dsh-vision-router 1.7.0 → 1.7.3

package/README.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.7.0"><img src="https://img.shields.io/badge/release-v1.7.0-5B4CF0?style=flat-square" alt="Release v1.7.0" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.7.1"><img src="https://img.shields.io/badge/release-v1.7.1-5B4CF0?style=flat-square" alt="Release v1.7.1" /></a>
   <a href="tests"><img src="https://img.shields.io/badge/verified-657%20tests-2EA44F?style=flat-square" alt="Verified: 657 tests" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="License: MIT" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
@@ -29,9 +29,9 @@
 <p align="center">💬 <strong>QQ community group: 1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **Announcement (v1.7.0)**
+> 📌 **Announcement (v1.7.1)**
 >
-> **v1.7.0:** Live model discovery, stronger settings, session recovery, and Ollama cold-start fixes.
+> **v1.7.1:** Remote settings can now be enabled after an explicit risk confirmation.
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />

package/README.zh.md

@@ -16,7 +16,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.7.0"><img src="https://img.shields.io/badge/release-v1.7.0-5B4CF0?style=flat-square" alt="Release v1.7.0" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v1.7.1"><img src="https://img.shields.io/badge/release-v1.7.1-5B4CF0?style=flat-square" alt="Release v1.7.1" /></a>
   <a href="tests"><img src="https://img.shields.io/badge/verified-657%20tests-2EA44F?style=flat-square" alt="Verified: 657 tests" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="License: MIT" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
@@ -29,9 +29,9 @@
 <p align="center">💬 <strong>QQ 用户交流群：1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **公告（v1.7.0）**
+> 📌 **公告（v1.7.1）**
 >
-> **v1.7.0：模型发现、设置、会话恢复与 Ollama 冷启动全面升级。**
+> **v1.7.1：远程设置现可在风险确认后开启。**
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />
@@ -178,7 +178,7 @@ opencode-go + 自动识图       ← 发图片时选这个
 | Intern AI（上海AI实验室） | `internvl-latest` · `internvl3.5-latest` | 30 RPM，**9000 万 token/月** | ✅ | chat.intern-ai.org.cn |
 | Groq | `meta-llama/llama-4-scout-17b-16e-instruct`（原生多模态，最多 5 张图） | 30 RPM / 14,400 次/天，免卡 | ❌ 需代理 | console.groq.com |
 | Google AI Studio | `gemini-2.5-flash` · `gemini-2.5-flash-lite` | 10–30 RPM / 500–1,500 次/天 | ❌ 需代理 | aistudio.google.com |
-| NVIDIA NIM | `meta/llama-3.2-11b-vision-instruct` · `nvidia/nemotron-nano-12b-v2-vl` | 40 RPM，免卡 | ⚠️ | build.nvidia.com |
+| NVIDIA NIM | `meta-llama/llama-3.2-11b-vision-instruct` · `nvidia/nemotron-nano-12b-v2-vl` | 40 RPM，免卡 | ⚠️ | build.nvidia.com |
 | OpenCode Zen | `mimo-v2.5-free`（视觉 + 代码） | 30 RPM / 500 次/天 | ⚠️ | opencode.ai/zen |
 | OpenRouter | `google/gemma-4-26b-a4b-it:free` · `google/gemma-4-31b-it:free` | 未充值账户 50 次/天 | ❌ 需代理 | openrouter.ai |
 

package/cordis.patch.yml

@@ -4,9 +4,9 @@
 # without any manual cordis.patch.yml edits. Later layers (the profile's own
 # cordis.patch.yml, --patch overlays) override these rows by id.
 
-# 纯增量补丁（issue #34）：不碰核心行。DSH rc.6仍保留旧版隐身接管兼容路径；
-# DSH rc.7则始终由宿主拥有deepseek-official，插件只提供「+ 自动识图」包装路由。
-# 因此这里永远不默认禁用官方llm-deepseek行。
+# 纯增量补丁（issue #34）：不碰核心行。最低支持 Host 仍保留旧兼容路径；
+# batch-attachment 合同的 Host 始终拥有 deepseek-official，插件只提供
+# 「+ 自动识图」包装路由，因此这里永远不默认禁用官方 llm-deepseek 行。
 
 # 挂载插件行。默认保持完整视觉工具表常驻（issue #81）：虽然渐进挂载可以
 # 少发一小段工具 schema，但图片轮首次扩展工具列表会改变请求前缀，可能让
@@ -18,14 +18,27 @@
       config:
         progressiveTools: false
 
-# 放宽附件图片限制（宿主默认 5MB / 4000 万像素 → 20MB / 1 亿像素），
-# 超长聊天记录截图（vision_long_screenshot_ocr 主场景）与大尺寸设计稿/
-# 扫描图可过宿主准入。rc6 与 rc7 的 @deepseek-ai/dsh-attachment-local
-# 均接受这两个可选字段（0.1.0-rc.6 / 0.1.0-rc.7 schema 已核对），且两边
-# dsh-base bundle 都存在 `- id: attachment-local` 行，因此该补丁在两个
-# 运行时上都有效、不破坏 host-neutral 原则；字段可选，不需要可在 profile
-# 补丁层覆写。
+# Vision Router 的附件产品契约：Host attachment store 负责保存用户提交的
+# durable 原件，具体视觉后端负责本次推理所需的 resize/tile/request budget。
+# 因此存储准入保持 20MiB / 1 亿像素，同时在 DSH rc.8 新增的单边限制上
+# 显式选择 10000px：覆盖 4K/手机原图和常见长截图，但不把 Host 的全局
+# 极端长边安全闸无限放开。该值作用于整个 attachment-local（包括原生视觉
+# provider），所以这里刻意不用 32768/无限；更大的部署需求仍可由后续
+# profile/--patch 层按实际 provider 能力覆盖。
+#
+# DSH 的 patch 是“整段 config 替换”而非深度合并。旧版 Vision Router 曾在
+# profile 自己的 cordis.patch.yml 写入同一行的 20MiB/100MP 两个字段；这层
+# 比 bundle 晚，会把这里新加的 maxImageDimension 擦掉，让 rc.8 又落回 2000。
+# 1.7.2 起运行时只对“20MiB + 100MP + rc.8 默认 2000px”这一历史指纹做一次
+# 内存态迁移到 10000px；显式自定义过 dimension 或其他附件策略一律不碰。
+# 这样升级旧 profile 不要求用户手工清理配置，同时后续 profile/--patch 的
+# 明确部署策略仍保持最终所有权。
+#
+# rc.6/rc.7 没有 maxImageDimension；发布合同 CI 会用真实旧包验证额外配置键
+# 不会破坏最低支持 Host。若旧 Host 开始严格拒绝未知键，此处必须改为按能力
+# 生成配置，而不是靠版本字符串分支。
 - id: attachment-local
   config:
     maxImageBytes: 20971520
     maxImagePixels: 100000000
+    maxImageDimension: 10000

package/docs/remote-settings.md

@@ -2,6 +2,8 @@
 
 Vision Router uses a dedicated DSH Connection RPC channel at `/vision-router-settings/*` because the global DSH settings/credentials plane is intentionally loopback-only.
 
-Remote editing is off by default. Enable it only from the loopback Vision Router settings page. DSH `trustedHosts` protects the browser carrier against Host/Origin/DNS-rebinding attacks; it is **not user authentication**. Vision Router therefore exposes only an explicit allow-list of low-risk preferences remotely. Network/proxy settings, credential-bearing HTTP providers, local Ollama/LM Studio endpoints, artifact paths, desktop capture, stealth/route ownership and the remote permission itself remain loopback-only.
+Remote editing is off by default. When a Vision Router settings page is opened through a DSH trusted host while the permission is still disabled, the page shows an explicit risk confirmation. Cancelling leaves remote editing disabled and writes nothing. Confirming enables only `allowRemoteSettings`, then reloads the scoped Vision Router settings immediately. The same permission can still be enabled or revoked from the loopback settings page.
+
+DSH `trustedHosts` protects the browser carrier against Host/Origin/DNS-rebinding attacks; it is **not user authentication**. Enable remote editing only when you trust the clients that can reach the DSH instance. Ordinary remote mutations remain restricted to the explicit Vision Router allow-list. Credential-bearing HTTP providers, local Ollama/LM Studio configuration, artifact paths and every other field not present in that allow-list stay unavailable remotely. `allowRemoteSettings` itself is not added to the ordinary mutation allow-list: it can be enabled only through the explicit risk-confirmation flow (or from the loopback settings page).
 
 If DSH is behind Nginx, Caddy or another reverse proxy, forward `/vision-router-settings/*` to the same DSH origin in addition to the normal DSH routes. The UI detects a 404 on this channel and shows this requirement directly.

package/entry.js

@@ -15,6 +15,7 @@ import { contextWithVisionExecutionPolicy } from './lib/vision-execution-policy.
 import { installLiveModelDiscovery } from './lib/live-model-discovery.js'
 import { installVisionModelRegistry } from './lib/vision-model-registry.js'
 import { installLiveModelClientPrelude } from './lib/live-model-client-prelude.js'
+import { installClientPresentationBoundary } from './lib/client-presentation-boundary.js'
 import { installAdversarialHardening } from './lib/adversarial-hardening.js'
 import { installOllamaColdStartGuard } from './lib/ollama-cold-start.js'
 import { installLocalVisionStabilizer } from './lib/local-vision-stabilizer.js'
@@ -31,9 +32,10 @@ import {
 } from './lib/structured-flow-hardening.js'
 import {
   attachmentContextForContract,
-  installRc7SettingsCompatibility,
-  isRc7ContractRuntime,
-  protectRc7ProviderOwnership,
+  ensureVisionAttachmentAdmissionPolicy,
+  hasBatchAttachmentContract,
+  installHostSettingsCompatibility,
+  protectHostProviderOwnership,
 } from './lib/dsh-contract-compat.js'
 
 // Increment whenever the browser-visible settings contract gains a field whose
@@ -56,7 +58,7 @@ core.Config.set('visionTurnBudgetMs', z.number().step(1000).min(10000).max(60000
 // Both visible entry points — Settings > Vision Router and the legacy
 // Settings > Plugins compatibility card — edit the same Host-owned namespace.
 // Keep the depth enum and custom cap on this final public contract so either
-// entry serializes exactly the same shape and rc.7 Host persistence accepts it.
+// entry serializes exactly the same shape on every supported Host generation.
 core.Config.set('visionDepth', z.union(['fast', 'standard', 'deep', 'custom']).default('standard'))
 core.Config.set('visionDepthMaxCalls', z.number().step(1).min(0).max(100).default(0))
 
@@ -79,6 +81,12 @@ core.Config.set(
 export * from './index.js'
 export {
   attachmentContextForContract,
+  ensureVisionAttachmentAdmissionPolicy,
+  hasBatchAttachmentContract,
+  installHostSettingsCompatibility,
+  protectHostProviderOwnership,
+  // Transitional public aliases retained for callers/tests written during the
+  // rc.7 compatibility pass. Runtime code below no longer branches on names.
   installRc7SettingsCompatibility,
   isRc7ContractRuntime,
   protectRc7ProviderOwnership,
@@ -106,7 +114,7 @@ export function apply(ctx, config = {}) {
         : 'deepseek-vision',
     visionConfig: config,
   })
-  // DSH rc.7 pi-ai replay v2 stores the real producer under
+  // Newer pi-ai replay envelopes store the real producer under
   // replayState.response.{provider,model}; the older delegated-replay shim
   // recognizes the pre-v2 top-level shape. Layer a narrow private compatibility
   // view so resumed wrapper history keeps provider-native replay metadata rather
@@ -150,21 +158,35 @@ export function apply(ctx, config = {}) {
         ? Number(bootConfig.visionTurnBudgetMs)
         : 90000,
   }
-  const rc7 = isRc7ContractRuntime(stabilizedCtx)
+  // The batch-attachment API is the released, non-incidental discriminator
+  // between the minimum Host contract and the newer Host-owned integration
+  // generation. Keep the branch named after that observable capability rather
+  // than a release number so rc.8+ naturally follows the same public contract.
+  const batchAttachmentHost = hasBatchAttachmentContract(stabilizedCtx)
+  // DSH profile overlays replace an attachment-local config object wholesale.
+  // A stale pre-rc.8 Vision Router profile row can therefore erase the newer
+  // bundle's maxImageDimension and silently restore rc.8's 2000px default even
+  // after the plugin package itself has updated. Repair only that historical
+  // 20MiB/100MP fingerprint; explicit deployment policies remain authoritative.
+  if (batchAttachmentHost) {
+    ensureVisionAttachmentAdmissionPolicy(stabilizedCtx, logging.logger)
+  }
   // The remote settings bridge uses DSH Connection's trusted-host carrier
   // fence and its own safe-field capability allow-list. Main's local Web
   // mutation boundary continues to protect the independent /_dsh write routes.
   installVisionRouterRemoteSettingsBridge(stabilizedCtx, logging.logger)
-  const ownershipCtx = rc7 ? protectRc7ProviderOwnership(stabilizedCtx) : stabilizedCtx
-  const settingsCtx = rc7
-    ? installRc7SettingsCompatibility(ownershipCtx, { ...runtimeConfig, stealth: false }, {
+  const ownershipCtx = batchAttachmentHost
+    ? protectHostProviderOwnership(stabilizedCtx)
+    : stabilizedCtx
+  const settingsCtx = batchAttachmentHost
+    ? installHostSettingsCompatibility(ownershipCtx, { ...runtimeConfig, stealth: false }, {
         namespace: 'vision-router',
         Config: core.Config,
       })
     : ownershipCtx
-  // rc.6/Termux keeps the narrow process-local fallback that was required by
-  // the old attachment-local durability walk. rc.7 formalizes AttachmentId as
-  // store-owned, so never synthesize one there: host persistence errors remain
+  // The minimum Host keeps the narrow process-local fallback required by the
+  // old attachment-local durability walk. Batch-capable hosts keep AttachmentId
+  // store-owned, so never fabricate one there: host persistence errors remain
   // authoritative and diagnosable instead of creating a false durable ref.
   const attachmentCompatCtx = attachmentContextForContract(settingsCtx, logging.logger, {
     installAndroidAttachmentCompat,
@@ -174,7 +196,7 @@ export function apply(ctx, config = {}) {
   // one-shot, enforces fast/standard/deep/custom quotas, tracks mixed branches,
   // rejects empty/non-evidence results, and applies one shared visual deadline.
   const structuredCtx = installStructuredFlowHardening(attachmentCompatCtx, runtimeConfig)
-  // DSH rc.7 publishes llm/adapters-updated synchronously from inside
+  // Newer DSH releases publish llm/adapters-updated synchronously from inside
   // registerAdapter(). Coalesce only Vision Router's listener: nested events
   // mark the topology dirty and the outer pass reruns to a fixed point, so we
   // neither double-register a twin nor lose a provider added mid-pass.
@@ -196,6 +218,12 @@ export function apply(ctx, config = {}) {
   // source strictly for diagnostics (`known` vs `live`) without changing the
   // admission decision.
   installVisionModelRegistry(reconciledCtx, liveDiscovery, { config: runtimeConfig })
+  // rc.8 turns ui-attachment into a dynamic presentation plugin and no longer
+  // exports its React implementation as package values. Install a narrowly
+  // scoped browser boundary that supplies Vision Router's own lightweight
+  // gallery to the legacy 1.7.x client factory, so the official package is
+  // never value-required at runtime and remains free to evolve independently.
+  installClientPresentationBoundary(reconciledCtx)
   // Keep endpoint-discovered ids private to Vision Router's settings client:
   // the prelude wraps this package's browser context rather than changing the
   // global llm.models response (which would expose UNKNOWN_MODEL entries in the
@@ -229,7 +257,7 @@ export function apply(ctx, config = {}) {
     const lms = c.localLmStudio && typeof c.localLmStudio === 'object' ? c.localLmStudio : {}
     logging.logger.info(
       'vision-router: base config summary — contract=%s instantDescribe=%s localDescribeStyle=%s localOllama=%s localLmStudio=%s',
-      rc7 ? 'rc7' : 'rc6',
+      batchAttachmentHost ? 'batch-attachments' : 'single-attachment',
       c.instantDescribe === true ? 'on' : 'off',
       c.localDescribeStyle === 'structured' ? 'structured' : 'plain',
       local.enabled === true ? 'on' : 'off',
@@ -240,11 +268,10 @@ export function apply(ctx, config = {}) {
   }
   try {
     const result = core.apply(executionCtx, runtimeConfig)
-    // DSH rc.7's Settings -> Models surface is backed by the configurable
-    // provider directory, not by the live adapter registry alone. Publish the
-    // main DeepSeek + 自动识图 route as a derived alias of official DeepSeek so
-    // a reinstall restores the expected model-group row without making an
-    // arbitrary textProvider look like DeepSeek. On rc.6 the helper is inert.
+    // On newer Hosts the Settings -> Models surface is backed by the
+    // configurable-provider directory, not by the live adapter registry alone.
+    // Publish the main DeepSeek + 自动识图 route as a derived alias of official
+    // DeepSeek. On older Hosts the helper feature-detects and stays inert.
     installWrapperDirectoryAlias(attachmentCompatCtx, runtimeConfig, logging.logger)
     if (result && typeof result.then === 'function') {
       return result.catch((error) => {

package/lib/client-presentation-boundary.js

@@ -0,0 +1,271 @@
+const CLIENT_PRESENTATION_MARK = 'data-vision-router-presentation-boundary'
+
+/**
+ * Browser prelude for the one legacy value edge left in lib/client.js.
+ *
+ * DSH rc.8 made @deepseek-ai/dsh-client-ui-attachment a dynamic presentation
+ * plugin and deliberately stopped exporting its React implementation as
+ * package values. Vision Router must therefore own the presentation of its
+ * `vision_present` tool card instead of reaching into that package.
+ *
+ * The current 1.7.x browser artifact is a hand-maintained self-registering
+ * factory. Rewriting the entire artifact just to replace one value edge would
+ * create a much larger compatibility diff, so this boundary intercepts that
+ * exact legacy require *before it can reach the DSH module table* and supplies
+ * a small plugin-owned gallery with the same narrow props the card already
+ * passes. No DSH attachment UI code or CSS is copied.
+ *
+ * This is intentionally a compatibility boundary, not a general module alias:
+ * only dsh-vision-router's own factory and only the historical attachment
+ * specifier are intercepted. A future modular client can move these components
+ * into its source directly and delete this prelude without changing card data
+ * loading or Host attachment ownership.
+ */
+export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
+  'use strict';
+  var TARGET = 'dsh-vision-router';
+  var LEGACY_ATTACHMENT_VALUE = '@deepseek-ai/dsh-client-ui-attachment';
+
+  function createPresentation(React) {
+    function PresentedImage(props) {
+      var attachment = props.attachment;
+      var load = props.load;
+      var labels = props.labels;
+      var tile = props.tile === true;
+      var state = React.useState(null);
+      var src = state[0];
+      var setSrc = state[1];
+      var failedState = React.useState(false);
+      var failed = failedState[0];
+      var setFailed = failedState[1];
+      var attemptState = React.useState(0);
+      var attempt = attemptState[0];
+      var setAttempt = attemptState[1];
+      var openState = React.useState(false);
+      var open = openState[0];
+      var setOpen = openState[1];
+
+      React.useEffect(function(){
+        var live = true;
+        setSrc(null);
+        setFailed(false);
+        Promise.resolve().then(function(){ return load(attachment); }).then(
+          function(url){ if (live) setSrc(url); },
+          function(){ if (live) setFailed(true); }
+        );
+        return function(){ live = false; };
+      }, [attachment, load, attempt]);
+
+      React.useEffect(function(){
+        if (!open || typeof document === 'undefined') return undefined;
+        var onKeyDown = function(event){ if (event && event.key === 'Escape') setOpen(false); };
+        document.addEventListener('keydown', onKeyDown);
+        return function(){ document.removeEventListener('keydown', onKeyDown); };
+      }, [open]);
+
+      var label = attachment && attachment.name ? attachment.name : labels.image;
+      var box = tile
+        ? { width: 64, height: 64 }
+        : { maxWidth: 240, maxHeight: 240 };
+      var frameStyle = Object.assign({
+        appearance: 'none',
+        border: '1px solid var(--dsw-alias-border-l2)',
+        borderRadius: 8,
+        background: 'var(--dsw-alias-bg-layer-3)',
+        padding: 0,
+        overflow: 'hidden',
+        display: 'flex',
+        alignItems: 'center',
+        justifyContent: 'center',
+        cursor: src ? 'zoom-in' : failed ? 'pointer' : 'default'
+      }, box);
+
+      if (failed) {
+        return React.createElement('button', {
+          type: 'button',
+          title: labels.loadFailed,
+          onClick: function(){ setAttempt(function(value){ return value + 1; }); },
+          style: Object.assign({}, frameStyle, {
+            minWidth: tile ? 64 : 120,
+            minHeight: tile ? 64 : 72,
+            color: 'var(--dsw-alias-label-tertiary)',
+            font: 'inherit',
+            fontSize: 12,
+            padding: 8
+          })
+        }, labels.loadFailed);
+      }
+
+      var thumb = React.createElement('button', {
+        type: 'button',
+        title: labels.open,
+        'aria-label': labels.openNamed(label),
+        disabled: !src,
+        onClick: function(){ if (src) setOpen(true); },
+        style: frameStyle
+      }, src
+        ? React.createElement('img', {
+            src: src,
+            alt: label,
+            style: tile
+              ? { width: '100%', height: '100%', objectFit: 'cover', display: 'block' }
+              : { maxWidth: 240, maxHeight: 240, width: 'auto', height: 'auto', display: 'block' }
+          })
+        : React.createElement('span', {
+            style: { color: 'var(--dsw-alias-label-tertiary)', fontSize: 12, padding: 10 }
+          }, labels.loading)
+      );
+
+      if (!open || !src) return thumb;
+      var overlay = React.createElement('div', {
+        role: 'dialog',
+        'aria-modal': 'true',
+        'aria-label': labels.lightbox.dialog,
+        onClick: function(event){ if (event.target === event.currentTarget) setOpen(false); },
+        style: {
+          position: 'fixed', inset: 0, zIndex: 11000, background: '#000b',
+          display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 24,
+          boxSizing: 'border-box'
+        }
+      },
+        React.createElement('img', {
+          src: src,
+          alt: label,
+          style: { maxWidth: '92vw', maxHeight: '88vh', objectFit: 'contain', borderRadius: 8 }
+        }),
+        React.createElement('button', {
+          type: 'button',
+          'aria-label': labels.lightbox.close,
+          title: labels.lightbox.close,
+          onClick: function(){ setOpen(false); },
+          style: {
+            position: 'fixed', top: 16, right: 18, width: 36, height: 36,
+            borderRadius: 18, border: '1px solid #ffffff55', background: '#111c',
+            color: '#fff', font: 'inherit', fontSize: 22, cursor: 'pointer'
+          }
+        }, '×')
+      );
+      return React.createElement(React.Fragment, null, thumb, overlay);
+    }
+
+    function ImageGallery(props) {
+      var images = Array.isArray(props.images) ? props.images : [];
+      if (images.length === 0) return null;
+      var tile = images.length > 1;
+      return React.createElement('div', {
+        style: {
+          display: 'flex', flexWrap: 'wrap', gap: 6,
+          justifyContent: props.align === 'end' ? 'flex-end' : 'flex-start',
+          alignItems: 'flex-start', maxWidth: '100%'
+        }
+      }, images.map(function(image, index){
+        var attachment = image && image.attachment;
+        var key = attachment && attachment.attachmentId
+          ? String(attachment.attachmentId) + ':' + index
+          : String(index);
+        return React.createElement(PresentedImage, {
+          key: key,
+          attachment: attachment,
+          load: props.load,
+          labels: props.labels,
+          tile: tile
+        });
+      }));
+    }
+
+    return { ImageGallery: ImageGallery };
+  }
+
+  function patchLoader(loader) {
+    if (!loader || (typeof loader !== 'object' && typeof loader !== 'function')) return;
+
+    if (typeof loader.load === 'function' && !loader.load.__visionRouterPresentationBoundary) {
+      var original = loader.load;
+      function load(spec) {
+        if (spec && spec.id === TARGET && typeof spec.factory === 'function') {
+          var factory = spec.factory;
+          spec = Object.assign({}, spec, {
+            factory: function(require) {
+              var React = require('react');
+              var presentation = createPresentation(React);
+              function scopedRequire(id) {
+                if (id === LEGACY_ATTACHMENT_VALUE) return presentation;
+                return require(id);
+              }
+              return factory(scopedRequire);
+            }
+          });
+        }
+        return original.call(this, spec);
+      }
+      Object.defineProperty(load, '__visionRouterPresentationBoundary', { value: true });
+      loader.load = load;
+    }
+
+    // rc.8's parser installs a queue-mode facade first. When the Web shell
+    // later calls create(), ClientModuleSystem switches that *same object* to
+    // live mode by assigning a brand-new loader.load function. That assignment
+    // necessarily erases every queue-time wrapper. Wrap create itself so the
+    // boundary is re-applied immediately after the official queue -> live
+    // transition and before lazy third-party bundles can register.
+    if (typeof loader.create === 'function' && !loader.create.__visionRouterPresentationBoundary) {
+      var originalCreate = loader.create;
+      function create() {
+        var result = originalCreate.apply(this, arguments);
+        patchLoader(loader);
+        return result;
+      }
+      Object.defineProperty(create, '__visionRouterPresentationBoundary', { value: true });
+      loader.create = create;
+    }
+  }
+
+  function install() {
+    if (window.__ModuleLoader__) {
+      patchLoader(window.__ModuleLoader__);
+      return;
+    }
+    var descriptor = Object.getOwnPropertyDescriptor(window, '__ModuleLoader__');
+    if (descriptor && descriptor.configurable === false) return;
+    var stored;
+    Object.defineProperty(window, '__ModuleLoader__', {
+      configurable: true,
+      enumerable: true,
+      get: function(){ return stored; },
+      set: function(value) {
+        stored = value;
+        patchLoader(value);
+        Object.defineProperty(window, '__ModuleLoader__', {
+          configurable: true,
+          enumerable: true,
+          writable: true,
+          value: stored
+        });
+      }
+    });
+  }
+
+  install();
+})();`
+
+export function injectClientPresentationBoundary(html) {
+  if (typeof html !== 'string' || html.includes(CLIENT_PRESENTATION_MARK)) return html
+  const safe = CLIENT_PRESENTATION_PRELUDE.replace(/<\/script/gi, '<\\/script')
+  const script = `<script ${CLIENT_PRESENTATION_MARK}>${safe}</script>`
+  // DSH's client-modules index tap prepends the queue-mode loader bootstrap at
+  // <head>. Run after that parser bootstrap so we can wrap both load() and the
+  // later create() transition. The create wrapper re-applies the boundary when
+  // rc.8 replaces loader.load while entering live mode.
+  const closeHead = html.indexOf('</head>')
+  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
+  return `${html}${script}`
+}
+
+export function installClientPresentationBoundary(ctx) {
+  ctx?.inject?.(['webServer'], (webCtx) => {
+    webCtx.effect(
+      () => webCtx.webServer.tapIndex(injectClientPresentationBoundary),
+      'vision-router: client presentation boundary',
+    )
+  })
+}

package/lib/dsh-contract-compat.js

@@ -1,4 +1,9 @@
-const RC7_OWNED_ROUTES = new Set(['deepseek-official', 'deepseek-official-native'])
+const HOST_OWNED_ROUTES = new Set(['deepseek-official', 'deepseek-official-native'])
+
+const LEGACY_VISION_ATTACHMENT_BYTES = 20 * 1024 * 1024
+const LEGACY_VISION_ATTACHMENT_PIXELS = 100_000_000
+const DSH_RC8_DEFAULT_IMAGE_DIMENSION = 2000
+const VISION_ROUTER_IMAGE_DIMENSION = 10_000
 
 function attachmentStoreOf(ctx) {
   if (!ctx || typeof ctx !== 'object') return undefined
@@ -19,33 +24,119 @@ function attachmentStoreOf(ctx) {
 }
 
 /**
- * Distinguish the released rc.6/rc.7 attachment contracts, not incidental
- * LLM capabilities. rc.6 already shipped registerConfigurableProviders(), so
- * that method cannot identify rc.7. rc.7's AttachmentStore adds saveImages()
- * while rc.6 exposes only validateImage/saveImage/readImage.
+ * Detect the released batch-attachment contract directly. DSH rc.6 exposes
+ * validateImage/saveImage/readImage only; rc.7+ adds AttachmentStore.saveImages().
+ * Do not infer this from unrelated LLM/settings methods: rc.6 already shipped
+ * registerConfigurableProviders(), so those methods cannot prove the attachment
+ * ownership generation.
  */
-export function isRc7ContractRuntime(ctx) {
+export function hasBatchAttachmentContract(ctx) {
   const store = attachmentStoreOf(ctx)
   return !!store && typeof store.saveImages === 'function'
 }
 
 /**
- * Preserve rc.7 provider ownership: Vision Router may wrap/delegate the
- * official provider, but cannot synthesize or replace it. Other adapters pass
- * through unchanged.
+ * Repair one historical Vision Router profile overlay on DSH rc.8.
+ *
+ * Before rc.8 introduced maxImageDimension, Vision Router wrote a profile-local
+ * attachment-local override containing only 20MiB / 100MP. DSH patch rows
+ * replace the WHOLE config object instead of deep-merging it, so that later
+ * profile layer shadows the newer bundle row and rc.8 silently rematerializes
+ * its own 2000px default. Plugin updates cannot delete a user's profile layer.
+ *
+ * The historical 20MiB + 100MP pair is therefore the migration fingerprint.
+ * Only when that exact pair is combined with rc.8's exact 2000px default do we
+ * raise the live store policy to Vision Router's 10000px contract. Explicitly
+ * customised dimensions or unrelated attachment deployments are never touched.
+ * LocalAttachmentStore reads `this.imageLimits` for every validation/save, so
+ * replacing this immutable policy object repairs authoritative admission as
+ * well as the limits projected to the browser for error copy.
  */
-export function protectRc7ProviderOwnership(ctx) {
+export function ensureVisionAttachmentAdmissionPolicy(ctx, logger, options = {}) {
+  const store = attachmentStoreOf(ctx)
+  const limits = store && store.imageLimits
+  if (!store || !limits || typeof limits !== 'object') {
+    return { changed: false, reason: 'attachment-limits-unavailable' }
+  }
+
+  const targetDimension = Number.isInteger(options.maxImageDimension)
+    ? Math.max(1, options.maxImageDimension)
+    : VISION_ROUTER_IMAGE_DIMENSION
+  const legacy =
+    limits.maxImageBytes === LEGACY_VISION_ATTACHMENT_BYTES &&
+    limits.maxImagePixels === LEGACY_VISION_ATTACHMENT_PIXELS &&
+    limits.maxImageDimension === DSH_RC8_DEFAULT_IMAGE_DIMENSION
+
+  if (!legacy) return { changed: false, reason: 'not-legacy-overlay', limits }
+
+  const next = Object.freeze({ ...limits, maxImageDimension: targetDimension })
+  let changed = false
+  try {
+    changed = Reflect.set(store, 'imageLimits', next)
+  } catch {
+    changed = false
+  }
+  if (!changed || store.imageLimits !== next) {
+    try {
+      logger?.warn?.(
+        'vision-router: detected the legacy attachment-local 20MiB/100MP overlay but could not repair maxImageDimension; DSH may still enforce 2000px',
+      )
+    } catch {
+      // Diagnostics must never break Host startup.
+    }
+    return { changed: false, reason: 'limits-readonly', limits }
+  }
+
+  try {
+    logger?.info?.(
+      'vision-router: repaired legacy attachment-local overlay — maxImageDimension %d -> %d',
+      DSH_RC8_DEFAULT_IMAGE_DIMENSION,
+      targetDimension,
+    )
+  } catch {
+    // Diagnostics must never break Host startup.
+  }
+  return { changed: true, reason: 'legacy-overlay-repaired', limits: next }
+}
+
+/**
+ * Keep the migration attached to the service lifecycle, not only initial boot.
+ * DSH hot-reloads profile/home patch files transactionally; attachment-local can
+ * therefore be reconstructed after Vision Router has already started. Cordis'
+ * service injection reruns this narrow check for each replacement instance.
+ */
+export function installVisionAttachmentAdmissionPolicy(ctx, logger, options = {}) {
+  const initial = ensureVisionAttachmentAdmissionPolicy(ctx, logger, options)
+  try {
+    if (ctx && typeof ctx.inject === 'function') {
+      ctx.inject(['attachments'], (attachmentCtx) => {
+        ensureVisionAttachmentAdmissionPolicy(attachmentCtx, logger, options)
+      })
+    }
+  } catch {
+    // Older/partial contexts may not expose lifecycle injection. The initial
+    // repair above is still authoritative for the currently mounted store.
+  }
+  return initial
+}
+
+/**
+ * Preserve host ownership of official DeepSeek routes on the batch-attachment
+ * contract generation. Vision Router may wrap/delegate those routes, but must
+ * not synthesize or replace them. Other adapters pass through unchanged.
+ */
+export function protectHostProviderOwnership(ctx) {
   if (!ctx || typeof ctx !== 'object' || !ctx.llm || typeof ctx.llm !== 'object') return ctx
   const llm = new Proxy(ctx.llm, {
     get(target, property) {
       if (property === 'registerAdapter') {
         return (routes, adapter) => {
           const list = Array.isArray(routes) ? routes : [routes]
-          if (list.some((route) => RC7_OWNED_ROUTES.has(String(route)))) {
+          if (list.some((route) => HOST_OWNED_ROUTES.has(String(route)))) {
             const error = new Error(
-              'vision-router: DSH rc.7 owns deepseek-official; use the auto-vision wrapper instead of provider takeover',
+              'vision-router: DSH owns deepseek-official on this host contract; use the auto-vision wrapper instead of provider takeover',
             )
-            error.code = 'DSH_RC7_PROVIDER_OWNERSHIP'
+            error.code = 'DSH_HOST_PROVIDER_OWNERSHIP'
             throw error
           }
           return target.registerAdapter(routes, adapter)
@@ -65,9 +156,9 @@ export function protectRc7ProviderOwnership(ctx) {
 }
 
 /**
- * The common rc.6/rc.7 SettingsProvider service is the stable public seam.
- * This helper mirrors installSettingsSection's attach/detach semantics without
- * forcing a new package-resolution edge into older rc.6 profiles.
+ * The common rc.6+ SettingsProvider service is the stable public seam. This
+ * helper mirrors installSettingsSection's attach/detach semantics without
+ * forcing a newer package-resolution edge into the minimum-supported host.
  */
 export function installSettingsSectionCompat(ctx, namespace, Config, entryConfig, hooks) {
   hooks.setSource(() => entryConfig)
@@ -82,22 +173,23 @@ export function installSettingsSectionCompat(ctx, namespace, Config, entryConfig
         hooks.setSource(() => entryConfig)
         hooks.onChange()
       },
-      'vision-router: rc7 settings compatibility source',
+      'vision-router: host settings compatibility source',
     )
   })
 }
 
 /**
- * Bridge rc.7's public settings-section semantics to core's rc.6-shaped
- * `ctx.inject(['settings']) -> settings.register()` callback. The stored rc.6
- * `stealth` flag is masked on rc.7 because provider takeover is not supported.
+ * Bridge the newer public settings-section semantics to core's legacy-shaped
+ * `ctx.inject(['settings']) -> settings.register()` callback. The old `stealth`
+ * flag is masked because host-owned official routes cannot be taken over on
+ * this contract generation.
  */
-export function installRc7SettingsCompatibility(ctx, entryConfig, options = {}) {
+export function installHostSettingsCompatibility(ctx, entryConfig, options = {}) {
   const install = options.installSettingsSection ?? installSettingsSectionCompat
   const ns = options.namespace
   const Config = options.Config
   if (Config === undefined) {
-    throw new TypeError('vision-router: rc7 settings compatibility requires Config')
+    throw new TypeError('vision-router: host settings compatibility requires Config')
   }
 
   let activeSource = () => ({ ...entryConfig, stealth: false })
@@ -172,13 +264,20 @@ export function installRc7SettingsCompatibility(ctx, entryConfig, options = {})
 }
 
 /**
- * rc.6 keeps the narrow Termux fallback. rc.7's batch-capable attachment
- * service keeps AttachmentId store-owned, so the host context passes through
- * untouched there.
+ * The minimum-supported host keeps the narrow Termux fallback. A
+ * batch-capable attachment service keeps AttachmentId store-owned, so that
+ * host context passes through untouched.
  */
 export function attachmentContextForContract(ctx, logger, options = {}) {
-  if (isRc7ContractRuntime(ctx)) return ctx
+  if (hasBatchAttachmentContract(ctx)) return ctx
   const install = options.installAndroidAttachmentCompat
   if (typeof install !== 'function') return ctx
   return install(ctx, logger, options.android)
 }
+
+// Transitional aliases for external/tests written against the rc.7-era names.
+// New code must consume the capability-named exports above so future DSH
+// releases do not accrete `if (rc8) / if (rc9)` branches.
+export const isRc7ContractRuntime = hasBatchAttachmentContract
+export const protectRc7ProviderOwnership = protectHostProviderOwnership
+export const installRc7SettingsCompatibility = installHostSettingsCompatibility

package/lib/live-model-client-prelude.js

@@ -516,31 +516,51 @@ export const LIVE_MODEL_CLIENT_PRELUDE = String.raw`(function(){
   }
 
   function patchLoader(loader) {
-    if (!loader || typeof loader.load !== 'function' || loader.load.__visionRouterLiveModels) return;
-    var original = loader.load;
-    function load(spec) {
-      if (spec && spec.id === 'dsh-vision-router' && typeof spec.factory === 'function') {
-        var factory = spec.factory;
-        spec = Object.assign({}, spec, {
-          factory: function(require) {
-            var exports = factory(require);
-            if (exports && typeof exports.apply === 'function' && !exports.apply.__visionRouterLiveModels) {
-              var apply = exports.apply;
-              var wrappedApply = function(ctx) {
-                var rest = Array.prototype.slice.call(arguments, 1);
-                return apply.apply(exports, [wrapContext(ctx)].concat(rest));
-              };
-              Object.defineProperty(wrappedApply, '__visionRouterLiveModels', { value: true });
-              exports.apply = wrappedApply;
+    if (!loader || (typeof loader !== 'object' && typeof loader !== 'function')) return;
+
+    if (typeof loader.load === 'function' && !loader.load.__visionRouterLiveModels) {
+      var original = loader.load;
+      function load(spec) {
+        if (spec && spec.id === 'dsh-vision-router' && typeof spec.factory === 'function') {
+          var factory = spec.factory;
+          spec = Object.assign({}, spec, {
+            factory: function(require) {
+              var exports = factory(require);
+              if (exports && typeof exports.apply === 'function' && !exports.apply.__visionRouterLiveModels) {
+                var apply = exports.apply;
+                var wrappedApply = function(ctx) {
+                  var rest = Array.prototype.slice.call(arguments, 1);
+                  return apply.apply(exports, [wrapContext(ctx)].concat(rest));
+                };
+                Object.defineProperty(wrappedApply, '__visionRouterLiveModels', { value: true });
+                exports.apply = wrappedApply;
+              }
+              return exports;
             }
-            return exports;
-          }
-        });
+          });
+        }
+        return original.call(loader, spec);
+      }
+      Object.defineProperty(load, '__visionRouterLiveModels', { value: true });
+      loader.load = load;
+    }
+
+    // rc.8 boot has two loader phases on the same object. The parser first
+    // exposes queue-mode load(); later ClientModuleSystem.create() assigns a
+    // new live-mode load() before any lazy community bundle arrives. A wrapper
+    // installed only during parsing is therefore silently discarded. Wrap the
+    // transition itself and immediately re-apply this factory/context boundary
+    // to the new live sink.
+    if (typeof loader.create === 'function' && !loader.create.__visionRouterLiveModels) {
+      var originalCreate = loader.create;
+      function create() {
+        var result = originalCreate.apply(this, arguments);
+        patchLoader(loader);
+        return result;
       }
-      return original.call(loader, spec);
+      Object.defineProperty(create, '__visionRouterLiveModels', { value: true });
+      loader.create = create;
     }
-    Object.defineProperty(load, '__visionRouterLiveModels', { value: true });
-    loader.load = load;
   }
 
   function install() {
@@ -574,8 +594,13 @@ export const LIVE_MODEL_CLIENT_PRELUDE = String.raw`(function(){
 export function injectLiveModelClientPrelude(html) {
   if (typeof html !== 'string' || html.includes(CLIENT_PRELUDE_MARK)) return html
   const script = `<script ${CLIENT_PRELUDE_MARK}>${LIVE_MODEL_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const head = html.indexOf('<head>')
-  return head === -1 ? `${script}${html}` : `${html.slice(0, head + 6)}${script}${html.slice(head + 6)}`
+  // DSH's client-modules index tap prepends its queue-mode facade immediately
+  // after <head>. Run after that parser bootstrap so we can wrap both load()
+  // and create(); the create wrapper then re-attaches us after rc.8 swaps in
+  // its live registration sink, before lazy third-party bundles arrive.
+  const closeHead = html.indexOf('</head>')
+  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
+  return `${html}${script}`
 }
 
 export function installLiveModelClientPrelude(ctx) {

package/lib/remote-settings-bridge.js

@@ -1,9 +1,11 @@
 import { installLocalRemoteSettingsPermissionBridge } from './local-remote-settings-permission.js'
+import { installRemoteSettingsRiskConfirmationBridge } from './remote-settings-risk-confirmation.js'
 
 const SETTINGS_NS = 'vision-router'
 
 export const REMOTE_SETTINGS_CHANNEL = '/vision-router-settings'
 export const REMOTE_SETTINGS_PERMISSION = 'allowRemoteSettings'
+export const REMOTE_SETTINGS_AUTHORIZE_ENDPOINT = 'authorize'
 
 // Remote DSH pages are deliberately less privileged than the loopback settings UI.
 // This is a capability allow-list, not a blacklist: a future Config field is local-only
@@ -117,6 +119,51 @@ function conflictResult(error) {
   }
 }
 
+export async function authorizeRemoteSettingsAfterRiskConfirmation(settings, payload, logger) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload) || payload.acceptedRisk !== true) {
+    return badRequest('acceptedRisk must be true')
+  }
+
+  let descriptor
+  try {
+    descriptor = namespaceDescriptor(settings)
+  } catch (error) {
+    logger?.warn?.('vision-router: remote settings authorization describe failed: %s', error?.message ?? String(error))
+    return settingsRejected('Vision Router settings could not be read')
+  }
+  if (!descriptor) return settingsRejected('Vision Router settings namespace is unavailable')
+  if (settings.writable !== true) return settingsRejected('Vision Router settings provider is read-only')
+
+  const value = descriptor.value
+  if (value && typeof value === 'object' && value[REMOTE_SETTINGS_PERMISSION] === true) {
+    return { ok: true, value: accessSnapshot(settings) }
+  }
+  if (!Number.isInteger(descriptor.revision) || descriptor.revision < 0) {
+    return settingsRejected('Vision Router settings revision is unavailable')
+  }
+
+  try {
+    await settings.mutate(
+      SETTINGS_NS,
+      [{ op: 'set', path: [REMOTE_SETTINGS_PERMISSION], value: true }],
+      descriptor.revision,
+    )
+  } catch (error) {
+    const conflict = conflictResult(error)
+    if (conflict) return conflict
+    logger?.warn?.('vision-router: remote settings authorization rejected: %s', error?.message ?? String(error))
+    return settingsRejected(error?.message ?? 'Vision Router remote settings authorization was rejected')
+  }
+
+  try {
+    const access = accessSnapshot(settings)
+    if (access.enabled !== true) return settingsRejected('Vision Router remote settings authorization did not persist')
+    return { ok: true, value: access }
+  } catch {
+    return settingsRejected('Vision Router remote settings were enabled but could not be read back')
+  }
+}
+
 export function createVisionRouterRemoteSettingsHandler(settings, logger) {
   return async (endpoint, payload) => {
     if (endpoint === 'describe') {
@@ -126,6 +173,9 @@ export function createVisionRouterRemoteSettingsHandler(settings, logger) {
         return settingsRejected('Vision Router settings could not be read')
       }
     }
+    if (endpoint === REMOTE_SETTINGS_AUTHORIZE_ENDPOINT) {
+      return authorizeRemoteSettingsAfterRiskConfirmation(settings, payload, logger)
+    }
     if (endpoint !== 'mutate') return badRequest('unknown Vision Router remote settings endpoint ' + JSON.stringify(endpoint))
 
     let descriptor
@@ -163,5 +213,6 @@ export function installVisionRouterRemoteSettingsBridge(ctx, logger) {
       'vision-router: opt-in remote settings channel',
     )
   })
+  installRemoteSettingsRiskConfirmationBridge(ctx)
   installLocalRemoteSettingsPermissionBridge(ctx, logger)
 }

package/lib/remote-settings-risk-confirmation.js

@@ -0,0 +1,195 @@
+const RISK_PRELUDE_MARK = 'data-vision-router-remote-settings-risk-confirmation'
+
+export const REMOTE_SETTINGS_RISK_CLIENT_PRELUDE = String.raw`(function(){
+  'use strict';
+  var CHANNEL = '/vision-router-settings';
+  var AUTHORIZE_ENDPOINT = 'authorize';
+  var connectionCache = typeof WeakMap === 'function' ? new WeakMap() : undefined;
+  var rpcCache = typeof WeakMap === 'function' ? new WeakMap() : undefined;
+  var contextCache = typeof WeakMap === 'function' ? new WeakMap() : undefined;
+  var authorizationPromise;
+
+  function chineseLocale() {
+    var lang = '';
+    try {
+      lang = String((document && document.documentElement && document.documentElement.lang) || (navigator && navigator.language) || '').toLowerCase();
+    } catch (_) {}
+    return lang === '' || lang.indexOf('zh') === 0;
+  }
+
+  function riskMessage() {
+    return chineseLocale()
+      ? '启用远程设置？\n\n当前页面通过远程地址访问 DSH。启用后，能够访问此 trusted host 的客户端可以修改 Vision Router 已开放的设置。\n\nDSH trustedHosts 不是身份认证，请仅在你信任当前网络和访问者时继续。API Key、HTTP Provider 凭据、本地 Ollama / LM Studio、产物路径等未列入远程白名单的敏感配置仍不会开放。\n\n确定要允许远程修改设置吗？'
+      : 'Enable remote settings?\n\nThis page is accessing DSH through a remote address. After enabling this, clients that can reach this trusted host can change the Vision Router settings exposed by the remote allow-list.\n\nDSH trustedHosts is not authentication. Continue only if you trust the current network and its users. Sensitive settings outside the remote allow-list, including API keys, HTTP-provider credentials, local Ollama / LM Studio, and artifact paths, remain unavailable remotely.\n\nAllow remote settings?';
+  }
+
+  function isPermissionDisabledDescribe(channel, endpoint, result) {
+    return channel === CHANNEL
+      && endpoint === 'describe'
+      && result && result.ok === true
+      && result.value && result.value.enabled !== true
+      && result.value.reason === 'permission-disabled';
+  }
+
+  async function authorizeAndRefresh(target, call) {
+    if (authorizationPromise) return authorizationPromise;
+    authorizationPromise = (async function(){
+      if (typeof window.confirm !== 'function' || window.confirm(riskMessage()) !== true) return undefined;
+      var authorized = await call.call(target, CHANNEL, AUTHORIZE_ENDPOINT, { acceptedRisk: true });
+      if (!authorized || authorized.ok !== true) {
+        var message = authorized && authorized.error && authorized.error.message
+          ? authorized.error.message
+          : 'Vision Router could not enable remote settings.';
+        try { if (typeof window.alert === 'function') window.alert(message); } catch (_) {}
+        return undefined;
+      }
+      return call.call(target, CHANNEL, 'describe', {});
+    })();
+    try { return await authorizationPromise; }
+    finally { authorizationPromise = undefined; }
+  }
+
+  function wrapRpc(rpc) {
+    if (!rpc || (typeof rpc !== 'object' && typeof rpc !== 'function')) return rpc;
+    if (rpcCache && rpcCache.has(rpc)) return rpcCache.get(rpc);
+    var wrapped = new Proxy(rpc, {
+      get: function(target, property) {
+        if (property === 'call') {
+          var call = Reflect.get(target, property, target);
+          if (typeof call !== 'function') return call;
+          return async function(channel, endpoint) {
+            var result = await call.apply(target, arguments);
+            if (!isPermissionDisabledDescribe(channel, endpoint, result)) return result;
+            var refreshed = await authorizeAndRefresh(target, call);
+            return refreshed || result;
+          };
+        }
+        var value = Reflect.get(target, property, target);
+        return typeof value === 'function' ? value.bind(target) : value;
+      }
+    });
+    if (rpcCache) rpcCache.set(rpc, wrapped);
+    return wrapped;
+  }
+
+  function wrapConnection(connection) {
+    if (!connection || (typeof connection !== 'object' && typeof connection !== 'function')) return connection;
+    if (connectionCache && connectionCache.has(connection)) return connectionCache.get(connection);
+    var wrapped = new Proxy(connection, {
+      get: function(target, property) {
+        if (property === 'rpc') return wrapRpc(Reflect.get(target, property, target));
+        var value = Reflect.get(target, property, target);
+        return typeof value === 'function' ? value.bind(target) : value;
+      }
+    });
+    if (connectionCache) connectionCache.set(connection, wrapped);
+    return wrapped;
+  }
+
+  function wrapContext(ctx) {
+    if (!ctx || typeof ctx !== 'object') return ctx;
+    if (contextCache && contextCache.has(ctx)) return contextCache.get(ctx);
+    var wrapped = new Proxy(ctx, {
+      get: function(target, property) {
+        if (property === 'get') {
+          var get = Reflect.get(target, property, target);
+          if (typeof get !== 'function') return get;
+          return function(name) {
+            var value = get.apply(target, arguments);
+            return name === 'connection' ? wrapConnection(value) : value;
+          };
+        }
+        var value = Reflect.get(target, property, target);
+        return typeof value === 'function' ? value.bind(target) : value;
+      }
+    });
+    if (contextCache) contextCache.set(ctx, wrapped);
+    return wrapped;
+  }
+
+  function patchLoader(loader) {
+    if (!loader || typeof loader.load !== 'function' || loader.load.__visionRouterRemoteRiskConfirmation) return;
+    var original = loader.load;
+    function load(spec) {
+      if (spec && spec.id === 'dsh-vision-router' && typeof spec.factory === 'function') {
+        var factory = spec.factory;
+        spec = Object.assign({}, spec, {
+          factory: function(require) {
+            var exports = factory(require);
+            if (exports && typeof exports.apply === 'function' && !exports.apply.__visionRouterRemoteRiskConfirmation) {
+              var apply = exports.apply;
+              var wrappedApply = function(ctx) {
+                var rest = Array.prototype.slice.call(arguments, 1);
+                return apply.apply(exports, [wrapContext(ctx)].concat(rest));
+              };
+              Object.defineProperty(wrappedApply, '__visionRouterRemoteRiskConfirmation', { value: true });
+              exports.apply = wrappedApply;
+            }
+            return exports;
+          }
+        });
+      }
+      return original.call(loader, spec);
+    }
+    Object.defineProperty(load, '__visionRouterRemoteRiskConfirmation', { value: true });
+    loader.load = load;
+  }
+
+  function install() {
+    if (window.__ModuleLoader__) {
+      patchLoader(window.__ModuleLoader__);
+      return;
+    }
+    var descriptor = Object.getOwnPropertyDescriptor(window, '__ModuleLoader__');
+    if (descriptor && descriptor.configurable === false) return;
+    if (descriptor && typeof descriptor.set === 'function') {
+      var previousGet = descriptor.get;
+      var previousSet = descriptor.set;
+      Object.defineProperty(window, '__ModuleLoader__', {
+        configurable: true,
+        enumerable: descriptor.enumerable !== false,
+        get: function(){ return previousGet ? previousGet.call(window) : undefined; },
+        set: function(value) {
+          previousSet.call(window, value);
+          try { patchLoader(window.__ModuleLoader__ || value); } catch (_) {}
+        }
+      });
+      return;
+    }
+    var stored;
+    Object.defineProperty(window, '__ModuleLoader__', {
+      configurable: true,
+      enumerable: true,
+      get: function(){ return stored; },
+      set: function(value) {
+        stored = value;
+        patchLoader(value);
+        Object.defineProperty(window, '__ModuleLoader__', {
+          configurable: true,
+          enumerable: true,
+          writable: true,
+          value: stored
+        });
+      }
+    });
+  }
+
+  try { install(); } catch (_) {}
+})();`
+
+export function injectRemoteSettingsRiskConfirmationPrelude(html) {
+  if (typeof html !== 'string' || html.includes(RISK_PRELUDE_MARK)) return html
+  const script = `<script ${RISK_PRELUDE_MARK}>${REMOTE_SETTINGS_RISK_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
+  const endHead = html.indexOf('</head>')
+  return endHead === -1 ? `${html}${script}` : `${html.slice(0, endHead)}${script}${html.slice(endHead)}`
+}
+
+export function installRemoteSettingsRiskConfirmationBridge(ctx) {
+  if (!ctx || typeof ctx.inject !== 'function') return
+  ctx.inject(['webServer'], (webCtx) => {
+    webCtx.effect(
+      () => webCtx.webServer.tapIndex(injectRemoteSettingsRiskConfirmationPrelude),
+      'vision-router: remote settings risk confirmation client shim',
+    )
+  })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vision-router",
-  "version": "1.7.0",
+  "version": "1.7.3",
   "description": "Eyes for text-only DeepSeek Harness agents: built-in free vision chain (no key) + pixel-level vision tools (Q&A, grounding, crop, pixel diff, colors, OCR, SVG trace, cutout, screenshots). One-command install, no Python, image turns work like ordinary tool-calling turns.",
   "license": "MIT",
   "repository": {
@@ -75,7 +75,7 @@
     "sharp": "^0.35.3"
   },
   "scripts": {
-    "test": "node --test tests/core.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/provider-directory-fallback.test.js tests/settings-section-order.test.js tests/vision-resilience.test.js tests/client.test.js tests/remote-settings-bridge.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/update-check.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/replay-delegation.test.js tests/adversarial-hardening.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/local-ollama.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/image-resource-governor.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js"
+    "test": "node --test tests/core.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/provider-directory-fallback.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/client.test.js tests/client-presentation-boundary.test.js tests/remote-settings-bridge.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/update-check.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/replay-delegation.test.js tests/adversarial-hardening.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/local-ollama.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/image-resource-governor.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js"
   },
   "pnpm": {
     "onlyBuiltDependencies": [