dsh-vision-router 2.1.5 → 2.1.6

package/README.md

@@ -17,7 +17,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.5"><img src="https://img.shields.io/badge/release-v2.1.5-5B4CF0?style=flat-square" alt="Release v2.1.5" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.6"><img src="https://img.shields.io/badge/release-v2.1.6-5B4CF0?style=flat-square" alt="Release v2.1.6" /></a>
   <a href="tests"><img src="https://img.shields.io/badge/verified-Node%2022%20%2B%2024-2EA44F?style=flat-square" alt="Verified: Node 22 + 24" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="License: MIT" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
@@ -39,9 +39,9 @@
 <p align="center">💬 <strong>QQ community group: 1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **Announcement (v2.1.5)**
+> 📌 **Announcement (v2.1.6)**
 >
-> **v2.1.5:** Supports the current DSH stable `0.1.5-rc.1`, reconciles Vision twins as providers change live, preserves Vision across wrapped-model switches, and hardens Web activation plus the release/security pipeline. [What’s new →](docs/releases/v2.1.5.md)
+> **v2.1.6:** Advances exact stable support to DSH `0.1.5-rc.2`, fixes the remote-settings `webServer` startup error, and completes Host-first proxy isolation, lifecycle, redirect-boundary, HTTP CONNECT, and SOCKS5 hardening without raising the rc.8 Host floor. [What’s new →](docs/releases/v2.1.6.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />
@@ -356,7 +356,7 @@ Everything is optional; defaults work out of the box. Prefer **Settings → Visi
 | `wrappedProviders` | `[{ provider: 'deepseek-official', models: [] }]` | optional manual wrapper scope `{ provider, models[] }`, used after disabling auto-wrap or to restrict which models can enter an internal wrapper through “👁 Vision”; changes apply live, no restart |
 | `routing` | `false` | legacy whole-turn chain routing (one-shot answer). `false` = tools-first flow (recommended) |
 | `reverseRouting` | `true` | with `routing: true`, route text turns back to `textProvider` |
-| `wrapperRoute` / `chainRoute` | `deepseek-vision` / `vision-chain` | admission wrapper route name / fallback chain route name (empty disables) |
+| `wrapperRoute` / `chainRoute` | `deepseek-vision` / `vision-chain` | developer route names. Leaving either field blank in current Settings clears the override and restores its default; explicitly blank values are retained only for legacy/manual persisted-config compatibility. |
 | `stealth` | `false` | take over the official `deepseek-official` route (official row only; custom routes are auto-wrapped by default) |
 | `textProvider` | `deepseek-official` / `deepseek-v4-pro` | the model that reasons (your daily model) |
 | `tool` / `progressiveTools` / `autoActivateOnImage` | `true` / `false` / `true` | vision tools on / progressive mounting (off by default for a stable tool schema) / image-turn auto-mount when progressive mode is enabled; `progressiveTools` is boot-time config |
@@ -370,9 +370,18 @@ Everything is optional; defaults work out of the box. Prefer **Settings → Visi
 | `cache` / `cacheTtlSeconds` / `cacheMaxEntries` | `true` / `3600` / `200` | vision answer cache |
 | `timeoutMs` | `120000` | per vision call deadline |
 | `artifactsDir` | `.dsh-vision-router/artifacts` | artifact directory (relative to the session workspace) |
-| `proxy` / `proxyHosts` | `''` / openrouter hosts | optional proxy for vision provider hosts only |
+| `proxy` / `proxyHosts` | `''` / openrouter hosts | **advanced override**: empty follows the DSH/Host network path; only an explicit value proxies selected vision hosts through Vision Router |
 | `catalogCorrections` | `true` | built-in catalog-routing corrections for known upstream wire-protocol mismatches; each correction disarms itself once the catalog is fixed upstream |
 
+
+### Network proxy: DSH/Host first
+
+Vision Router does **not own network egress by default**. When `proxy` is empty, Router-owned vision HTTP injects no private dispatcher and the Host-owned compatibility wrapper stays transparent, so requests continue on the current DSH/Host network path. With an explicit override, Host-owned adapter traffic is intercepted only while Vision Router is actively executing that configured visual provider; unrelated concurrent Host traffic keeps the Host route.
+
+On the DSH 0.1.5 line (rc.1+), the Host provides process-wide outbound proxy policy from `HTTP_PROXY` / `HTTPS_PROXY` / `ALL_PROXY` / `NO_PROXY`; TUN mode also works transparently below the process. DSH does not automatically read the macOS/Windows “system proxy” switch, so enabling only an app's System Proxy is not the same as proxying the CLI.
+
+Set `proxy` only when you intentionally need a **vision-only proxy override**. It remains available for older Hosts, SOCKS5 users, and deployments that need selected vision domains to take a different route; `proxyHosts` scopes only this plugin override and does not redefine the Host's global proxy policy. Redirects cannot widen that scope: once a DVR-proxied request redirects to a host outside `proxyHosts`, that hop returns to the request's inherited Host/caller dispatcher. A request whose initial URL is outside `proxyHosts` stays fully Host-owned, even if a later redirect enters the list.
+
 ### Local Ollama vision backend (merged from dsh-vision)
 
 > **Incremental author**: [shaoqiuyuavailable](https://github.com/shaoqiuyuavailable) (router local-vision increment)
@@ -413,7 +422,7 @@ ollama pull qwen2.5vl
 ## Requirements
 
 - DeepSeek Harness Web profile. Normal installs can use `npx @deepseek-ai/dsh ...`; source checkouts use `pnpm dsh ...`. A bare `dsh ...` command only works when the CLI is already on your shell `PATH`.
-- **DSH Host support policy:** DVR 2.1.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.1`. Exact `0.1.5-alpha.2` coverage is **verification evidence only**, not a preview support promise; scheduled `latest`/`alpha` canaries monitor drift without changing the support policy. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
+- **DSH Host support policy:** DVR 2.1.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.2`. Exact `0.1.5-alpha.2` coverage is **verification evidence only**, not a preview support promise; scheduled `latest`/`alpha` canaries monitor drift without changing the support policy. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
 - Node ≥ 22 (host side).
 - No API key for the default free chain; a credential reference (`apiKeyEnv`) only for paid `httpProviders`.
 - Chrome / Chromium / Edge is needed only for `vision_html_screenshot`; every other tool works without a browser.

package/README.zh.md

@@ -17,7 +17,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.5"><img src="https://img.shields.io/badge/release-v2.1.5-5B4CF0?style=flat-square" alt="Release v2.1.5" /></a>
+  <a href="https://github.com/ysr666/dsh-vision-router/releases/tag/v2.1.6"><img src="https://img.shields.io/badge/release-v2.1.6-5B4CF0?style=flat-square" alt="Release v2.1.6" /></a>
   <a href="tests"><img src="https://img.shields.io/badge/verified-Node%2022%20%2B%2024-2EA44F?style=flat-square" alt="已验证 Node 22 + 24" /></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat-square" alt="MIT 许可证" /></a>
   <a href="package.json"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-339933?style=flat-square&amp;logo=nodedotjs&amp;logoColor=white" alt="Node.js >=22" /></a>
@@ -39,9 +39,9 @@
 <p align="center">💬 <strong>QQ 用户交流群：1105463028</strong></p>
 
 > [!WARNING]
-> 📌 **公告（v2.1.5）**
+> 📌 **公告（v2.1.6）**
 >
-> **v2.1.5：已支持当前 DSH 稳定版 `0.1.5-rc.1`，修复 live provider 变化时 Vision twin 对账与识图模式下 wrapper 模型切换，并加固 Web 激活与发版/安全链路。** [查看完整更新 →](docs/releases/v2.1.5.md)
+> **v2.1.6：正式验证 DSH `0.1.5-rc.2`，修复远程设置 `webServer` 启动报错，并完成 Host-first 代理隔离、生命周期、redirect 边界、HTTP CONNECT 与 SOCKS5 加固；公开最低 Host 仍为 rc.8。** [查看完整更新 →](docs/releases/v2.1.6.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />
@@ -354,7 +354,7 @@ Web profile 现在提供一级 **设置 → Vision Router** 页面。常规页
 | `wrappedProviders` | `[{ provider: 'deepseek-official', models: [] }]` | 可选手动包装范围 `{ provider, models[] }`；用于关闭自动包装后手动指定，或限制某个 provider 只有部分模型可通过「👁 识图」进入 wrapper |
 | `routing` | `false` | 旧版整轮链路由（一次性整轮回答）。`false` = 工具优先流程（推荐） |
 | `reverseRouting` | `true` | 开启 `routing` 时，文字轮路由回 `textProvider` |
-| `wrapperRoute` / `chainRoute` | `deepseek-vision` / `vision-chain` | 准入包装路由名 / 降级链路由名（置空关闭） |
+| `wrapperRoute` / `chainRoute` | `deepseek-vision` / `vision-chain` | 开发者路由名。当前设置页留空会清除覆盖并恢复默认值；显式空字符串仅作为旧版/手工持久化配置兼容保留。 |
 | `stealth` | `false` | 接管官方 `deepseek-official` 路由（仅官方行；自定义路由默认由自动包装处理） |
 | `textProvider` | `deepseek-official` / `deepseek-v4-pro` | 负责思考的模型（你的日常模型） |
 | `tool` / `progressiveTools` / `autoActivateOnImage` | `true` / `false` / `true` | 视觉工具总开关 / 渐进式挂载（默认关闭以稳定工具 schema）/ 渐进模式下图片轮自动挂载；`progressiveTools` 为启动期配置 |
@@ -368,9 +368,18 @@ Web profile 现在提供一级 **设置 → Vision Router** 页面。常规页
 | `cache` / `cacheTtlSeconds` / `cacheMaxEntries` | `true` / `3600` / `200` | 视觉答案缓存 |
 | `timeoutMs` | `120000` | 单次视觉调用超时 |
 | `artifactsDir` | `.dsh-vision-router/artifacts` | 产物目录（相对会话工作区） |
-| `proxy` / `proxyHosts` | `''` / openrouter 域名 | 仅视觉供应商域名可选的本地代理 |
+| `proxy` / `proxyHosts` | `''` / openrouter 域名 | **高级覆盖**：留空沿用 DSH/Host 网络路径；仅显式填写时让指定视觉域名使用插件代理 |
 | `catalogCorrections` | `true` | 内置目录纠错：当已安装目录把已知模型路由到错误协议时按正确协议应答；上游修复后对应纠错自动失效 |
 
+
+### 网络代理：默认跟随 DSH/Host
+
+Vision Router 默认**不接管网络出口**。`proxy` 留空时，Router-owned 视觉 HTTP 不注入自有 dispatcher，Host-owned 兼容层也保持透明，因此请求继续沿用 DSH/Host 当前网络路径。显式填写覆盖时，Host-owned adapter 也只会在 Vision Router 正在执行该已配置视觉模型的调用作用域内被代理；并发的其他 Host 请求仍沿用 Host 路径。
+
+在 DSH 0.1.5 系列（rc.1+）中，Host 已提供统一出网代理：`HTTP_PROXY` / `HTTPS_PROXY` / `ALL_PROXY` / `NO_PROXY` 在启动时解析并应用；TUN 模式也会在更底层透明生效。DSH 本身不会自动读取 macOS/Windows 的“系统代理”开关，所以仅打开代理软件的 System Proxy 并不等价于 CLI 已经走代理。
+
+只有在你确实需要“**视觉请求单独走另一条代理**”时才填写 `proxy`。这仍保留给旧 Host、SOCKS5 用户和按视觉域名定向覆盖的高级场景；`proxyHosts` 只约束这一插件级覆盖，不会重定义 Host 的全局代理策略。 Redirect 也不会扩大这个范围：已进入 DVR 代理的请求一旦跳转到 `proxyHosts` 之外，该跳立即回到请求原本继承的 Host/caller dispatcher；首个 URL 不在 `proxyHosts` 的请求则全程保持 Host-owned，即使后续跳转进入名单也不会临时加载 DVR 代理。
+
 ### 本地 Ollama 视觉后端（并入自 dsh-vision）
 
 > **增量开发作者**：[shaoqiuyuavailable](https://github.com/shaoqiuyuavailable)（router 本地视觉增量）
@@ -411,7 +420,7 @@ ollama pull qwen2.5vl
 ## 环境要求
 
 - DeepSeek Harness 的 Web profile。普通安装可用 `npx @deepseek-ai/dsh ...`；从源码仓库运行时用 `pnpm dsh ...`。只有 CLI 已经进入系统 `PATH` 时才能直接写 `dsh ...`。
-- **DSH Host 支持策略：** DVR 2.1.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前正式发布通道已验证并支持到 `0.1.5-rc.1`。对 `0.1.5-alpha.2` 的精确覆盖**只属于验证证据**，不代表对 preview 的公开支持承诺；定时 `latest`/`alpha` canary 只负责发现上游漂移，也不会自动改变支持策略。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
+- **DSH Host 支持策略：** DVR 2.1.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前正式发布通道已验证并支持到 `0.1.5-rc.2`。对 `0.1.5-alpha.2` 的精确覆盖**只属于验证证据**，不代表对 preview 的公开支持承诺；定时 `latest`/`alpha` canary 只负责发现上游漂移，也不会自动改变支持策略。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
 - Node ≥ 22（宿主侧）。
 - 默认免费链路无需 API Key；付费 `httpProviders` 只需一个凭据引用（`apiKeyEnv`）。
 - 只有 `vision_html_screenshot` 需要 Chrome / Chromium / Edge；其余工具无浏览器也能用。

package/docs/architecture/2x-contract-ledger.md

@@ -40,7 +40,7 @@ A green test run while the old path can still silently rescue the new path is no
 | session surface repair | existing `surfaceOp: { op: 'replace' }` and `sourceEventSeqs` semantics remain compatible |
 | attachment identity | durable attachment ids remain Host/session identities; no cross-session lookup is introduced |
 | artifact publication | existing public derived-artifact paths/return values remain compatible; managed run cleanup remains confined to Router-owned provenance/namespaces |
-| proxy setting | existing proxy/proxyHosts behavior remains compatible; Router-owned HTTP stays independent of process-global fetch mutation |
+| proxy setting | persisted `proxy` / `proxyHosts` remain compatible; blank `proxy` means Host-owned egress, while an explicit value remains a vision-only advanced override. Router-owned HTTP stays independent of process-global fetch mutation |
 | Doctor | Closure does not turn advisory architecture/support diagnostics into new failure exit codes |
 | support window | DVR 2.0.x continues to support the published minimum/previous/current DSH window; rc.6 support is not removed by a patch-level closure |
 | runtime platforms | Node 22/24 and the existing Ubuntu/macOS/Windows host-sharp contract remain supported |

package/docs/architecture/compat-inventory.md

@@ -70,18 +70,19 @@ P0 records why each major compatibility seam exists and the condition that permi
 - **Reason:** carry the Router-owned provider transport into compatibility callers whose mature function signatures still accept only a raw `fetch` or use an internal direct HTTP call, while keeping Router traffic off the process-global fetch patch.
 - **Host gap:** this is an internal composition gap rather than a DSH version persona: `fetchWithOpenAICompatibility(...)` and the Anthropic catalog-correction path do not yet receive a `VisionProviderTransport` parameter explicitly.
 - **First needed for:** provider-scoped transport ownership and proxy narrowing without rewriting the mature compatibility call signatures in the same migration.
-- **Feature detection:** explicit transport-aware callers bypass the registry; only compatibility paths that call `currentVisionProviderTransport()` consume the currently installed process/profile transport. The registry never patches `globalThis.fetch`.
-- **Removal condition:** every Router-owned compatibility caller receives `VisionProviderTransport` explicitly, production has zero reads of `currentVisionProviderTransport()`, and the install/release registry can be removed without changing proxy, credential, bounded-body or cancellation behavior.
-- **Tests:** `vision-provider-transport`, `http-compat`, `catalog-corrections`, P2 Data Boundary provider-transport Node 22/24, Host pack/install smoke.
+- **Feature detection:** explicit transport-aware callers bypass the registry; only compatibility paths that call `currentVisionProviderTransport()` consume the currently installed process/profile transport. The registry never patches `globalThis.fetch`. Router-owned and scoped Host-owned explicit proxies share one lease/retire dispatcher pool. First-hop `proxyHosts` admission preserves the no-Undici Host path for non-matches; admitted requests use a request-scoped selector that re-checks every redirect origin and delegates non-matches to the request-start Host/caller dispatcher.
+- **Removal condition:** every Router-owned compatibility caller receives `VisionProviderTransport` explicitly, production has zero reads of `currentVisionProviderTransport()`, and the install/release registry can be removed without changing proxy, redirect-hop authority, credential, bounded-body, cancellation, or dispatcher-lifecycle behavior.
+- **Tests:** `vision-provider-transport` (A→B lifecycle, proxy clear, pending-construction unload, synchronous loader failure, real Fetch listed→unlisted redirect, initial-unlisted no-import and explicit-caller fallback), `legacy-global-proxy-boundary` (scoped Host-owned redirect and pool cleanup), `http-compat`, `catalog-corrections`, P2 Data Boundary provider-transport Node 22/24, Host pack/install smoke.
 
 ## `lib/legacy-global-proxy-boundary.js`
 
-- **Reason:** retain the process-global proxy patch only for Host-owned/raw-fetch visual providers that still lack a provider-scoped proxy seam. Router-owned `vision-http` and direct protocol-correction traffic already uses `VisionProviderTransport` with an explicit dispatcher.
-- **Host gap:** the supported Host window does not yet guarantee one provider-scoped/shared HTTP proxy seam that third-party Host-owned adapters can consume without a process-global fetch wrapper.
-- **First needed for:** legacy/custom Host-owned visual provider compatibility when users configure Vision Router proxy routing.
-- **Feature detection:** live visual-chain ownership. Router-owned routes bypass the legacy patch; any unknown/Host-owned provider conservatively keeps it available. This is capability/ownership detection, not a Host-version persona.
-- **Removal condition:** **the minimum supported DSH provides a provider-scoped/shared HTTP proxy seam** that covers the remaining Host-owned/raw-fetch provider compatibility requirement.
-- **Tests:** `legacy-global-proxy-boundary`, `vision-provider-transport`, `adversarial-hardening`, P2 Data Boundary Node 22/24.
+- **Reason:** preserve the explicit Vision Router proxy override for Host-owned/raw-fetch visual providers without granting that configuration process-wide routing authority. Router-owned HTTP already uses `VisionProviderTransport`; blank `proxy` leaves the compatibility wrapper fully transparent.
+- **Host gap:** DSH 0.1.5 owns ordinary process egress, but a Host adapter invoked through `ctx.llm.stream()` still exposes no DVR-owned request/dispatcher parameter for a vision-only SOCKS/selective override. A separate legacy direct whole-turn mode (`routing=true` plus blank `chainRoute`) also hands control to the Host after the DVR hook returns, leaving no adapter-iteration scope to authorize.
+- **First needed for:** legacy/custom Host-owned visual provider compatibility when users configure a Vision Router-specific proxy override.
+- **Feature detection:** live explicit proxy + exact configured Host-owned provider/model + AsyncLocalStorage visual-call scope. Router-owned routes, blank proxy, different pairs and concurrent ordinary Host traffic are pass-through. Only the explicit direct whole-turn blank-`chainRoute` configuration retains unscoped compatibility.
+- **H3 product decision:** KEEP `proxy` / `proxyHosts` supported and non-deprecated as a local-only Advanced override; do not add a second legacy-proxy toggle. Explicit blank `chainRoute` is legacy persisted/manual compatibility, not a current Settings workflow.
+- **Removal condition:** Host-owned adapter requests can receive the explicit DVR override through a scoped Host transport (or the override is intentionally retired under an announced product policy), and the direct whole-turn explicit-empty `chainRoute` state is migrated/retired by support-window policy.
+- **Tests:** `legacy-global-proxy-boundary`, `vision-provider-transport`, exact Host proxy egress contract, Benchmark/Exact Check coverage, P2 Data Boundary Node 22/24.
 
 ## `lib/legacy-core-vision-policy-bridge.js`
 

package/docs/architecture/dsh-compatibility-matrix.md

@@ -10,7 +10,7 @@ The matrix is capability-based. Runtime code must feature-detect the seam it nee
 | --- | --- | --- |
 | `minimum-contract` | `0.1.0-rc.6` | Historical compatibility-retention fixture. The name is legacy; DVR 2.1.x public support starts at rc.8. |
 | `legacy-contract` | `0.1.0-rc.8` | Public support-floor fixture carrying batch attachments and dimension policy. |
-| `current-contract` | `0.1.5-rc.1` | Current stable Host contract baseline. Must remain green. |
+| `current-contract` | `0.1.5-rc.2` | Current stable Host contract baseline. Must remain green. |
 | exact preview gates | `0.1.5-alpha.2` | Required verification evidence only; not a public preview-support claim. |
 | `latest-dsh` / alpha canaries | resolved dynamically from npm dist-tags | Scheduled drift surveillance only. Never changes support policy by itself. |
 
@@ -20,7 +20,7 @@ Node 22 and Node 24 remain the general required runtime matrix. The Host contrac
 
 `yes` means the fixture has a direct positive test or feature probe. `no` means a direct negative probe exists. `compat` means the fixture proves Vision Router can safely carry the newer input/config through that Host, but does **not** claim the Host owns that capability. `probe` means the capability is intentionally not inferred from the version label and is verified at runtime/contract-test time.
 
-| Capability | minimum-contract rc.6 | legacy-contract rc.8 | current-contract rc.1 (0.1.5) | Evidence / detection |
+| Capability | minimum-contract rc.6 | legacy-contract rc.8 | current-contract rc.2 (0.1.5) | Evidence / detection |
 | --- | --- | --- | --- | --- |
 | Batch attachment save | no | yes | yes | `hasBatchAttachmentContract()` checks the released `attachments.saveImages` prototype; `tests/rc6-rc7-compat.test.js`; contract CI. |
 | Max image dimension policy | compat | yes | yes | All fixtures parse the complete attachment-local row; rc.8/current positively retain the field and the established admission tests exercise the 10000/10001 boundary. Older Schemastery passthrough is not treated as ownership evidence. |

package/docs/architecture/dsh-support-window.md

@@ -9,10 +9,12 @@ The public support policy contains only released Host semantics. Preview/canary
 | Role | DSH train | Meaning |
 |---|---|---|
 | Minimum Supported Host | `0.1.0-rc.8` | Oldest Host generation that DVR 2.1.x publicly supports. |
-| Current Stable Host | `0.1.5-rc.1` | Current npm stable-channel release covered by required exact Host and browser evidence. |
+| Current Stable Host | `0.1.5-rc.2` | Current npm stable-channel release covered by required exact Host and browser evidence. |
 
 DVR `2.1.x` therefore keeps `0.1.0-rc.8` as its public floor and supports released Host trains through the current stable channel. Runtime branching remains capability-based rather than version-string-driven.
 
+DSH `0.1.5-rc.1` remains explicitly admitted for existing installations; current exact stable evidence has advanced to `0.1.5-rc.2`. Advancing this evidence does not raise the public minimum.
+
 No later support-floor increase is currently announced.
 
 ## Verification evidence — not support policy
@@ -21,7 +23,7 @@ Compatibility evidence answers a different question: what exact upstream release
 
 | Evidence role | DSH source | Meaning |
 |---|---|---|
-| Exact stable evidence | `0.1.5-rc.1` | Required Host/wire and real Host + Chromium coverage for the current stable release. |
+| Exact stable evidence | `0.1.5-rc.2` | Required Host/wire and real Host + Chromium coverage for the current stable release. |
 | Exact preview evidence | `0.1.5-alpha.2` | Required preview Host/wire/lifecycle/browser evidence. This is not a preview support promise. |
 | Stable drift canary | npm dist-tag `latest` | Scheduled, dynamically resolved surveillance. A failure starts compatibility investigation; it does not rewrite support policy. |
 | Preview drift canary | npm dist-tag `alpha` | Scheduled, dynamically resolved surveillance with preview-specific lifecycle coverage. A failure does not rewrite support policy. |

package/docs/architecture/host-first-proxy-convergence.md

@@ -0,0 +1,91 @@
+# Host-first Proxy Convergence
+
+Status: **H0 + H1 + H2 + H3 complete without raising the DSH support floor**
+
+H1 baseline: `main@9fb7f1736813f1f5c63c1f0e8214eb12a779f24e`
+
+H2 merged: `main@40b43d78b7c105c19188059172c2883eea9e681c`
+
+## Decision
+
+Network egress is a Host concern, not a vision-routing concern. Vision Router therefore treats DSH/Host as the default network authority and keeps its own proxy only as an explicit, vision-only compatibility/advanced override.
+
+`proxy: ''` means **do not override transport**. Router-owned HTTP calls pass no private dispatcher, and the Host-owned compatibility wrapper stays transparent. Whatever path DSH/Host currently owns — direct, environment proxy, or a lower-level TUN — remains authoritative.
+
+An explicit non-empty `proxy` keeps the existing Vision Router behavior for users who need a different route for selected `proxyHosts`, including legacy SOCKS5 configurations. Persisted settings are not migrated or rewritten.
+
+## Why this direction
+
+DSH's 0.1.5 line introduced a process-wide outbound proxy subsystem (`@deepseek-ai/dsh-http-proxy`) with one Host policy and a public `proxyRouteFor()` transport seam. Keeping a second generic proxy authority inside Vision Router would duplicate routing, redirect, dispatcher-lifecycle, and ownership policy.
+
+The production plugin does not import or require that Host package. The current public support window still includes older DSH releases, and the upstream package contract explicitly says ordinary `fetch()` callers should do nothing: the Host global dispatcher already owns routing. Calling `proxyRouteFor()` is reserved for consumers that must branch on proxy state or own a transport that cannot use normal fetch. H1 therefore adopts the Host capability by preserving plain fetch and proving the behavior against exact Host source, rather than adding a second route decision.
+
+## Compatibility matrix
+
+| Host / user state | Authority after H0 | Vision Router behavior |
+|---|---|---|
+| Any supported Host, `proxy=''` | DSH/Host | inject no dispatcher; compatibility wrapper is transparent |
+| Explicit `proxy` + Router-owned HTTP | Vision Router for matching vision hosts | provider-scoped dispatcher; no global interception |
+| Explicit `proxy` + Host-owned visual adapter | Vision Router only inside that visual adapter call | AsyncLocalStorage-scoped dispatcher interception |
+| `routing=true` + explicit blank `chainRoute` + Host-owned provider | Vision Router legacy compatibility | narrow unscoped direct whole-turn fallback retained until H3 |
+| SOCKS5 / legacy `socks5h` override | Vision Router | preserved; `socks5h` is projected at the Undici boundary |
+| Non-matching `proxyHosts` | DSH/Host | no plugin dispatcher and no Undici import |
+
+## H0 invariants
+
+1. Blank/whitespace `proxy` never authorizes the legacy proxy compatibility wrapper.
+2. Blank `proxy` never imports Vision Router's userland Undici ProxyAgent.
+3. Router-owned HTTP with blank `proxy` calls the captured Host fetch without an explicit dispatcher, so ambient Host dispatcher changes remain visible at request time.
+4. Explicit `proxy` remains live-editable and preserves `proxyHosts` narrowing.
+5. No schema migration, no setting rewrite, no DSH peer-range increase, and no new dependency on `@deepseek-ai/dsh-http-proxy`.
+6. The legacy compatibility seam is relevant only for the intersection: explicit plugin proxy **and** Host-owned/raw-fetch visual provider.
+
+## H1 — Host capability adoption
+
+H1 is complete as an egress contract, not as a new production dependency. Exact DSH source gates now run a local fake proxy through the Host's real `installProxyFromEnvironment()` implementation and drive Vision Router's shipping provider transport with `proxy: ''`. The contract proves all of the following:
+
+1. Host proxy policy receives Vision Router egress while Vision Router reports no private override and never imports its ProxyAgent.
+2. Host `NO_PROXY` remains authoritative for a bypassed target.
+3. A redirect from a proxied origin to a `NO_PROXY` origin is re-evaluated by the Host dispatcher per hop; the first-hop proxy decision is not pinned across the redirect.
+4. The same contract runs against the exact current stable Host and exact preview evidence on Linux, macOS, and Windows through the existing source-contract matrix.
+5. Production code contains no `@deepseek-ai/dsh-http-proxy` dependency or import. `proxyRouteFor()` is used only by the exact-source test as an oracle for the Host decision.
+
+The current stable evidence advances to DSH `0.1.5-rc.2`; `0.1.5-rc.1` remains explicitly peer-admitted, and the public minimum remains `0.1.0-rc.8`.
+
+## H2 — Scope Host-owned override authority
+
+H2 retires the **configuration-wide proxy authority** without removing the compatibility feature. Core no longer constructs ProxyAgent instances or installs its own process proxy patch. One compatibility wrapper remains outside runtime composition, but its default behavior is an exact pass-through to the DSH/Host fetch chain that existed when it was installed.
+
+For DVR-owned calls into a Host adapter, `streamWithLegacyGlobalProxyScope(provider, model, ...)` keeps an AsyncLocalStorage authorization alive across lazy AsyncIterable creation and every `next()` / `return()` / `throw()` operation. The wrapper injects a private dispatcher only when the live settings still contain an explicit proxy and the active scope exactly matches a configured Host-owned vision pair. Vision-chain adapter calls, `vision_describe`, capability Benchmark and Exact Check use this same boundary. Router-owned direct HTTP continues through `VisionProviderTransport` instead.
+
+H2 regression proof includes a deliberately blocked Host-owned visual stream plus a concurrent same-origin ordinary Host fetch. The ordinary request receives no DVR dispatcher; only the visual request receives the marked ProxyAgent dispatcher after its stream resumes. Clearing the proxy while the visual stream is active immediately returns later requests to Host authority.
+
+One unscoped compatibility case remains intentionally: `routing=true` with an explicitly blank `chainRoute` routes the whole image turn directly to the first Host provider after the DVR routing hook returns, so there is no DVR-owned adapter-iteration boundary to scope. H2 preserves that old configuration narrowly rather than silently breaking it in a patch release.
+
+## H3 — Product contract for the override and last wrapper
+
+H3 decides to **keep `proxy` / `proxyHosts` supported and non-deprecated** as a local-only Advanced override. No extra “legacy proxy” toggle is added: blank `proxy` is already the opt-out/default, the controls are already behind Advanced and local-only, and another authority bit would make the settings contract harder to reason about without removing the compatibility boundary.
+
+This is a current capability decision, not inertia. The H3 audit on 2026-09-11 checked DSH `0.1.5-rc.2` plus upstream `master@c291e7961a515f6d7af9304e7fd1d257929aef26`: `@deepseek-ai/dsh-http-proxy` still accepts only `http:` / `https:` and explicitly diagnoses SOCKS-family URLs as unsupported. The Host LLM adapter surface at that revision also still has no generic per-call dispatcher/transport input that a plugin can pass through `ctx.llm.stream()`. DVR issue #455 provides current Windows + DSH 0.1.5-rc.1 user evidence that `socks5://` plus selective `proxyHosts` is a real supported deployment shape. Removing the override now would therefore remove capability, not merely delete compatibility code.
+
+The remaining unscoped `routing=true` + explicit `chainRoute=''` behavior is classified as **legacy persisted/manual-config compatibility only**. Current Settings does not create that state: leaving `chainRoute` blank clears the user-layer override, so the schema default `vision-chain` becomes effective again. Existing persisted/manual explicit-empty values continue to work in this support window; H3 neither migrates nor rewrites them. Public documentation must not teach “leave `chainRoute` blank to disable” as a current Settings workflow.
+
+The final Host-owned compatibility wrapper remains justified until both conditions are satisfied: (1) Host-owned adapter calls can receive the DVR-specific override through a scoped Host transport/dispatcher seam, or the DVR override is intentionally removed under a future announced product policy; and (2) the legacy direct whole-turn explicit-empty `chainRoute` state has been migrated or retired under the applicable support-window policy. A Host release that merely has a global HTTP(S) proxy does not satisfy those conditions.
+
+### Post-H3 dispatcher lifecycle hardening
+
+Both explicit DVR proxy paths now use one `createProxyDispatcherPool()` lease/retire owner. A live proxy identity change retires the previous dispatcher immediately as an authority decision, but request leases prevent graceful close until already-admitted fetch calls have handed control back. Clearing the plugin proxy retires the cached dispatcher without constructing a replacement, Router-owned plugin cleanup calls `transport.dispose()`, and the Host-owned compatibility boundary disposes its pool with its own fiber. Pending constructors that resolve after replacement or unload are still retired and closed; synchronous loader/fetch failures cannot strand leases or poison the cache.
+
+### Per-hop redirect authority
+
+`proxyHosts` is an authorization upper bound, not merely a first-request filter. DVR first checks the original request URL before importing its userland Undici; if that URL is not listed, the entire request remains on the inherited Host path, including any later redirect into a listed domain. This deliberately preserves #149's no-Undici boundary for non-admitted traffic.
+
+When the original URL is listed, DVR supplies Fetch with a tiny request-scoped dispatcher selector rather than a fixed ProxyAgent. Each Undici `dispatch()` re-checks `options.origin`: listed hops use the leased DVR ProxyAgent; non-listed or malformed origins use the dispatcher that the request inherited at admission time (an explicit caller dispatcher when present, otherwise Undici's current Host global dispatcher snapshot). The selector borrows that fallback and never owns or closes it. Fetch/Undici therefore remains authoritative for redirect status handling, method/body rewriting, replay, credential/header stripping, redirect limits, and cancellation.
+
+This also preserves the DSH 0.1.5 Host policy across the repository's Undici-major split: Undici 8 publishes its Dispatcher v2 globally and a `Dispatcher1Wrapper` under the legacy global symbol; DVR's Undici 7 reads that legacy symbol, so a non-listed redirect hop can safely delegate back to the Host-owned dispatcher instead of manufacturing a direct connection.
+
+After the shared pool became authoritative for both explicit-proxy paths, the older runtime-level `ProxyDispatcherTracker` and its `globalThis.fetch` observer were removed. Those components could no longer see the real ProxyAgent after per-hop selectors were introduced, and retaining them would create a third, ineffective dispatcher-lifecycle authority. The shared pool is now the only owner that closes DVR-created ProxyAgents; borrowed Host/caller dispatchers remain outside DVR ownership.
+
+## System proxy terminology
+
+Vision Router must not implement OS-specific proxy discovery. DSH's 0.1.5 network guide distinguishes OS “system proxy” settings, standard proxy environment variables, and TUN mode; DSH itself follows the environment policy and does not automatically read macOS/Windows system-proxy switches. Host-first therefore means “follow DSH/Host”, not “reimplement operating-system proxy detection in this plugin”.

package/docs/architecture/p3-compat-retirement.md

@@ -24,7 +24,7 @@ P3-B is intentionally a retirement audit, not a quota to delete files. Under the
 | replay envelope v2 compatibility | old durable histories remain valid inputs even when the live Host is newer | only when the supported history/runtime window no longer needs producer rebinding or Host provides an equivalent native replay identity seam |
 | adapter prepareCall/coalescing compatibility | the support matrix still spans Host generations with different adapter-registration/update behavior | only when the minimum Host and every DVR-owned adapter satisfy one stable registration/update contract |
 | pi-ai bridge wire compatibility | legacy direct-bridge traffic remains a supported route shape | only after the direct bridge is retired or all supported Hosts execute that path through an equivalent native wire seam |
-| process-global proxy compatibility | P2-E already reduced this to Host-owned/raw-fetch compatibility only; the minimum Host still lacks a provider-scoped/shared proxy seam | when the minimum supported Host provides a provider-scoped/shared HTTP proxy seam |
+| scoped Host-owned proxy compatibility | H0/H1 makes DSH/Host the default authority; H2 removes configuration-wide interception; H3 keeps `proxy` / `proxyHosts` supported because current Host proxy still lacks SOCKS and arbitrary Host adapters expose no DVR per-call dispatcher seam. Explicit blank `chainRoute` is legacy persisted/manual compatibility only | when Host-owned adapter calls can carry the DVR override through a scoped Host transport (or an announced product policy retires the override) **and** the explicit-empty `chainRoute` state is migrated/retired |
 
 ## First planned deletion window
 

package/docs/architecture/p3-host-native-seams.md

@@ -20,7 +20,7 @@ Current result: **NO NEW HOST-NATIVE MIGRATION IS AUTHORIZED IN DVR 2.0.x.**
 | Candidate | Current evidence | Decision |
 |---|---|---|
 | settings exposure | Newer Hosts expose stronger live settings seams, but rc.6 remains the minimum and existing compatibility is still required for the supported window | NO-GO in 2.0.x |
-| provider transport / proxy | P2-D moved Router-owned HTTP to `VisionProviderTransport`; P2-E reduced the global patch to Host-owned/raw-fetch compatibility. The minimum Host still has no proven provider-scoped/shared proxy seam | KEEP P2 boundary; no native migration |
+| provider transport / proxy | P2-D moved Router-owned HTTP to `VisionProviderTransport`; H0/H1 proved Host-owned default egress; H2 scopes the explicit DVR override to exact Host-owned visual adapter execution. H3 verifies current DSH still supports only HTTP(S) proxy URLs, while real DVR users rely on SOCKS/selective overrides and arbitrary Host adapters expose no DVR per-call dispatcher seam | KEEP `proxy` / `proxyHosts` supported and KEEP the scoped compatibility boundary; no extra legacy toggle and no generic Host route duplication |
 | `ctx.jobs` | P2-F's ten-point spike found that Jobs does not replace DVR's priority, authority-revoke, topology-abort and evidence-publication fencing without retaining the custom scheduler | NO-GO; retain current scheduler |
 | adapter registration replacement | Current Host generations expose better replacement behavior, but a read-only capability probe cannot prove a stable returned handle across the full minimum/previous/current window | NO-GO until minimum Host contract and parity tests prove one handle contract |
 | scoped tool execution hooks | Current DSH has richer tool pipeline seams, but the rc.6 support floor and existing mature wrapper behavior mean a migration would be a split-path compatibility rewrite rather than simplification | NO-GO in 2.0.x |

package/docs/releases/v2.1.6.md

@@ -0,0 +1,30 @@
+# v2.1.6
+
+DVR 2.1.6 is a compatibility and network-hardening patch for the 2.1.x train. It advances exact stable validation to DSH `0.1.5-rc.2`, fixes the DSH 0.1.5 remote-settings startup error, and finishes the Host-first proxy convergence work without changing the public routing model, persisted settings schema, or minimum Host floor (`0.1.0-rc.8`).
+
+## DSH 0.1.5-rc.2 and remote Settings
+
+- Advances the fixed stable/exact Host evidence to DSH `0.1.5-rc.2`; exact `0.1.5-alpha.2` coverage remains preview verification evidence only. `0.1.5-rc.1` remains explicitly peer-compatible and the public DVR 2.1.x floor stays at `0.1.0-rc.8`.
+- Fixes #465 by declaring `settings`, `connection`, and `webServer` on the same Cordis caller fiber that invokes `connection.rpc.handle()`. This prevents `cannot get property "webServer" without inject` under DSH 0.1.5 strict service-access semantics.
+- Keeps the remote Settings security model unchanged: the RPC channel remains `trusted-host`, sensitive network/credential/local-device fields stay local-only, and the explicit remote field allow-list plus risk-confirmation flow remain authoritative.
+- Keeps the separate Web-bundle `modules -> webServer` compatibility overlay in place while current upstream DSH still lacks that Loader activation dependency; #448 continues to track its eventual retirement.
+
+## Host-first proxy convergence
+
+- Makes the DSH/Host network path authoritative whenever Vision Router's `proxy` is blank. Ordinary Host traffic no longer passes through a second DVR proxy-routing decision.
+- Keeps explicit `proxy` / `proxyHosts` as a supported, local-only Advanced override for visual traffic, including SOCKS5 and selective-host deployments that current DSH Host proxy policy cannot replace.
+- Scopes Host-owned visual adapter overrides with AsyncLocalStorage, so concurrent same-origin Host requests do not inherit DVR proxy state. Vision chain, `vision_describe`, Benchmark, and Exact Check share the same scoped authority.
+- Gives Router-owned and scoped Host-owned ProxyAgents one shared lease/retire lifecycle. Hot proxy replacement, clearing configuration, pending construction, synchronous failures, and plugin unload now retire Agents without leaking or closing in-flight work.
+- Enforces `proxyHosts` on every redirect hop after the initial request is admitted. Redirects that leave the allow-list return to the request-start Host/caller dispatcher while Fetch/Undici remains responsible for redirect semantics, body replay, header stripping, limits, and abort behavior.
+- Preserves historical `socks5h://` settings without rewriting persisted configuration: the compatibility projection to Undici-native `socks5://` happens only after a request is admitted by `proxyHosts`.
+- Removes the obsolete process-wide dispatcher tracker/global-fetch observer after lifecycle ownership moved to the shared dispatcher pool.
+
+## Protocol and regression coverage
+
+- Adds real loopback HTTP CONNECT and SOCKS5 protocol tests in addition to MockAgent/FakeProxyAgent coverage. The SOCKS case verifies proxy-side DNS by sending an unresolved domain name through the SOCKS5 tunnel.
+- Exact-source stable/preview contracts continue to run on Ubuntu, macOS, and Windows; Node 22/24 CI, routing parity, adversarial fuzzing, dependency review, CodeQL, native multimodal cold resume, Windows screenshot runtime, and host-sharp integration remain release gates.
+- Pre-release acceptance on macOS used the actual `npm pack` tarball installed through DSH `0.1.5-rc.2`, then exercised the real Chromium Settings UI, a settings write/readback round trip, cold Web restart, and a real headless vision turn. `vision_ocr`, `vision_describe`, and `vision_colors` correctly read a generated image using the machine's normal DSH model credentials.
+
+## Upgrade
+
+Upgrade to 2.1.6 and restart DSH Web/Desktop. Existing 2.1.x settings remain compatible; no migration is required.

package/index.js

@@ -12,9 +12,10 @@
 // are downscaled with sharp, results are cached by content hash + question,
 // and an optional JSON mode validates structured output.
 //
-// Proxy: an optional `proxy` config (e.g. http://127.0.0.1:10808) patches the
-// process fetch to route only the `proxyHosts` domains through it; everything
-// else (DeepSeek and the rest) stays on the direct connection.
+// Proxy: network egress is Host-owned by default. A blank `proxy` leaves fetch
+// entirely on DSH/Host's current network path. An explicit plugin proxy is an
+// advanced vision-only override for `proxyHosts`; Host-owned visual adapters use
+// a scoped compatibility wrapper, never configuration-wide process routing.
 
 // Compatibility shim: dsh 0.1.2-alpha.4 removed `session.events` in favor of
 // `session.snapshotEvents()`. This helper returns an array (or undefined) that
@@ -105,6 +106,7 @@ import {
 } from './lib/http-body-limit.js'
 import { writeArtifactFile } from './lib/artifact-boundary.js'
 import { stripTrailingSlashes } from './lib/string-normalization.js'
+import { streamWithLegacyGlobalProxyScope } from './lib/legacy-global-proxy-boundary.js'
 import { parseVersionComparator } from './lib/version-range.js'
 import { createCoalescingRunner } from './lib/adapter-update-coalescer.js'
 import { captureWindowsDesktop } from './lib/windows-desktop-capture.js'
@@ -1765,7 +1767,15 @@ export function apply(ctx, config = {}, runtime = {}) {
     const corrected = await correctedVisionAnswer(pair, messages, options)
     if (corrected !== undefined) return corrected
     assertOpenCodeGoAffinityForPair(pair, options.sessionId)
-    return visionAnswer(ctx.llm, {
+    return visionAnswer({
+      stream(streamOptions) {
+        return streamWithLegacyGlobalProxyScope(
+          pair.provider,
+          pair.model,
+          () => ctx.llm.stream(streamOptions),
+        )
+      },
+    }, {
       provider: pair.provider,
       model: pair.model,
       messages,
@@ -2079,14 +2089,18 @@ export function apply(ctx, config = {}, runtime = {}) {
               })
               if (text === undefined) {
                 assertOpenCodeGoAffinityForPair(pair, options.sessionId)
-                yield* streamWithVisionSessionAffinity(options.sessionId, () => ctx.llm.stream({
-                  ...options,
-                  provider: pair.provider,
-                  model: pair.model,
-                  reasoningEffort: undefined,
-                  messages,
-                  signal: attemptSignal,
-                }))
+                yield* streamWithLegacyGlobalProxyScope(
+                  pair.provider,
+                  pair.model,
+                  () => streamWithVisionSessionAffinity(options.sessionId, () => ctx.llm.stream({
+                    ...options,
+                    provider: pair.provider,
+                    model: pair.model,
+                    reasoningEffort: undefined,
+                    messages,
+                    signal: attemptSignal,
+                  })),
+                )
                 return
               }
               if (text !== '') {
@@ -2227,73 +2241,8 @@ export function apply(ctx, config = {}, runtime = {}) {
   // #208: attachment refs, description memory and the event-log cursor are
   // owned by the same bounded SessionVisionStateStore above.
 
-  // ── optional fetch proxy for the vision provider hosts ─────────────────────
-  //
-  // Resolved per request from the live settings section (`current()`), so the
-  // Web settings panel can change the proxy URL and host list without a
-  // restart. The fetch patcher itself is installed once for the plugin fiber.
-
-  const currentProxyUrl = () => {
-    const value = current().proxy
-    return typeof value === 'string' && value !== '' ? value : undefined
-  }
-  const currentProxyHosts = () => {
-    const value = current().proxyHosts
-    return Array.isArray(value)
-      ? value.filter((host) => typeof host === 'string' && host !== '')
-      : []
-  }
-
-  {
-    const originalFetch = globalThis.fetch
-    let cachedAgentUrl
-    let cachedAgentPromise
-    const agentFor = (url) => {
-      if (cachedAgentUrl === url && cachedAgentPromise !== undefined) return cachedAgentPromise
-      cachedAgentUrl = url
-      // Do not import userland Undici at plugin/module load time. Loading a
-      // different Undici major can disturb the dispatcher used by the host's
-      // built-in fetch even when Vision Router's own proxy setting is empty.
-      // Load ProxyAgent only when this plugin's selective proxy is actually used.
-      cachedAgentPromise = import('undici')
-        .then(({ ProxyAgent }) => {
-          if (typeof ProxyAgent !== 'function') {
-            throw new Error('dsh-vision-router: undici ProxyAgent is unavailable')
-          }
-          return new ProxyAgent(url)
-        })
-        .catch((error) => {
-          if (cachedAgentUrl === url) {
-            cachedAgentUrl = undefined
-            cachedAgentPromise = undefined
-          }
-          throw error
-        })
-      return cachedAgentPromise
-    }
-    const patchedFetch = (input, init) => {
-      const proxyUrl = currentProxyUrl()
-      if (proxyUrl === undefined) return originalFetch(input, init)
-      let url
-      try {
-        url = new URL(
-          typeof input === 'string' ? input : input && input.url ? input.url : String(input),
-        )
-      } catch {
-        return originalFetch(input, init)
-      }
-      if (!hostMatchesAny(url.hostname, currentProxyHosts())) return originalFetch(input, init)
-      return agentFor(proxyUrl).then((dispatcher) =>
-        originalFetch(input, { ...(init ?? {}), dispatcher }),
-      )
-    }
-    ctx.effect(() => {
-      globalThis.fetch = patchedFetch
-      return () => {
-        globalThis.fetch = originalFetch
-      }
-    }, 'vision-router: proxy fetch')
-  }
+  // Host-owned proxy overrides are scoped by lib/legacy-global-proxy-boundary.js.
+  // Core no longer owns or installs a process-wide proxy fetch implementation.
 
   const lookupAttachment = (session, id) => sessionVisionIndex.lookupAttachment(session, id)
 

package/lib/adversarial-hardening.js

@@ -470,52 +470,6 @@ export function installAdversarialHardening(ctx, config = {}, core) {
   const wrapped = new Proxy(ctx, {
     get(target, property) {
       if (property === 'tools') return wrapTools(target.tools, wrapped, core, hardenedConfig)
-      if (property === 'effect') {
-        const effect = Reflect.get(target, property, target)
-        if (typeof effect !== 'function') return effect
-        return (factory, label) => {
-          if (label !== 'vision-router: proxy fetch') return effect.call(target, factory, label)
-          return effect.call(target, () => {
-            const originalFetch = globalThis.fetch
-            const disposer = factory()
-            let installedFetch = globalThis.fetch
-            let active = true
-            // Later plugins may capture this function. Making it an inert
-            // delegator on unload removes Vision Router from the chain even if
-            // another plugin still sits above it, and prevents it resurfacing
-            // when that later plugin restores the fetch value it captured.
-            const guardedFetch = (...args) => {
-              const fetchImpl = active && typeof installedFetch === 'function'
-                ? installedFetch
-                : originalFetch
-              return fetchImpl(...args)
-            }
-            globalThis.fetch = guardedFetch
-            return () => {
-              if (!active) return
-              active = false
-              // Drop the raw Vision Router fetch closure as soon as ownership
-              // ends. This releases its cached ProxyAgent/undici closure even
-              // when a later plugin still retains guardedFetch.
-              installedFetch = undefined
-              const currentFetch = globalThis.fetch
-              try {
-                // Always run the underlying effect disposer. It may own more
-                // than the process-level pointer; skipping it merely because a
-                // later plugin wrapped fetch leaks that lifecycle forever.
-                if (typeof disposer === 'function') disposer()
-              } finally {
-                // The core disposer currently restores originalFetch
-                // unconditionally. Preserve any later plugin that was above us,
-                // while an outermost Vision Router cleanup returns to the host.
-                globalThis.fetch = currentFetch === guardedFetch
-                  ? originalFetch
-                  : currentFetch
-              }
-            }
-          }, label)
-        }
-      }
       // Deliberately do NOT wrap ctx.inject or injected child contexts. DSH
       // rc.6 ties route/effect ownership to the exact child-context identity;
       // replacing it with a Proxy previously made host routes disappear (#160).