dsh-vision-router 2.1.6 → 2.1.7

package/lib/live-model-discovery.js

@@ -5,6 +5,7 @@ import process from 'node:process'
 import { resolveDshHome } from './doctor.js'
 import { MODEL_RESPONSE_MAX_BYTES, readResponseJsonBounded } from './http-body-limit.js'
 import { stripTrailingSlashes } from './string-normalization.js'
+import { isLocalUiRequest } from './web-capability-boundary.js'
 
 export const LIVE_MODELS_PATH = '/_dsh/vision-router/live-models'
 export const LIVE_MODEL_CACHE_VERSION = 2
@@ -161,17 +162,34 @@ async function saveCache(file, providers, fsOps) {
   await fsOps.rename(temporary, file)
 }
 
-function rawPiProfiles(ctx) {
+function piProfilesState(ctx) {
   try {
     const settings = ctx?.get?.('settings')
-    const value = settings?.get?.('llm-pi-ai')
+    if (!settings || typeof settings.get !== 'function') return { authoritative: false, providers: {} }
+    const value = settings.get('llm-pi-ai')
     const providers = value?.providers
-    return providers && typeof providers === 'object' && !Array.isArray(providers) ? providers : {}
+    if (!providers || typeof providers !== 'object' || Array.isArray(providers)) {
+      return { authoritative: false, providers: {} }
+    }
+    return { authoritative: true, providers }
   } catch {
-    return {}
+    return { authoritative: false, providers: {} }
   }
 }
 
+function rawPiProfiles(ctx) {
+  return piProfilesState(ctx).providers
+}
+
+function providerConfigurationToken(provider, raw) {
+  return JSON.stringify([
+    provider,
+    normalizeBaseURL(raw?.baseURL) ?? '',
+    nonEmpty(raw?.api) ?? '',
+    nonEmpty(raw?.apiKeyEnv) ?? '',
+  ])
+}
+
 function visionProviderPriority(ctx, fallbackConfig = {}) {
   const preferred = new Set()
   const collect = (value) => {
@@ -349,15 +367,18 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
   let providers = new Map()
   let version = 0
   let evidenceGeneration = 0
+  let configuredProviders
+  let configuredTokens = new Map()
+  let providerGenerations = new Map()
+  let providerGenerationSequence = 0
   let active = 0
   let disposed = false
   let saveTail = Promise.resolve()
   const inflight = new Map()
+  const inflightAuthority = new Map()
   const queued = new Map()
   const backoffUntil = new Map()
-  const cacheReady = loadCache(cacheFile, fsOps).then((loaded) => {
-    if (!disposed) providers = loaded
-  })
+  const activeControllers = new Map()
 
   const persist = () => {
     saveTail = saveTail
@@ -366,6 +387,76 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     return saveTail
   }
 
+  const pruneUnconfiguredState = () => {
+    if (!(configuredProviders instanceof Set)) return false
+    let providerCacheChanged = false
+    for (const provider of [...providers.keys()]) {
+      if (configuredProviders.has(provider)) continue
+      providers.delete(provider)
+      providerCacheChanged = true
+    }
+    for (const provider of [...queued.keys()]) {
+      if (!configuredProviders.has(provider)) queued.delete(provider)
+    }
+    for (const provider of [...backoffUntil.keys()]) {
+      if (!configuredProviders.has(provider)) backoffUntil.delete(provider)
+    }
+    for (const [provider, controller] of activeControllers.entries()) {
+      if (configuredProviders.has(provider)) continue
+      try { controller.abort() } catch {}
+    }
+    if (providerCacheChanged) version += 1
+    return providerCacheChanged
+  }
+
+  const reconcileConfiguredProviders = () => {
+    const state = piProfilesState(ctx)
+    if (!state.authoritative) return state.providers
+    const next = new Set(Object.keys(state.providers))
+    const nextTokens = new Map([...next].map((provider) => [
+      provider,
+      providerConfigurationToken(provider, state.providers[provider]),
+    ]))
+    const nextGenerations = new Map()
+    for (const provider of next) {
+      const unchanged = configuredProviders instanceof Set &&
+        configuredProviders.has(provider) &&
+        configuredTokens.get(provider) === nextTokens.get(provider)
+      if (unchanged && providerGenerations.has(provider)) {
+        nextGenerations.set(provider, providerGenerations.get(provider))
+      } else {
+        providerGenerationSequence += 1
+        nextGenerations.set(provider, providerGenerationSequence)
+      }
+    }
+    configuredProviders = next
+    configuredTokens = nextTokens
+    providerGenerations = nextGenerations
+    if (pruneUnconfiguredState()) void persist()
+    return state.providers
+  }
+
+  const currentDiscoveryAuthority = (provider) => ({
+    providerGeneration: providerGenerations.get(provider) ?? 0,
+    evidenceGeneration,
+  })
+
+  const sameDiscoveryAuthority = (left, right) => (
+    left?.providerGeneration === right?.providerGeneration &&
+    left?.evidenceGeneration === right?.evidenceGeneration
+  )
+
+  const discoveryStillCurrent = (provider, authority) => (
+    sameDiscoveryAuthority(authority, currentDiscoveryAuthority(provider)) &&
+    (!(configuredProviders instanceof Set) || configuredProviders.has(provider))
+  )
+
+  const cacheReady = loadCache(cacheFile, fsOps).then((loaded) => {
+    if (disposed) return
+    providers = loaded
+    reconcileConfiguredProviders()
+  })
+
   const visibleEntry = (entry, at = now()) => {
     if (!entry || entry.routeMismatch === true || at - entry.discoveredAt > staleMs) return undefined
     const currentEvidence = entry.evidenceGeneration === evidenceGeneration
@@ -391,10 +482,10 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     }
   }
 
-  const discover = async (provider) => {
+  const discover = async (provider, authorityAtStart) => {
     const plan = await providerPlan(ctx, provider)
-    if (!plan.ok) return
-    const generationAtStart = evidenceGeneration
+    if (!plan.ok || disposed || !discoveryStillCurrent(provider, authorityAtStart)) return
+    const generationAtStart = authorityAtStart.evidenceGeneration
     const previous = providers.get(provider)
     const at = now()
     const sameRoute = previous?.fingerprint === plan.fingerprint
@@ -414,6 +505,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     }
 
     const controller = new AbortController()
+    activeControllers.set(provider, controller)
     const timer = setTimeout(() => controller.abort(), timeoutMs)
     try {
       const headers = { accept: 'application/json' }
@@ -432,6 +524,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
         label: `${provider} model listing`,
       })
       const models = normalizeOpenAIModelListing(body, { maxModels: options.maxModels })
+      if (disposed || !discoveryStillCurrent(provider, authorityAtStart)) return
       providers.set(provider, {
         provider,
         fingerprint: plan.fingerprint,
@@ -444,7 +537,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
       version += 1
       void persist()
     } catch (error) {
-      if (disposed) return
+      if (disposed || !discoveryStillCurrent(provider, authorityAtStart)) return
       const current = providers.get(provider)
       const message = boundedError(error)
       if (current) {
@@ -455,6 +548,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
       logger?.debug?.('vision-router: live model discovery failed for %s: %s', provider, message)
     } finally {
       clearTimeout(timer)
+      if (activeControllers.get(provider) === controller) activeControllers.delete(provider)
     }
   }
 
@@ -470,14 +564,17 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
       if (!picked) return
       queued.delete(picked.provider)
       active += 1
-      const task = discover(picked.provider)
+      const authorityAtStart = currentDiscoveryAuthority(picked.provider)
+      const task = discover(picked.provider, authorityAtStart)
         .catch(() => {})
         .finally(() => {
           active = Math.max(0, active - 1)
           inflight.delete(picked.provider)
+          inflightAuthority.delete(picked.provider)
           pump()
         })
       inflight.set(picked.provider, task)
+      inflightAuthority.set(picked.provider, authorityAtStart)
     }
   }
 
@@ -491,9 +588,13 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
   }
 
   function queueConfigured() {
-    const raw = rawPiProfiles(ctx)
+    const raw = reconcileConfiguredProviders()
     const preferred = visionProviderPriority(ctx, fallbackConfig)
-    for (const provider of Object.keys(raw)) queue(provider, preferred.has(provider) ? 0 : 10)
+    for (const provider of Object.keys(raw)) {
+      const activeAuthority = inflightAuthority.get(provider)
+      if (activeAuthority && sameDiscoveryAuthority(activeAuthority, currentDiscoveryAuthority(provider))) continue
+      queue(provider, preferred.has(provider) ? 0 : 10)
+    }
   }
 
   const hasModel = (provider, model) => {
@@ -524,7 +625,12 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     async dispose() {
       disposed = true
       queued.clear()
+      for (const controller of activeControllers.values()) {
+        try { controller.abort() } catch {}
+      }
       await Promise.allSettled([...inflight.values(), cacheReady, saveTail])
+      activeControllers.clear()
+      inflightAuthority.clear()
     },
   }
 }
@@ -579,7 +685,11 @@ export function installLiveModelDiscovery(ctx, options = {}) {
         }
         try {
           const url = new URL(req.url ?? LIVE_MODELS_PATH, 'http://localhost')
-          const schedule = url.searchParams.get('refresh') !== '0'
+          // The snapshot itself is safe for an authenticated remote Settings UI,
+          // but refresh drives Host-side provider I/O and may resolve stored
+          // credentials. Preserve local ?refresh=1 behavior while making every
+          // remote GET a passive read of already-owned discovery state.
+          const schedule = isLocalUiRequest(req) && url.searchParams.get('refresh') !== '0'
           sendJson(res, 200, await manager.snapshot({ schedule }))
         } catch (error) {
           sendJson(res, 500, { ok: false, error: boundedError(error) })

package/lib/remote-settings-bridge.js

@@ -3,6 +3,7 @@ import { installRemoteSettingsRiskConfirmationBridge } from './remote-settings-r
 import { installSettingsIaClientPrelude } from './settings-ia-client-prelude.js'
 import { installLegacySettingsMigration } from './settings-migration.js'
 import { installV2SettingsIaIntegration } from './v2-settings-ia-integration.js'
+import { remoteConfigFieldAdmissionError } from './runtime-config-normalizer.js'
 
 const SETTINGS_NS = 'vision-router'
 
@@ -107,6 +108,10 @@ function validateMutation(payload, descriptor) {
   if (!mutable.has(field)) return { error: 'Vision Router setting ' + JSON.stringify(field) + ' is local-only' }
   const value = descriptor && descriptor.value
   if (typeof value !== 'object' || value === null || Array.isArray(value) || !Object.prototype.hasOwnProperty.call(value, field)) return { error: 'unknown Vision Router settings field ' + JSON.stringify(field) }
+  if (op.op === 'set') {
+    const budgetError = remoteConfigFieldAdmissionError(field, op.value)
+    if (budgetError) return { error: budgetError }
+  }
   return { ops: [op], expectedRevision }
 }
 
@@ -213,10 +218,10 @@ export function createVisionRouterRemoteSettingsHandler(settings, logger) {
 }
 
 export function installVisionRouterRemoteSettingsBridge(ctx, logger) {
-  // DSH client-connection scopes rpc.handle() registrations to the caller
-  // Context and mounts their WebRoute through owner.webServer. Keep webServer
-  // on this exact injected fiber so strict Cordis service access in 0.1.5+
-  // cannot turn remote-settings registration into a startup error.
+  // Declare the services this caller uses directly. Current DSH Connection
+  // accessors additionally trace their route owner through the Connection
+  // provider fiber; cordis.patch.yml therefore keeps that provider activated
+  // on webServer as a separate compatibility boundary (#478).
   ctx.inject(['settings', 'connection', 'webServer'], (remoteCtx) => {
     const handler = createVisionRouterRemoteSettingsHandler(remoteCtx.settings, logger ?? remoteCtx.logger)
     remoteCtx.effect(

package/lib/replay-delegation.js

@@ -12,7 +12,6 @@ const dynamicWrapperAdapters = new WeakMap()
 const NATIVE_DEEPSEEK_ROUTE = 'deepseek-official-native'
 const OFFICIAL_DEEPSEEK_ROUTE = 'deepseek-official'
 const VISION_HTTP_ROUTE = 'vision-http'
-const MAIN_WRAPPER_MODEL_IDS = new Set(['deepseek-v4-pro', 'deepseek-v4-flash'])
 
 // One entry per (sessionId, provider, model) tuple: a long-running dsh web
 // process would otherwise grow the reasoning-effort memory without bound as
@@ -153,45 +152,52 @@ function withoutReasoningEffort(options) {
   return rest
 }
 
-async function mainWrapperModels(ctx, fallbackWrapperRoute) {
+async function mainWrapperCatalog(ctx) {
   // When the hidden native route is active the public stock DeepSeek row owns
   // the picker and the legacy wrapper is intentionally hidden.
-  if (nativeDeepSeekActive(ctx)) return []
+  if (nativeDeepSeekActive(ctx)) return { adapter: undefined, models: [] }
   let registration
   try {
     registration = ctx?.llm?.registration(OFFICIAL_DEEPSEEK_ROUTE)
   } catch {
-    return []
+    return { adapter: undefined, models: [] }
   }
   const adapter = registration && registration.adapter
-  if (!adapter || typeof adapter.listModels !== 'function') return []
+  if (!adapter || typeof adapter.listModels !== 'function') {
+    return { adapter, models: [] }
+  }
   try {
     const listed = await adapter.listModels(OFFICIAL_DEEPSEEK_ROUTE)
-    const route = currentWrapperRoute(ctx, fallbackWrapperRoute)
-    return (Array.isArray(listed) ? listed : [])
-      .filter((model) => model && MAIN_WRAPPER_MODEL_IDS.has(model.id))
-      .map((model) => ({
-        ...model,
-        provider: route,
-        inputModalities: ['text', 'image'],
-      }))
+    return {
+      adapter,
+      models: (Array.isArray(listed) ? listed : []).filter(
+        (entry) => entry && isNonEmptyString(entry.id),
+      ),
+    }
   } catch {
-    return []
+    return { adapter, models: [] }
   }
 }
 
+async function mainWrapperModels(ctx, fallbackWrapperRoute) {
+  const { models } = await mainWrapperCatalog(ctx)
+  const route = currentWrapperRoute(ctx, fallbackWrapperRoute)
+  return models.map((model) => ({
+    ...model,
+    provider: route,
+    inputModalities: ['text', 'image'],
+  }))
+}
+
 async function mainWrapperModel(ctx, fallbackWrapperRoute, model, signal) {
-  // Composite legacy vision-chain entries are not DeepSeek models; leave them
-  // to the core wrapper's existing resolver.
-  if (!MAIN_WRAPPER_MODEL_IDS.has(model) || nativeDeepSeekActive(ctx)) return undefined
-  let registration
-  try {
-    registration = ctx?.llm?.registration(OFFICIAL_DEEPSEEK_ROUTE)
-  } catch {
-    return undefined
-  }
-  const adapter = registration && registration.adapter
+  // The special wrapper mirrors the *live official DeepSeek catalog* rather
+  // than a frozen list of model ids. DSH stable can add a new default model
+  // without requiring a Vision Router release, while membership still fails
+  // closed to the official provider and cannot follow textProvider/relay rows.
+  if (!isNonEmptyString(model) || nativeDeepSeekActive(ctx)) return undefined
+  const { adapter, models } = await mainWrapperCatalog(ctx)
   if (!adapter || typeof adapter.resolveModel !== 'function') return undefined
+  if (!models.some((entry) => entry.id === model)) return undefined
   const base = await adapter.resolveModel(OFFICIAL_DEEPSEEK_ROUTE, model, signal)
   return {
     ...base,
@@ -246,6 +252,7 @@ function dynamicWrapperAdapter(adapter, ctx, fallbackWrapperRoute) {
           const pinned = await mainWrapperModels(ctx, fallbackWrapperRoute)
           if (typeof original !== 'function') return pinned
           const route = currentWrapperRoute(ctx, fallbackWrapperRoute)
+          const pinnedIds = new Set(pinned.map((model) => model.id))
           let composites = []
           try {
             const listed = await original.apply(target, args)
@@ -254,14 +261,13 @@ function dynamicWrapperAdapter(adapter, ctx, fallbackWrapperRoute) {
               // ("provider/model（视觉）", published when whole-turn routing is
               // enabled) so the legacy routing mode keeps its picker entries.
               // These rows are structurally composite ids (`provider/model`);
-              // any DeepSeek mirror — and any other row the core might emit —
-              // is dropped here: normal DeepSeek models must keep coming from
-              // the pinned official/native identity above, never from the
-              // possibly-stale textProvider.
+              // any official DeepSeek mirror — and any other row the core may
+              // emit — is dropped here. Normal DeepSeek models come only from
+              // the live official catalog above, never from textProvider.
               composites = listed.filter(
                 (row) => row
                   && row.provider === route
-                  && !MAIN_WRAPPER_MODEL_IDS.has(row.id)
+                  && !pinnedIds.has(row.id)
                   && String(row.id ?? '').includes('/'),
               )
             }