dsh-vision-router 1.5.3 → 1.6.0

package/README.md

@@ -12,6 +12,7 @@
   <a href="https://awesome-dsh-plugin.com"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin" /></a>
   <a href="https://github.com/zp-home/dsh-recommend"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fzp-home%2Fdsh-recommend%2Fmain%2Fdata%2Fbadges%2Fysr666__dsh-vision-router.certified.json&amp;style=flat-square" alt="dsh-recommend 🏅 精选认证" /></a>
   <a href="https://github.com/zp-home/dsh-recommend"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fzp-home%2Fdsh-recommend%2Fmain%2Fdata%2Fbadges%2Fysr666__dsh-vision-router.json&amp;style=flat-square" alt="dsh score 0.90" /></a>
+  <a href="https://dshplugin.app/plugins/dsh-vision-router"><img src="https://img.shields.io/badge/DSHPlugin.app-listed-555?style=flat-square" alt="Listed on DSHPlugin.app" /></a>
 </p>
 
 <p align="center">
@@ -28,9 +29,9 @@
 <p align="center">💬 <strong>QQ community group: 1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **Announcement (v1.5.3)**
+> 📌 **Announcement (v1.6.0)**
 >
-> **v1.5.3:** Fixes the rc.6 update-check routes (#160), guards repetition-loop vision output, rewords misleading copy, and logs every backend vision call.
+> **v1.6.0:** Explicit vision-backend authorization — paid visual models merely configured in DSH are no longer callable; the DeepSeek + 自动识图 identity is pinned to official DeepSeek; the one-click updater now infers the owning profile and refuses on ambiguity; full-page screenshots, rc.7 Models directory, install diagnostics, guide-scroll performance and Android/Termux attachments all fixed.
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />
@@ -118,6 +119,9 @@ For normal npm/npx installs, installation is a single command:
 npx @deepseek-ai/dsh plugin --profile web add dsh-vision-router
 ```
 
+> [!WARNING]
+> If this profile already loads community plugins manually through `cordis.patch.yml`, do **not** mix that legacy setup with `dsh plugin add` / `dsh plugin list`: current DSH CLI behavior can also append bundle-patch dependencies to `dsh.profile.bundles`, causing those plugins to register twice. Migrate the existing manual plugin rows to bundle-managed loading first, or keep using the manual installation path. See [deepseek-harness discussion #2889](https://github.com/deepseek-ai/deepseek-harness/discussions/2889).
+
 > [!NOTE]
 > Third-party `dsh-web-plugin-manager` / `dshpm` **v0.4.2+** is also compatible: its quality gate now correctly allows `@deepseek-ai/schemastery` as a runtime dependency. The official DSH CLI above remains the recommended install path.
 
@@ -415,6 +419,9 @@ Normal npm/npx install — one command:
 npx @deepseek-ai/dsh plugin --profile web add dsh-vision-router
 ```
 
+> [!NOTE]
+> Profiles that mix legacy manual `cordis.patch.yml` plugin rows with bundle-managed plugins should read the compatibility warning in [Quick start](#1-install-the-plugin) before running DSH plugin commands.
+
 From a DeepSeek Harness source checkout:
 
 ```sh

package/README.zh.md

@@ -12,6 +12,7 @@
   <a href="https://awesome-dsh-plugin.com"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin" /></a>
   <a href="https://github.com/zp-home/dsh-recommend"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fzp-home%2Fdsh-recommend%2Fmain%2Fdata%2Fbadges%2Fysr666__dsh-vision-router.certified.json&amp;style=flat-square" alt="dsh-recommend 🏅 精选认证" /></a>
   <a href="https://github.com/zp-home/dsh-recommend"><img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fzp-home%2Fdsh-recommend%2Fmain%2Fdata%2Fbadges%2Fysr666__dsh-vision-router.json&amp;style=flat-square" alt="dsh score 0.90" /></a>
+  <a href="https://dshplugin.app/plugins/dsh-vision-router"><img src="https://img.shields.io/badge/DSHPlugin.app-listed-555?style=flat-square" alt="已收录于 DSHPlugin.app" /></a>
 </p>
 
 <p align="center">
@@ -28,9 +29,9 @@
 <p align="center">💬 <strong>QQ 用户交流群：1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **公告（v1.5.3）**
+> 📌 **公告（v1.6.0）**
 >
-> **v1.5.3：修复 rc.6 更新检查路由（#160）、守卫视觉循环输出、改写易误导文案，并逐后端记录视觉调用日志。**
+> **v1.6.0：视觉后端显式授权——仅在 DSH 里配置过的付费视觉模型不再可被调用，「DeepSeek + 自动识图」身份钉死官方 DeepSeek；一键更新改为从运行中插件真实路径反查所属 profile、不确定即拒绝；全页截图、rc.7 模型目录、安装诊断、设置引导性能与 Android/Termux 附件全部修复。**
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />
@@ -116,6 +117,9 @@
 npx @deepseek-ai/dsh plugin --profile web add dsh-vision-router
 ```
 
+> [!WARNING]
+> 如果这个 profile 里已经有通过 `cordis.patch.yml` **手动挂载**的社区插件，不要再把这种旧式加载方式与 `dsh plugin add` / `dsh plugin list` 混用：当前 DSH CLI 可能同时把带 bundle patch 的依赖追加到 `dsh.profile.bundles`，导致这些插件被重复注册。请先把原有手动插件迁移到 bundle 管理方式，或继续沿用手动安装路径。详见 [deepseek-harness Discussion #2889](https://github.com/deepseek-ai/deepseek-harness/discussions/2889)。
+
 > [!NOTE]
 > 第三方 `dsh-web-plugin-manager` / `dshpm` **v0.4.2+** 现已兼容：其质量门已正确放行作为运行时依赖的 `@deepseek-ai/schemastery`。上面的官方 DSH CLI 仍是推荐安装方式。
 
@@ -410,6 +414,9 @@ ollama pull qwen2.5vl
 npx @deepseek-ai/dsh plugin --profile web add dsh-vision-router
 ```
 
+> [!NOTE]
+> 如果 profile 混用了旧式 `cordis.patch.yml` 手动插件行与 bundle 管理方式，请先阅读[快速开始](#1-安装插件)里的兼容警告，再执行 DSH plugin 命令。
+
 从 DeepSeek Harness 源码仓库运行：
 
 ```sh

package/entry.js

@@ -10,7 +10,10 @@ import z from '@deepseek-ai/schemastery'
 import * as core from './index.js'
 import { installVisionRouterFileLogging } from './lib/file-logger.js'
 import { contextWithDelegatedReplay } from './lib/replay-delegation.js'
+import { installAdversarialHardening } from './lib/adversarial-hardening.js'
 import { installLocalVisionStabilizer } from './lib/local-vision-stabilizer.js'
+import { installWrapperDirectoryAlias } from './lib/wrapper-directory.js'
+import { installAndroidAttachmentCompat } from './lib/android-attachment-compat.js'
 
 // Schemastery object schemas expose set() as the supported way to replace a
 // field schema. This mutates the Config object that index.js itself later uses
@@ -24,22 +27,47 @@ export const Config = core.Config
 // Defense in depth for direct/programmatic callers that invoke apply() without
 // first running the Cordis Config resolver: only an explicit true enables the
 // schema-changing progressive mode. The wrapped context changes logger plus a
-// private llm view used only by Vision Router: wrapper -> delegate calls can
-// restore adapter-owned replay identity without mutating the host LLM service.
+// private llm/tools view used only by Vision Router: wrapper -> delegate calls
+// preserve replay identity, while vision-tool network calls are constrained to
+// the exact backends the user selected in Vision Router.
 export function apply(ctx, config = {}) {
   const logging = installVisionRouterFileLogging(ctx)
-  const runtimeCtx = contextWithDelegatedReplay(logging.ctx)
+  const runtimeCtx = contextWithDelegatedReplay(logging.ctx, {
+    wrapperRoute:
+      typeof config.wrapperRoute === 'string' && config.wrapperRoute !== ''
+        ? config.wrapperRoute
+        : 'deepseek-vision',
+    visionConfig: config,
+  })
+  // Security/runtime boundary shared by the core and the local-vision shim:
+  // keep artifacts inside the session workspace, make HTML screenshots truly
+  // offline + sandboxed, protect the screenshot-permission side effect, and
+  // make the process-wide fetch cleanup coexist with later plugin patches.
+  const { ctx: hardenedCtx, config: hardenedConfig } = installAdversarialHardening(
+    runtimeCtx,
+    config,
+    core,
+  )
   // #141 stabilization boundary: keep the recently merged local-vision
   // behavior isolated from main's existing provider/router semantics. It
   // normalizes only the local settings/runtime seams before core.apply sees
   // the context (desktop screenshot exposure, instant-local budget/one-pass,
   // local vision-http transport and connection-probe fallback).
-  const { ctx: stabilizedCtx, bootConfig } = installLocalVisionStabilizer(runtimeCtx, config, core)
+  const { ctx: stabilizedCtx, bootConfig } = installLocalVisionStabilizer(
+    hardenedCtx,
+    hardenedConfig,
+    core,
+  )
+  // #182: Android/Termux cannot open /data/data for the attachment-local
+  // durability walk. Keep this workaround private to Vision Router so the
+  // host attachment service and every non-Android runtime retain their normal
+  // semantics. Once DSH accepts the save, the compatibility path is inert.
+  const attachmentCompatCtx = installAndroidAttachmentCompat(stabilizedCtx, logging.logger)
   // 启动诊断摘要只描述 composition/apply 的基础配置。设置服务可能稍后
   // 覆盖这些值；每个图片轮还会记录 current() 的实时决策，避免把这个
   // 启动快照误当成最终设置状态。
   try {
-    const c = config && typeof config === 'object' ? config : {}
+    const c = hardenedConfig && typeof hardenedConfig === 'object' ? hardenedConfig : {}
     const local = c.localOllama && typeof c.localOllama === 'object' ? c.localOllama : {}
     const lms = c.localLmStudio && typeof c.localLmStudio === 'object' ? c.localLmStudio : {}
     logging.logger.info(
@@ -53,10 +81,17 @@ export function apply(ctx, config = {}) {
     /* diagnostics must never break apply */
   }
   try {
-    const result = core.apply(stabilizedCtx, {
+    const runtimeConfig = {
       ...bootConfig,
-      progressiveTools: config.progressiveTools === true,
-    })
+      progressiveTools: hardenedConfig.progressiveTools === true,
+    }
+    const result = core.apply(attachmentCompatCtx, runtimeConfig)
+    // DSH rc.7's Settings -> Models surface is backed by the configurable
+    // provider directory, not by the live adapter registry alone. Publish the
+    // main DeepSeek + 自动识图 route as a derived alias of official DeepSeek so
+    // a reinstall restores the expected model-group row without making an
+    // arbitrary textProvider look like DeepSeek.
+    installWrapperDirectoryAlias(attachmentCompatCtx, runtimeConfig, logging.logger)
     if (result && typeof result.then === 'function') {
       return result.catch((error) => {
         logging.logger.error(

package/lib/adversarial-hardening.js

@@ -0,0 +1,322 @@
+import { existsSync, realpathSync } from 'node:fs'
+import { mkdir, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const DEFAULT_ARTIFACTS_DIR = '.dsh-vision-router/artifacts'
+const MAX_VIEWPORT_WIDTH = 4096
+const MAX_VIEWPORT_HEIGHT = 4096
+const MAX_SCREENSHOT_PIXELS = 50_000_000
+
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.trim() !== ''
+}
+
+export function normalizeArtifactsDir(value) {
+  if (!isNonEmptyString(value)) return DEFAULT_ARTIFACTS_DIR
+  const raw = value.trim()
+  if (path.isAbsolute(raw) || path.win32.isAbsolute(raw)) return DEFAULT_ARTIFACTS_DIR
+  const parts = raw.split(/[\\/]+/)
+  if (parts.some((part) => part === '..')) return DEFAULT_ARTIFACTS_DIR
+  const normalized = path.normalize(raw)
+  if (normalized === '' || normalized === '.' || normalized === path.sep) return DEFAULT_ARTIFACTS_DIR
+  return normalized
+}
+
+function hardenConfig(config = {}) {
+  const value = config && typeof config === 'object' ? config : {}
+  return { ...value, artifactsDir: normalizeArtifactsDir(value.artifactsDir) }
+}
+
+function isPathInside(root, candidate) {
+  const relative = path.relative(root, candidate)
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative))
+}
+
+function realpathOrResolve(value, realpath = realpathSync) {
+  try {
+    return realpath(value)
+  } catch {
+    return path.resolve(value)
+  }
+}
+
+function workspaceOf(exec) {
+  const cwd = exec?.agent?.session?.header?.cwd
+  return isNonEmptyString(cwd) ? cwd : process.cwd()
+}
+
+function artifactDirectory(exec, configured, realpath = realpathSync) {
+  const workspace = realpathOrResolve(workspaceOf(exec), realpath)
+  const relative = normalizeArtifactsDir(configured)
+  const target = path.resolve(workspace, relative)
+  if (!isPathInside(workspace, target)) {
+    throw new Error('vision-router: artifactsDir must stay inside the session workspace')
+  }
+  return target
+}
+
+export function sameOriginRequest(req) {
+  const origin = req?.headers?.origin
+  const host = req?.headers?.host
+  const fetchSite = req?.headers?.['sec-fetch-site']
+  if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'none') return false
+  if (!origin) return true
+  if (!host) return false
+  try {
+    return new URL(origin).host === host
+  } catch {
+    return false
+  }
+}
+
+function safeViewportDimension(value, fallback, max, label) {
+  if (value === undefined) return fallback
+  if (!Number.isInteger(value) || value <= 0 || value > max) {
+    throw new Error(`vision_html_screenshot: ${label} must be an integer between 1 and ${max}`)
+  }
+  return value
+}
+
+export function htmlRequestAllowed(urlValue, allowedRoot) {
+  let url
+  try {
+    url = new URL(urlValue)
+  } catch {
+    return false
+  }
+  if (url.protocol === 'data:' || url.protocol === 'blob:' || url.protocol === 'about:') return true
+  if (url.protocol !== 'file:') return false
+  let filePath
+  let root
+  try {
+    filePath = realpathSync(fileURLToPath(url))
+    // The allowed root can sit under a symlinked path (macOS /var ->
+    // /private/var, /tmp -> /private/tmp). Resolve it the same way the file
+    // path is resolved, otherwise genuinely local files fail the containment
+    // check. Fail closed when the root cannot be resolved at all.
+    root = realpathSync(allowedRoot)
+  } catch {
+    return false
+  }
+  return isPathInside(root, filePath)
+}
+
+function wrapRequestInterception(page, allowedRoot) {
+  return page.setRequestInterception(true).then(() => {
+    page.on('request', (request) => {
+      try {
+        if (htmlRequestAllowed(request.url(), allowedRoot)) request.continue()
+        else request.abort('blockedbyclient')
+      } catch {
+        try { request.abort('blockedbyclient') } catch { /* best effort */ }
+      }
+    })
+  })
+}
+
+// Full-page wake used when the core module predates wakePageForFullCapture:
+// sweep the scrollbar so lazy images and scroll-triggered reveals below the
+// fold exist before the height is measured and the page is captured.
+async function fallbackWakePageForFullCapture(page, viewportHeight) {
+  const step = Number.isInteger(viewportHeight) && viewportHeight > 0 ? viewportHeight : 720
+  await page.evaluate(() => {
+    document.documentElement.style.scrollBehavior = 'auto'
+  })
+  const total = await page.evaluate(() =>
+    Math.max(document.documentElement.scrollHeight, document.body ? document.body.scrollHeight : 0),
+  )
+  for (let y = 0; y < total; y += step) {
+    await page.evaluate((yy) => window.scrollTo(0, yy), y)
+    await new Promise((resolve) => setTimeout(resolve, 60))
+  }
+  await page.evaluate(() => window.scrollTo(0, 0))
+  await new Promise((resolve) => setTimeout(resolve, 800))
+}
+
+/**
+ * Full scrollable page height (CSS px), measured after reveals have woken.
+ * The viewport height is part of the max: an empty page has zero scroll
+ * height, and must not be misreported as exceeding the pixel safety limit.
+ */
+export async function fullPageHeightOf(page) {
+  return await page.evaluate(() => Math.max(
+    document.documentElement?.scrollHeight ?? 0,
+    document.body?.scrollHeight ?? 0,
+    window.innerHeight,
+  ))
+}
+
+export function createSecureHtmlScreenshotExecute(ctx, core, config, deps = {}) {
+  const importPuppeteer = deps.importPuppeteer ?? (() => import('puppeteer-core'))
+  const fileExists = deps.existsSync ?? existsSync
+  const makeDir = deps.mkdir ?? mkdir
+  const saveFile = deps.writeFile ?? writeFile
+  const realpath = deps.realpathSync ?? realpathSync
+  const wakeFullPage =
+    typeof core?.wakePageForFullCapture === 'function'
+      ? core.wakePageForFullCapture
+      : fallbackWakePageForFullCapture
+
+  return async (args, exec) => {
+    const source = String(args?.source ?? '')
+    if (!/\.(html?|htm)$/i.test(source)) {
+      throw new Error('vision_html_screenshot: source must be a local .html/.htm file')
+    }
+    const fsService = ctx.get('fs')
+    if (fsService === undefined) throw new Error('vision_html_screenshot: the fs service is not available')
+    const resolved = await fsService.resolve(source)
+    const targetPath = core.toRealPath(fsService, resolved)
+    if (!fileExists(targetPath)) throw new Error(`vision_html_screenshot: file not found: ${source}`)
+
+    const targetReal = realpath(targetPath)
+    const workspace = realpathOrResolve(workspaceOf(exec), realpath)
+    const sourceRoot = isPathInside(workspace, targetReal) ? workspace : realpath(path.dirname(targetReal))
+
+    const width = safeViewportDimension(args?.width, 1200, MAX_VIEWPORT_WIDTH, 'width')
+    const height = safeViewportDimension(args?.height, 720, MAX_VIEWPORT_HEIGHT, 'height')
+    const fullPage = args?.fullPage === true
+
+    let puppeteer
+    try {
+      puppeteer = await importPuppeteer()
+    } catch {
+      throw new Error('vision_html_screenshot: puppeteer-core is not installed')
+    }
+    const candidates = core.chromiumCandidates(
+      typeof process !== 'undefined' && process.env ? process.env : {},
+      typeof process !== 'undefined' ? process.platform : '',
+    )
+    const executablePath = candidates.find((candidate) => fileExists(candidate))
+    if (executablePath === undefined) {
+      throw new Error(
+        'vision_html_screenshot: no Chrome/Chromium/Edge found; install one or set CHROME_PATH / PUPPETEER_EXECUTABLE_PATH',
+      )
+    }
+
+    const launchArgs = ['--disable-gpu', '--hide-scrollbars', '--incognito']
+    if (fullPage) launchArgs.push('--blink-settings=imagesLazyLoadingEnabled=false')
+    const launcher = puppeteer.default ?? puppeteer
+    let browser
+    try {
+      browser = await launcher.launch({ executablePath, headless: true, args: launchArgs })
+    } catch (error) {
+      const detail = error && error.message ? error.message : String(error)
+      throw new Error(`vision_html_screenshot: secure Chrome sandbox launch failed: ${detail}`)
+    }
+
+    try {
+      const page = await browser.newPage()
+      await page.setViewport({ width, height })
+      // Puppeteer 25 exposes this API. Treat its absence as a hard failure:
+      // the tool promises an offline render, so silently degrading would
+      // recreate the security gap this boundary exists to close.
+      if (typeof page.setOfflineMode !== 'function') {
+        throw new Error('vision_html_screenshot: browser offline mode is unavailable')
+      }
+      await page.setOfflineMode(true)
+      await wrapRequestInterception(page, sourceRoot)
+      await page.goto(pathToFileURL(targetReal).href, { waitUntil: 'networkidle0', timeout: 30000 })
+
+      let pageHeight
+      if (fullPage) {
+        // Recreate the pre-hardening behavior: wake lazy/scroll-triggered
+        // content before measuring, so below-the-fold reveals are not silently
+        // missing from the capture.
+        await wakeFullPage(page, height)
+        pageHeight = await fullPageHeightOf(page)
+        if (!Number.isFinite(pageHeight) || pageHeight <= 0 || width * pageHeight > MAX_SCREENSHOT_PIXELS) {
+          throw new Error(
+            `vision_html_screenshot: full-page capture exceeds the ${MAX_SCREENSHOT_PIXELS} pixel safety limit`,
+          )
+        }
+      } else if (width * height > MAX_SCREENSHOT_PIXELS) {
+        throw new Error(`vision_html_screenshot: viewport exceeds the ${MAX_SCREENSHOT_PIXELS} pixel safety limit`)
+      }
+
+      const png = fullPage
+        ? await page.screenshot({ type: 'png', fullPage: true })
+        : await page.screenshot({ type: 'png' })
+      const stem = fullPage ? `shot-${width}x${height}-fullpage` : `shot-${width}x${height}`
+      const dir = artifactDirectory(exec, config.artifactsDir, realpath)
+      await makeDir(dir, { recursive: true })
+      const target = path.join(dir, `${core.artifactStemOf(source, stem)}.png`)
+      if (!isPathInside(dir, target)) throw new Error('vision_html_screenshot: unsafe artifact target')
+      await saveFile(target, png)
+      const result = { path: target, width, height, bytes: png.length }
+      if (fullPage) result.pageHeight = pageHeight
+      return JSON.stringify(result)
+    } finally {
+      await browser.close()
+    }
+  }
+}
+
+function wrapTools(tools, ctx, core, config) {
+  if (!tools || (typeof tools !== 'object' && typeof tools !== 'function')) return tools
+  return new Proxy(tools, {
+    get(target, property) {
+      if (property !== 'register') {
+        const value = Reflect.get(target, property, target)
+        return typeof value === 'function' ? value.bind(target) : value
+      }
+      const register = Reflect.get(target, property, target)
+      return (def) => {
+        if (def?.name === 'vision_html_screenshot' && typeof def.execute === 'function') {
+          return register.call(target, {
+            ...def,
+            execute: createSecureHtmlScreenshotExecute(ctx, core, config),
+          })
+        }
+        return register.call(target, def)
+      }
+    },
+  })
+}
+
+export function installAdversarialHardening(ctx, config = {}, core) {
+  if (!ctx || typeof ctx !== 'object') return { ctx, config: hardenConfig(config) }
+  const hardenedConfig = hardenConfig(config)
+  const wrapped = new Proxy(ctx, {
+    get(target, property) {
+      if (property === 'tools') return wrapTools(target.tools, wrapped, core, hardenedConfig)
+      if (property === 'effect') {
+        const effect = Reflect.get(target, property, target)
+        if (typeof effect !== 'function') return effect
+        return (factory, label) => {
+          if (label !== 'vision-router: proxy fetch') return effect.call(target, factory, label)
+          return effect.call(target, () => {
+            const originalFetch = globalThis.fetch
+            const disposer = factory()
+            const installedFetch = globalThis.fetch
+            let active = true
+            // Later plugins may capture this function. Making it an inert
+            // delegator on unload removes Vision Router from the chain even if
+            // another plugin still sits above it, and prevents it resurfacing
+            // when that later plugin restores the fetch value it captured.
+            const guardedFetch = (...args) => active
+              ? installedFetch(...args)
+              : originalFetch(...args)
+            globalThis.fetch = guardedFetch
+            return () => {
+              active = false
+              if (globalThis.fetch === guardedFetch) {
+                globalThis.fetch = originalFetch
+                // The core disposer is safe only while our guard is still the
+                // active process-level fetch. Never let its unconditional
+                // assignment clobber a later plugin's patch.
+                if (typeof disposer === 'function') disposer()
+              }
+            }
+          }, label)
+        }
+      }
+      // Deliberately do NOT wrap ctx.inject or injected child contexts. DSH
+      // rc.6 ties route/effect ownership to the exact child-context identity;
+      // replacing it with a Proxy previously made host routes disappear (#160).
+      const value = Reflect.get(target, property, target)
+      return typeof value === 'function' ? value.bind(target) : value
+    },
+  })
+  return { ctx: wrapped, config: hardenedConfig }
+}

package/lib/android-attachment-compat.js

@@ -0,0 +1,162 @@
+import { createHash } from 'node:crypto'
+
+const wrappedContexts = new WeakMap()
+const MAX_TRANSIENT_ATTACHMENTS = 64
+
+function nonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0
+}
+
+export function isAndroidTermuxRuntime(options = {}) {
+  const platform = options.platform ?? process.platform
+  const env = options.env ?? process.env
+  if (platform === 'android') return true
+  if (nonEmptyString(env?.TERMUX_VERSION)) return true
+  const prefix = nonEmptyString(env?.PREFIX) ? env.PREFIX : ''
+  return prefix.includes('/com.termux/') || prefix.includes('\\com.termux\\')
+}
+
+export function isPermissionBoundaryError(error) {
+  let current = error
+  const seen = new Set()
+  for (let depth = 0; current && depth < 8; depth += 1) {
+    if ((typeof current === 'object' || typeof current === 'function') && seen.has(current)) break
+    if (typeof current === 'object' || typeof current === 'function') seen.add(current)
+    const code = current && typeof current === 'object' ? current.code : undefined
+    if (code === 'EACCES' || code === 'EPERM') return true
+    current = current && typeof current === 'object' ? current.cause : undefined
+  }
+  return false
+}
+
+function displayName(value) {
+  if (!nonEmptyString(value)) return undefined
+  const leaf = value.slice(Math.max(value.lastIndexOf('/'), value.lastIndexOf('\\')) + 1)
+  const clean = leaf.replace(/[\u0000-\u001f\u007f]/g, '').trim().slice(0, 255)
+  return clean === '' ? undefined : clean
+}
+
+async function probeImage(data, injectedProbe) {
+  if (typeof injectedProbe === 'function') return injectedProbe(data)
+  const mod = await import('sharp')
+  const sharp = mod.default ?? mod
+  const metadata = await sharp(data, { failOn: 'none' }).metadata()
+  const width = Number(metadata.width ?? 0)
+  const height = Number(metadata.height ?? 0)
+  if (!Number.isInteger(width) || width <= 0 || !Number.isInteger(height) || height <= 0) {
+    throw new Error('vision-router: Android attachment fallback could not read image dimensions')
+  }
+  return { width, height }
+}
+
+async function transientStoredImage(input, injectedProbe) {
+  const data = input?.data
+  if (!(data instanceof Uint8Array) || data.byteLength === 0) {
+    throw new Error('vision-router: Android attachment fallback received empty image bytes')
+  }
+  const mediaType = input?.mediaType
+  if (!nonEmptyString(mediaType)) {
+    throw new Error('vision-router: Android attachment fallback received no media type')
+  }
+  const { width, height } = await probeImage(data, injectedProbe)
+  const sha256 = createHash('sha256').update(data).digest('hex')
+  const name = displayName(input?.name)
+  const ref = {
+    attachmentId: `sha256:${sha256}`,
+    mediaType,
+    bytes: data.byteLength,
+    width,
+    height,
+    ...(name !== undefined ? { name } : {}),
+  }
+  return { ref, data }
+}
+
+function rememberTransient(map, stored) {
+  const id = String(stored.ref.attachmentId)
+  if (map.has(id)) map.delete(id)
+  map.set(id, stored)
+  while (map.size > MAX_TRANSIENT_ATTACHMENTS) {
+    const oldest = map.keys().next().value
+    map.delete(oldest)
+  }
+}
+
+/**
+ * Android/Termux compatibility shim for deepseek-harness attachment-local.
+ *
+ * Current DSH attachment-local proves directory durability by fsyncing every
+ * ancestor from DSH_HOME to the filesystem root. Android SELinux lets Termux
+ * access its own /data/data/com.termux subtree but intentionally denies opening
+ * /data/data itself, so saveImage() is wrapped as ATTACHMENT_WRITE_FAILED even
+ * though the image bytes are otherwise readable.
+ *
+ * Keep the host service authoritative. Only when an Android runtime reaches an
+ * EACCES/EPERM boundary do Vision Router's own calls fall back to a bounded,
+ * process-local content-addressed attachment. The paired readImage() wrapper
+ * makes the direct vision-http path and plugin-side bridge code consume those
+ * bytes normally. Once upstream accepts the save, this path is never used.
+ */
+export function installAndroidAttachmentCompat(ctx, logger, options = {}) {
+  if (!ctx || typeof ctx !== 'object' || !isAndroidTermuxRuntime(options.runtime)) return ctx
+  const cached = wrappedContexts.get(ctx)
+  if (cached) return cached
+
+  let attachments
+  try {
+    attachments = typeof ctx.get === 'function' ? ctx.get('attachments') : undefined
+  } catch {
+    return ctx
+  }
+  if (!attachments || typeof attachments.saveImage !== 'function' || typeof attachments.readImage !== 'function') {
+    return ctx
+  }
+
+  const transient = new Map()
+  const wrappedAttachments = new Proxy(attachments, {
+    get(target, property) {
+      if (property === 'saveImage') {
+        return async (input) => {
+          try {
+            return await target.saveImage(input)
+          } catch (error) {
+            if (!isPermissionBoundaryError(error)) throw error
+            const stored = await transientStoredImage(input, options.probeImage)
+            rememberTransient(transient, stored)
+            try {
+              logger?.warn?.(
+                'vision-router: Android/Termux attachment save hit an inaccessible ancestor; using a process-local image ref until DSH attachment-local is fixed upstream',
+              )
+            } catch {
+              /* diagnostics must never block the fallback */
+            }
+            return stored.ref
+          }
+        }
+      }
+      if (property === 'readImage') {
+        return async (ref, signal) => {
+          signal?.throwIfAborted?.()
+          const id = String(ref?.attachmentId ?? '')
+          const stored = transient.get(id)
+          if (stored !== undefined) return stored
+          return target.readImage(ref, signal)
+        }
+      }
+      const value = Reflect.get(target, property, target)
+      return typeof value === 'function' ? value.bind(target) : value
+    },
+  })
+
+  const wrapped = new Proxy(ctx, {
+    get(target, property) {
+      if (property === 'get') {
+        return (name) => (name === 'attachments' ? wrappedAttachments : target.get(name))
+      }
+      const value = Reflect.get(target, property, target)
+      return typeof value === 'function' ? value.bind(target) : value
+    },
+  })
+  wrappedContexts.set(ctx, wrapped)
+  return wrapped
+}