dsh-vision-router 1.6.2 → 1.7.1

package/README.md

@@ -16,8 +16,8 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.5.3"><img src="https://img.shields.io/badge/release-v1.5.3-5B4CF0?style=flat-square" alt="Release v1.5.3" /></a>
-  <a href="tests"><img src="https://img.shields.io/badge/verified-368%20tests-2EA44F?style=flat-square" alt="Verified: 368 tests" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.7.1"><img src="https://img.shields.io/badge/release-v1.7.1-5B4CF0?style=flat-square" alt="Release v1.7.1" /></a>
+  <a href="tests"><img src="https://img.shields.io/badge/verified-657%20tests-2EA44F?style=flat-square" alt="Verified: 657 tests" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="License: MIT" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
   <img src="https://img.shields.io/badge/runtime-no%20Python-8A2BE2?style=flat-square" alt="No Python" />
@@ -29,9 +29,9 @@
 <p align="center">💬 <strong>QQ community group: 1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **Announcement (v1.6.2)**
+> 📌 **Announcement (v1.7.1)**
 >
-> **v1.6.2:** Stability release — fixes onboarding, OCR, model synchronization and large-image handling, improving long-session and overall runtime reliability.
+> **v1.7.1:** Remote settings can now be enabled after an explicit risk confirmation.
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />
@@ -265,7 +265,7 @@ vision_long_screenshot_ocr image="chat-log.png" chunkHeight=1200 overlap=120
 
 The vision tools try backends in order and surface an error only after all of them fail:
 
-1. **User vision models**: one per settings row, top to bottom; only models under **Settings → Models** that explicitly declare image input are shown;
+1. **User vision models**: one per settings row, top to bottom; active providers remain visible even when model enumeration is partial, callable generative models stay selectable, image metadata is advisory, and actual support is verified at runtime;
 2. **Local Ollama (optional, off by default)**: `localOllama.enabled` adds keyless, offline recognition through your local Ollama (for example qwen2.5vl);
 3. **Local LM Studio (optional, off by default)**: `localLmStudio.enabled` follows Ollama and requires the real model identifier shown in LM Studio Developer or returned by `/v1/models`;
 4. **Advanced custom HTTP vision endpoints**: legacy/advanced `httpProviders`, when present, run after the local backends;
@@ -345,7 +345,7 @@ Everything is optional; defaults work out of the box. Edit via the Web card or a
 | `rewriteImages` | `true` | rewrite image blocks in the model input (cached description or tool-hint marker); the UI log keeps images |
 | `desktopScreenshot` | `false` | privacy opt-in for the model-callable `vision_screenshot` desktop-capture tool; checked live before every capture |
 | `freeFallback` | `true` | append the anonymous OVH models after explicit local/custom HTTP backends; turning this off never disables an explicitly configured local backend |
-| `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai' }` | **Local vision backend (merged from dsh-vision)**: when enabled, `local-ollama` leads the HTTP vision chain; skipped automatically when Ollama is down; `format` selects `openai` (`/chat/completions`) or `anthropic` (`/messages`); optional `temperature` / `top_p` are sent only when explicitly set, otherwise the local server default is respected |
+| `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai' }` | **Local vision backend (merged from dsh-vision)**: when enabled, `local-ollama` leads the HTTP vision chain; skipped automatically when Ollama is down; `format` selects `openai` (`/chat/completions`) or `anthropic` (`/messages`); optional `temperature` / `top_p` are sent only when explicitly set. v1.7 prewarms loopback models and renews a 30-minute residency so cold loading is not charged to the normal inference deadline |
 | `localLmStudio` | `{ enabled: false, baseURL: 'http://localhost:1234/v1', model: '', format: 'openai' }` | **Local LM Studio backend (merged from dsh-vision)**: follows Ollama and precedes custom/cloud HTTP backends; enabling it requires the real model identifier shown in LM Studio Developer or returned by `/v1/models`; supports the same optional sampling fields, while `format: 'anthropic'` requires LM Studio 0.4.1+ |
 | `instantDescribe` | `false` | **Instant local translation (merged from dsh-vision)**: when on and at least one local backend is usable, uncached image blocks are recognized before the first model step; Ollama is tried before LM Studio with a shared timeout budget, multi-image batches run concurrently (up to 3), and failures fall back to the static tool-hint marker |
 | `localDescribeStyle` | `plain` | **Local recognition output style (merged from dsh-vision)**: `plain` = flat description; `structured` = structured recognition (【初步判断】/【细节】/【空间结构】/【原图尺寸】), better for screenshot analysis |
@@ -393,6 +393,7 @@ ollama pull qwen2.5vl
 **3. What happens**
 
 - When enabled, `local-ollama` heads the HTTP vision chain. For a strict local-only setup, remove cloud vision rows/custom HTTP endpoints and turn off `freeFallback`.
+- **v1.7 cold-start handling:** the selected loopback Ollama model is prewarmed through Ollama's native API and kept resident for 30 minutes. If it is cold when Ollama is the primary image backend, loading completes before the normal vision-task budget starts; a short `/api/ps` probe keeps a dead service on the fast fallback path. Remote Ollama URLs are never auto-warmed.
 - **LM Studio works the same way** — enable `localLmStudio` in the same "Local vision" group with its OpenAI-compatible endpoint (default `http://localhost:1234/v1`) and enter the exact model identifier shown in Developer or `/v1/models`. It sits after `local-ollama` and before custom/cloud HTTP backends.
 - Each local backend can speak **OpenAI or Anthropic format** via `format` (default `openai`). Anthropic mode routes to `/v1/messages` with `anthropic-version` and base64 image sources; `x-api-key` is sent only when a key is configured. LM Studio needs version 0.4.1 or newer for this endpoint.
 - If a local backend is down or the call times out, its entry is skipped automatically and the chain falls through to the cloud backends — no call breaks.

package/README.zh.md

@@ -16,8 +16,8 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.5.3"><img src="https://img.shields.io/badge/release-v1.5.3-5B4CF0?style=flat-square" alt="Release v1.5.3" /></a>
-  <a href="tests"><img src="https://img.shields.io/badge/verified-368%20tests-2EA44F?style=flat-square" alt="Verified: 368 tests" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.7.1"><img src="https://img.shields.io/badge/release-v1.7.1-5B4CF0?style=flat-square" alt="Release v1.7.1" /></a>
+  <a href="tests"><img src="https://img.shields.io/badge/verified-657%20tests-2EA44F?style=flat-square" alt="Verified: 657 tests" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="License: MIT" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
   <img src="https://img.shields.io/badge/runtime-no%20Python-8A2BE2?style=flat-square" alt="No Python" />
@@ -29,9 +29,9 @@
 <p align="center">💬 <strong>QQ 用户交流群：1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **公告（v1.6.2）**
+> 📌 **公告（v1.7.1）**
 >
-> **v1.6.2：集中修复引导、OCR、模型同步与大图处理问题，提升长会话和整体运行稳定性。**
+> **v1.7.1：远程设置现可在风险确认后开启。**
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />
@@ -178,7 +178,7 @@ opencode-go + 自动识图       ← 发图片时选这个
 | Intern AI（上海AI实验室） | `internvl-latest` · `internvl3.5-latest` | 30 RPM，**9000 万 token/月** | ✅ | chat.intern-ai.org.cn |
 | Groq | `meta-llama/llama-4-scout-17b-16e-instruct`（原生多模态，最多 5 张图） | 30 RPM / 14,400 次/天，免卡 | ❌ 需代理 | console.groq.com |
 | Google AI Studio | `gemini-2.5-flash` · `gemini-2.5-flash-lite` | 10–30 RPM / 500–1,500 次/天 | ❌ 需代理 | aistudio.google.com |
-| NVIDIA NIM | `meta/llama-3.2-11b-vision-instruct` · `nvidia/nemotron-nano-12b-v2-vl` | 40 RPM，免卡 | ⚠️ | build.nvidia.com |
+| NVIDIA NIM | `meta-llama/llama-3.2-11b-vision-instruct` · `nvidia/nemotron-nano-12b-v2-vl` | 40 RPM，免卡 | ⚠️ | build.nvidia.com |
 | OpenCode Zen | `mimo-v2.5-free`（视觉 + 代码） | 30 RPM / 500 次/天 | ⚠️ | opencode.ai/zen |
 | OpenRouter | `google/gemma-4-26b-a4b-it:free` · `google/gemma-4-31b-it:free` | 未充值账户 50 次/天 | ❌ 需代理 | openrouter.ai |
 
@@ -264,7 +264,7 @@ vision_long_screenshot_ocr image="chat-log.png" chunkHeight=1200 overlap=120
 
 视觉工具按顺序逐个尝试，全部失败才报错：
 
-1. **用户视觉模型**：设置卡里一行一个，从上到下；只显示 **设置 → 模型** 中明确声明支持 image 输入的模型；
+1. **用户视觉模型**：设置卡里一行一个，从上到下；已启用供应商即使模型枚举部分失败也会保留在下拉中，可调用的生成式模型继续可选，图片能力声明只作提示，最终以运行时实际调用为准；
 2. **本地 Ollama（可选，默认关）**：`localOllama.enabled` 开启后，通过本机 Ollama 做免 Key、离线识别（例如 qwen2.5vl）；
 3. **本地 LM Studio（可选，默认关）**：`localLmStudio.enabled` 排在 Ollama 之后，模型名必须填写 LM Studio Developer 页或 `/v1/models` 返回的真实标识；
 4. **高级自定义 HTTP 视觉端点**：旧配置/高级配置中的 `httpProviders` 排在本地后端之后；
@@ -344,7 +344,7 @@ Web 配置页在 **设置 → 插件 → 插件配置** 下注册「视觉路由
 | `rewriteImages` | `true` | 模型输入层改写图片块（缓存描述或工具提示标记）；界面日志保留图片 |
 | `desktopScreenshot` | `false` | 模型可调用的 `vision_screenshot` 桌面截屏隐私开关；每次截屏前实时检查 |
 | `freeFallback` | `true` | 在显式本地/自定义 HTTP 后端之后追加匿名 OVH 模型；关闭它不会停用用户明确配置的本地后端 |
-| `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai' }` | **本地视觉后端（并入自 dsh-vision）**：开启后 local-ollama 排在 HTTP 视觉链最前；Ollama 未运行会自动跳过；`format` 可选 `openai`（`/chat/completions`）或 `anthropic`（`/messages`）；可选的 `temperature` / `top_p` 只在显式填写时发送，留空尊重本地服务默认值 |
+| `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai' }` | **本地视觉后端（并入自 dsh-vision）**：开启后 local-ollama 排在 HTTP 视觉链最前；Ollama 未运行会自动跳过；`format` 可选 `openai`（`/chat/completions`）或 `anthropic`（`/messages`）；可选的 `temperature` / `top_p` 只在显式填写时发送。v1.7 会预热本机 loopback 模型并续期 30 分钟驻留，冷加载时间不再计入正常识图截止时间 |
 | `localLmStudio` | `{ enabled: false, baseURL: 'http://localhost:1234/v1', model: '', format: 'openai' }` | **本地 LM Studio 后端（并入自 dsh-vision）**：排在 Ollama 之后、自定义/云 HTTP 后端之前；开启时必须填写 LM Studio Developer 页或 `/v1/models` 返回的真实模型标识；可选采样参数同 Ollama，`format: 'anthropic'` 需 LM Studio 0.4.1+ |
 | `instantDescribe` | `false` | **即时本地翻译（并入自 dsh-vision）**：开启且至少一个本地后端可用时，在第一模型步之前识别无缓存图片块；Ollama → LM Studio 共用总超时预算，多图并发上限 3，失败则回退静态工具标记 |
 | `localDescribeStyle` | `plain` | **本地识别输出风格（并入自 dsh-vision）**：`plain` = 平铺描述；`structured` = 结构化识别（【初步判断】/【细节】/【空间结构】/【原图尺寸】），截图分析质量更高 |
@@ -388,6 +388,7 @@ ollama pull qwen2.5vl
 **3. 行为说明**
 
 - 开启后 `local-ollama` 排在 HTTP 视觉链最前。若要严格纯本地，请移除云视觉行/自定义 HTTP 端点，并关闭 `freeFallback`。
+- **v1.7 冷启动处理：**选中的本机 loopback Ollama 模型会通过原生 API 预热并保持 30 分钟驻留。如果模型在 Ollama 作为首个图片后端时已经冷却，加载会在正常视觉任务预算开始之前完成；短 `/api/ps` 探测保证服务未运行/挂死时仍快速进入 fallback。远程 Ollama URL 不会自动预热。
 - **LM Studio 同理**——同一「本地视觉」组里开启 `localLmStudio`，填 OpenAI 兼容端点（默认 `http://localhost:1234/v1`），并使用 Developer 页或 `/v1/models` 返回的真实模型标识。它排在 `local-ollama` 之后、自定义/云 HTTP 后端之前。
 - 每个本地后端可通过 `format` 选择 **OpenAI 或 Anthropic 格式**（默认 `openai`）。Anthropic 模式走 `/v1/messages`，带 `anthropic-version` 并把图片转为 base64 source；只有配置了 Key 才发送 `x-api-key`。LM Studio 需 0.4.1 或更高版本才提供该端点。
 - 任一本地后端未运行或调用超时时自动跳过，继续降级到云链——任何调用都不受影响。

package/docs/doctor.md

@@ -1,6 +1,6 @@
 # Vision Router doctor / repair
 
-Vision Router ships a small standalone diagnostic CLI. It does not need DSH to boot first, so it can still run when DSH exits while parsing a broken profile manifest.
+Vision Router ships a small standalone diagnostic CLI. It does not need DSH to boot first, so it can still run when DSH exits while parsing a broken profile manifest or when an older Vision Router build left one conversation unable to cold-resume.
 
 ## Normal installation stays unchanged
 
@@ -68,3 +68,29 @@ npx dsh-vision-router repair --profile web
 ```
 
 to rewrite them to bare names (`dsh-vision-router`, `@deepseek-ai/*`), which exempt every future version, so upgrades take effect immediately again. Unrelated entries and the rest of the file are left untouched.
+
+## Repair a conversation that only breaks after restarting DSH
+
+A very early Vision Router build briefly persisted the automatic vision-tool mount reminder as a `user/message` without a message `id`. The conversation could keep working in the live process, but after DSH restarted the stricter cold-resume validator could reject that stored event with an error containing:
+
+```text
+lacks an identified message
+```
+
+Current Vision Router builds no longer create that malformed event. To recover an already-affected conversation, **stop DSH first**, then run:
+
+```sh
+npx dsh-vision-router repair-sessions
+```
+
+The repair is intentionally narrow and fail-closed:
+
+- it scans `$DSH_HOME/sessions` for the exact historical Vision Router auto-mount reminder signature only;
+- unrelated malformed messages are not changed;
+- both raw `session.jsonl` and DSH's default checksummed `session.jsonl.zstd` format are supported;
+- unchanged Zstandard frames stay byte-for-byte identical;
+- torn/incomplete logs are refused so DSH can perform its own crash recovery first;
+- the source file identity is checked again immediately before replacement, so a live writer causes the operation to abort instead of racing;
+- every changed log receives a byte-for-byte backup next to the original before replacement, and the repaired log is re-read and verified before success is reported.
+
+After the command reports a repaired session, restart DSH and reopen the conversation. Running `repair-sessions` again is idempotent: already-repaired logs are left untouched.

package/docs/remote-settings.md

@@ -0,0 +1,9 @@
+# Remote Vision Router settings
+
+Vision Router uses a dedicated DSH Connection RPC channel at `/vision-router-settings/*` because the global DSH settings/credentials plane is intentionally loopback-only.
+
+Remote editing is off by default. When a Vision Router settings page is opened through a DSH trusted host while the permission is still disabled, the page shows an explicit risk confirmation. Cancelling leaves remote editing disabled and writes nothing. Confirming enables only `allowRemoteSettings`, then reloads the scoped Vision Router settings immediately. The same permission can still be enabled or revoked from the loopback settings page.
+
+DSH `trustedHosts` protects the browser carrier against Host/Origin/DNS-rebinding attacks; it is **not user authentication**. Enable remote editing only when you trust the clients that can reach the DSH instance. Ordinary remote mutations remain restricted to the explicit Vision Router allow-list. Credential-bearing HTTP providers, local Ollama/LM Studio configuration, artifact paths and every other field not present in that allow-list stay unavailable remotely. `allowRemoteSettings` itself is not added to the ordinary mutation allow-list: it can be enabled only through the explicit risk-confirmation flow (or from the loopback settings page).
+
+If DSH is behind Nginx, Caddy or another reverse proxy, forward `/vision-router-settings/*` to the same DSH origin in addition to the normal DSH routes. The UI detects a 404 on this channel and shows this requirement directly.

package/docs/update-check.md

@@ -23,7 +23,7 @@ dsh plugin --profile <current-profile> add dsh-vision-router@<latest>
 
 The registry-confirmed target version is installed explicitly rather than through a bare `update`. This matters because pnpm 11 applies `minimumReleaseAge` (default 1440 minutes): a plain `pnpm update` silently keeps the current version while every candidate release is younger than 24h and still exits 0 ("Already up to date") — a false-success update that leaves the old version running after restart. `add <name>@<version>` installs the confirmed release (pnpm auto-exempts the requested version from the policy when needed). For non-registry installs (git/file/link/workspace specs) the updater keeps `update` semantics and only verifies the result.
 
-The subprocess uses `execFile` with `shell: false`; no shell command is constructed from browser input. The update endpoint also requires a process-local token returned by the same-origin update-check endpoint. After the updater exits, the plugin reads the `dsh-vision-router` manifest under the profile's `node_modules` and verifies that the installed version actually reached the target — **a zero exit code alone is never reported as success**. Only a verified update asks the user to restart DSH so the new plugin bundle is loaded.
+The subprocess uses `execFile` with `shell: false`; no shell command is constructed from browser input. The update endpoint also requires a process-local bearer token. That token is issued only to the local DSH UI (loopback transport plus a localhost/loopback Host); a remotely exposed settings page can still perform the read-only version check, but its response does not contain the mutation token and therefore cannot trigger the local updater. The POST update route independently enforces the same local-UI boundary before validating the token. After the updater exits, the plugin reads the `dsh-vision-router` manifest under the profile's `node_modules` and verifies that the installed version actually reached the target — **a zero exit code alone is never reported as success**. Only a verified update asks the user to restart DSH so the new plugin bundle is loaded.
 
 If the CLI cannot be verified — for example a raw TypeScript source entry that needs a workspace-specific loader — the one-click button is not offered. This commonly applies to a DSH source checkout launched with `pnpm dsh`: version checking still works, but updating remains under the source workspace's own pnpm workflow. The card keeps the version information and release-notes link and tells the user to update through their original DSH installation path instead.
 

package/entry.js

@@ -10,12 +10,21 @@ import z from '@deepseek-ai/schemastery'
 import * as core from './index.js'
 import { installVisionRouterFileLogging } from './lib/file-logger.js'
 import { contextWithDelegatedReplay } from './lib/replay-delegation.js'
+import { contextWithReplayEnvelopeV2Compat } from './lib/replay-envelope-v2-compat.js'
+import { contextWithVisionExecutionPolicy } from './lib/vision-execution-policy.js'
+import { installLiveModelDiscovery } from './lib/live-model-discovery.js'
+import { installVisionModelRegistry } from './lib/vision-model-registry.js'
+import { installLiveModelClientPrelude } from './lib/live-model-client-prelude.js'
 import { installAdversarialHardening } from './lib/adversarial-hardening.js'
+import { installOllamaColdStartGuard } from './lib/ollama-cold-start.js'
 import { installLocalVisionStabilizer } from './lib/local-vision-stabilizer.js'
 import { installWrapperDirectoryAlias } from './lib/wrapper-directory.js'
 import { installAndroidAttachmentCompat } from './lib/android-attachment-compat.js'
 import { contextWithCoalescedAdapterUpdates } from './lib/adapter-update-coalescer.js'
 import { installTesseractExecFileCompat } from './lib/tesseract-exec-compat.js'
+import { installLocalMutationRouteBoundary } from './lib/web-capability-boundary.js'
+import { installScreenshotSourceBoundary } from './lib/screenshot-source-boundary.js'
+import { installVisionRouterRemoteSettingsBridge } from './lib/remote-settings-bridge.js'
 import {
   installStructuredFlowHardening,
   normalizeGuidanceOverrides,
@@ -27,16 +36,46 @@ import {
   protectRc7ProviderOwnership,
 } from './lib/dsh-contract-compat.js'
 
+// Increment whenever the browser-visible settings contract gains a field whose
+// absence changes write semantics. This revision is also exposed as a resolved
+// schema default so a newer browser client can distinguish a genuinely updated
+// Host from a stale in-process plugin module instead of reporting a generic
+// readback mismatch after the old Host rejects a newly visible field.
+export const SETTINGS_CONTRACT_REVISION = 4
+
 // Schemastery object schemas expose set() as the supported way to replace a
 // field schema. This mutates the Config object that index.js itself later uses
 // for the settings namespace, so composition config and settings validation
 // agree on the same default.
 core.Config.set('progressiveTools', z.boolean().default(false))
-// Structured 1+x now also has a turn-level wall-clock budget. Individual
+// Structured 1+x also has a turn-level wall-clock budget. Individual
 // visionTaskTimeoutMs budgets remain unchanged; this one prevents a deep turn
 // from multiplying them into several minutes of serial waiting.
 core.Config.set('visionTurnBudgetMs', z.number().step(1000).min(10000).max(600000).default(90000))
 
+// Both visible entry points — Settings > Vision Router and the legacy
+// Settings > Plugins compatibility card — edit the same Host-owned namespace.
+// Keep the depth enum and custom cap on this final public contract so either
+// entry serializes exactly the same shape and rc.7 Host persistence accepts it.
+core.Config.set('visionDepth', z.union(['fast', 'standard', 'deep', 'custom']).default('standard'))
+core.Config.set('visionDepthMaxCalls', z.number().step(1).min(0).max(100).default(0))
+
+// Settings surfaces and Host persistence must agree on this field. Keep the
+// permission on the public entry contract as well as index.js so a packaged
+// build cannot expose the new client toggle while registering an older Host
+// schema that silently recovers from the rejected settings.mutate call. This
+// deliberately repeats the default: entry.js is the final schema authority
+// loaded by Cordis and therefore the right place to close client/Host drift.
+core.Config.set('allowRemoteSettings', z.boolean().default(false))
+
+// Internal read-only-by-convention handshake. It is not rendered by Vision
+// Router's settings UI and is not in the remote mutable allow-list; its resolved
+// default lets diagnostics prove which schema the running Host actually loaded.
+core.Config.set(
+  'settingsContractRevision',
+  z.number().step(1).min(1).max(SETTINGS_CONTRACT_REVISION).default(SETTINGS_CONTRACT_REVISION),
+)
+
 export * from './index.js'
 export {
   attachmentContextForContract,
@@ -53,30 +92,52 @@ export const Config = core.Config
 // preserve replay identity, while vision-tool network calls are constrained to
 // the exact backends the user selected in Vision Router.
 export function apply(ctx, config = {}) {
-  const logging = installVisionRouterFileLogging(ctx)
-  const runtimeCtx = contextWithDelegatedReplay(logging.ctx, {
+  // DSH's browser WebServer can intentionally bind 0.0.0.0 and carries no
+  // authentication layer of its own. Same-origin headers are only a CSRF
+  // signal, so install a transport-level loopback fence before ANY plugin-owned
+  // route is registered. The wrapper patches only webServer.register and hands
+  // every injection callback the original child context identity unchanged.
+  const localMutationCtx = installLocalMutationRouteBoundary(ctx)
+  const logging = installVisionRouterFileLogging(localMutationCtx)
+  const delegatedReplayCtx = contextWithDelegatedReplay(logging.ctx, {
     wrapperRoute:
       typeof config.wrapperRoute === 'string' && config.wrapperRoute !== ''
         ? config.wrapperRoute
         : 'deepseek-vision',
     visionConfig: config,
   })
+  // DSH rc.7 pi-ai replay v2 stores the real producer under
+  // replayState.response.{provider,model}; the older delegated-replay shim
+  // recognizes the pre-v2 top-level shape. Layer a narrow private compatibility
+  // view so resumed wrapper history keeps provider-native replay metadata rather
+  // than degrading to foreign history at the delegate boundary.
+  const runtimeCtx = contextWithReplayEnvelopeV2Compat(delegatedReplayCtx)
+  // Filesystem authority is separate from browser rendering safety. Put this
+  // boundary INSIDE adversarial hardening so the secure HTML renderer that the
+  // outer layer installs is itself wrapped by canonical workspace containment.
+  const screenshotSourceCtx = installScreenshotSourceBoundary(runtimeCtx, core)
   // Security/runtime boundary shared by the core and the local-vision shim:
   // keep artifacts inside the session workspace, make HTML screenshots truly
   // offline + sandboxed, protect the screenshot-permission side effect, and
   // make the process-wide fetch cleanup coexist with later plugin patches.
   const { ctx: hardenedCtx, config: hardenedConfig } = installAdversarialHardening(
-    runtimeCtx,
+    screenshotSourceCtx,
     config,
     core,
   )
+  // Ollama's native API can preload a model independently of an actual vision
+  // inference. Install this boundary before the local-vision stabilizer so the
+  // final local vision-http adapter is observed after stabilization. Primary
+  // local-Ollama image turns finish a cold model load in pre-step, before the
+  // 45s vision-task budget begins; fallback Ollama warms in the background.
+  const ollamaColdStartCtx = installOllamaColdStartGuard(hardenedCtx, hardenedConfig, core)
   // #141 stabilization boundary: keep the recently merged local-vision
   // behavior isolated from main's existing provider/router semantics. It
   // normalizes only the local settings/runtime seams before core.apply sees
   // the context (desktop screenshot exposure, instant-local budget/one-pass,
   // local vision-http transport and connection-probe fallback).
   const { ctx: stabilizedCtx, bootConfig } = installLocalVisionStabilizer(
-    hardenedCtx,
+    ollamaColdStartCtx,
     hardenedConfig,
     core,
   )
@@ -90,6 +151,10 @@ export function apply(ctx, config = {}) {
         : 90000,
   }
   const rc7 = isRc7ContractRuntime(stabilizedCtx)
+  // The remote settings bridge uses DSH Connection's trusted-host carrier
+  // fence and its own safe-field capability allow-list. Main's local Web
+  // mutation boundary continues to protect the independent /_dsh write routes.
+  installVisionRouterRemoteSettingsBridge(stabilizedCtx, logging.logger)
   const ownershipCtx = rc7 ? protectRc7ProviderOwnership(stabilizedCtx) : stabilizedCtx
   const settingsCtx = rc7
     ? installRc7SettingsCompatibility(ownershipCtx, { ...runtimeConfig, stealth: false }, {
@@ -106,20 +171,54 @@ export function apply(ctx, config = {}) {
   })
   // Final structured-flow guard sits closest to core.apply so it sees the
   // actual tool registrations and pre-step listener. It makes bootstrap
-  // one-shot, enforces fast/standard/deep quotas, tracks mixed branches,
-  // rejects empty/non-evidence results, and applies one shared turn deadline.
+  // one-shot, enforces fast/standard/deep/custom quotas, tracks mixed branches,
+  // rejects empty/non-evidence results, and applies one shared visual deadline.
   const structuredCtx = installStructuredFlowHardening(attachmentCompatCtx, runtimeConfig)
   // DSH rc.7 publishes llm/adapters-updated synchronously from inside
   // registerAdapter(). Coalesce only Vision Router's listener: nested events
   // mark the topology dirty and the outer pass reruns to a fixed point, so we
   // neither double-register a twin nor lose a provider added mid-pass.
   const reconciledCtx = contextWithCoalescedAdapterUpdates(structuredCtx)
+  // Discover the provider's actual /models list independently of DSH's static
+  // catalog. The Host owns credentials/networking/cache; the browser receives
+  // model ids only. A live hit is also the evidence required before an
+  // UNKNOWN_MODEL catalog miss may enter the compatibility bridge.
+  const liveDiscovery = installLiveModelDiscovery(reconciledCtx, {
+    config: runtimeConfig,
+    logger: logging.logger,
+  })
+  // Consolidate the private picker registry without weakening execution
+  // admission. Fresh/stale endpoint models get explicit source labels, while a
+  // model already saved under an active provider stays visible as [saved] even
+  // when that provider does not enumerate every accepted id. Saved-only rows do
+  // NOT alter liveDiscovery.hasModel(), so they cannot authorize a direct
+  // UNKNOWN_MODEL bridge by themselves. The registry also exposes the evidence
+  // source strictly for diagnostics (`known` vs `live`) without changing the
+  // admission decision.
+  installVisionModelRegistry(reconciledCtx, liveDiscovery, { config: runtimeConfig })
+  // Keep endpoint-discovered ids private to Vision Router's settings client:
+  // the prelude wraps this package's browser context rather than changing the
+  // global llm.models response (which would expose UNKNOWN_MODEL entries in the
+  // ordinary chat model picker). The existing classic client bundle stays the
+  // DSH module-system artifact, including HMR/source-map behavior.
+  installLiveModelClientPrelude(reconciledCtx)
+  // Direct compatibility bridging is allowed only after DSH/pi-ai's exact
+  // pre-wire image-capability admission rejection, or a local UNKNOWN_MODEL
+  // backed by exact private-registry evidence. Record the same provenance in
+  // the persistent diagnostics log so one image turn clearly shows attempt ->
+  // adapter failure -> direct bridge -> success/fallback. Provider/network/auth
+  // failures remain authoritative and cannot be retried through a second path.
+  const executionCtx = contextWithVisionExecutionPolicy(reconciledCtx, {
+    isBridgeEvidence: (provider, model) => liveDiscovery.hasModel(provider, model),
+    evidenceSource: (provider, model) => liveDiscovery.evidenceSource?.(provider, model),
+    logger: logging.logger,
+  })
   // index.js historically passes image bytes as `options.input` to the async
   // execFile API. That option is not fed into child stdin, so Tesseract waits
   // for data until the OCR slice expires. Materialize only this exact
   // Tesseract-stdin call to a temporary image file; all other execFile calls
   // keep their native behavior.
-  installTesseractExecFileCompat(reconciledCtx)
+  installTesseractExecFileCompat(executionCtx)
 
   // 启动诊断摘要只描述 composition/apply 的基础配置。设置服务可能稍后
   // 覆盖这些值；每个图片轮还会记录 current() 的实时决策，避免把这个
@@ -140,7 +239,7 @@ export function apply(ctx, config = {}) {
     /* diagnostics must never break apply */
   }
   try {
-    const result = core.apply(reconciledCtx, runtimeConfig)
+    const result = core.apply(executionCtx, runtimeConfig)
     // DSH rc.7's Settings -> Models surface is backed by the configurable
     // provider directory, not by the live adapter registry alone. Publish the
     // main DeepSeek + 自动识图 route as a derived alias of official DeepSeek so