dsh-vision-router 2.1.0 → 2.1.1

package/docs/releases/v2.1.1.md

@@ -0,0 +1,19 @@
+# v2.1.1
+
+This is an urgent browser-startup hotfix for DVR 2.1.0.
+
+## Fixed
+
+- Fixes #367: DSH Web could fail while applying `dsh-vision-router` with `cannot get property "remote.session" without inject`.
+- The 2.1.0 client Host compatibility prelude no longer probes the optional `remote.session` namespace through the traceable `ctx.remote` proxy. It resolves the optional namespace through `ctx.get('remote.session')` first and keeps a guarded fallback for older/non-Cordis harnesses.
+- The new Host model-catalog bridge still uses `remote.session.modelCatalog()` when available, while older supported Hosts keep the original `connection.api.llm.models()` path and exact legacy Remote/Connection surfaces.
+
+## Regression coverage
+
+- Adds a production-shaped regression where reading `ctx.remote.session` throws the exact #367 Cordis error while `ctx.get('remote.session')` succeeds.
+- Adds the same test to the default Node 22/24 suite and the Web compatibility suite.
+- Keeps a fail-closed legacy-host regression so the hotfix does not turn the optional alpha namespace into a hard browser dependency.
+
+## Upgrade
+
+Users on 2.1.0 who hit the browser loader failure should upgrade to 2.1.1 and restart the DSH Web/Desktop process. No settings migration is required.

package/lib/client-host-compat-prelude.js

@@ -20,11 +20,22 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
   var LEGACY_CREDENTIAL_EVENT = 'credentials/updated';
   var HOST_CREDENTIAL_EVENT = 'credentials/reference-updated';
 
-  function hasHostCatalog(remote) {
-    return !!(
-      remote && remote.session &&
-      typeof remote.session.modelCatalog === 'function'
-    );
+  function optionalHostSession(ctx, remote) {
+    try {
+      if (ctx && typeof ctx.get === 'function') {
+        var session = ctx.get('remote.session');
+        if (session) return session;
+      }
+    } catch (_) {}
+    try {
+      return remote && remote.session;
+    } catch (_) {
+      return undefined;
+    }
+  }
+
+  function hasHostCatalog(session) {
+    return !!(session && typeof session.modelCatalog === 'function');
   }
 
   function wrapCatalogResult(value) {
@@ -37,23 +48,23 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
     return value;
   }
 
-  function catalogModels(remote) {
+  function catalogModels(session) {
     return function models() {
-      return Promise.resolve(remote.session.modelCatalog()).then(wrapCatalogResult);
+      return Promise.resolve(session.modelCatalog()).then(wrapCatalogResult);
     };
   }
 
-  function compatibleApi(originalApi, remote) {
+  function compatibleApi(originalApi, session) {
     var originalLlm = originalApi && originalApi.llm;
     var llm = originalLlm && (typeof originalLlm === 'object' || typeof originalLlm === 'function')
       ? new Proxy(originalLlm, {
           get: function(target, property) {
-            if (property === 'models') return catalogModels(remote);
+            if (property === 'models') return catalogModels(session);
             var value = Reflect.get(target, property, target);
             return typeof value === 'function' ? value.bind(target) : value;
           }
         })
-      : { models: catalogModels(remote) };
+      : { models: catalogModels(session) };
     if (originalApi && (typeof originalApi === 'object' || typeof originalApi === 'function')) {
       return new Proxy(originalApi, {
         get: function(target, property) {
@@ -66,10 +77,10 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
     return { llm: llm };
   }
 
-  function compatibleConnection(connection, remote) {
-    if (!hasHostCatalog(remote)) return connection;
+  function compatibleConnection(connection, session) {
+    if (!hasHostCatalog(session)) return connection;
     if (!connection || (typeof connection !== 'object' && typeof connection !== 'function')) return connection;
-    var api = compatibleApi(connection.api, remote);
+    var api = compatibleApi(connection.api, session);
     return new Proxy(connection, {
       get: function(target, property) {
         if (property === 'api') return api;
@@ -79,8 +90,8 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
     });
   }
 
-  function compatibleRemote(remote) {
-    if (!hasHostCatalog(remote)) return remote;
+  function compatibleRemote(remote, session) {
+    if (!hasHostCatalog(session)) return remote;
     if (!remote || (typeof remote !== 'object' && typeof remote !== 'function')) return remote;
     return new Proxy(remote, {
       get: function(target, property) {
@@ -140,7 +151,8 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
 
   function compatibleContext(ctx) {
     if (!ctx || typeof ctx !== 'object' || typeof Proxy !== 'function') return ctx;
-    var remote = compatibleRemote(ctx.remote);
+    var session = optionalHostSession(ctx, ctx.remote);
+    var remote = compatibleRemote(ctx.remote, session);
     var locale = compatibleLocale(ctx.locale);
     return new Proxy(ctx, {
       get: function(target, property) {
@@ -151,7 +163,7 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
           if (typeof get !== 'function') return get;
           return function(name) {
             var value = get.call(target, name);
-            return name === 'connection' ? compatibleConnection(value, remote) : value;
+            return name === 'connection' ? compatibleConnection(value, session) : value;
           };
         }
         var value = Reflect.get(target, property, target);

package/lib/doctor.js

@@ -303,12 +303,53 @@ function stripYamlComment(line) {
   return line
 }
 
+function yamlIndent(line) {
+  return /^(\s*)/.exec(line)?.[1].length ?? 0
+}
+
+function rowIsInsideInsert(lines, rowIndex, rowIndent) {
+  for (let cursor = rowIndex - 1; cursor >= 0; cursor -= 1) {
+    const candidate = lines[cursor]
+    if (/^\s*$/.test(candidate)) continue
+    const indent = yamlIndent(candidate)
+    if (indent >= rowIndent) continue
+    return /^\s*-?\s*insert\s*:\s*$/.test(candidate)
+  }
+  return false
+}
+
+function inspectVisionRouterPatchRows(lines) {
+  let mountRows = 0
+  let overrideRows = 0
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const idMatch = /^(\s*)-\s+id\s*:\s*['"]?([^'"\s]+)['"]?\s*$/.exec(lines[index])
+    if (!idMatch) continue
+    const rowIndent = idMatch[1].length
+    let pluginName
+    for (let cursor = index + 1; cursor < lines.length; cursor += 1) {
+      const candidate = lines[cursor]
+      if (/^\s*$/.test(candidate)) continue
+      const indent = yamlIndent(candidate)
+      if (indent <= rowIndent) break
+      const nameMatch = /^\s*name\s*:\s*['"]?([^'"\s]+)['"]?\s*$/.exec(candidate)
+      if (nameMatch) pluginName = nameMatch[1]
+    }
+    if (idMatch[2] !== 'vision-router' && pluginName !== PLUGIN_NAME) continue
+    if (rowIsInsideInsert(lines, index, rowIndent)) mountRows += 1
+    else overrideRows += 1
+  }
+
+  return { mountRows, overrideRows }
+}
+
 export function inspectProfilePatch(patchPath) {
   if (!existsSync(patchPath)) {
     return {
       path: patchPath,
       exists: false,
       visionRouterRows: 0,
+      visionRouterOverrideRows: 0,
       manualVisionRouter: false,
       disablesOfficialDeepSeek: false,
     }
@@ -317,14 +358,13 @@ export function inspectProfilePatch(patchPath) {
   try {
     text = readFileBounded(patchPath).toString('utf8')
   } catch (error) {
-    return { path: patchPath, exists: true, visionRouterRows: 0, manualVisionRouter: false, disablesOfficialDeepSeek: false, error: error instanceof Error ? error.message : String(error), oversized: error?.code === 'DOCTOR_INPUT_TOO_LARGE' }
+    return { path: patchPath, exists: true, visionRouterRows: 0, visionRouterOverrideRows: 0, manualVisionRouter: false, disablesOfficialDeepSeek: false, error: error instanceof Error ? error.message : String(error), oversized: error?.code === 'DOCTOR_INPUT_TOO_LARGE' }
   }
   const lines = text.split(/\r?\n/).map(stripYamlComment)
-  let visionRouterRows = 0
+  const { mountRows: visionRouterRows, overrideRows: visionRouterOverrideRows } = inspectVisionRouterPatchRows(lines)
   let disablesOfficialDeepSeek = false
   for (let index = 0; index < lines.length; index += 1) {
     const line = lines[index]
-    if (/^\s*name\s*:\s*['"]?dsh-vision-router['"]?\s*$/.test(line)) visionRouterRows += 1
     if (!/^\s*-?\s*id\s*:\s*['"]?llm-deepseek['"]?\s*$/.test(line)) continue
     for (let cursor = index + 1; cursor < Math.min(lines.length, index + 12); cursor += 1) {
       if (/^\s*-\s+id\s*:/.test(lines[cursor])) break
@@ -338,6 +378,7 @@ export function inspectProfilePatch(patchPath) {
     path: patchPath,
     exists: true,
     visionRouterRows,
+    visionRouterOverrideRows,
     manualVisionRouter: visionRouterRows > 0,
     disablesOfficialDeepSeek,
   }
@@ -581,4 +622,4 @@ export function doctorProfiles({ dshHome = resolveDshHome(), profile, fix = fals
       && applicable.every(profileHealthy)
       && (log.settingsSaveFailures?.length ?? 0) === 0,
   }
-}
+}

package/lib/grounding-coordinate-frame.js

@@ -0,0 +1,93 @@
+export const GROUNDING_FRAME_SIZE = 1000
+
+function finitePositiveInteger(value, name) {
+  const number = Number(value)
+  if (!Number.isFinite(number) || number <= 0) {
+    throw new TypeError(`${name} must be a positive finite number`)
+  }
+  return Math.max(1, Math.round(number))
+}
+
+/**
+ * Build the exact geometry used to letterbox a source raster into the
+ * grounding protocol's square frame. The rendered dimensions are integers so
+ * callers can resize to these exact values before extending the canvas; the
+ * inverse therefore never depends on a backend's resize policy.
+ */
+export function createGroundingFrame(width, height, frameSize = GROUNDING_FRAME_SIZE) {
+  const sourceWidth = finitePositiveInteger(width, 'width')
+  const sourceHeight = finitePositiveInteger(height, 'height')
+  const size = finitePositiveInteger(frameSize, 'frameSize')
+  const scale = Math.min(size / sourceWidth, size / sourceHeight)
+  const renderedWidth = Math.max(1, Math.min(size, Math.round(sourceWidth * scale)))
+  const renderedHeight = Math.max(1, Math.min(size, Math.round(sourceHeight * scale)))
+  const left = Math.floor((size - renderedWidth) / 2)
+  const top = Math.floor((size - renderedHeight) / 2)
+  const right = size - renderedWidth - left
+  const bottom = size - renderedHeight - top
+
+  return Object.freeze({
+    frameWidth: size,
+    frameHeight: size,
+    sourceWidth,
+    sourceHeight,
+    renderedWidth,
+    renderedHeight,
+    left,
+    top,
+    right,
+    bottom,
+    scaleX: renderedWidth / sourceWidth,
+    scaleY: renderedHeight / sourceHeight,
+  })
+}
+
+function finiteCoordinate(value) {
+  const number = Number(value)
+  return Number.isFinite(number) ? number : undefined
+}
+
+function clamp(value, min, max) {
+  return Math.max(min, Math.min(value, max))
+}
+
+/** Map a box reported in the explicit square grounding frame back to source pixels. */
+export function groundingFrameBoxToSource(box, frame) {
+  if (!box || !frame) return undefined
+  const x1 = finiteCoordinate(box.x1)
+  const y1 = finiteCoordinate(box.y1)
+  const x2 = finiteCoordinate(box.x2)
+  const y2 = finiteCoordinate(box.y2)
+  if ([x1, y1, x2, y2].some((value) => value === undefined)) return undefined
+
+  const raw = {
+    x1: (x1 - frame.left) / frame.scaleX,
+    y1: (y1 - frame.top) / frame.scaleY,
+    x2: (x2 - frame.left) / frame.scaleX,
+    y2: (y2 - frame.top) / frame.scaleY,
+  }
+  const mapped = {
+    x1: Math.floor(clamp(raw.x1, 0, frame.sourceWidth)),
+    y1: Math.floor(clamp(raw.y1, 0, frame.sourceHeight)),
+    x2: Math.ceil(clamp(raw.x2, 0, frame.sourceWidth)),
+    y2: Math.ceil(clamp(raw.y2, 0, frame.sourceHeight)),
+  }
+  if (mapped.x2 <= mapped.x1 || mapped.y2 <= mapped.y1) return undefined
+  return mapped
+}
+
+/** Map source-pixel geometry into the square frame, useful for protocol tests. */
+export function sourceBoxToGroundingFrame(box, frame) {
+  if (!box || !frame) return undefined
+  const x1 = finiteCoordinate(box.x1)
+  const y1 = finiteCoordinate(box.y1)
+  const x2 = finiteCoordinate(box.x2)
+  const y2 = finiteCoordinate(box.y2)
+  if ([x1, y1, x2, y2].some((value) => value === undefined)) return undefined
+  return {
+    x1: frame.left + x1 * frame.scaleX,
+    y1: frame.top + y1 * frame.scaleY,
+    x2: frame.left + x2 * frame.scaleX,
+    y2: frame.top + y2 * frame.scaleY,
+  }
+}

package/lib/grounding-coordinate-runtime.js

@@ -0,0 +1,244 @@
+import { randomUUID } from 'node:crypto'
+import { unlink } from 'node:fs/promises'
+import path from 'node:path'
+import { writeArtifactFile } from './artifact-boundary.js'
+import {
+  createGroundingFrame,
+  groundingFrameBoxToSource,
+} from './grounding-coordinate-frame.js'
+
+const GROUNDING_TOOL_NAMES = new Set(['vision_ground', 'vision_detect'])
+let sharpPromise
+
+function loadSharp() {
+  if (!sharpPromise) {
+    sharpPromise = import('sharp').then((mod) => mod.default ?? mod).catch((error) => {
+      sharpPromise = undefined
+      throw error
+    })
+  }
+  return sharpPromise
+}
+
+function workspaceOf(exec) {
+  const cwd = exec?.agent?.session?.header?.cwd
+  return typeof cwd === 'string' && cwd !== '' ? cwd : process.cwd()
+}
+
+function artifactsDirOf(config) {
+  return typeof config?.artifactsDir === 'string' && config.artifactsDir !== ''
+    ? config.artifactsDir
+    : '.dsh-vision-router/artifacts'
+}
+
+function contextService(ctx, name) {
+  try {
+    if (typeof ctx?.get === 'function') return ctx.get(name)
+  } catch {
+    return undefined
+  }
+  return ctx?.[name]
+}
+
+async function readSourceBytes(ctx, core, sessionVisionIndex, exec, image) {
+  const source = String(image ?? '')
+  if (core?.isAttachmentIdInput?.(source)) {
+    const session = exec?.agent?.session
+    const ref = sessionVisionIndex?.lookupAttachment?.(session, source.trim())
+    if (ref === undefined) {
+      throw new Error(
+        `vision-router: unknown attachment id "${source}" (it must come from an image uploaded in this conversation)`,
+      )
+    }
+    const attachments = contextService(ctx, 'attachments')
+    if (!attachments || typeof attachments.readImage !== 'function') {
+      throw new Error('vision-router: the attachment service is not available in this deployment')
+    }
+    const stored = await attachments.readImage(ref, exec?.signal)
+    if (!stored?.data) throw new Error(`vision-router: failed to read attachment ${source}`)
+    return Buffer.from(stored.data)
+  }
+
+  const fs = contextService(ctx, 'fs')
+  if (!fs || typeof fs.resolve !== 'function' || typeof fs.readBytes !== 'function') {
+    throw new Error('vision-router: the fs service is not available')
+  }
+  const target = await fs.resolve(source)
+  return Buffer.from(await fs.readBytes(target, undefined, 20 * 1024 * 1024))
+}
+
+async function buildGroundingFrame(bytes) {
+  const sharp = await loadSharp()
+  const meta = await sharp(bytes, { failOn: 'none' }).metadata()
+  const width = Number(meta.width ?? 0)
+  const height = Number(meta.height ?? 0)
+  if (width <= 0 || height <= 0) throw new Error('could not read image dimensions')
+  const frame = createGroundingFrame(width, height)
+  const framed = await sharp(bytes, { failOn: 'none' })
+    .resize(frame.renderedWidth, frame.renderedHeight, { fit: 'fill' })
+    .extend({
+      top: frame.top,
+      bottom: frame.bottom,
+      left: frame.left,
+      right: frame.right,
+      background: { r: 0, g: 0, b: 0, alpha: 1 },
+    })
+    .png()
+    .toBuffer()
+  return { frame, framed, width, height }
+}
+
+function parseToolResult(raw) {
+  if (typeof raw !== 'string' || raw.trim() === '') return undefined
+  try {
+    const parsed = JSON.parse(raw)
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : undefined
+  } catch {
+    return undefined
+  }
+}
+
+async function removeInternalFrame(workspace, publishedPath) {
+  if (typeof publishedPath !== 'string' || publishedPath === '') return
+  const target = path.isAbsolute(publishedPath) ? publishedPath : path.resolve(workspace, publishedPath)
+  try {
+    await unlink(target)
+  } catch {
+    // The internal frame is best-effort cleanup. Artifact retention may already
+    // have removed it after the delegated tool completed.
+  }
+}
+
+async function executeInGroundingFrame({
+  ctx,
+  core,
+  config,
+  sessionVisionIndex,
+  def,
+  execute,
+  args,
+  exec,
+}) {
+  const source = String(args?.image ?? '')
+  const bytes = await readSourceBytes(ctx, core, sessionVisionIndex, exec, source)
+  const { frame, framed, width, height } = await buildGroundingFrame(bytes)
+  const workspace = workspaceOf(exec)
+  const artifactsDir = artifactsDirOf(config)
+  const internalName = `.grounding-frame-${randomUUID()}.png`
+  const framePath = await writeArtifactFile(workspace, artifactsDir, internalName, framed)
+
+  try {
+    const raw = await execute(
+      {
+        ...(args ?? {}),
+        image: framePath,
+        // Core's annotation would be in the protocol frame. Re-publish only an
+        // original-raster annotation after the deterministic inverse transform.
+        annotate: false,
+      },
+      exec,
+    )
+    const delegated = parseToolResult(raw)
+    if (!delegated || delegated.ok === false) return raw
+
+    if (def.name === 'vision_ground') {
+      const mapped = groundingFrameBoxToSource(delegated, frame)
+      if (!mapped) {
+        throw new Error('vision_ground: the model box falls entirely outside the letterboxed source raster')
+      }
+      const result = { ...mapped, width, height }
+      if (args?.annotate !== false) {
+        if (typeof core?.annotateBoxBuffer !== 'function') {
+          throw new Error('vision_ground: core annotation helper is unavailable')
+        }
+        const annotated = await core.annotateBoxBuffer(bytes, mapped)
+        const stem = core?.artifactStemOf?.(source, 'ground') ?? `image-ground-${Date.now()}`
+        result.annotatedPath = await writeArtifactFile(workspace, artifactsDir, `${stem}.png`, annotated)
+      }
+      return JSON.stringify(result)
+    }
+
+    const elements = []
+    for (const item of Array.isArray(delegated.elements) ? delegated.elements : []) {
+      const mapped = groundingFrameBoxToSource(item?.box, frame)
+      if (!mapped) continue
+      elements.push({
+        ...item,
+        number: elements.length + 1,
+        box: mapped,
+      })
+    }
+    const result = { width, height, elements }
+    if (args?.annotate !== false && elements.length > 0) {
+      if (typeof core?.annotateBoxesBuffer !== 'function') {
+        throw new Error('vision_detect: core annotation helper is unavailable')
+      }
+      const annotated = await core.annotateBoxesBuffer(bytes, elements.map((item) => item.box))
+      const stem = core?.artifactStemOf?.(source, 'detect') ?? `image-detect-${Date.now()}`
+      result.annotatedPath = await writeArtifactFile(workspace, artifactsDir, `${stem}.png`, annotated)
+    }
+    return JSON.stringify(result)
+  } finally {
+    await removeInternalFrame(workspace, framePath)
+  }
+}
+
+function wrapGroundingDefinition(ctx, options, def) {
+  if (!def || !GROUNDING_TOOL_NAMES.has(def.name) || typeof def.execute !== 'function') return def
+  const execute = def.execute
+  return {
+    ...def,
+    execute(args, exec) {
+      return executeInGroundingFrame({
+        ctx,
+        ...options,
+        def,
+        execute,
+        args,
+        exec,
+      })
+    },
+  }
+}
+
+/**
+ * Give vision_ground / vision_detect one explicit provider-independent
+ * coordinate protocol: the model always receives an exact 1000x1000
+ * letterboxed raster, while callers always receive Host-canonical source
+ * pixels. Core still owns provider selection, fallback, retry and failure
+ * semantics; this boundary owns only raster geometry and original-image
+ * annotation.
+ */
+export function contextWithGroundingCoordinateFrame(ctx, options = {}) {
+  if (!ctx || (typeof ctx !== 'object' && typeof ctx !== 'function')) return ctx
+  const sourceTools = ctx.tools ?? contextService(ctx, 'tools')
+  if (!sourceTools || typeof sourceTools.register !== 'function') return ctx
+
+  const tools = new Proxy(sourceTools, {
+    get(target, property) {
+      if (property !== 'register') {
+        const value = Reflect.get(target, property, target)
+        return typeof value === 'function' ? value.bind(target) : value
+      }
+      const register = Reflect.get(target, property, target)
+      return (def, ...rest) => register.call(
+        target,
+        wrapGroundingDefinition(ctx, options, def),
+        ...rest,
+      )
+    },
+  })
+
+  return new Proxy(ctx, {
+    get(target, property) {
+      if (property === 'tools') return tools
+      if (property === 'get') {
+        const get = Reflect.get(target, property, target)
+        if (typeof get !== 'function') return get
+        return (name, ...rest) => name === 'tools' ? tools : get.call(target, name, ...rest)
+      }
+      const value = Reflect.get(target, property, target)
+      return typeof value === 'function' ? value.bind(target) : value
+    },
+  })
+}

package/lib/runtime-composition.js

@@ -28,6 +28,7 @@ import { installTesseractExecFileCompat } from './tesseract-exec-compat.js'
 import { installLocalMutationRouteBoundary } from './web-capability-boundary.js'
 import { installScreenshotSourceBoundary } from './screenshot-source-boundary.js'
 import { installVisionToolRuntimeBoundary } from './vision-tool-runtime-boundary.js'
+import { contextWithGroundingCoordinateFrame } from './grounding-coordinate-runtime.js'
 import { installVisionRoutingRuntime } from './vision-routing-runtime.js'
 import { createCapabilityProfileStore } from './vision-capability-probe.js'
 import { installCapabilityBenchmarkService } from './vision-capability-benchmark-service.js'
@@ -249,11 +250,21 @@ export function applyVisionRuntimeComposition(ctx, config = {}, core) {
     logger: logging.logger,
   })
 
+  // Ground/detect own one explicit raster-coordinate boundary. It wraps only
+  // the tool-registration view, before runtime-performance observation. That
+  // leaves adapter sampling on the same execution seam while backend preflight
+  // remains the final outer Core-visible policy boundary.
+  const groundingCoordinateCtx = contextWithGroundingCoordinateFrame(executionCtx, {
+    core,
+    config: runtimeConfig,
+    sessionVisionIndex: sessionVisionRuntime.index,
+  })
+
   // Only real visual-tool adapter streams are timed, and only while live Auto
   // authority permits future-routing observation. Benchmark/background calls
   // have no visual-tool scope and cannot contaminate this store.
   const performanceCtx = contextWithVisionRuntimePerformance(
-    executionCtx,
+    groundingCoordinateCtx,
     runtimePerformanceStore,
     {
       logger: logging.logger,
@@ -345,4 +356,4 @@ export function applyVisionRuntimeComposition(ctx, config = {}, core) {
     )
     throw error
   }
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vision-router",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Eyes for text-only DeepSeek Harness agents: built-in free vision chain (no key) + pixel-level vision tools (Q&A, grounding, crop, pixel diff, colors, OCR, SVG trace, cutout, screenshots). One-command install, no Python, image turns work like ordinary tool-calling turns.",
   "license": "MIT",
   "repository": {
@@ -69,14 +69,15 @@
     "sharp": "^0.35.3"
   },
   "scripts": {
-    "test": "node --test tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/vision-resilience-lifecycle.test.js tests/vision-breaker-readonly.test.js tests/alpha1-browser-lifecycle-integration.test.js tests/client.test.js tests/issue-307-regression.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/update-check.test.js tests/update-check-signal-lifecycle.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/session-repair-v2.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/replay-delegation.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/local-ollama.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/pi-ai-bridge-wire-compat.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/runtime-i18n.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-lifecycle.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/settings-native-card-semantics.test.js tests/settings-native-card-lazy-data.test.js tests/settings-invalid-staged-dirty.test.js tests/vision-toggle-root-hardening.test.js && node --test tests/vision-backend-runtime-policy.test.js",
+    "test": "node --test tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/grounding-coordinate-frame.test.js tests/grounding-coordinate-runtime.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/vision-resilience-lifecycle.test.js tests/vision-breaker-readonly.test.js tests/alpha1-browser-lifecycle-integration.test.js tests/issue-367-remote-session-inject.test.js tests/client.test.js tests/issue-307-regression.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/update-check.test.js tests/update-check-signal-lifecycle.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/session-repair-v2.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/replay-delegation.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/local-ollama.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/pi-ai-bridge-wire-compat.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/runtime-i18n.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-lifecycle.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/settings-native-card-semantics.test.js tests/settings-native-card-lazy-data.test.js tests/settings-invalid-staged-dirty.test.js tests/vision-toggle-root-hardening.test.js && node --test tests/vision-backend-runtime-policy.test.js",
     "test:core": "node --test tests/core.test.js tests/runtime-e2e.test.js tests/structured-bootstrap.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-execution-policy.test.js tests/vision-backend-runtime-policy.test.js",
     "test:routing": "node --test tests/vision-routing-product.test.js tests/vision-capability-router.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow.test.js tests/vision-capability-shadow-health.test.js tests/vision-runtime-performance.test.js tests/vision-background-benchmark.test.js tests/vision-image-input-verdict.test.js",
     "test:session": "node --test tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/replay-delegation.test.js tests/legacy-session-repair.test.js tests/session-repair-v2.test.js tests/issue-276-session-image-ownership.test.js",
     "test:resources": "node --test tests/artifact-path-security.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js",
     "test:compat": "node --test tests/adapter-prepare-call-compat.test.js tests/attachment-admission-policy.test.js tests/rc6-rc7-compat.test.js tests/rc6-real-settings-persistence.test.js tests/android-attachment-compat.test.js tests/http-compat.test.js tests/pi-ai-bridge-wire-compat.test.js tests/native-image-coexistence.test.js tests/tesseract-node24-boot.test.js tests/dsh-host-capabilities.test.js",
-    "test:web": "node --test tests/alpha1-browser-lifecycle-integration.test.js tests/client.test.js tests/client-presentation-boundary.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-acceptance-regression.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/local-remote-settings-permission.test.js tests/v2-settings-ia-integration.test.js tests/logging-ui.test.js",
+    "test:web": "node --test tests/alpha1-browser-lifecycle-integration.test.js tests/issue-367-remote-session-inject.test.js tests/client.test.js tests/client-presentation-boundary.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-acceptance-regression.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/local-remote-settings-permission.test.js tests/v2-settings-ia-integration.test.js tests/logging-ui.test.js",
     "test:contract": "node --test tests/manifest-dependencies.test.js tests/bundle-defaults.test.js tests/zero-regression-gate.test.js tests/issue-289-native-nonintervention.test.js tests/runtime-boundary-fixes.test.js tests/runtime-i18n.test.js tests/adapter-prepare-call-compat.test.js tests/rc6-rc7-compat.test.js tests/attachment-admission-policy.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js",
+    "test:grounding": "node --test tests/grounding-coordinate-frame.test.js tests/grounding-coordinate-runtime.test.js tests/vision-capability-grounding-proof-contract.test.js",
     "test:stress": "node scripts/image-resource-stress.mjs && node --test tests/large-image-resource-integration.test.js tests/resource-retention-lifecycle.test.js"
   },
   "pnpm": {
@@ -95,4 +96,4 @@
     },
     "bundle": { "patch": "./cordis.patch.yml" }
   }
-}
+}