dsh-vision-router 2.1.4 → 2.1.5

package/README.md

@@ -17,7 +17,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.0"><img src="https://img.shields.io/badge/release-v2.1.0-5B4CF0?style=flat-square" alt="Release v2.1.0" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.5"><img src="https://img.shields.io/badge/release-v2.1.5-5B4CF0?style=flat-square" alt="Release v2.1.5" /></a>
   <a href="tests"><img src="https://img.shields.io/badge/verified-Node%2022%20%2B%2024-2EA44F?style=flat-square" alt="Verified: Node 22 + 24" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="License: MIT" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
@@ -39,9 +39,9 @@
 <p align="center">💬 <strong>QQ community group: 1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **Announcement (v2.1.0)**
+> 📌 **Announcement (v2.1.5)**
 >
-> **v2.1.0:** Native five-card Settings, explicit Vision mode, runtime i18n, hardened capability routing/benchmarks, and the DSH rc.8 support floor. [What’s new →](docs/releases/v2.1.0.md)
+> **v2.1.5:** Supports the current DSH stable `0.1.5-rc.1`, reconciles Vision twins as providers change live, preserves Vision across wrapped-model switches, and hardens Web activation plus the release/security pipeline. [What’s new →](docs/releases/v2.1.5.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />
@@ -413,7 +413,7 @@ ollama pull qwen2.5vl
 ## Requirements
 
 - DeepSeek Harness Web profile. Normal installs can use `npx @deepseek-ai/dsh ...`; source checkouts use `pnpm dsh ...`. A bare `dsh ...` command only works when the CLI is already on your shell `PATH`.
-- **DSH Host support policy:** DVR 2.1.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.2-rc.1`. Exact `0.1.3-alpha.2` coverage is **verification evidence only**, not a preview support promise; scheduled `latest`/`alpha` canaries monitor drift without changing the support policy. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
+- **DSH Host support policy:** DVR 2.1.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.1`. Exact `0.1.5-alpha.2` coverage is **verification evidence only**, not a preview support promise; scheduled `latest`/`alpha` canaries monitor drift without changing the support policy. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
 - Node ≥ 22 (host side).
 - No API key for the default free chain; a credential reference (`apiKeyEnv`) only for paid `httpProviders`.
 - Chrome / Chromium / Edge is needed only for `vision_html_screenshot`; every other tool works without a browser.

package/README.zh.md

@@ -17,7 +17,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.0"><img src="https://img.shields.io/badge/release-v2.1.0-5B4CF0?style=flat-square" alt="Release v2.1.0" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.5"><img src="https://img.shields.io/badge/release-v2.1.5-5B4CF0?style=flat-square" alt="Release v2.1.5" /></a>
   <a href="tests"><img src="https://img.shields.io/badge/verified-Node%2022%20%2B%2024-2EA44F?style=flat-square" alt="已验证 Node 22 + 24" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="MIT 许可证" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
@@ -39,9 +39,9 @@
 <p align="center">💬 <strong>QQ 用户交流群：1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **公告（v2.1.0）**
+> 📌 **公告（v2.1.5）**
 >
-> **v2.1.0：原生五卡设置、输入框识图、运行时双语、能力路由/测评加固，并正式启用 DSH rc.8 最低支持线。** [查看完整更新 →](docs/releases/v2.1.0.md)
+> **v2.1.5：已支持当前 DSH 稳定版 `0.1.5-rc.1`，修复 live provider 变化时 Vision twin 对账与识图模式下 wrapper 模型切换，并加固 Web 激活与发版/安全链路。** [查看完整更新 →](docs/releases/v2.1.5.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />
@@ -411,7 +411,7 @@ ollama pull qwen2.5vl
 ## 环境要求
 
 - DeepSeek Harness 的 Web profile。普通安装可用 `npx @deepseek-ai/dsh ...`；从源码仓库运行时用 `pnpm dsh ...`。只有 CLI 已经进入系统 `PATH` 时才能直接写 `dsh ...`。
-- **DSH Host 支持策略：** DVR 2.1.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前正式发布通道已验证并支持到 `0.1.2-rc.1`。对 `0.1.3-alpha.2` 的精确覆盖**只属于验证证据**，不代表对 preview 的公开支持承诺；定时 `latest`/`alpha` canary 只负责发现上游漂移，也不会自动改变支持策略。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
+- **DSH Host 支持策略：** DVR 2.1.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前正式发布通道已验证并支持到 `0.1.5-rc.1`。对 `0.1.5-alpha.2` 的精确覆盖**只属于验证证据**，不代表对 preview 的公开支持承诺；定时 `latest`/`alpha` canary 只负责发现上游漂移，也不会自动改变支持策略。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
 - Node ≥ 22（宿主侧）。
 - 默认免费链路无需 API Key；付费 `httpProviders` 只需一个凭据引用（`apiKeyEnv`）。
 - 只有 `vision_html_screenshot` 需要 Chrome / Chromium / Edge；其余工具无浏览器也能用。

package/cordis.patch.yml

@@ -4,9 +4,20 @@
 # without any manual cordis.patch.yml edits. Later layers (the profile's own
 # cordis.patch.yml, --patch overlays) override these rows by id.
 
-# 纯增量补丁（issue #34）：不碰核心行。最低支持 Host 仍保留旧兼容路径；
+# 纯增量补丁（issue #34）：不替换/禁用核心行。最低支持 Host 仍保留旧兼容路径；
 # batch-attachment 合同的 Host 始终拥有 deepseek-official，插件只提供
 # 「+ 自动识图」包装路由，因此这里永远不默认禁用官方 llm-deepseek 行。
+#
+# DSH 0.1.5 family（含当前 0.1.5-rc.1）的 client-modules Node half 在 webServer 尚未可用时会走
+# ctx.inject() 延迟注册路径；Linux 并行 Loader 激活可在安装额外 client bundle 后
+# 命中 Cordis 的 service-access 竞态（"webServer without inject"）。rc.8 至当前
+# Web bundle 都使用同一个 modules row，因此只给该既有行追加显式 webServer
+# activation dependency：不替换 row，不改变 client graph，只把官方已经需要的
+# Web carrier 依赖从运行时探测收敛成 Loader 顺序。非 Web surface 缺少该 row 时
+# Include 按官方 patch 语义仅跳过此 overlay。上游修复该竞态后可重新审计删除。
+- id: modules
+  name: '@deepseek-ai/dsh-client-modules'
+  inject: [webServer]
 
 # 挂载插件行。默认保持完整视觉工具表常驻（issue #81）：虽然渐进挂载可以
 # 少发一小段工具 schema，但图片轮首次扩展工具列表会改变请求前缀，可能让

package/docs/architecture/dsh-compatibility-matrix.md

@@ -10,8 +10,8 @@ The matrix is capability-based. Runtime code must feature-detect the seam it nee
 | --- | --- | --- |
 | `minimum-contract` | `0.1.0-rc.6` | Historical compatibility-retention fixture. The name is legacy; DVR 2.1.x public support starts at rc.8. |
 | `legacy-contract` | `0.1.0-rc.8` | Public support-floor fixture carrying batch attachments and dimension policy. |
-| `current-contract` | `0.1.2-rc.1` | Current stable Host contract baseline. Must remain green. |
-| exact preview gates | `0.1.3-alpha.2` | Required verification evidence only; not a public preview-support claim. |
+| `current-contract` | `0.1.5-rc.1` | Current stable Host contract baseline. Must remain green. |
+| exact preview gates | `0.1.5-alpha.2` | Required verification evidence only; not a public preview-support claim. |
 | `latest-dsh` / alpha canaries | resolved dynamically from npm dist-tags | Scheduled drift surveillance only. Never changes support policy by itself. |
 
 Node 22 and Node 24 remain the general required runtime matrix. The Host contract jobs are additive; they do not replace the normal test matrix.
@@ -20,7 +20,7 @@ Node 22 and Node 24 remain the general required runtime matrix. The Host contrac
 
 `yes` means the fixture has a direct positive test or feature probe. `no` means a direct negative probe exists. `compat` means the fixture proves Vision Router can safely carry the newer input/config through that Host, but does **not** claim the Host owns that capability. `probe` means the capability is intentionally not inferred from the version label and is verified at runtime/contract-test time.
 
-| Capability | minimum-contract rc.6 | legacy-contract rc.8 | current-contract rc.1 (0.1.2) | Evidence / detection |
+| Capability | minimum-contract rc.6 | legacy-contract rc.8 | current-contract rc.1 (0.1.5) | Evidence / detection |
 | --- | --- | --- | --- | --- |
 | Batch attachment save | no | yes | yes | `hasBatchAttachmentContract()` checks the released `attachments.saveImages` prototype; `tests/rc6-rc7-compat.test.js`; contract CI. |
 | Max image dimension policy | compat | yes | yes | All fixtures parse the complete attachment-local row; rc.8/current positively retain the field and the established admission tests exercise the 10000/10001 boundary. Older Schemastery passthrough is not treated as ownership evidence. |

package/docs/architecture/dsh-support-window.md

@@ -9,7 +9,7 @@ The public support policy contains only released Host semantics. Preview/canary
 | Role | DSH train | Meaning |
 |---|---|---|
 | Minimum Supported Host | `0.1.0-rc.8` | Oldest Host generation that DVR 2.1.x publicly supports. |
-| Current Stable Host | `0.1.2-rc.1` | Current npm stable-channel release covered by required exact Host and browser evidence. |
+| Current Stable Host | `0.1.5-rc.1` | Current npm stable-channel release covered by required exact Host and browser evidence. |
 
 DVR `2.1.x` therefore keeps `0.1.0-rc.8` as its public floor and supports released Host trains through the current stable channel. Runtime branching remains capability-based rather than version-string-driven.
 
@@ -21,8 +21,8 @@ Compatibility evidence answers a different question: what exact upstream release
 
 | Evidence role | DSH source | Meaning |
 |---|---|---|
-| Exact stable evidence | `0.1.2-rc.1` | Required Host/wire and real Host + Chromium coverage for the current stable release. |
-| Exact preview evidence | `0.1.3-alpha.2` | Required preview Host/wire/lifecycle/browser evidence. This is not a preview support promise. |
+| Exact stable evidence | `0.1.5-rc.1` | Required Host/wire and real Host + Chromium coverage for the current stable release. |
+| Exact preview evidence | `0.1.5-alpha.2` | Required preview Host/wire/lifecycle/browser evidence. This is not a preview support promise. |
 | Stable drift canary | npm dist-tag `latest` | Scheduled, dynamically resolved surveillance. A failure starts compatibility investigation; it does not rewrite support policy. |
 | Preview drift canary | npm dist-tag `alpha` | Scheduled, dynamically resolved surveillance with preview-specific lifecycle coverage. A failure does not rewrite support policy. |
 

package/docs/releases/v2.1.5.md

@@ -0,0 +1,41 @@
+# v2.1.5
+
+DVR 2.1.5 is a compatibility, reliability, and release-hardening patch. It moves the fixed stable evidence to DSH `0.1.5-rc.1`, keeps exact preview evidence on `0.1.5-alpha.2`, fixes live Vision-twin reconciliation and wrapped-model switching, and modularizes the oversized Core runtime without changing the public 2.1.x routing model or minimum Host floor.
+
+## DSH 0.1.5 stable / preview compatibility
+
+- Supports the current npm stable Host `0.1.5-rc.1` while keeping DSH `0.1.0-rc.8` as the public minimum for DVR 2.1.x. Exact `0.1.5-alpha.2` coverage remains preview verification evidence only, not a blanket preview-support promise.
+- Admits the exact verified `0.1.5-alpha.1`, `0.1.5-alpha.2`, and `0.1.5-rc.1` Host peers without using a broad semver range that would silently promise compatibility with future untested DSH releases.
+- Moves the required current Host contract, Node 22/24 release-family contracts, exact source checks, and real Host + Chromium browser gates onto `0.1.5-rc.1`; the exact preview gates move to `0.1.5-alpha.2`.
+- Pins exact source evidence to immutable upstream commits and verifies the checkout SHA before running attachment normalization, LLM adapter, session/remotes, and Web compatibility contracts on Ubuntu, macOS, and Windows.
+- Keeps the existing Web `@deepseek-ai/dsh-client-modules` row explicitly waiting for the official `webServer` carrier. Current `0.1.5-rc.1` and `0.1.5-alpha.2` still require this compatibility overlay.
+- Adds a three-state overlay lifecycle contract plus moving upstream watch: `shim-required` keeps the overlay, `retire-ready` fails and requires deliberate retirement once DSH owns the dependency, and `dangerous-drift` fails closed if the upstream row changes incompatibly.
+
+## Vision-mode and live-provider reliability
+
+- Preserves Vision mode when the user switches to another model that has a matching hidden Vision Router wrapper in the same visible source provider. Cross-provider switches or targets without a wrapper still leave Vision mode, and DSH's image-session model guards remain authoritative.
+- Treats `wrappedProviders` as configuration intent rather than a snapshot of startup topology. Generated `<provider>-vision` twins are reconciled against the live provider registry: dormant sources do not materialize twins, newly mounted providers gain them, removed providers withdraw them, and provider/model presentation metadata refreshes atomically.
+- Reuses the bounded adapter-update coalescer for synchronous registry events so live provider churn converges without duplicate registrations, re-entrant loops, or stale model filters.
+- Keeps the lower twin-image capability compatibility boundary tolerant of out-of-order registration for older Host shapes while preserving fail-closed ownership checks for Vision Router-owned routes.
+
+## Runtime architecture
+
+- Splits the oversized root runtime into `lib/core-primitives.js` and `lib/sharp-runtime.js` while keeping `Config`, `apply`, Host composition, and public exports owned by the existing entry point.
+- The modularization is behavior-preserving: no settings migration, route rename, tool-schema change, or public API change is introduced. A permanent architecture contract prevents the extracted primitives from drifting back into a monolithic entry file or creating a second runtime owner.
+
+## Security and release hardening
+
+- Updates the development `sharp` runtime past the libheif advisory while keeping the shared-Host peer contract at `sharp >=0.35.3 <1`, so the security fix does not raise the public Host floor.
+- Reworks the trusted PR impact shadow so `pull_request_target` never checks out PR code. The classifier is fetched from the trusted base commit, size-bounded, and verified against its Git blob identity before execution; permissions remain read-only.
+- Adds deterministic adversarial security fuzzing, dependency review, OpenSSF Scorecard coverage, Private Vulnerability Reporting guidance, and stronger immutable release verification.
+- Expands audited browser-impact triggers so client preludes, model-visibility boundaries, Web modules, Settings client surfaces, and exact compatibility modules cannot change without the corresponding browser/source gates running.
+
+## Validation
+
+- Release-candidate coverage includes Node 22/24, DSH rc.6/rc.7/rc.8 compatibility contracts, current stable `0.1.5-rc.1`, exact preview `0.1.5-alpha.2`, Ubuntu/macOS/Windows exact-source contracts, Windows screenshot runtime, host-sharp on all three desktop OSes, routing parity, native multimodal cold resume, large-image resource stress, deterministic hostile-input fuzz, dependency review, CodeQL, and real Chromium lifecycle gates for both exact stable and preview Hosts.
+- The moving release-channel canary also resolves npm `latest` and `alpha` independently so a newly published DSH train is detected before the fixed release evidence is deliberately advanced.
+- No Settings migration is required. Restart DSH Web/Desktop after upgrading so the updated Host and browser compatibility logic is loaded.
+
+## Upgrade
+
+Upgrade to 2.1.5 and restart DSH Web/Desktop. Existing Vision Router settings remain compatible.