verdict, and the Reuse section with per-harness grant decisions and discovered vision. Spends no quota; `--json` for a machine-readable report.
 

package/docs/harness-setup.md

@@ -47,3 +47,13 @@ Windows runs the same CI matrix. Detection there skips the process-ancestry pass
 ## Gateway setups
 
 OpenCode with DeepSeek: `opencode auth login`, pick DeepSeek and paste the key (it lands in `~/.local/share/opencode/auth.json`), then set the default model in `~/.config/opencode/opencode.jsonc` to `deepseek/deepseek-v4-flash`. Pi reads its key from `~/.pi/agent/auth.json`.
+
+## DeepSeek Harness (dsh)
+
+dsh is different from the other harnesses: modlens plugs in as a native tool, not a prompt-triggered skill. The package itself is a dsh bundle, so one command installs it into a profile:
+
+```sh
+dsh plugin --profile web add @liustack/modlens
+```
+
+This registers a `read_image` tool whose schema reaches the model on every request (no trigger heuristics), runs the modlens CLI shipped inside the same package, and returns the structured evidence as the tool's canonical JSON output. Engines, reuse grants, and guard rules stay in `~/.modlens/config.json`, shared with every other harness. dsh is in developer preview and its plugin surface may change; the plugin touches only `ctx.tools.register` to keep that surface minimal.

package/dsh/index.js

@@ -0,0 +1,213 @@
+// DeepSeek Harness (dsh) plugin: registers a read_image tool backed by the
+// modlens CLI that ships in this very package. dsh models are text-only, so
+// the tool is the vision bridge; unlike prompt-triggered skills, a registered
+// tool schema reaches the model on every request, so there is no trigger
+// gamble. The engine is spawned from ../dist/main.js inside this package:
+// no PATH lookup, no npx, the plugin and its engine version-lock together.
+//
+// Loaded via the cordis.patch.yml row `@liustack/modlens/dsh` (see the
+// package.json `dsh.bundle` manifest). Providers, reuse grants, and guard
+// rules keep living in ~/.modlens/config.json, shared with every harness.
+import { spawn } from 'node:child_process'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+
+const CLI_PATH = fileURLToPath(new URL('../dist/main.js', import.meta.url))
+// Kept in lockstep with src/schema.ts by a repo test; the plugin file cannot
+// import the TS source and stays fully dependency-free (node builtins only).
+const OUTPUT_SCHEMA = JSON.parse(
+  readFileSync(new URL('./vision-schema.json', import.meta.url), 'utf8'),
+)
+
+const CLI_TIMEOUT_MS = 180_000
+
+export const name = 'modlens'
+export const inject = ['tools', 'agents', 'attachments']
+
+const MEDIA_EXT = {
+  'image/png': '.png',
+  'image/jpeg': '.jpg',
+  'image/webp': '.webp',
+  'image/gif': '.gif',
+}
+
+export function apply(ctx, config = {}) {
+  if (config.autoRead !== false) {
+    registerAutoRead(ctx)
+  }
+  // Registered as a raw JSON-Schema tool definition (no dsh package imports:
+  // the developer-preview registry accepts these and out-of-tree resolution
+  // of @deepseek-ai/dsh-tools is not yet reliable), so this plugin owns its
+  // own argument validation inside execute.
+  ctx.tools.register({
+    name: 'read_image',
+    description:
+      'Read an image through the modlens vision bridge. Use whenever a message references an image the current model cannot see: a local file path or an http(s) URL to a screenshot, photo, chart, diagram, or document scan. Returns structured evidence with every word transcribed (ocr.full_text), layout regions in reading order, semantics, and an uncertainty list; quote the evidence instead of guessing. Requires a configured modlens engine (run `npx @liustack/modlens doctor` in a terminal to check).',
+    parameters: {
+      type: 'object',
+      properties: {
+        path: {
+          type: 'string',
+          description: 'Absolute local file path or http(s) URL of the image',
+        },
+        prompt: {
+          type: 'string',
+          description: 'Optional extra focus for the reading (e.g. "focus on the axis labels")',
+        },
+      },
+      required: ['path'],
+    },
+    output: {
+      schema: OUTPUT_SCHEMA,
+      render: (_args, value) => [{ type: 'text', text: renderEvidence(value) }],
+    },
+    // The CLI enforces its own deadline; this is the cooperative backstop.
+    timeoutMs: CLI_TIMEOUT_MS + 20_000,
+    isConcurrencySafe: () => true,
+    presentCall: (args) => ({
+      card: 'generic',
+      title: 'read_image',
+      kind: 'read',
+      rawInput: args,
+      ...(typeof args?.path === 'string' && !/^https?:\/\//i.test(args.path)
+        ? { locations: [{ path: args.path }] }
+        : {}),
+    }),
+    async execute(args, exec) {
+      if (typeof args?.path !== 'string' || args.path.trim() === '') {
+        throw new Error('read_image needs a non-empty string "path".')
+      }
+      const cliArgs = [CLI_PATH, '-i', args.path, '--timeout', String(CLI_TIMEOUT_MS)]
+      if (args.prompt) {
+        cliArgs.push('--prompt', args.prompt)
+      }
+      const { stdout, stderr, code } = await run(process.execPath, cliArgs, exec.signal)
+      if (code !== 0) {
+        throw new Error(
+          `modlens failed (exit ${code}): ${(stderr || stdout).trim().slice(0, 500)}`,
+        )
+      }
+      let parsed
+      try {
+        parsed = JSON.parse(stdout)
+      } catch {
+        throw new Error(`modlens produced no JSON: ${stdout.trim().slice(0, 300)}`)
+      }
+      // The canonical value is the vision result itself; routing details
+      // (meta.attempts, whose quota a reused engine spent) stay operational.
+      return parsed.result
+    },
+  })
+}
+
+/**
+ * Phase 2: paste auto-route. When entered messages carry image blocks (the
+ * Web UI's paste/drop intake) and the model behind dsh is text-only, rewrite
+ * each image block into a modlens evidence text block before the step starts.
+ * Runs after `next()` so downstream pre-step listeners (compaction, context
+ * injectors) see and shape the same final message set; a failed read degrades
+ * to an explanatory text block instead of rejecting the step.
+ */
+function registerAutoRead(ctx) {
+  ctx.on('agent/pre-step', async (payload, next) => {
+    const decision = await next()
+    if (decision.kind !== 'enter') {
+      return decision
+    }
+    const hasImage = decision.messages.some(
+      (message) =>
+        Array.isArray(message.content) &&
+        message.content.some((block) => block?.type === 'image'),
+    )
+    if (!hasImage) {
+      return decision
+    }
+    const messages = []
+    for (const message of decision.messages) {
+      if (!Array.isArray(message.content)) {
+        messages.push(message)
+        continue
+      }
+      const content = []
+      for (const block of message.content) {
+        if (block?.type !== 'image') {
+          content.push(block)
+          continue
+        }
+        content.push(await readImageBlock(ctx, block, payload.signal))
+      }
+      messages.push({ ...message, content })
+    }
+    return { kind: 'enter', messages }
+  })
+}
+
+async function readImageBlock(ctx, block, signal) {
+  const { mkdtemp, rm, writeFile } = await import('node:fs/promises')
+  const { tmpdir } = await import('node:os')
+  const { join } = await import('node:path')
+  let dir
+  try {
+    const stored = await ctx.attachments.readImage(block.attachment, signal)
+    dir = await mkdtemp(join(tmpdir(), 'modlens-dsh-'))
+    const file = join(
+      dir,
+      `paste${MEDIA_EXT[stored.mediaType ?? block.attachment?.mediaType] ?? '.png'}`,
+    )
+    await writeFile(file, Buffer.from(stored.bytes), { mode: 0o600 })
+    const cli = process.env.MODLENS_DSH_CLI || CLI_PATH
+    const { stdout, stderr, code } = await run(
+      process.execPath,
+      [cli, '-i', file, '--timeout', String(CLI_TIMEOUT_MS)],
+      signal,
+    )
+    if (code !== 0) {
+      throw new Error((stderr || stdout).trim().slice(0, 300))
+    }
+    const parsed = JSON.parse(stdout)
+    return {
+      type: 'text',
+      text: `[Pasted image, read by the modlens vision bridge]\n${renderEvidence(parsed.result)}`,
+    }
+  } catch (error) {
+    return {
+      type: 'text',
+      text: `[A pasted image could not be read by modlens: ${
+        error instanceof Error ? error.message.slice(0, 300) : String(error)
+      }. Tell the user, and suggest running \`npx @liustack/modlens doctor\`.]`,
+    }
+  } finally {
+    if (dir) {
+      await rm(dir, { recursive: true, force: true }).catch(() => {})
+    }
+  }
+}
+
+function run(command, args, signal) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'], signal })
+    let stdout = ''
+    let stderr = ''
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk
+    })
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk
+    })
+    child.on('error', reject)
+    child.on('close', (code) => resolve({ stdout, stderr, code }))
+  })
+}
+
+function renderEvidence(value) {
+  const lines = [value.summary]
+  const text = value.ocr?.full_text?.trim()
+  if (text) {
+    lines.push('', 'Transcription:', text.length > 4000 ? `${text.slice(0, 4000)}…` : text)
+  }
+  const uncertainty = value.uncertainty ?? []
+  if (uncertainty.length > 0) {
+    lines.push('', `Uncertain: ${uncertainty.join('; ')}`)
+  }
+  return lines.join('\n')
+}

package/dsh/vision-schema.json

@@ -0,0 +1 @@
+{"type":"object","properties":{"summary":{"type":"string"},"ocr":{"type":"object","properties":{"full_text":{"type":"string"},"lines":{"type":"array","items":{"type":"object","properties":{"text":{"type":"string"},"language":{"type":"string"}},"required":["text"]}}},"required":["full_text","lines"]},"layout":{"type":"object","properties":{"regions":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["title","subtitle","paragraph","list","table","chart","form","code","image","icon","other"]},"reading_order":{"type":"number"},"text":{"type":"string"}},"required":["type","reading_order","text"]}}},"required":["regions"]},"semantics":{"type":"object","properties":{"scene":{"type":"string"},"intent":{"type":"string"},"entities":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"evidence":{"type":"string"}},"required":["name","type"]}},"relations":{"type":"array","items":{"type":"object","properties":{"subject":{"type":"string"},"predicate":{"type":"string"},"object":{"type":"string"}},"required":["subject","predicate","object"]}}},"required":["scene","entities"]},"visual":{"type":"object","properties":{"dominant_colors":{"type":"array","items":{"type":"string"}},"style":{"type":"string"},"notes":{"type":"array","items":{"type":"string"}}}},"uncertainty":{"type":"array","items":{"type":"string"}}},"required":["summary","ocr","layout","semantics","visual","uncertainty"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liustack/modlens",
-  "version": "3.8.0",
+  "version": "3.9.0",
   "description": "Plug-in vision for text-only LLMs, powered by the free Antigravity CLI",
   "type": "module",
   "bin": {
@@ -26,7 +26,9 @@
     "skills/modlens/scripts",
     "skills/modlens/references",
     "CHANGELOG.md",
-    "SECURITY.md"
+    "SECURITY.md",
+    "dsh",
+    "cordis.patch.yml"
   ],
   "keywords": [
     "cli",
@@ -64,5 +66,14 @@
     "typescript": "^5.9.3",
     "vite": "^6.4.1",
     "vitest": "^3.2.7"
+  },
+  "exports": {
+    "./dsh": "./dsh/index.js",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
   }
-}
+}

package/skills/modlens/SKILL.md

@@ -20,11 +20,11 @@ powershell -ExecutionPolicy Bypass -File <skill-dir>\scripts\run.ps1 <args>
 
 It resolves a working runtime (PATH `modlens`, then `npx`, then `bunx`) and forwards your arguments unchanged. Exit 78 means no runtime: relay the `nextSteps` from its stderr JSON instead of retrying.
 
-If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.8.0):
+If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.9.0):
 
-1. A `modlens` on `PATH` whose major version is 3 and is at least 3.8.0: `modlens <args>`.
-2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.8.0 modlens <args>`.
-3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.8.0 <args>`.
+1. A `modlens` on `PATH` whose major version is 3 and is at least 3.9.0: `modlens <args>`.
+2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.9.0 modlens <args>`.
+3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.9.0 <args>`.
 4. Otherwise tell the user no JavaScript runtime was found and that installing Node 22.13+ (https://nodejs.org) or Bun (https://bun.sh) is the next step. Do not claim modlens itself failed.
 
 `references/runtime.md` documents the pin and the diagnostic fields.

package/skills/modlens/references/configure.md

@@ -62,7 +62,7 @@ Field semantics:
   - List a model by what actually reaches it, not by what it could see: a multimodal model behind a gateway that strips images still needs modlens, and your session transcript records the model name the gateway reports. `modlens doctor`'s Guard section shows the rules and a live verdict for checking the result.
   - `denyWhenUnknown` (default `false`) decides what happens when no signal identifies the active model, in either mode: `false` proceeds, `true` denies. The active model is detected from, strongest first: the `MODLENS_MODEL` env var (`none` means "treat as unknown"), the harness's session storage, the `--model` self-report.
 - Environment variables override the file for these bindings: `GEMINI_API_KEY`, `OPENAI_API_KEY`, `OPENAI_BASE_URL`, `ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL`. Beyond those, modlens reads `MODLENS_HARNESS` (paste-recovery and guard scope), `MODLENS_MODEL` (guard override, see `guards`), and the fingerprints harnesses inject themselves, which pin the guard's storage lookup to the current session: `CLAUDE_CODE_SESSION_ID`, `CODEX_THREAD_ID`, plus the presence markers harness detection relies on (`CLAUDECODE`, `PI_CODING_AGENT`, `CODEX_SANDBOX`).
-- `reuse.<claude|codex|opencode|pi>`: per-harness grants for spending other local logins, written by the onboarding conversation (`references/onboard.md`). `true` lets reads reuse that harness (pi credentials join the inline region with every guard intact; a signed-in Codex, an OpenCode vision model, or pi driven directly join the agent region before `claude-cli`), `false` records a refusal so the user is never re-asked, absent means never asked and nothing runs. `claude` absent counts as granted: `claude-cli` predates this model as a built-in provider, and `reuse.claude false` removes it from the chain (`-p claude-cli` still pins). Reused engines get no priority over the user's own: regions order by speed class only. Every reused answer adds a `meta.warnings` line naming whose quota it spent, and `modlens doctor`'s Reuse section shows each harness's decision plus what discovery found (probe results cache for 6 hours in `~/.modlens/auto-cache.json`; doctor always re-probes). Set with `modlens config set reuse.codex true` (empty clears back to never-asked).
+- `reuse.<claude|codex|opencode|pi|grok>`: per-harness grants for spending other local logins, written by the onboarding conversation (`references/onboard.md`). `true` lets reads reuse that harness (pi credentials join the inline region with every guard intact; a signed-in Codex, an OpenCode vision model, or pi driven directly join the agent region before `claude-cli`), `false` records a refusal so the user is never re-asked, absent means never asked and nothing runs. `claude` absent counts as granted: `claude-cli` predates this model as a built-in provider, and `reuse.claude false` removes it from the chain (`-p claude-cli` still pins). Reused engines get no priority over the user's own: regions order by speed class only. Every reused answer adds a `meta.warnings` line naming whose quota it spent, and `modlens doctor`'s Reuse section shows each harness's decision plus what discovery found (probe results cache for 6 hours in `~/.modlens/auto-cache.json`; doctor always re-probes). Set with `modlens config set reuse.codex true` (empty clears back to never-asked).
 - Unknown top-level keys and unknown provider names are ignored rather than rejected, so a typo fails quiet: run `modlens doctor` after hand-editing, it shows which file and env values are actually in effect.
 
 Hand-editing is fine (keep the file valid JSON and its permissions 0600). `modlens config set` does the same thing with guardrails.

package/skills/modlens/references/onboard.md

@@ -33,7 +33,7 @@ Consent rules:
 
 | The user agreed to | Run |
 | :-- | :-- |
-| Reusing a harness CLI | `modlens config set reuse.<claude\|codex\|opencode\|pi> true` (one per consent) |
+| Reusing a harness CLI | `modlens config set reuse.<claude\|codex\|opencode\|pi\|grok> true` (one per consent) |
 | A Gemini key they handed over | `modlens config set gemini-api.apiKey <key>` |
 | An OpenAI-compatible endpoint | `config set openai.baseUrl / openai.apiKey / openai.model` |
 | Guard rules for their text-only model | `modlens config set guards.allowModels '["<pattern>"]'` (patterns: `references/configure.md`) |

package/skills/modlens/references/runtime.md

@@ -8,7 +8,7 @@ shell syntax.
 
 ## Pinned version
 
-- Pinned CLI version: 3.8.0
+- Pinned CLI version: 3.9.0
 - npm package: `@liustack/modlens`
 - CLI binary name: `modlens`
 

package/skills/modlens/scripts/run.ps1

@@ -24,7 +24,7 @@ $ErrorActionPreference = 'Stop'
 # package.json version, and the release script rewrites it on every bump.
 $Package = '@liustack/modlens'
 $Bin = 'modlens'
-$Pinned = '3.8.0'
+$Pinned = '3.9.0'
 # -------------------------------------------------------------------------------
 
 $NativeNote = 'no native artifact is published for this tool yet; phase A ships npm launch paths only'

package/skills/modlens/scripts/run.sh

@@ -22,7 +22,7 @@ set -eu
 # package.json version, and the release script rewrites it on every bump.
 PKG="@liustack/modlens"
 BIN="modlens"
-PINNED="3.8.0"
+PINNED="3.9.0"
 # -------------------------------------------------------------------------------
 
 NATIVE_NOTE="no native artifact is published for this tool yet; phase A ships npm launch paths only"