dsh-vision-router 2.1.6 → 2.2.0

package/lib/live-model-discovery.js

@@ -5,6 +5,7 @@ import process from 'node:process'
 import { resolveDshHome } from './doctor.js'
 import { MODEL_RESPONSE_MAX_BYTES, readResponseJsonBounded } from './http-body-limit.js'
 import { stripTrailingSlashes } from './string-normalization.js'
+import { isLocalUiRequest } from './web-capability-boundary.js'
 
 export const LIVE_MODELS_PATH = '/_dsh/vision-router/live-models'
 export const LIVE_MODEL_CACHE_VERSION = 2
@@ -161,17 +162,34 @@ async function saveCache(file, providers, fsOps) {
   await fsOps.rename(temporary, file)
 }
 
-function rawPiProfiles(ctx) {
+function piProfilesState(ctx) {
   try {
     const settings = ctx?.get?.('settings')
-    const value = settings?.get?.('llm-pi-ai')
+    if (!settings || typeof settings.get !== 'function') return { authoritative: false, providers: {} }
+    const value = settings.get('llm-pi-ai')
     const providers = value?.providers
-    return providers && typeof providers === 'object' && !Array.isArray(providers) ? providers : {}
+    if (!providers || typeof providers !== 'object' || Array.isArray(providers)) {
+      return { authoritative: false, providers: {} }
+    }
+    return { authoritative: true, providers }
   } catch {
-    return {}
+    return { authoritative: false, providers: {} }
   }
 }
 
+function rawPiProfiles(ctx) {
+  return piProfilesState(ctx).providers
+}
+
+function providerConfigurationToken(provider, raw) {
+  return JSON.stringify([
+    provider,
+    normalizeBaseURL(raw?.baseURL) ?? '',
+    nonEmpty(raw?.api) ?? '',
+    nonEmpty(raw?.apiKeyEnv) ?? '',
+  ])
+}
+
 function visionProviderPriority(ctx, fallbackConfig = {}) {
   const preferred = new Set()
   const collect = (value) => {
@@ -349,15 +367,18 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
   let providers = new Map()
   let version = 0
   let evidenceGeneration = 0
+  let configuredProviders
+  let configuredTokens = new Map()
+  let providerGenerations = new Map()
+  let providerGenerationSequence = 0
   let active = 0
   let disposed = false
   let saveTail = Promise.resolve()
   const inflight = new Map()
+  const inflightAuthority = new Map()
   const queued = new Map()
   const backoffUntil = new Map()
-  const cacheReady = loadCache(cacheFile, fsOps).then((loaded) => {
-    if (!disposed) providers = loaded
-  })
+  const activeControllers = new Map()
 
   const persist = () => {
     saveTail = saveTail
@@ -366,6 +387,76 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     return saveTail
   }
 
+  const pruneUnconfiguredState = () => {
+    if (!(configuredProviders instanceof Set)) return false
+    let providerCacheChanged = false
+    for (const provider of [...providers.keys()]) {
+      if (configuredProviders.has(provider)) continue
+      providers.delete(provider)
+      providerCacheChanged = true
+    }
+    for (const provider of [...queued.keys()]) {
+      if (!configuredProviders.has(provider)) queued.delete(provider)
+    }
+    for (const provider of [...backoffUntil.keys()]) {
+      if (!configuredProviders.has(provider)) backoffUntil.delete(provider)
+    }
+    for (const [provider, controller] of activeControllers.entries()) {
+      if (configuredProviders.has(provider)) continue
+      try { controller.abort() } catch {}
+    }
+    if (providerCacheChanged) version += 1
+    return providerCacheChanged
+  }
+
+  const reconcileConfiguredProviders = () => {
+    const state = piProfilesState(ctx)
+    if (!state.authoritative) return state.providers
+    const next = new Set(Object.keys(state.providers))
+    const nextTokens = new Map([...next].map((provider) => [
+      provider,
+      providerConfigurationToken(provider, state.providers[provider]),
+    ]))
+    const nextGenerations = new Map()
+    for (const provider of next) {
+      const unchanged = configuredProviders instanceof Set &&
+        configuredProviders.has(provider) &&
+        configuredTokens.get(provider) === nextTokens.get(provider)
+      if (unchanged && providerGenerations.has(provider)) {
+        nextGenerations.set(provider, providerGenerations.get(provider))
+      } else {
+        providerGenerationSequence += 1
+        nextGenerations.set(provider, providerGenerationSequence)
+      }
+    }
+    configuredProviders = next
+    configuredTokens = nextTokens
+    providerGenerations = nextGenerations
+    if (pruneUnconfiguredState()) void persist()
+    return state.providers
+  }
+
+  const currentDiscoveryAuthority = (provider) => ({
+    providerGeneration: providerGenerations.get(provider) ?? 0,
+    evidenceGeneration,
+  })
+
+  const sameDiscoveryAuthority = (left, right) => (
+    left?.providerGeneration === right?.providerGeneration &&
+    left?.evidenceGeneration === right?.evidenceGeneration
+  )
+
+  const discoveryStillCurrent = (provider, authority) => (
+    sameDiscoveryAuthority(authority, currentDiscoveryAuthority(provider)) &&
+    (!(configuredProviders instanceof Set) || configuredProviders.has(provider))
+  )
+
+  const cacheReady = loadCache(cacheFile, fsOps).then((loaded) => {
+    if (disposed) return
+    providers = loaded
+    reconcileConfiguredProviders()
+  })
+
   const visibleEntry = (entry, at = now()) => {
     if (!entry || entry.routeMismatch === true || at - entry.discoveredAt > staleMs) return undefined
     const currentEvidence = entry.evidenceGeneration === evidenceGeneration
@@ -391,10 +482,10 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     }
   }
 
-  const discover = async (provider) => {
+  const discover = async (provider, authorityAtStart) => {
     const plan = await providerPlan(ctx, provider)
-    if (!plan.ok) return
-    const generationAtStart = evidenceGeneration
+    if (!plan.ok || disposed || !discoveryStillCurrent(provider, authorityAtStart)) return
+    const generationAtStart = authorityAtStart.evidenceGeneration
     const previous = providers.get(provider)
     const at = now()
     const sameRoute = previous?.fingerprint === plan.fingerprint
@@ -414,6 +505,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     }
 
     const controller = new AbortController()
+    activeControllers.set(provider, controller)
     const timer = setTimeout(() => controller.abort(), timeoutMs)
     try {
       const headers = { accept: 'application/json' }
@@ -432,6 +524,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
         label: `${provider} model listing`,
       })
       const models = normalizeOpenAIModelListing(body, { maxModels: options.maxModels })
+      if (disposed || !discoveryStillCurrent(provider, authorityAtStart)) return
       providers.set(provider, {
         provider,
         fingerprint: plan.fingerprint,
@@ -444,7 +537,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
       version += 1
       void persist()
     } catch (error) {
-      if (disposed) return
+      if (disposed || !discoveryStillCurrent(provider, authorityAtStart)) return
       const current = providers.get(provider)
       const message = boundedError(error)
       if (current) {
@@ -455,6 +548,7 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
       logger?.debug?.('vision-router: live model discovery failed for %s: %s', provider, message)
     } finally {
       clearTimeout(timer)
+      if (activeControllers.get(provider) === controller) activeControllers.delete(provider)
     }
   }
 
@@ -470,14 +564,17 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
       if (!picked) return
       queued.delete(picked.provider)
       active += 1
-      const task = discover(picked.provider)
+      const authorityAtStart = currentDiscoveryAuthority(picked.provider)
+      const task = discover(picked.provider, authorityAtStart)
         .catch(() => {})
         .finally(() => {
           active = Math.max(0, active - 1)
           inflight.delete(picked.provider)
+          inflightAuthority.delete(picked.provider)
           pump()
         })
       inflight.set(picked.provider, task)
+      inflightAuthority.set(picked.provider, authorityAtStart)
     }
   }
 
@@ -491,9 +588,13 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
   }
 
   function queueConfigured() {
-    const raw = rawPiProfiles(ctx)
+    const raw = reconcileConfiguredProviders()
     const preferred = visionProviderPriority(ctx, fallbackConfig)
-    for (const provider of Object.keys(raw)) queue(provider, preferred.has(provider) ? 0 : 10)
+    for (const provider of Object.keys(raw)) {
+      const activeAuthority = inflightAuthority.get(provider)
+      if (activeAuthority && sameDiscoveryAuthority(activeAuthority, currentDiscoveryAuthority(provider))) continue
+      queue(provider, preferred.has(provider) ? 0 : 10)
+    }
   }
 
   const hasModel = (provider, model) => {
@@ -524,7 +625,12 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     async dispose() {
       disposed = true
       queued.clear()
+      for (const controller of activeControllers.values()) {
+        try { controller.abort() } catch {}
+      }
       await Promise.allSettled([...inflight.values(), cacheReady, saveTail])
+      activeControllers.clear()
+      inflightAuthority.clear()
     },
   }
 }
@@ -579,7 +685,11 @@ export function installLiveModelDiscovery(ctx, options = {}) {
         }
         try {
           const url = new URL(req.url ?? LIVE_MODELS_PATH, 'http://localhost')
-          const schedule = url.searchParams.get('refresh') !== '0'
+          // The snapshot itself is safe for an authenticated remote Settings UI,
+          // but refresh drives Host-side provider I/O and may resolve stored
+          // credentials. Preserve local ?refresh=1 behavior while making every
+          // remote GET a passive read of already-owned discovery state.
+          const schedule = isLocalUiRequest(req) && url.searchParams.get('refresh') !== '0'
           sendJson(res, 200, await manager.snapshot({ schedule }))
         } catch (error) {
           sendJson(res, 500, { ok: false, error: boundedError(error) })

package/lib/local-vision-stabilizer.js

@@ -5,6 +5,7 @@ import path from 'node:path'
 import { promisify } from 'node:util'
 import { sameOriginRequest } from './adversarial-hardening.js'
 import { normalizeRuntimeVisionConfig } from './runtime-config-normalizer.js'
+import { isOffloadedImageBlock, offloadedImagePlaceholder } from './image-offload-compat.js'
 
 /**
  * Narrow runtime guard around the local-vision features merged in #141.
@@ -177,6 +178,10 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
       const content = []
       for (const block of message.content) {
         if (block && block.type === 'image' && block.attachment) {
+          if (isOffloadedImageBlock(block)) {
+            content.push({ type: 'text', text: offloadedImagePlaceholder(block) })
+            continue
+          }
           if (!attachments || typeof attachments.readImage !== 'function') continue
           try {
             const stored = await attachments.readImage(block.attachment)
@@ -200,12 +205,16 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
             if (nested && nested.type === 'text' && typeof nested.text === 'string') {
               parts.push(nested.text)
             } else if (nested && nested.type === 'image') {
-              const attachment = nested.attachment || {}
-              const id = attachment.attachmentId || attachment.id || 'unknown'
-              parts.push(
-                `[attached image: ${id}] this tool result contained an image; ` +
-                  'inspect it with vision_describe (or re-read it with read_image)',
-              )
+              if (isOffloadedImageBlock(nested)) {
+                parts.push(offloadedImagePlaceholder(nested))
+              } else {
+                const attachment = nested.attachment || {}
+                const id = attachment.attachmentId || attachment.id || 'unknown'
+                parts.push(
+                  `[attached image: ${id}] this tool result contained an image; ` +
+                    'inspect it with vision_describe (or re-read it with read_image)',
+                )
+              }
             }
           }
           if (parts.length > 0) {

package/lib/official-deepseek-catalog.js

@@ -0,0 +1,120 @@
+const catalogStateByAdapter = new WeakMap()
+
+export const OFFICIAL_DEEPSEEK_CATALOG_FRESH_MS = 30_000
+export const OFFICIAL_DEEPSEEK_CATALOG_STALE_IF_ERROR_MS = 10 * 60_000
+export const OFFICIAL_DEEPSEEK_CATALOG_FAILURE_BACKOFF_MS = 5_000
+
+function catalogUnavailable(cause) {
+  const error = new Error('vision-router: the official DeepSeek catalog is temporarily unavailable')
+  error.code = 'OFFICIAL_CATALOG_UNAVAILABLE'
+  if (cause !== undefined) error.cause = cause
+  return error
+}
+
+function normalizedModels(listed) {
+  if (!Array.isArray(listed)) {
+    throw new TypeError('official DeepSeek adapter listModels() did not return an array')
+  }
+  return Object.freeze(
+    listed
+      .filter((entry) => entry && typeof entry.id === 'string' && entry.id !== '')
+      .map((entry) => Object.freeze({ ...entry })),
+  )
+}
+
+/**
+ * Process-local authority for the live official DeepSeek catalog.
+ *
+ * The special DeepSeek vision wrapper must not infer product identity from an
+ * adapter's permissive resolveModel() behavior. Membership therefore remains
+ * fail-closed to a catalog actually observed from the official adapter. A
+ * short fresh cache coalesces duplicate Core/replay reads; a bounded
+ * stale-if-error window keeps transient endpoint failures from taking down a
+ * long-lived session. Cold start and expired-cache failures stay fail-closed.
+ *
+ * State is keyed by adapter identity so Host adapter replacement cannot inherit
+ * another registration's catalog. Nothing is persisted across process restart:
+ * a previous process is not durable authority for a newly started Host.
+ */
+export async function getOfficialDeepSeekCatalog(adapter, {
+  provider = 'deepseek-official',
+  now = Date.now,
+  freshMs = OFFICIAL_DEEPSEEK_CATALOG_FRESH_MS,
+  staleIfErrorMs = OFFICIAL_DEEPSEEK_CATALOG_STALE_IF_ERROR_MS,
+  failureBackoffMs = OFFICIAL_DEEPSEEK_CATALOG_FAILURE_BACKOFF_MS,
+} = {}) {
+  if (!adapter || typeof adapter.listModels !== 'function') {
+    throw catalogUnavailable()
+  }
+
+  let state = catalogStateByAdapter.get(adapter)
+  if (state === undefined) {
+    state = {
+      models: undefined,
+      fetchedAt: 0,
+      inFlight: undefined,
+      failure: undefined,
+      failedAt: 0,
+    }
+    catalogStateByAdapter.set(adapter, state)
+  }
+
+  const currentTime = Number(now())
+  const age =
+    state.models === undefined
+      ? Number.POSITIVE_INFINITY
+      : Math.max(0, currentTime - state.fetchedAt)
+  if (state.models !== undefined && age <= Math.max(0, Number(freshMs) || 0)) {
+    return state.models
+  }
+  if (state.inFlight !== undefined) return state.inFlight
+
+  const failureAge =
+    state.failure === undefined
+      ? Number.POSITIVE_INFINITY
+      : Math.max(0, currentTime - state.failedAt)
+  if (failureAge <= Math.max(0, Number(failureBackoffMs) || 0)) {
+    if (
+      state.models !== undefined
+      && age <= Math.max(0, Number(staleIfErrorMs) || 0)
+    ) {
+      return state.models
+    }
+    throw state.failure
+  }
+
+  const refresh = (async () => {
+    try {
+      const listed = await adapter.listModels(provider)
+      const models = normalizedModels(listed)
+      state.models = models
+      state.fetchedAt = Number(now())
+      state.failure = undefined
+      state.failedAt = 0
+      return models
+    } catch (cause) {
+      const failureTime = Number(now())
+      const error = catalogUnavailable(cause)
+      state.failure = error
+      state.failedAt = failureTime
+      const staleAge =
+        state.models === undefined
+          ? Number.POSITIVE_INFINITY
+          : Math.max(0, failureTime - state.fetchedAt)
+      if (
+        state.models !== undefined
+        && staleAge <= Math.max(0, Number(staleIfErrorMs) || 0)
+      ) {
+        return state.models
+      }
+      throw error
+    }
+  })()
+
+  state.inFlight = refresh
+  try {
+    return await refresh
+  } finally {
+    if (state.inFlight === refresh) state.inFlight = undefined
+  }
+}

package/lib/ollama-cold-start.js

@@ -4,6 +4,7 @@ import {
   readResponseJsonBounded,
 } from './http-body-limit.js'
 import { stripTrailingSlashes } from './string-normalization.js'
+import { blocksHaveRetainedImage } from './image-offload-compat.js'
 
 export const OLLAMA_WARMUP_KEEP_ALIVE = '30m'
 export const OLLAMA_WARMUP_TIMEOUT_MS = 120000
@@ -250,22 +251,9 @@ export function createOllamaWarmupManager({
   return { ensure, background, dispose }
 }
 
-function messagesContainImage(messages, core) {
+function messagesContainImage(messages, _core) {
   if (!Array.isArray(messages)) return false
-  return messages.some((message) => {
-    const content = message && Array.isArray(message.content) ? message.content : []
-    if (typeof core?.blocksHaveImage === 'function') {
-      try { return core.blocksHaveImage(content) } catch { /* fall through */ }
-    }
-    const stack = [...content]
-    while (stack.length > 0) {
-      const block = stack.pop()
-      if (!block || typeof block !== 'object') continue
-      if (block.type === 'image') return true
-      if (Array.isArray(block.content)) stack.push(...block.content)
-    }
-    return false
-  })
+  return messages.some((message) => blocksHaveRetainedImage(message?.content))
 }
 
 function configuredRows(config) {

package/lib/remote-settings-bridge.js

@@ -3,6 +3,7 @@ import { installRemoteSettingsRiskConfirmationBridge } from './remote-settings-r
 import { installSettingsIaClientPrelude } from './settings-ia-client-prelude.js'
 import { installLegacySettingsMigration } from './settings-migration.js'
 import { installV2SettingsIaIntegration } from './v2-settings-ia-integration.js'
+import { remoteConfigFieldAdmissionError } from './runtime-config-normalizer.js'
 
 const SETTINGS_NS = 'vision-router'
 
@@ -107,6 +108,10 @@ function validateMutation(payload, descriptor) {
   if (!mutable.has(field)) return { error: 'Vision Router setting ' + JSON.stringify(field) + ' is local-only' }
   const value = descriptor && descriptor.value
   if (typeof value !== 'object' || value === null || Array.isArray(value) || !Object.prototype.hasOwnProperty.call(value, field)) return { error: 'unknown Vision Router settings field ' + JSON.stringify(field) }
+  if (op.op === 'set') {
+    const budgetError = remoteConfigFieldAdmissionError(field, op.value)
+    if (budgetError) return { error: budgetError }
+  }
   return { ops: [op], expectedRevision }
 }
 
@@ -171,6 +176,24 @@ export async function authorizeRemoteSettingsAfterRiskConfirmation(settings, pay
   }
 }
 
+/**
+ * Register the dedicated settings channel against the active DSH Connection
+ * trust contract. rc.8 requires a per-channel `trusted-host` policy. Newer
+ * Connection carriers expose `requestRejection()` and authenticate every
+ * dedicated RPC route before dispatch, while `rpc.handle()` accepts only the
+ * channel and handler. Feature-detect the carrier-owned trust fence rather
+ * than passing a security-looking argument that modern Hosts do not consume.
+ */
+export function registerVisionRouterRemoteSettingsChannel(connection, handler) {
+  if (!connection || typeof connection !== 'object' || !connection.rpc || typeof connection.rpc.handle !== 'function') {
+    throw new TypeError('Vision Router remote settings requires DSH Connection RPC handle()')
+  }
+  if (typeof connection.requestRejection === 'function') {
+    return connection.rpc.handle(REMOTE_SETTINGS_CHANNEL, handler)
+  }
+  return connection.rpc.handle(REMOTE_SETTINGS_CHANNEL, handler, { authority: 'trusted-host' })
+}
+
 export function createVisionRouterRemoteSettingsHandler(settings, logger) {
   return async (endpoint, payload) => {
     if (endpoint === 'describe') {
@@ -213,14 +236,14 @@ export function createVisionRouterRemoteSettingsHandler(settings, logger) {
 }
 
 export function installVisionRouterRemoteSettingsBridge(ctx, logger) {
-  // DSH client-connection scopes rpc.handle() registrations to the caller
-  // Context and mounts their WebRoute through owner.webServer. Keep webServer
-  // on this exact injected fiber so strict Cordis service access in 0.1.5+
-  // cannot turn remote-settings registration into a startup error.
+  // Declare the services this caller uses directly. Current DSH Connection
+  // accessors additionally trace their route owner through the Connection
+  // provider fiber; cordis.patch.yml therefore keeps that provider activated
+  // on webServer as a separate compatibility boundary (#478).
   ctx.inject(['settings', 'connection', 'webServer'], (remoteCtx) => {
     const handler = createVisionRouterRemoteSettingsHandler(remoteCtx.settings, logger ?? remoteCtx.logger)
     remoteCtx.effect(
-      () => remoteCtx.connection.rpc.handle(REMOTE_SETTINGS_CHANNEL, handler, { authority: 'trusted-host' }),
+      () => registerVisionRouterRemoteSettingsChannel(remoteCtx.connection, handler),
       'vision-router: opt-in remote settings channel',
     )
   })