dsh-vision-router 2.0.0 → 2.1.0

package/lib/web-capability-boundary.js

@@ -1,6 +1,8 @@
 const wrappedContexts = new WeakMap()
 const patchedWebServers = new WeakMap()
 
+const VISION_ROUTER_WEB_PREFIX = '/_dsh/vision-router/'
+
 const LOCAL_MUTATION_ROUTES = new Map([
   ['/_dsh/vision-router/self-update', new Set(['POST'])],
   ['/_dsh/vision-router/logs', new Set(['POST'])],
@@ -89,6 +91,41 @@ function rejectRemoteMutation(res) {
   }))
 }
 
+function rejectUnauthenticatedHostRequest(res, status) {
+  const code = status === 403 ? 403 : 401
+  res.writeHead(code, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  })
+  res.end(JSON.stringify({
+    ok: false,
+    error: code === 401 ? 'dsh web authentication required' : 'dsh web request rejected',
+  }))
+}
+
+function hostRequestRejection(req, getConnection) {
+  // Direct handler calls and unit fixtures intentionally have no transport and
+  // are not browser requests. Do not turn alpha.1 browser authentication into
+  // a new requirement for internal Host composition or old compatibility tests.
+  if (!req?.socket && !req?.connection) return undefined
+  let connection
+  try { connection = typeof getConnection === 'function' ? getConnection() : undefined }
+  catch { connection = undefined }
+  const requestRejection = connection && typeof connection.requestRejection === 'function'
+    ? connection.requestRejection.bind(connection)
+    : undefined
+  if (requestRejection === undefined) return undefined
+  try {
+    const status = requestRejection(req)
+    return status === 401 || status === 403 ? status : undefined
+  } catch {
+    // Host authentication is a security boundary. If an alpha/newer Host
+    // advertises it but cannot evaluate this request, fail closed rather than
+    // silently falling back to the pre-authenticated rc.6/rc.7 behavior.
+    return 403
+  }
+}
+
 function redactRemoteBody(path, body) {
   if (!body || typeof body !== 'object' || Array.isArray(body)) return body
   if (path === '/_dsh/vision-router/update-check') {
@@ -140,17 +177,25 @@ function runWithRemoteReadRedaction(path, handler, req, res) {
   return result
 }
 
-function guardedRoute(route) {
+function guardedRoute(route, getConnection) {
   if (!route || typeof route !== 'object' || typeof route.handler !== 'function') return route
+  const pluginOwned = typeof route.path === 'string' && route.path.startsWith(VISION_ROUTER_WEB_PREFIX)
   const mutationMethods = LOCAL_MUTATION_ROUTES.get(route.path)
   const sensitiveReadMethods = SENSITIVE_READ_ROUTES.get(route.path)
-  if ((!mutationMethods || mutationMethods.size === 0) && (!sensitiveReadMethods || sensitiveReadMethods.size === 0)) {
+  if (!pluginOwned && (!mutationMethods || mutationMethods.size === 0) && (!sensitiveReadMethods || sensitiveReadMethods.size === 0)) {
     return route
   }
   const originalHandler = route.handler
   return {
     ...route,
     handler(req, res) {
+      if (pluginOwned) {
+        const rejection = hostRequestRejection(req, getConnection)
+        if (rejection !== undefined) {
+          rejectUnauthenticatedHostRequest(res, rejection)
+          return undefined
+        }
+      }
       const method = String(req?.method ?? '').toUpperCase()
       const localUi = isLocalUiRequest(req)
       if (mutationMethods?.has(method) && !localUi) {
@@ -170,7 +215,7 @@ function guardedRoute(route) {
  * child context. DSH rc.6/rc.7 use that exact child identity for effect
  * ownership, so the service method is the narrow safe interception point.
  */
-function retainWebServerBoundary(webServer) {
+function retainWebServerBoundary(webServer, getConnection) {
   if (!webServer || (typeof webServer !== 'object' && typeof webServer !== 'function')) return () => {}
   if (typeof webServer.register !== 'function') return () => {}
 
@@ -179,7 +224,7 @@ function retainWebServerBoundary(webServer) {
     const originalRegister = webServer.register
     let active = true
     const guardedRegister = function registerWithLocalMutationBoundary(route) {
-      return originalRegister.call(this, active ? guardedRoute(route) : route)
+      return originalRegister.call(this, active ? guardedRoute(route, getConnection) : route)
     }
     webServer.register = guardedRegister
     state = { count: 0, originalRegister, guardedRegister, deactivate: () => { active = false } }
@@ -200,10 +245,12 @@ function retainWebServerBoundary(webServer) {
 }
 
 /**
- * DSH's all-interface WebServer deliberately has no TLS/auth/origin policy.
- * Same-origin checks therefore prevent browser CSRF but cannot authenticate a
- * LAN client. Keep plugin-owned OS/process/disk mutations local-UI-only and do
- * not issue their bearer capability tokens or host paths to remote clients.
+ * DSH rc.6/rc.7 expose no browser-authentication service for named plugin
+ * routes, so the historical local-machine fences below remain the compatibility
+ * floor. DSH 0.1.2-alpha.1 adds `connection.requestRejection(req)` specifically
+ * so another Web route can inherit the Host/Origin + signed-browser-session
+ * boundary. Feature-detect that seam and apply it to every DVR-owned named
+ * route before the plugin's narrower local-mutation/read-redaction policy.
  */
 export function installLocalMutationRouteBoundary(ctx) {
   if (!ctx || (typeof ctx !== 'object' && typeof ctx !== 'function')) return ctx
@@ -220,7 +267,16 @@ export function installLocalMutationRouteBoundary(ctx) {
             return inject.call(target, dependencies, callback, ...rest)
           }
           return inject.call(target, dependencies, (childCtx) => {
-            const release = retainWebServerBoundary(childCtx?.webServer)
+            const getConnection = () => {
+              try {
+                if (typeof childCtx?.get === 'function') return childCtx.get('connection')
+              } catch {}
+              try {
+                if (typeof target?.get === 'function') return target.get('connection')
+              } catch {}
+              return childCtx?.connection ?? target?.connection
+            }
+            const release = retainWebServerBoundary(childCtx?.webServer, getConnection)
             let owned = false
             try {
               if (typeof childCtx?.effect === 'function') {

package/lib/windows-screenshot-dpi-compat.js

@@ -0,0 +1,148 @@
+const VIRTUAL_SCREEN_MARKER = '[System.Windows.Forms.SystemInformation]::VirtualScreen'
+const COPY_FROM_SCREEN_MARKER = '$g.CopyFromScreen($b.X,$b.Y,0,0,$bmp.Size)'
+const SAVE_PATTERN = /\$bmp\.Save\('((?:''|[^'])*)'\)/
+
+function powerShellBasename(file) {
+  return String(file ?? '').replace(/\\/g, '/').split('/').pop().toLowerCase()
+}
+
+function quotePowerShellSingle(value) {
+  return `'${String(value).replace(/'/g, "''")}'`
+}
+
+function savedPathFromLegacyScript(script) {
+  const match = SAVE_PATTERN.exec(String(script ?? ''))
+  return match ? match[1].replace(/''/g, "'") : undefined
+}
+
+export function isLegacyWindowsScreenshotScript(script) {
+  const source = String(script ?? '')
+  return (
+    source.includes('Add-Type -AssemblyName System.Windows.Forms,System.Drawing') &&
+    source.includes(VIRTUAL_SCREEN_MARKER) &&
+    source.includes('[System.Drawing.Graphics]::FromImage($bmp)') &&
+    source.includes(COPY_FROM_SCREEN_MARKER) &&
+    savedPathFromLegacyScript(source) !== undefined
+  )
+}
+
+export function buildPerMonitorWindowsScreenshotScript(outputPath) {
+  const quotedPath = quotePowerShellSingle(outputPath)
+  const source = String.raw`using System;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+public static class DshVisionDesktopCapture
+{
+    private static readonly IntPtr PerMonitorV2 = new IntPtr(-4);
+    private static readonly IntPtr PerMonitorV1 = new IntPtr(-3);
+
+    [DllImport("user32.dll")]
+    private static extern IntPtr SetThreadDpiAwarenessContext(IntPtr dpiContext);
+
+    private static IntPtr TrySetContext(IntPtr context)
+    {
+        try
+        {
+            return SetThreadDpiAwarenessContext(context);
+        }
+        catch (EntryPointNotFoundException)
+        {
+            return IntPtr.Zero;
+        }
+        catch (DllNotFoundException)
+        {
+            return IntPtr.Zero;
+        }
+    }
+
+    private static IntPtr EnterPerMonitorContext()
+    {
+        IntPtr previous = TrySetContext(PerMonitorV2);
+        if (previous == IntPtr.Zero)
+        {
+            previous = TrySetContext(PerMonitorV1);
+        }
+        if (previous == IntPtr.Zero)
+        {
+            throw new InvalidOperationException(
+                "could not enter a per-monitor DPI awareness context; refusing to return a potentially misaligned screenshot");
+        }
+        return previous;
+    }
+
+    private static void RestoreContext(IntPtr previous)
+    {
+        try
+        {
+            SetThreadDpiAwarenessContext(previous);
+        }
+        catch
+        {
+            // The helper process exits immediately after capture. Restoration
+            // is still attempted so this method is correct if reused.
+        }
+    }
+
+    public static void ValidateDpiContext()
+    {
+        IntPtr previous = EnterPerMonitorContext();
+        RestoreContext(previous);
+    }
+
+    public static void Capture(string outputPath)
+    {
+        IntPtr previous = EnterPerMonitorContext();
+        try
+        {
+            Rectangle bounds = SystemInformation.VirtualScreen;
+            if (bounds.Width <= 0 || bounds.Height <= 0)
+            {
+                throw new InvalidOperationException("the Windows virtual screen has no drawable area");
+            }
+
+            using (var bitmap = new Bitmap(bounds.Width, bounds.Height))
+            using (var graphics = Graphics.FromImage(bitmap))
+            {
+                graphics.CopyFromScreen(bounds.X, bounds.Y, 0, 0, bounds.Size);
+                bitmap.Save(outputPath);
+            }
+        }
+        finally
+        {
+            RestoreContext(previous);
+        }
+    }
+}`
+
+  return [
+    'Add-Type -AssemblyName System.Windows.Forms,System.Drawing',
+    `$__dshVisionCaptureSource = @'\n${source}\n'@`,
+    'try {',
+    "  Add-Type -TypeDefinition $__dshVisionCaptureSource -ReferencedAssemblies 'System.Windows.Forms.dll','System.Drawing.dll' -ErrorAction Stop",
+    '} catch {',
+    "  throw ('vision_screenshot: failed to initialize the Windows DPI-aware capture helper: ' + $_.Exception.Message)",
+    '}',
+    `[DshVisionDesktopCapture]::Capture(${quotedPath})`,
+  ].join('\n')
+}
+
+export function rewriteWindowsScreenshotExecArgs(file, args, options = {}) {
+  const platform = options.platform ?? (typeof process !== 'undefined' ? process.platform : '')
+  if (platform !== 'win32') return args
+  const executable = powerShellBasename(file)
+  if (executable !== 'powershell.exe' && executable !== 'powershell') return args
+  if (!Array.isArray(args)) return args
+
+  const commandIndex = args.findIndex((arg) => String(arg).toLowerCase() === '-command')
+  if (commandIndex < 0 || commandIndex + 1 >= args.length) return args
+  const script = args[commandIndex + 1]
+  if (!isLegacyWindowsScreenshotScript(script)) return args
+
+  const outputPath = savedPathFromLegacyScript(script)
+  if (outputPath === undefined) return args
+  const rewritten = args.slice()
+  rewritten[commandIndex + 1] = buildPerMonitorWindowsScreenshotScript(outputPath)
+  return rewritten
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vision-router",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Eyes for text-only DeepSeek Harness agents: built-in free vision chain (no key) + pixel-level vision tools (Q&A, grounding, crop, pixel diff, colors, OCR, SVG trace, cutout, screenshots). One-command install, no Python, image turns work like ordinary tool-calling turns.",
   "license": "MIT",
   "repository": {
@@ -11,7 +11,7 @@
   "type": "module",
   "main": "lib/public-entry.js",
   "bin": {
-    "dsh-vision-router": "./lib/doctor-cli.js"
+    "dsh-vision-router": "./lib/doctor-cli-p0.js"
   },
   "exports": {
     ".": "./lib/public-entry.js",
@@ -54,8 +54,8 @@
     "undici": "^7.29.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.0-rc.6 || ^0.1.1-rc.1",
-    "@deepseek-ai/dsh-llm-deepseek": "^0.1.0-rc.6 || ^0.1.1-rc.1",
+    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.0-rc.8 || ^0.1.1-rc.1",
+    "@deepseek-ai/dsh-llm-deepseek": "^0.1.0-rc.8 || ^0.1.1-rc.1",
     "sharp": ">=0.35.3 <1"
   },
   "peerDependenciesMeta": {
@@ -69,7 +69,15 @@
     "sharp": "^0.35.3"
   },
   "scripts": {
-    "test": "node --test tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/vision-breaker-readonly.test.js tests/client.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/update-check.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/session-repair-v2.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/replay-delegation.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/local-ollama.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/pi-ai-bridge-wire-compat.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/image-resource-governor.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/vision-toggle-root-hardening.test.js && node --test tests/vision-backend-runtime-policy.test.js"
+    "test": "node --test tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/vision-resilience-lifecycle.test.js tests/vision-breaker-readonly.test.js tests/alpha1-browser-lifecycle-integration.test.js tests/client.test.js tests/issue-307-regression.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/update-check.test.js tests/update-check-signal-lifecycle.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/session-repair-v2.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/replay-delegation.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/local-ollama.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/pi-ai-bridge-wire-compat.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/runtime-i18n.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-lifecycle.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/settings-native-card-semantics.test.js tests/settings-native-card-lazy-data.test.js tests/settings-invalid-staged-dirty.test.js tests/vision-toggle-root-hardening.test.js && node --test tests/vision-backend-runtime-policy.test.js",
+    "test:core": "node --test tests/core.test.js tests/runtime-e2e.test.js tests/structured-bootstrap.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-execution-policy.test.js tests/vision-backend-runtime-policy.test.js",
+    "test:routing": "node --test tests/vision-routing-product.test.js tests/vision-capability-router.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow.test.js tests/vision-capability-shadow-health.test.js tests/vision-runtime-performance.test.js tests/vision-background-benchmark.test.js tests/vision-image-input-verdict.test.js",
+    "test:session": "node --test tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/replay-delegation.test.js tests/legacy-session-repair.test.js tests/session-repair-v2.test.js tests/issue-276-session-image-ownership.test.js",
+    "test:resources": "node --test tests/artifact-path-security.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js",
+    "test:compat": "node --test tests/adapter-prepare-call-compat.test.js tests/attachment-admission-policy.test.js tests/rc6-rc7-compat.test.js tests/rc6-real-settings-persistence.test.js tests/android-attachment-compat.test.js tests/http-compat.test.js tests/pi-ai-bridge-wire-compat.test.js tests/native-image-coexistence.test.js tests/tesseract-node24-boot.test.js tests/dsh-host-capabilities.test.js",
+    "test:web": "node --test tests/alpha1-browser-lifecycle-integration.test.js tests/client.test.js tests/client-presentation-boundary.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-acceptance-regression.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/local-remote-settings-permission.test.js tests/v2-settings-ia-integration.test.js tests/logging-ui.test.js",
+    "test:contract": "node --test tests/manifest-dependencies.test.js tests/bundle-defaults.test.js tests/zero-regression-gate.test.js tests/issue-289-native-nonintervention.test.js tests/runtime-boundary-fixes.test.js tests/runtime-i18n.test.js tests/adapter-prepare-call-compat.test.js tests/rc6-rc7-compat.test.js tests/attachment-admission-policy.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js",
+    "test:stress": "node scripts/image-resource-stress.mjs && node --test tests/large-image-resource-integration.test.js tests/resource-retention-lifecycle.test.js"
   },
   "pnpm": {
     "onlyBuiltDependencies": ["sharp"]
@@ -87,4 +95,4 @@
     },
     "bundle": { "patch": "./cordis.patch.yml" }
   }
-}
+}