dsh-vision-router 2.2.5 → 2.2.6

package/README.md

@@ -42,9 +42,9 @@
 > **Data leaves your machine by default.** When a cloud vision model is used, Vision Router sends the image (or a derived crop), the vision prompt and related request metadata to that provider. A fresh install has an anonymous OVHcloud vision fallback enabled, so "free" and "no key" do **not** mean offline. Do not use the cloud chain for confidential, regulated or classified material. See [Data flow and strict local-only use](#data-flow-and-strict-local-only-use).
 
 > [!WARNING]
-> 📌 **Announcement (v2.2.1)**
+> 📌 **Announcement (v2.2.5)**
 >
-> **v2.2.1:** Stability hotfix for large-session repair, accessor-based fetch composition, non-divisible pixel-diff bounds, and local Ollama answer-budget preservation — without raising the rc.8 Host floor. [What’s new →](docs/releases/v2.2.1.md)
+> **v2.2.5:** Adds fail-closed **Local-only vision** and fixes the remaining DSH `0.1.7-rc.2` Windows Desktop multi-plugin `Loading plugins…` hang by isolating Vision Router’s WebServer registrar from other plugins. The public Host floor remains `0.1.0-rc.8`. [What’s new →](docs/releases/v2.2.5.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />
@@ -436,7 +436,7 @@ ollama pull qwen2.5vl
 ## Requirements
 
 - DeepSeek Harness Web profile. Normal installs can use `npx @deepseek-ai/dsh ...`; source checkouts use `pnpm dsh ...`. A bare `dsh ...` command only works when the CLI is already on your shell `PATH`.
-- **DSH Host support policy:** DVR 2.2.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.3`. Exact `0.1.7-rc.2` (`next`) coverage is **verification evidence only**, not a preview support promise; scheduled `latest`/`alpha` canaries monitor drift without changing the support policy. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
+- **DSH Host support policy:** DVR 2.2.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.3`. The DSH `0.2.x` train is forward-admitted (`^0.2.0`) after exact pre-release master, real Host, Windows Desktop, multi-plugin isolation, and packaged-ASAR validation; the final immutable `0.2.0` tag and signed Desktop artifact will be revalidated when upstream publishes them. Exact `0.1.7-rc.2` (`next`) coverage remains verification evidence. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
 - Node ≥ 22 (host side).
 - No API key for the default free chain; a credential reference (`apiKeyEnv`) only for paid `httpProviders`.
 - Chrome / Chromium / Edge is needed only for `vision_html_screenshot`; every other tool works without a browser.

package/README.zh.md

@@ -42,9 +42,9 @@
 > **默认配置会让数据出网。** 使用云端视觉模型时，Vision Router 会将图片（或由它裁剪出的局部）、识图提示词及相关请求元数据发送给对应供应商。新安装默认开启 OVHcloud 匿名视觉兜底，因此“免费”和“免 Key”不等于离线。涉密、涉案、内部或其他受限材料请勿使用云端链路。详见[数据流向与严格纯本地配置](#数据流向与严格纯本地配置)。
 
 > [!WARNING]
-> 📌 **公告（v2.2.1）**
+> 📌 **公告（v2.2.5）**
 >
-> **v2.2.1：稳定性热修——修复大型 Session repair 卡死、accessor fetch 组合、非整除 pixel diff 边界与本地 Ollama 推理占满答案预算；公开最低 Host 仍保持 `0.1.0-rc.8`。** [查看完整更新 →](docs/releases/v2.2.1.md)
+> **v2.2.5：新增 fail-closed 的「仅本地视觉」，并根修 DSH `0.1.7-rc.2` Windows Desktop 多插件环境下残留的 `Loading plugins…` 卡死——Vision Router 的 WebServer registrar 不再污染其他插件。公开最低 Host 仍保持 `0.1.0-rc.8`。** [查看完整更新 →](docs/releases/v2.2.5.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />
@@ -434,7 +434,7 @@ ollama pull qwen2.5vl
 ## 环境要求
 
 - DeepSeek Harness 的 Web profile。普通安装可用 `npx @deepseek-ai/dsh ...`；从源码仓库运行时用 `pnpm dsh ...`。只有 CLI 已经进入系统 `PATH` 时才能直接写 `dsh ...`。
-- **DSH Host 支持策略：** DVR 2.2.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前正式发布通道已验证并支持到 `0.1.5-rc.3`。对 `0.1.7-rc.2`（`next`）的精确覆盖**只属于验证证据**，不代表对 preview 的公开支持承诺；定时 `latest`/`alpha` canary 只负责发现上游漂移，也不会自动改变支持策略。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
+- **DSH Host 支持策略：** DVR 2.2.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前正式发布通道已验证并支持到 `0.1.5-rc.3`。DSH `0.2.x` 版本线已在完成精确预发布 master、真实 Host、Windows Desktop、多插件隔离及打包后 ASAR 验证后提前准入（`^0.2.0`）；上游正式发布不可变 `0.2.0` tag 和签名 Desktop 安装包后仍会立即复验。对 `0.1.7-rc.2`（`next`）的精确覆盖继续作为验证证据。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
 - Node ≥ 22（宿主侧）。
 - 默认免费链路无需 API Key；付费 `httpProviders` 只需一个凭据引用（`apiKeyEnv`）。
 - 只有 `vision_html_screenshot` 需要 Chrome / Chromium / Edge；其余工具无浏览器也能用。

package/docs/architecture/dsh-support-window.md

@@ -17,6 +17,12 @@ DSH `0.1.5-rc.1` / `0.1.5-rc.2` remain admitted for existing installations; curr
 
 No later support-floor increase is currently announced.
 
+### DSH 0.2.x forward admission
+
+DVR 2.2.x peer-admits the DSH `0.2.x` train (`^0.2.0`) without raising the `0.1.0-rc.8` minimum Host floor. This forward admission is backed by the public pre-0.2.0 master at `21638c56315ae6a2b552d6091945d3144c9af32e`: three-OS source contracts, real Host + Chromium, Windows Node 22/24 Desktop authentication, the Node 24 multi-plugin isolation adversary, and an unsigned Windows Desktop built through the upstream release packager all passed. The packaged audit also exercised DVR from `resources/app.asar/dsh`, including authenticated index/API requests, DVR RPC, structured bootstrap injection, and foreign WebServer registrar isolation.
+
+The immutable upstream `0.2.0` tag and signed official Desktop installer did not yet exist when this admission was added. They remain release-time revalidation targets; this forward admission prevents DSH's Host peer gate from rejecting otherwise-compatible DVR installs during that release transition.
+
 ## Verification evidence — not support policy
 
 Compatibility evidence answers a different question: what exact upstream releases and moving channels have current CI proof? It must never be interpreted as a public support-floor change.

package/docs/releases/v2.2.6.md

@@ -0,0 +1,24 @@
+# v2.2.6
+
+DSH Vision Router 2.2.6 is a DSH 0.2 compatibility and runtime-hardening update. It admits the validated DSH 0.2 release train without raising the public Host floor, reduces Settings startup amplification, adds the LM Studio native chat route, and bounds Doctor probe responses while streaming.
+
+## Highlights
+
+- **DSH 0.2 release-train compatibility:** both official DSH peers now admit `>=0.2.0-rc.1 <0.3.0-0`. This covers validated `0.2.0-rc.1` and later 0.2.x prerelease/stable versions without requiring a peer edit for every tag, while every 0.3 prerelease/stable remains excluded until a separate compatibility review.
+- **Permanent DSH `0.2.0-rc.1` gates:** exact-source Windows/macOS/Linux checks, real Host + Chromium lifecycle coverage, Windows Desktop Node 22/24 authenticated-request checks, Node 24 multi-plugin ordering, and stable/next/preview release-channel canaries are now part of CI.
+- **Settings startup amplification root fix (#577):** the DSH 0.1.7 Settings compatibility layer reuses a stable shared service/cache/listener/mutation queue behind the per-caller facade instead of multiplying full-profile recomposition work across child contexts. Exact `0.1.7-rc.2` multi-plugin measurements dropped from 59 configuration calls to roughly 8–10 in the tested profile. This addresses the second amplification mechanism found while investigating #551; the reporter's field A/B remains open and is not treated as closed by this release.
+- **LM Studio native route (#579):** native LM Studio requests use `/api/v1/chat`, and the plugin maps disabled reasoning to the native `reasoning: "off"` behavior instead of sending an OpenAI-compatible-only field.
+- **Doctor response hardening (#580):** runtime probes enforce the response ceiling while streaming and cancel oversized responses instead of buffering beyond the diagnostic boundary.
+- Keeps the public minimum supported DSH Host at `0.1.0-rc.8`; no settings migration is required.
+
+## Validation
+
+- Exact DSH `0.2.0-rc.1@4878cdabd87d4041bdaff61d04c966883b9fd07a` passes Ubuntu/macOS/Windows source contracts, official Host peer evaluation, proxy/overlay contracts, real Host + Chromium Vision/mixed-attachment/Settings lifecycles, Windows Desktop Node 22/24, and the Node 24 multi-plugin adversary.
+- The retained DSH `0.1.7-rc.2` real-Host/browser regression gates remain green.
+- A physical macOS run using the published npm runtime `@deepseek-ai/dsh@0.2.0-rc.1` passed plugin admission, authentication boundaries, Settings save/reload/readback, enabled Vision composer flow, mixed attachment paste/upload, and three consecutive Host restarts with persisted settings and no compatibility-disable/uncaught/fatal signatures.
+- Main CI, DSH Contract, Adversarial Fuzz, routing parity, dependency review, preview browser smoke, native multimodal cold-resume, and the DSH release-channel canary passed on the final compatibility head.
+- Local release-prep suite: `1507` passed, `1` intentional skip, `0` failed; the separate backend runtime-policy suite passed `9/9`.
+
+## Upgrade
+
+Users moving to DSH `0.2.0-rc.1` should upgrade to Vision Router 2.2.6 so the Host compatibility preflight accepts the plugin. Existing supported 0.1.x users can also upgrade in place. Issue #551 remains open for the reporter's original `0.1.7-rc.2` 18-plugin field A/B and is tracked independently from this release.

package/index.js

@@ -1164,8 +1164,9 @@ export function apply(ctx, config = {}, runtime = {}) {
           // Local backends (format=anthropic etc.) go through their own
           // dispatcher; regular HTTP providers keep the plain OpenAI call.
           // Both consume the same pre-built OpenAI content blocks (image_url
-          // data URIs); callLocalBackend converts them for the Anthropic wire.
-          text = await (entry.provider.format === 'anthropic'
+          // data URIs); callLocalBackend converts them for the Anthropic and
+          // LM Studio native wires.
+          text = await ((entry.provider.format === 'anthropic' || entry.provider.format === 'lmstudio')
             ? callLocalBackend(entry.provider, openAIMessages, {
                 maxTokens: entry.provider.maxTokens ?? 4096,
                 signal: options.signal,

package/lib/doctor-cli-p0.js

@@ -7,6 +7,7 @@ import {
   formatDshHostCapability,
   normalizeDshHostCapabilities,
 } from './dsh-host-capabilities.js'
+import { DOCTOR_RESPONSE_MAX_BYTES, readResponseJsonBounded } from './http-body-limit.js'
 import {
   DSH_SUPPORT_WINDOW,
   DSH_VERIFICATION_EVIDENCE,
@@ -63,7 +64,9 @@ export async function probeDoctorHostCapabilities({ baseUrl, fetchImpl = globalT
         capabilities: unknownSnapshot(),
       }
     }
-    const body = await response.json()
+    const body = await readResponseJsonBounded(response, DOCTOR_RESPONSE_MAX_BYTES, {
+      label: 'Doctor Host capability response',
+    })
     return {
       ok: true,
       source: 'live-runtime',

package/lib/doctor-runtime.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import os, { homedir } from 'node:os'
 import path from 'node:path'
 import { CURRENT_VERSION } from './update-check.js'
+import { DOCTOR_RESPONSE_MAX_BYTES, readResponseTextBounded } from './http-body-limit.js'
 
 export const DEFAULT_RUNTIME_URL = 'http://127.0.0.1:3080'
 const SAFE_RUNTIME_ROUTES = [
@@ -111,17 +112,17 @@ export async function probeRuntime({
         signal: timeoutSignal(timeoutMs),
       })
       if (response.status === 200) {
-        const text = typeof response.text === 'function' ? await response.text() : ''
-        if (Buffer.byteLength(text) <= 16 * 1024) {
-          const body = text ? JSON.parse(text) : undefined
-          const expectedDirectory = path.resolve(dshHome, 'logs', 'vision-router')
-          const actualDirectory = typeof body?.directory === 'string' ? path.resolve(body.directory) : undefined
-          const candidates = [...new Set(applicableProfiles.filter((name) => typeof name === 'string'))]
-          if (body?.local === true && actualDirectory === expectedDirectory && candidates.length === 1 && candidates[0] === requestedProfile) {
-            ownership = { requestedProfile, verified: true, profile: requestedProfile, source: 'log-home+unique-profile' }
-          } else if (body?.local === true && actualDirectory === expectedDirectory) {
-            ownership = { requestedProfile, verified: false, reason: 'profile-ambiguous', candidateProfiles: candidates }
-          }
+        const text = await readResponseTextBounded(response, DOCTOR_RESPONSE_MAX_BYTES, {
+          label: 'Doctor runtime ownership response',
+        })
+        const body = text ? JSON.parse(text) : undefined
+        const expectedDirectory = path.resolve(dshHome, 'logs', 'vision-router')
+        const actualDirectory = typeof body?.directory === 'string' ? path.resolve(body.directory) : undefined
+        const candidates = [...new Set(applicableProfiles.filter((name) => typeof name === 'string'))]
+        if (body?.local === true && actualDirectory === expectedDirectory && candidates.length === 1 && candidates[0] === requestedProfile) {
+          ownership = { requestedProfile, verified: true, profile: requestedProfile, source: 'log-home+unique-profile' }
+        } else if (body?.local === true && actualDirectory === expectedDirectory) {
+          ownership = { requestedProfile, verified: false, reason: 'profile-ambiguous', candidateProfiles: candidates }
         }
       }
     } catch {

package/lib/dsh-settings-017-compat.js

@@ -110,6 +110,18 @@ function revisionFor(editor, namespace, current, inherited) {
   return previous.revision
 }
 
+const CORDIS_ORIGINAL = Symbol.for('cordis.original')
+
+function serviceIdentity(value) {
+  if (!value || (typeof value !== 'object' && typeof value !== 'function')) return value
+  try {
+    const original = value[CORDIS_ORIGINAL]
+    return original && (typeof original === 'object' || typeof original === 'function') ? original : value
+  } catch {
+    return value
+  }
+}
+
 function serviceOf(ctx, name) {
   try {
     const value = typeof ctx?.get === 'function' ? ctx.get(name) : undefined
@@ -176,17 +188,26 @@ function applyOperations(current, inherited, ops) {
   return next
 }
 
-function createConfigEditorSettingsFacade(editor, entryConfig, namespace) {
-  const listeners = new Set()
+function createConfigEditorSettingsFacade(editor, entryConfig, namespace, sharedState) {
+  const listeners = sharedState.listeners
 
-  function state() {
+  // ConfigEditor.configuration() rebuilds the complete profile and, on 0.1.7,
+  // composes every entry through structuredClone(). Ordinary profile writes
+  // reload this plugin and therefore replace the facade; keep one immutable
+  // instance snapshot for runtime reads and refresh only at write boundaries.
+  function state(refresh = false) {
+    if (sharedState.stateLoaded && !refresh) return sharedState.cachedState
     const row = configEditorRow(editor, namespace)
-    if (!row) return undefined
+    if (!row) {
+      sharedState.cachedState = undefined
+      sharedState.stateLoaded = true
+      return sharedState.cachedState
+    }
     const current = objectLike(row.entry?.options?.config) ? row.entry.options.config : {}
     const inherited = objectLike(row.inherited) ? row.inherited : {}
     const base = mergeResolved(entryConfig, inherited)
     const value = mergeResolved(entryConfig, current)
-    return {
+    sharedState.cachedState = {
       row,
       descriptor: {
         ns: namespace,
@@ -197,17 +218,25 @@ function createConfigEditorSettingsFacade(editor, entryConfig, namespace) {
         applies: true,
       },
     }
+    sharedState.stateLoaded = true
+    return sharedState.cachedState
   }
 
   function notify(value) {
     for (const listener of [...listeners]) {
-      try { listener(value, undefined) } catch {}
+      try { listener(clone(value), undefined) } catch {}
     }
   }
 
+  function enqueueMutation(task) {
+    const running = sharedState.mutationTail.then(task, task)
+    sharedState.mutationTail = running.catch(() => {})
+    return running
+  }
+
   const scope = {
     get() {
-      return state()?.descriptor.value ?? entryConfig
+      return clone(state()?.descriptor.value ?? entryConfig)
     },
     watch(listener) {
       if (typeof listener !== 'function') return () => {}
@@ -234,23 +263,35 @@ function createConfigEditorSettingsFacade(editor, entryConfig, namespace) {
       const current = state()
       return current ? [clone(current.descriptor)] : []
     },
-    async mutate(namespaceName, operations, expectedRevision) {
-      if (namespaceName !== namespace) throw new Error(`No configurable plugin entry ${JSON.stringify(namespaceName)}`)
-      const before = state()
-      if (!before) throw new Error(`No configurable plugin entry ${JSON.stringify(namespace)}`)
-      if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0) {
-        throw admissionError('expectedRevision must be a non-negative safe integer')
-      }
-      if (expectedRevision !== before.descriptor.revision) {
-        throw settingsConflict(expectedRevision, before.descriptor.revision)
+    mutate(namespaceName, operations, expectedRevision) {
+      let ops
+      try {
+        if (namespaceName !== namespace) throw new Error(`No configurable plugin entry ${JSON.stringify(namespaceName)}`)
+        if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 0) {
+          throw admissionError('expectedRevision must be a non-negative safe integer')
+        }
+        // Validate and clone caller-owned values before this write waits behind
+        // another mutation, closing a queued-request time-of-check/use gap.
+        ops = validateOperations(operations)
+      } catch (error) {
+        return Promise.reject(error)
       }
-      const ops = validateOperations(operations)
-      const entry = before.row.entry
-      await editor.edit(entry, (current, inherited) => applyOperations(current, inherited, ops))
-      const after = state()
-      if (!after) throw new Error('Vision Router configuration entry disappeared after the write')
-      notify(after.descriptor.value)
-      return clone(after.descriptor)
+      return enqueueMutation(async () => {
+        // Runtime reads use the facade snapshot. Writes deliberately cross the
+        // ConfigEditor boundary again so optimistic concurrency still observes
+        // changes that landed before a Host reload replaced this facade.
+        const before = state(true)
+        if (!before) throw new Error(`No configurable plugin entry ${JSON.stringify(namespace)}`)
+        if (expectedRevision !== before.descriptor.revision) {
+          throw settingsConflict(expectedRevision, before.descriptor.revision)
+        }
+        const entry = before.row.entry
+        await editor.edit(entry, (current, inherited) => applyOperations(current, inherited, ops))
+        const after = state(true)
+        if (!after) throw new Error('Vision Router configuration entry disappeared after the write')
+        notify(after.descriptor.value)
+        return clone(after.descriptor)
+      })
     },
   }
 }
@@ -264,6 +305,7 @@ function createConfigEditorSettingsFacade(editor, entryConfig, namespace) {
 function contextWithLazySettingsCompatibility(ctx, entryConfig, namespace) {
   const wrappers = new WeakMap()
   const facades = new WeakMap()
+  const sharedStates = new WeakMap()
   let injectedEditor
 
   try {
@@ -284,9 +326,24 @@ function contextWithLazySettingsCompatibility(ctx, entryConfig, namespace) {
         || !editor || typeof editor.edit !== 'function' || typeof editor.configuration !== 'function') {
       return settings
     }
+    const identity = serviceIdentity(editor)
+    let sharedState = sharedStates.get(identity)
+    if (!sharedState) {
+      sharedState = {
+        listeners: new Set(),
+        cachedState: undefined,
+        stateLoaded: false,
+        mutationTail: Promise.resolve(),
+      }
+      sharedStates.set(identity, sharedState)
+    }
     let facade = facades.get(editor)
     if (!facade) {
-      facade = createConfigEditorSettingsFacade(editor, entryConfig, namespace)
+      // Cordis may hand different traceable proxy views of the same service to
+      // different child contexts. Keep each facade bound to its caller-owned
+      // proxy for method ownership, but share the expensive immutable snapshot
+      // and write queue by the stable underlying service identity.
+      facade = createConfigEditorSettingsFacade(editor, entryConfig, namespace, sharedState)
       facades.set(editor, facade)
     }
     return facade

package/lib/http-body-limit.js

@@ -3,6 +3,7 @@ const DEFAULT_FALLBACK_MAX_BYTES = 4 * 1024 * 1024
 export const MODEL_RESPONSE_MAX_BYTES = 4 * 1024 * 1024
 export const METADATA_RESPONSE_MAX_BYTES = 512 * 1024
 export const ERROR_RESPONSE_MAX_BYTES = 64 * 1024
+export const DOCTOR_RESPONSE_MAX_BYTES = 16 * 1024
 
 function normalizedLimit(value) {
   const number = Number(value)
@@ -34,7 +35,10 @@ export async function readResponseBytesBounded(response, maxBytes, options = {})
   const limit = normalizedLimit(maxBytes)
   const label = typeof options.label === 'string' && options.label !== '' ? options.label : 'HTTP response'
   const declared = declaredLength(response)
-  if (declared !== undefined && declared > limit) throw responseTooLarge(label, limit, declared)
+  if (declared !== undefined && declared > limit) {
+    try { await response?.body?.cancel?.('response body limit exceeded') } catch { /* best effort */ }
+    throw responseTooLarge(label, limit, declared)
+  }
 
   const body = response?.body
   if (body && typeof body.getReader === 'function') {

package/lib/local-vision-stabilizer.js

@@ -63,15 +63,25 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
   const positive = (value, fallback) =>
     Number.isFinite(value) && value > 0 ? Number(value) : fallback
 
-  const actualConfig = () => {
+  let resolvedConfig = config
+
+  const captureConfig = (value, scope = rawScope) => {
     try {
-      const value = rawScope && typeof rawScope.get === 'function' ? rawScope.get() : config
-      return normalizeRuntimeVisionConfig(value && typeof value === 'object' ? value : config)
+      let candidate = value
+      if ((!candidate || typeof candidate !== 'object') && scope && typeof scope.get === 'function') {
+        candidate = scope.get()
+      }
+      resolvedConfig = normalizeRuntimeVisionConfig(
+        candidate && typeof candidate === 'object' ? candidate : config,
+      )
     } catch {
-      return config
+      resolvedConfig = config
     }
+    return resolvedConfig
   }
 
+  const actualConfig = () => resolvedConfig
+
   const localTaskBudget = (value = actualConfig()) =>
     Math.max(
       1000,
@@ -344,6 +354,7 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
           if (typeof watch !== 'function') return watch
           return (listener) =>
             watch.call(target, (...args) => {
+              if (rawScope === target) captureConfig(args[0], target)
               syncScreenshot()
               return listener(...args)
             })
@@ -369,6 +380,7 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
           const scope = target.register(namespace, schema, fixedOptions)
           if (namespace === 'vision-router') {
             rawScope = scope
+            captureConfig(undefined, scope)
             syncScreenshot()
             // The Settings service is dynamic. Never keep its scope after the
             // owning injection fiber unloads; during the gap fall back to the
@@ -378,6 +390,7 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
                 () => () => {
                   if (rawScope !== scope) return
                   rawScope = undefined
+                  resolvedConfig = config
                   syncScreenshot()
                 },
                 'vision-router: local settings scope lifecycle',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vision-router",
-  "version": "2.2.5",
+  "version": "2.2.6",
   "description": "Eyes for text-only DeepSeek Harness agents: built-in free vision chain + pixel-level tools. Remote vision providers, including the default free fallback, receive image content unless strict local-only use is configured.",
   "license": "MIT",
   "repository": {
@@ -54,8 +54,8 @@
     "undici": "^7.29.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.0-rc.8 || ^0.1.1-rc.1 || ^0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.6-alpha.1 || 0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm-deepseek": "^0.1.0-rc.8 || ^0.1.1-rc.1 || ^0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.6-alpha.1 || 0.1.7-rc.2",
+    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.0-rc.8 || ^0.1.1-rc.1 || ^0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.6-alpha.1 || 0.1.7-rc.2 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm-deepseek": "^0.1.0-rc.8 || ^0.1.1-rc.1 || ^0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.6-alpha.1 || 0.1.7-rc.2 || >=0.2.0-rc.1 <0.3.0-0",
     "sharp": ">=0.35.3 <1"
   },
   "peerDependenciesMeta": {