dsh-vision-router 2.2.6 → 2.2.8

package/README.md

@@ -375,7 +375,7 @@ Everything is optional; defaults work out of the box. Prefer **Settings → Visi
 | `tool` / `progressiveTools` / `autoActivateOnImage` | `true` / `false` / `true` | vision tools on / progressive mounting (off by default for a stable tool schema) / image-turn auto-mount when progressive mode is enabled; `progressiveTools` is boot-time config |
 | `rewriteImages` | `true` | rewrite image blocks in the model input (cached description or tool-hint marker); the UI log keeps images |
 | `desktopScreenshot` | `false` | privacy opt-in for the model-callable `vision_screenshot` desktop-capture tool; checked live before every capture |
-| `localOnlyVision` | `false` | runtime privacy policy: when enabled, only loopback vision endpoints may execute; cloud/DSH providers and the built-in OVH fallback stay saved but are fail-closed |
+| `localOnlyVision` | `false` | visual-endpoint privacy policy: only loopback vision endpoints may execute, so Vision Router keeps image bytes/crops off cloud vision services; derived result text (descriptions, OCR, coordinates) still goes to the current chat model, so strict end-to-end local use also requires a local chat model |
 | `freeFallback` | `true` | append the anonymous OVH models after explicit local/custom HTTP backends; ignored while `localOnlyVision` is enabled |
 | `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | local vision backend; OpenAI mode disables supported model reasoning by default so the output budget is spent on answer text |
 | `localLmStudio` | `{ enabled: false, baseURL: 'http://localhost:1234/v1', model: '', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | local LM Studio backend after Ollama; LM Studio 0.4+ can use `format: 'lmstudio'` for documented native reasoning control |
@@ -436,7 +436,7 @@ ollama pull qwen2.5vl
 ## Requirements
 
 - DeepSeek Harness Web profile. Normal installs can use `npx @deepseek-ai/dsh ...`; source checkouts use `pnpm dsh ...`. A bare `dsh ...` command only works when the CLI is already on your shell `PATH`.
-- **DSH Host support policy:** DVR 2.2.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.3`. The DSH `0.2.x` train is forward-admitted (`^0.2.0`) after exact pre-release master, real Host, Windows Desktop, multi-plugin isolation, and packaged-ASAR validation; the final immutable `0.2.0` tag and signed Desktop artifact will be revalidated when upstream publishes them. Exact `0.1.7-rc.2` (`next`) coverage remains verification evidence. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
+- **DSH Host support policy:** DVR 2.2.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.3`. The DSH `0.2.x` train is peer-admitted from the verified `0.2.0-rc.1` boundary (`>=0.2.0-rc.1 <0.3.0-0`); exact `0.2.0-rc.2` (`next/rc`) source, real Host, Windows Desktop, multi-plugin, Settings, mixed-attachment, bundle-recompose, and Host-Sharp gates are preview verification evidence, not a support-floor increase. The final stable `0.2.0` tag and signed Desktop artifact will still be revalidated when published. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
 - Node ≥ 22 (host side).
 - No API key for the default free chain; a credential reference (`apiKeyEnv`) only for paid `httpProviders`.
 - Chrome / Chromium / Edge is needed only for `vision_html_screenshot`; every other tool works without a browser.

package/README.zh.md

@@ -373,7 +373,7 @@ Web profile 现在提供一级 **设置 → Vision Router** 页面。常规页
 | `tool` / `progressiveTools` / `autoActivateOnImage` | `true` / `false` / `true` | 视觉工具总开关 / 渐进式挂载（默认关闭以稳定工具 schema）/ 渐进模式下图片轮自动挂载；`progressiveTools` 为启动期配置 |
 | `rewriteImages` | `true` | 模型输入层改写图片块（缓存描述或工具提示标记）；界面日志保留图片 |
 | `desktopScreenshot` | `false` | 模型可调用的 `vision_screenshot` 桌面截屏隐私开关；每次截屏前实时检查 |
-| `localOnlyVision` | `false` | 运行时隐私策略：开启后只有回环地址上的视觉端点可执行；云端/DSH Provider 与内置 OVH 兜底保留配置但 fail closed |
+| `localOnlyVision` | `false` | 视觉端点隐私策略：只有回环地址上的视觉端点可执行，Vision Router 不会把图片/裁剪发给云端视觉服务；描述、OCR、坐标等识图结果文本仍会交给当前聊天模型，因此严格端到端纯本地还需同时使用本地聊天模型 |
 | `freeFallback` | `true` | 在显式本地/自定义 HTTP 后端之后追加匿名 OVH 模型；`localOnlyVision` 开启期间不会执行 |
 | `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | 本地视觉后端；OpenAI 模式默认关闭受支持模型的推理，把输出预算留给正文 |
 | `localLmStudio` | `{ enabled: false, baseURL: 'http://localhost:1234/v1', model: '', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | Ollama 之后的本地 LM Studio 后端；LM Studio 0.4+ 可选 `format: 'lmstudio'` 使用官方原生推理控制 |
@@ -434,7 +434,7 @@ ollama pull qwen2.5vl
 ## 环境要求
 
 - DeepSeek Harness 的 Web profile。普通安装可用 `npx @deepseek-ai/dsh ...`；从源码仓库运行时用 `pnpm dsh ...`。只有 CLI 已经进入系统 `PATH` 时才能直接写 `dsh ...`。
-- **DSH Host 支持策略：** DVR 2.2.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前正式发布通道已验证并支持到 `0.1.5-rc.3`。DSH `0.2.x` 版本线已在完成精确预发布 master、真实 Host、Windows Desktop、多插件隔离及打包后 ASAR 验证后提前准入（`^0.2.0`）；上游正式发布不可变 `0.2.0` tag 和签名 Desktop 安装包后仍会立即复验。对 `0.1.7-rc.2`（`next`）的精确覆盖继续作为验证证据。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
+- **DSH Host 支持策略：** DVR 2.2.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前稳定通道已验证并支持到 `0.1.5-rc.3`。DSH `0.2.x` 从已验证的 `0.2.0-rc.1` 边界开始准入（`>=0.2.0-rc.1 <0.3.0-0`）；精确 `0.2.0-rc.2`（`next/rc`）源码、真实 Host、Windows Desktop、多插件、Settings、混合附件、bundle 重组及 Host-Sharp 门禁仅作为预览验证证据，不抬高公开支持下限。上游正式发布稳定版 `0.2.0` tag 和签名 Desktop 安装包后仍会立即复验。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
 - Node ≥ 22（宿主侧）。
 - 默认免费链路无需 API Key；付费 `httpProviders` 只需一个凭据引用（`apiKeyEnv`）。
 - 只有 `vision_html_screenshot` 需要 Chrome / Chromium / Edge；其余工具无浏览器也能用。

package/docs/architecture/dsh-020-rc2-adaptation.md

@@ -0,0 +1,23 @@
+# DSH 0.2.0-rc.2 compatibility audit
+
+- Channel: next/rc (kept distinct from stable and alpha/pre-release)
+- Upstream tag: `dsh-v0.2.0-rc.2`
+- Upstream commit: `639ed015397290b3745d163aafe02ffee4aa3f84`
+- Published: 2026-09-29 09:21:31 UTC
+- Comparison baseline: `dsh-v0.2.0-rc.1` at `4878cdabd87d4041bdaff61d04c966883b9fd07a`
+
+## Seam review
+
+| Area | rc.1 → rc.2 finding | DVR action |
+| --- | --- | --- |
+| Host / Desktop | Desktop now ships a bundled CLI entry, command installation management, login-shell environment import, and Windows console signal bridging. Existing Web profile plugin injection remains available. | Re-run exact-source on Windows/macOS/Linux plus Windows Desktop on Node 22 and 24. |
+| Session | Session controller source is unchanged; its package version advances only. New timed user-question persistence is additive outside DVR's session image ownership seam. | Retain session/adversarial regressions and real Host lifecycle checks. |
+| Settings | Settings controller source is unchanged. Web preset/default and Creator controls are no longer gated by Coding Tools. | Re-run Settings mount/save/reload/readback in real Chromium; no compatibility shim added. |
+| bundle | Published bundle package sources are unchanged apart from versions. Desktop/Host bundles become more self-contained for CLI launch. | Re-run bundle recomposition and cache-manifest validation. |
+| web/client | Model picker search, shortcut modal caching, preset Settings behavior, and long-session rendering changed. | Re-run Vision toggle, mixed attachments, Settings, and client/browser contract suites. |
+| model / attachment | Attachment package sources are unchanged; model-facing work is UI/search and pi-ai/Mistral compatibility. | Re-run mixed-attachment and provider wire contracts. |
+| service injection | API Remotes adds the user-question remote; Gateway adds additive `hasLiveClient()`. DVR's declared injected services and Host-owned proxy authority are unchanged. | Re-run injection, proxy-egress, multi-plugin ordering, and Host-Sharp contracts. |
+
+## Policy
+
+The public minimum Host remains DSH `0.1.0-rc.8`. The current stable evidence remains `0.1.5-rc.3`. The peer range remains `>=0.2.0-rc.1 <0.3.0-0`; rc.2 advances exact next/rc verification evidence and does not widen the range or turn preview evidence into a stable support claim.

package/docs/architecture/dsh-compatibility-matrix.md

@@ -11,9 +11,10 @@ The matrix is capability-based. Runtime code must feature-detect the seam it nee
 | `minimum-contract` | `0.1.0-rc.6` | Historical compatibility-retention fixture. The name is legacy; DVR 2.1.x and later 2.x public support starts at rc.8. |
 | `legacy-contract` | `0.1.0-rc.8` | Public support-floor fixture carrying batch attachments and dimension policy. |
 | `current-contract` | `0.1.5-rc.3` | Current stable Host contract baseline. Must remain green. |
-| `preview-contract` / exact preview gates | `0.1.7-rc.2` (`next`) | Required verification evidence only; not a public preview-support claim. |
+| `preview-contract` | `0.1.7-rc.2` | Retained predecessor-preview regression fixture. |
+| `DSH 0.2.0-rc.2 validation` | `0.2.0-rc.2` (`next/rc`) | Current exact next/rc evidence; not a public preview-support claim. |
 | retained preview regression | `0.1.5-alpha.2` | Older preview regression fixture retained as an older preview regression while the 0.1.7 next line is qualified. |
-| `latest-dsh` / alpha canaries | resolved dynamically from npm dist-tags | Scheduled drift surveillance only. Never changes support policy by itself. |
+| release-channel canary | npm `latest` / `next` / `alpha` | Separately labelled stable, next/rc, and alpha/pre-release drift surveillance. Never changes support policy by itself. |
 
 Node 22 and Node 24 remain the general required runtime matrix. The Host contract jobs are additive; they do not replace the normal test matrix.
 
@@ -38,7 +39,7 @@ Node 22 and Node 24 remain the general required runtime matrix. The Host contrac
 | Public entry boot | yes | yes | yes | packed plugin public entry import in each Host contract fixture. |
 | Packaged tarball install | yes | yes | yes | each Host contract fixture packs the plugin then installs the tarball into an isolated Host package. |
 
-Preview-only evidence: the `0.1.7-rc.2` (`next`) contract fixture additionally mounts the Host-owned `@deepseek-ai/dsh-compaction-image-offload` projection and proves that one offloaded image occurrence stays offloaded across live requests, `SessionStore.fork()`, JSONL process restart, and cold resume, while a new occurrence of the same durable attachment remains a retained image. This is verification evidence for the preview contract only; it does not expand the public support window.
+Preview-only evidence: the retained `0.1.7-rc.2` contract fixture additionally mounts the Host-owned `@deepseek-ai/dsh-compaction-image-offload` projection and proves that one offloaded image occurrence stays offloaded across live requests, `SessionStore.fork()`, JSONL process restart, and cold resume. The exact `0.2.0-rc.1` gate separately proves immutable source contracts, official peer evaluation, Host proxy authority, WebServer overlay ownership, real Host + Chromium Vision/mixed-attachment/Settings/bundle lifecycles, and Windows Node 22/24 Desktop plus the Node 24 multi-plugin adversary. Both are verification evidence only; neither expands the public support window.
 
 ## Compatibility inventory and exit criteria
 

package/docs/architecture/dsh-support-window.md

@@ -19,9 +19,9 @@ No later support-floor increase is currently announced.
 
 ### DSH 0.2.x forward admission
 
-DVR 2.2.x peer-admits the DSH `0.2.x` train (`^0.2.0`) without raising the `0.1.0-rc.8` minimum Host floor. This forward admission is backed by the public pre-0.2.0 master at `21638c56315ae6a2b552d6091945d3144c9af32e`: three-OS source contracts, real Host + Chromium, Windows Node 22/24 Desktop authentication, the Node 24 multi-plugin isolation adversary, and an unsigned Windows Desktop built through the upstream release packager all passed. The packaged audit also exercised DVR from `resources/app.asar/dsh`, including authenticated index/API requests, DVR RPC, structured bootstrap injection, and foreign WebServer registrar isolation.
+DVR 2.2.x peer-admits the DSH `0.2.x` train from the verified rc.1 boundary (`>=0.2.0-rc.1 <0.3.0-0`) without raising the `0.1.0-rc.8` minimum Host floor. Initial forward admission was backed by public pre-0.2.0 master `21638c56315ae6a2b552d6091945d3144c9af32e`. Exact release evidence has now advanced to immutable `dsh-v0.2.0-rc.2` commit `639ed015397290b3745d163aafe02ffee4aa3f84`, published on 2026-09-29. Required gates cover three-OS source contracts, real Host + Chromium, Settings mount/save/reload/readback, mixed attachments, bundle recomposition, Windows Node 22/24 Desktop authentication, the Node 24 multi-plugin isolation adversary, and Host-owned Sharp resolution.
 
-The immutable upstream `0.2.0` tag and signed official Desktop installer did not yet exist when this admission was added. They remain release-time revalidation targets; this forward admission prevents DSH's Host peer gate from rejecting otherwise-compatible DVR installs during that release transition.
+The final immutable upstream `0.2.0` stable tag and signed official Desktop installer remain release-time revalidation targets. The rc.1 evidence is next-channel verification, not a preview support promise and not a support-floor increase.
 
 ## Verification evidence — not support policy
 
@@ -30,9 +30,10 @@ Compatibility evidence answers a different question: what exact upstream release
 | Evidence role | DSH source | Meaning |
 |---|---|---|
 | Exact stable evidence | `0.1.5-rc.3` | Required Host/wire and real Host + Chromium coverage for the current stable release. |
-| Exact preview evidence | `0.1.7-rc.2` (`next`) | Required preview Host/wire/lifecycle/browser evidence. This is not a preview support promise. |
+| Exact next/rc evidence | `0.2.0-rc.2` (`next/rc`) | Required Host/wire/lifecycle/browser evidence. This is not a preview support promise. |
 | Stable drift canary | npm dist-tag `latest` | Scheduled, dynamically resolved surveillance. A failure starts compatibility investigation; it does not rewrite support policy. |
-| Preview drift canary | npm dist-tag `alpha` | Scheduled, dynamically resolved surveillance with preview-specific lifecycle coverage. A failure does not rewrite support policy. |
+| Next/rc drift canary | npm dist-tag `next` | Scheduled, dynamically resolved surveillance for the rc channel. A failure does not rewrite support policy. |
+| Alpha/pre-release drift canary | npm dist-tag `alpha` | Scheduled, dynamically resolved surveillance for the alpha channel. A failure does not rewrite support policy. |
 
 The exact evidence values may move in a patch-level maintenance PR when CI proof advances. The public minimum may move only under the support-floor protocol below.
 
@@ -75,3 +76,5 @@ DVR must not turn these tables into widespread version-string conditionals. Runt
 ## Compatibility-retirement rule
 
 The 2.1.x floor makes rc.6-only compatibility candidates eligible for a fresh deletion audit, but does not automatically authorize deletion. Durable session formats, replay envelopes, adapter wire shapes, and other historical inputs may outlive the Host version that originally produced them.
+
+See [DSH 0.2.0-rc.2 compatibility audit](dsh-020-rc2-adaptation.md) for the upstream seam review and validation plan.

package/docs/architecture/host-first-proxy-convergence.md

@@ -50,7 +50,7 @@ H1 is complete as an egress contract, not as a new production dependency. Exact
 4. The same contract runs against the exact current stable Host and exact preview evidence on Linux, macOS, and Windows through the existing source-contract matrix.
 5. Production code contains no `@deepseek-ai/dsh-http-proxy` dependency or import. `proxyRouteFor()` is used only by the exact-source test as an oracle for the Host decision.
 
-The current stable evidence advances to DSH `0.1.5-rc.3`; `0.1.5-rc.1` / `0.1.5-rc.2` remain explicitly peer-admitted, exact next-channel evidence is `0.1.7-rc.2`, and the public minimum remains `0.1.0-rc.8`.
+The current stable evidence remains DSH `0.1.5-rc.3`; `0.1.5-rc.1` / `0.1.5-rc.2` remain explicitly peer-admitted, exact next/rc evidence is `0.2.0-rc.2`, and the public minimum remains `0.1.0-rc.8`.
 
 ## H2 — Scope Host-owned override authority
 

package/docs/releases/v2.2.7.md

@@ -0,0 +1,22 @@
+# v2.2.7
+
+DSH Vision Router 2.2.7 is a reliability, Desktop compatibility, and security hotfix. It restores the official Desktop Settings/local-capability path, repairs Electron-local Tesseract execution, hardens artifact/cache publication under symlinked workspaces and overlapping writers, and picks up the upstream Undici 7.29.1 security release without changing the public DSH support floor.
+
+## Highlights
+
+- **Official Desktop origin fix (#589):** `dsh-app://app` is now recognized consistently as the exact DSH-owned local Desktop origin across Settings, Settings IA, local diagnostics, exact-check, screenshot, and 0.1.7 compatibility surfaces. Lookalike origins remain remote, and server-side local-only boundaries are unchanged.
+- **Electron local OCR fix (#590):** the Tesseract `execFile` compatibility layer now synchronizes Node CJS/ESM builtin exports symmetrically during install, rollback, and teardown. This fixes Windows Electron cases where forced Tesseract received the literal `stdin` path or Auto OCR silently fell back to a vision model.
+- **Artifact path identity fix (#594):** artifact containment and atomic writes still use canonical real paths, while successful publication returns the caller-visible workspace path. Symlinked workspaces such as macOS `/tmp -> /private/tmp` no longer make a valid artifact appear to escape its session workspace.
+- **Collision-resistant cache publication (#594):** live-model, capability-profile, background-stop, and image-input-verdict caches now use unique atomic temporary paths. Independent writers in the same process and millisecond can no longer collide on one temp file and fail `rename()` with `ENOENT`.
+- **Undici 7.29.1 security update (#593):** the runtime picks up the upstream 7.29.1 security release, including fixes around connection-option preservation, WebSocket failure handling, shared-cache safety, decompression bounds, retry/body settlement, and response framing. This dependency hardening does not imply every upstream advisory was reachable through Vision Router itself.
+- **DSH 0.2 validation/cache hardening (#588):** canonical compatibility evidence now reflects the validated `0.2.0-rc.1` train, and DSH build-cache manifests include required `lib` outputs so incomplete archives fail closed instead of reaching runtime smoke with missing build artifacts.
+
+## Validation
+
+- PR #594 completed 75 repository checks with 0 failures, including Node 22/24, Windows/macOS/Linux, artifact-boundary 22/24, DSH minimum/current/preview contracts, exact-source, real Host + Chromium, Windows Desktop Host, routing parity, Host Sharp, hostile-input fuzz, dependency review, and CodeQL.
+- Local final hotfix validation on the Undici 7.29.1 base: main suite `1520` passed, `1` intentional skip, `0` failed; backend runtime-policy suite passed `9/9`; targeted artifact/cache/live-model/capability/background lifecycle coverage passed `43/43`.
+- The public minimum supported DSH Host remains `0.1.0-rc.8`; existing 2.2.x settings require no migration.
+
+## Upgrade
+
+2.2.6 users should upgrade to 2.2.7, especially when using the official Desktop app, local Tesseract OCR, symlinked/custom workspaces, or long-running installations that may overlap cache writes. No configuration changes are required.

package/docs/releases/v2.2.8.md

@@ -0,0 +1,25 @@
+# v2.2.8
+
+DSH Vision Router 2.2.8 is a Desktop compatibility and lifecycle reliability patch. It restores conversation-side Vision UI injection in the official static-shell Desktop, prevents stale Vision tool restrictions from surviving plugin reloads, adds real Electron end-to-end coverage on Windows and macOS, hardens DSH build-cache completeness and test diagnostics, clarifies the `localOnlyVision` privacy boundary, and advances exact preview verification to DSH `0.2.0-rc.2` without changing the public Host support floor.
+
+## Highlights
+
+- **Official Desktop conversation injection (#597):** browser-side client preludes now use one capability-detected carrier that publishes structured `webserver/index-inject` rows for the official Desktop shell while retaining `tapIndex()` as the older/Web fallback. The Vision toggle and related client boundaries no longer depend on HTTP-served HTML to appear.
+- **Vision tool lifecycle fix (#597):** Session tool restrictions installed while Vision mode is off are explicitly released when the plugin boundary is disposed. A surviving Agent can no longer inherit an orphaned restriction from an older plugin/HMR instance and keep `vision_describe` and the rest of the DVR tool surface hidden after Vision is re-enabled.
+- **Real Desktop functional gates (#597):** Windows Node 24 and macOS now launch the actual Electron renderer and exercise Settings open/save/reload, workspace/session startup, image attachment, Vision toggle state, real `vision_describe` tool calling, image delivery to a controlled local vision backend, and the final rendered assistant response. Separate adversarial tests still cover duplicate/ordered carriers, failure recovery, OFF→ON→OFF authority, and plugin reload boundaries.
+- **Complete DSH build caches (#597):** trusted exact-Host caches retain both native `packages/*/lib` JavaScript outputs and `packages/*/bin` artifacts under a new cache schema. A cache hit can no longer restore a half-built DSH runtime missing files such as `@deepseek-ai/node-addon-system/lib/flock.js`.
+- **Safer Desktop diagnostics (#597):** failure artifacts persist fixed summaries of Host/network evidence rather than writing arbitrary response bodies to disk. CodeQL verified the previous network-data-to-file path as fixed.
+- **`localOnlyVision` privacy wording (#598):** Settings and documentation now state the actual boundary precisely: raw image bytes stay on local vision backends, while derived OCR/description/tool results can still enter the active chat-model context. This is a disclosure clarification, not a routing-policy change.
+- **DSH `0.2.0-rc.2` verification (#599):** the permanent next/rc compatibility gate now pins exact rc.2 source and covers Linux/macOS/Windows source contracts, Node 22/24 Windows Desktop Host, real Host + Chromium, multi-plugin ordering, Settings, mixed attachments, bundle recomposition, and real Windows/macOS Electron renderer flows. The peer-admission boundary and public minimum remain unchanged.
+
+## Validation
+
+- Final local regression on the rc.2-compatible tree: main suite `1534` passed, `1` intentional skip, `0` failed; backend runtime-policy suite passed `9/9`.
+- DSH `0.2.0-rc.2` passed exact-source checks on Ubuntu, Windows, and macOS; real Host + Chromium; Windows Desktop Host on Node 22 and Node 24; Node 24 multi-plugin ordering; and real Windows/macOS Electron renderer lifecycle tests.
+- The real Desktop Vision flow reached the controlled text model, issued `vision_describe`, delivered actual image content to the controlled vision backend, consumed the tool result, and rendered the expected final response.
+- The post-merge `main` push gates for `f92a6e0` completed with 0 failures, including CI, HOL security, DSH exact-source, DSH 0.1.7 real Host, DSH `0.2.0-rc.2` validation, preview browser smoke, routing parity, data boundary, architecture closure, and compatibility convergence.
+- The public minimum supported DSH Host remains `0.1.0-rc.8`; existing 2.2.x settings require no migration.
+
+## Upgrade
+
+2.2.7 users should upgrade to 2.2.8, especially when using the official Desktop app or frequently reloading/updating plugins in long-lived sessions. No configuration changes are required.

package/lib/artifact-io.js

@@ -106,7 +106,8 @@ async function resolveArtifactTargetForRun(workspace, artifactsDir, relativePath
   const lstatImpl = deps.lstat ?? lstat
 
   throwIfVisionAborted()
-  const workspaceReal = await realpathImpl(path.resolve(String(workspace ?? '')))
+  const workspaceLexical = path.resolve(String(workspace ?? ''))
+  const workspaceReal = await realpathImpl(workspaceLexical)
   throwIfVisionAborted()
   const relativeBase = normalizeArtifactsDir(artifactsDir)
   const requestedTarget = normalizeRelativeArtifactPath(relativePath)
@@ -114,6 +115,7 @@ async function resolveArtifactTargetForRun(workspace, artifactsDir, relativePath
     ? normalizeRelativeArtifactPath(path.join(ARTIFACT_RUNS_DIR, runId, requestedTarget))
     : requestedTarget
   const lexicalBase = path.resolve(workspaceReal, relativeBase)
+  const callerVisibleBase = path.resolve(workspaceLexical, relativeBase)
   if (!isPathInside(workspaceReal, lexicalBase)) {
     throw new Error('vision-router: artifactsDir must stay inside the session workspace')
   }
@@ -135,6 +137,7 @@ async function resolveArtifactTargetForRun(workspace, artifactsDir, relativePath
   }
 
   const lexicalTarget = path.resolve(lexicalBase, relativeTarget)
+  const callerVisibleTarget = path.resolve(callerVisibleBase, relativeTarget)
   if (!isPathInside(lexicalBase, lexicalTarget)) {
     throw new Error('vision-router: artifact target must stay inside the artifacts directory')
   }
@@ -186,7 +189,7 @@ async function resolveArtifactTargetForRun(workspace, artifactsDir, relativePath
   if (existing?.isDirectory?.()) {
     throw new Error('vision-router: artifact target is a directory')
   }
-  return { target, parentReal, artifactsBaseReal, runsBaseReal, runBaseReal, existing, runId }
+  return { target, callerVisibleTarget, parentReal, artifactsBaseReal, runsBaseReal, runBaseReal, existing, runId }
 }
 
 export function resolveArtifactTarget(workspace, artifactsDir, relativePath, deps = {}) {
@@ -246,7 +249,12 @@ async function writeArtifactFileForRun(workspace, artifactsDir, relativePath, da
       }
       scheduleArtifactRetention(resolved.artifactsBaseReal, { protectRunId: resolved.runId })
     }
-    return resolved.target
+    // Keep canonical paths for containment and atomic I/O, but return the
+    // caller-visible lexical workspace path. On macOS /tmp resolves to
+    // /private/tmp (and real deployments may use symlinked workspaces);
+    // leaking the realpath makes a valid artifact appear outside the session
+    // workspace to downstream path/address code.
+    return resolved.callerVisibleTarget
   } finally {
     if (!published) {
       try { await unlinkImpl(temp) } catch { /* best effort */ }

package/lib/client-host-compat-prelude.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const CLIENT_HOST_COMPAT_MARK = 'data-vision-router-host-compat'
 
@@ -243,19 +243,14 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectClientHostCompatibility(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_HOST_COMPAT_MARK)) return html
-  const safe = CLIENT_HOST_COMPAT_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${CLIENT_HOST_COMPAT_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_HOST_COMPAT_MARK, CLIENT_HOST_COMPAT_PRELUDE)
 }
 
 export function installClientHostCompatibility(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectClientHostCompatibility),
-      'vision-router: client Host compatibility boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_HOST_COMPAT_MARK,
+    prelude: CLIENT_HOST_COMPAT_PRELUDE,
+    label: 'vision-router: client Host compatibility',
+    injectHtml: injectClientHostCompatibility,
   })
 }

package/lib/client-presentation-boundary-main.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const CLIENT_PRESENTATION_MARK = 'data-vision-router-presentation-boundary'
 const VISION_MODE_WRAPPER_SOURCE = 'deepseek-official'
 
@@ -1304,23 +1305,14 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectClientPresentationBoundary(html) {
-  if (typeof html !== 'string' || html.includes(CLIENT_PRESENTATION_MARK)) return html
-  const safe = CLIENT_PRESENTATION_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${CLIENT_PRESENTATION_MARK}>${safe}</script>`
-  // DSH's client-modules index tap prepends the queue-mode loader bootstrap at
-  // <head>. Run after that parser bootstrap so we can wrap both load() and the
-  // later create() transition. The create wrapper re-applies the boundary when
-  // rc.8 replaces loader.load while entering live mode.
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRESENTATION_MARK, CLIENT_PRESENTATION_PRELUDE)
 }
 
 export function installClientPresentationBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectClientPresentationBoundary),
-      'vision-router: client presentation boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRESENTATION_MARK,
+    prelude: CLIENT_PRESENTATION_PRELUDE,
+    label: 'vision-router: client presentation boundary',
+    injectHtml: injectClientPresentationBoundary,
   })
 }

package/lib/client-presentation-boundary.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import {
   CLIENT_PRESENTATION_PRELUDE as BASE_CLIENT_PRESENTATION_PRELUDE,
   resolveVisionModePair,
@@ -187,20 +187,15 @@ export {
 }
 
 export function injectClientPresentationBoundary(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_PRESENTATION_MARK)) return html
-  const safe = CLIENT_PRESENTATION_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${CLIENT_PRESENTATION_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRESENTATION_MARK, CLIENT_PRESENTATION_PRELUDE)
 }
 
 export function installClientPresentationBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectClientPresentationBoundary),
-      'vision-router: client presentation boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRESENTATION_MARK,
+    prelude: CLIENT_PRESENTATION_PRELUDE,
+    label: 'vision-router: client presentation boundary',
+    injectHtml: injectClientPresentationBoundary,
   })
   // Keep Host-version compatibility in its own capability-detected prelude.
   // This lets the large legacy client factory stay byte-stable while alpha/new

package/lib/client-script-carrier.js

@@ -0,0 +1,90 @@
+import { htmlHasScriptMarker } from './html-script-marker.js'
+
+const CARRIER_REGISTRY = '__dshVisionRouterClientCarriers'
+
+function carrierKey(marker) {
+  const value = String(marker || 'vision-router-client-script')
+  return `vr:${value.replace(/^data-vision-router-/, '')}`
+}
+
+/**
+ * Wrap one browser prelude with a shared one-shot fence. Modern served-Web
+ * pages can receive both structured index rows and tapIndex HTML transforms,
+ * while Desktop/static carriers receive only the structured row. The fence
+ * keeps both delivery paths safe without relying on each prelude to implement
+ * its own duplicate-execution semantics.
+ */
+export function clientCarrierSource(marker, prelude) {
+  const key = JSON.stringify(carrierKey(marker))
+  return `(function(){\n  var root = window;\n  var registry = root.${CARRIER_REGISTRY};\n  if (!registry || typeof registry !== 'object') {\n    registry = Object.create(null);\n    try { Object.defineProperty(root, '${CARRIER_REGISTRY}', { value: registry, configurable: true }); }\n    catch (_) { root.${CARRIER_REGISTRY} = registry; }\n  }\n  var key = ${key};\n  if (registry[key]) return;\n  registry[key] = true;\n  try {\n${prelude}\n  } catch (error) {\n    try { delete registry[key]; } catch (_) { registry[key] = false; }\n    throw error;\n  }\n})();`
+}
+
+export function injectClientCarrierHtml(html, marker, prelude) {
+  const structuredMark = `/* ${marker} */`
+  if (typeof html !== 'string' || htmlHasScriptMarker(html, marker) || html.includes(structuredMark)) return html
+  const safe = clientCarrierSource(marker, prelude).replace(/<\/script/gi, '<\\/script')
+  const script = `<script ${marker}>${safe}</script>`
+  const closeHead = html.indexOf('</head>')
+  return closeHead === -1 ? `${html}${script}` : `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
+}
+
+
+export function injectClientStyleHtml(html, marker, css) {
+  if (typeof html !== 'string' || typeof marker !== 'string' || marker === '') return html
+  if (html.includes(`<style ${marker}>`)) return html
+  const style = `<style ${marker}>${String(css || '')}</style>`
+  const closeHead = html.indexOf('</head>')
+  return closeHead === -1 ? `${html}${style}` : `${html.slice(0, closeHead)}${style}${html.slice(closeHead)}`
+}
+
+export function appendStructuredClientStyle(table, marker, css) {
+  if (!Array.isArray(table) || typeof marker !== 'string' || marker === '') return false
+  const signature = `/* ${marker}:style */`
+  if (table.some((row) => row?.kind === 'style' && typeof row.text === 'string' && row.text.includes(signature))) return false
+  table.push({ kind: 'style', placement: 'head', text: `${signature}
+${String(css || '')}` })
+  return true
+}
+
+export function appendStructuredClientCarrier(table, marker, prelude) {
+  if (!Array.isArray(table)) return false
+  const signature = `/* ${marker} */`
+  if (table.some((row) => row?.kind === 'script' && typeof row.text === 'string' && row.text.includes(signature))) {
+    return false
+  }
+  table.push({
+    kind: 'script',
+    placement: 'head',
+    text: `${signature}\n${clientCarrierSource(marker, prelude)}`,
+  })
+  return true
+}
+
+/**
+ * Register the same client prelude on both supported browser carriers:
+ * - structured `webserver/index-inject` rows for Desktop/static shells;
+ * - `tapIndex()` HTML transforms for served-Web and older Hosts.
+ */
+export function installClientScriptCarriers(ctx, { marker, prelude, label, injectHtml, style }) {
+  if (!ctx || typeof ctx.inject !== 'function') return
+  ctx.inject(['webServer'], (webCtx) => {
+    if (typeof webCtx.on === 'function') {
+      webCtx.on('webserver/index-inject', (table) => {
+        if (style) appendStructuredClientStyle(table, style.marker || marker, style.text)
+        appendStructuredClientCarrier(table, marker, prelude)
+      })
+    }
+    if (typeof webCtx.effect === 'function' && webCtx.webServer?.tapIndex) {
+      const baseTransform = typeof injectHtml === 'function'
+        ? injectHtml
+        : (html) => injectClientCarrierHtml(html, marker, prelude)
+      const transform = style
+        ? (html) => baseTransform(injectClientStyleHtml(html, style.marker || marker, style.text))
+        : baseTransform
+      webCtx.effect(
+        () => webCtx.webServer.tapIndex(transform),
+        label,
+      )
+    }
+  })
+}

package/lib/client.js

@@ -230,7 +230,7 @@ window.__ModuleLoader__.load({
       hintRewriteImages: '避免把无法读取的原始图片直接发送给纯文字模型。推荐保持开启。',
       hintDownscale: '超过像素预算的图片先缩放再送视觉模型，降低延迟与成本；默认开启。',
       hintCache: '缓存识图答案（按图片内容 + 问题）；默认开启。',
-      hintLocalOnlyVision: '开启后仅允许回环地址上的本地视觉后端；云端/DSH Provider 与 OVH 免费兜底会被运行时硬阻止。主聊天模型是否联网不受此开关控制。',
+      hintLocalOnlyVision: '开启后仅允许回环地址上的本地视觉后端；云端/DSH Provider 与 OVH 免费兜底会被运行时硬阻止，因此 Vision Router 不会把图片和裁剪发送到云端视觉服务。视觉后端返回的描述、OCR、坐标等识图结果文本仍会交给当前聊天模型；若聊天模型在云端，图片语义仍可能离开本机。严格纯本地还需同时选择本地聊天模型。',
       hintFreeFallback: '当你选择的识图模型都不可用时，自动尝试内置 OVH 免费模型。免注册、免 API Key。',
       hintFreeCloudFirst:
         '默认关闭。开启后，云端后端先尝试内置 OVH 免费模型（免注册、免 API Key），' +
@@ -519,7 +519,7 @@ window.__ModuleLoader__.load({
       hintRewriteImages: 'Prevents raw image content from being sent to a text-only model that cannot read it. Recommended on.',
       hintDownscale: 'Images beyond the pixel budget are resized before the vision call, cutting latency and cost; on by default.',
       hintCache: 'Caches vision answers (keyed by image content + question); on by default.',
-      hintLocalOnlyVision: 'When enabled, only visual backends on loopback addresses may run. Cloud/DSH providers and the OVH free fallback are blocked at runtime. This does not control whether the main chat model is remote.',
+      hintLocalOnlyVision: 'When enabled, only visual backends on loopback addresses may run. Cloud/DSH providers and the OVH free fallback are blocked at runtime, so Vision Router does not send image bytes or crops to cloud vision services. Derived result text—descriptions, OCR, and coordinates—is still passed to the current chat model; if that model is remote, image semantics may still leave this machine. For a strict end-to-end local workflow, select a local chat model too.',
       hintFreeFallback: 'If your selected vision models fail, automatically try the built-in OVH free models. No signup or API key required.',
       hintFreeCloudFirst:
         'Off by default. When enabled, cloud backends try the built-in OVH free models first (no signup, no API key), ' +
@@ -1210,6 +1210,11 @@ window.__ModuleLoader__.load({
       // become local merely because a stale Connection says true.
       const location = locationLike ?? (typeof window !== 'undefined' ? window.location : undefined)
       const hostname = typeof location?.hostname === 'string' ? location.hostname.toLowerCase().replace(/^\[|\]$/g, '') : ''
+      const protocol = typeof location?.protocol === 'string' ? location.protocol.toLowerCase() : ''
+      // The official Desktop shell uses dsh-app://app instead of an HTTP
+      // loopback URL. Trust only that exact scheme/host pair: broad custom-
+      // protocol trust would let an unrelated embedded page gain local UI.
+      if (protocol === 'dsh-app:' && hostname === 'app') return false
       if (hostname !== '') {
         if (hostname === 'localhost' || hostname.endsWith('.localhost') || hostname === '::1') return false
         if (/^127(?:\.\d{1,3}){3}$/.test(hostname)) return false

package/lib/dsh-support-window.js

@@ -6,8 +6,9 @@ export const DSH_SUPPORT_WINDOW = Object.freeze({
 
 export const DSH_VERIFICATION_EVIDENCE = Object.freeze({
   exactStable: '0.1.5-rc.3',
-  exactPreview: '0.1.7-rc.2',
+  exactPreview: '0.2.0-rc.2',
   stableCanaryDistTag: 'latest',
+  nextCanaryDistTag: 'next',
   previewCanaryDistTag: 'alpha',
 })
 
@@ -48,9 +49,10 @@ export function formatDshSupportWindowLines(capabilities = {}) {
     `  support floor: DVR ${DSH_SUPPORT_WINDOW.dvrTrain} -> DSH ${DSH_SUPPORT_WINDOW.minimum}`,
     'DSH compatibility verification evidence:',
     `  exact stable: ${DSH_VERIFICATION_EVIDENCE.exactStable}`,
-    `  exact preview (not a support claim): ${DSH_VERIFICATION_EVIDENCE.exactPreview}`,
+    `  exact next/rc (not a support claim): ${DSH_VERIFICATION_EVIDENCE.exactPreview}`,
     `  scheduled stable canary: npm dist-tag ${DSH_VERIFICATION_EVIDENCE.stableCanaryDistTag}`,
-    `  scheduled preview canary: npm dist-tag ${DSH_VERIFICATION_EVIDENCE.previewCanaryDistTag}`,
+    `  scheduled next/rc canary: npm dist-tag ${DSH_VERIFICATION_EVIDENCE.nextCanaryDistTag}`,
+    `  scheduled alpha/pre-release canary: npm dist-tag ${DSH_VERIFICATION_EVIDENCE.previewCanaryDistTag}`,
     `  upgrade advice: ${advice.level} (${advice.code}) — ${advice.message}`,
   ])
 }

package/lib/guide-vision-toggle-highlight.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const CLIENT_PRELUDE_MARK = 'data-vision-router-guide-toggle-highlight'
 
 export function unionGuideRects(first, second) {
@@ -149,18 +150,14 @@ export const GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectGuideVisionToggleHighlight(html) {
-  if (typeof html !== 'string' || html.includes(CLIENT_PRELUDE_MARK)) return html
-  const script = `<script ${CLIENT_PRELUDE_MARK}>${GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRELUDE_MARK, GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE)
 }
 
 export function installGuideVisionToggleHighlight(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectGuideVisionToggleHighlight),
-      'vision-router: onboarding vision-toggle spotlight',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRELUDE_MARK,
+    prelude: GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE,
+    label: 'vision-router: guide Vision toggle highlight',
+    injectHtml: injectGuideVisionToggleHighlight,
   })
 }

package/lib/live-model-client-prelude.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import { htmlHasScriptMarker } from './html-script-marker.js'
 
 const CLIENT_PRELUDE_MARK = 'data-vision-router-live-models'
@@ -588,22 +589,14 @@ export const LIVE_MODEL_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectLiveModelClientPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_PRELUDE_MARK)) return html
-  const script = `<script ${CLIENT_PRELUDE_MARK}>${LIVE_MODEL_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  // DSH's client-modules index tap prepends its queue-mode facade immediately
-  // after <head>. Run after that parser bootstrap so we can wrap both load()
-  // and create(); the create wrapper then re-attaches us after rc.8 swaps in
-  // its live registration sink, before lazy third-party bundles arrive.
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRELUDE_MARK, LIVE_MODEL_CLIENT_PRELUDE)
 }
 
 export function installLiveModelClientPrelude(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectLiveModelClientPrelude),
-      'vision-router: live model client prelude',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRELUDE_MARK,
+    prelude: LIVE_MODEL_CLIENT_PRELUDE,
+    label: 'vision-router: live model client prelude',
+    injectHtml: injectLiveModelClientPrelude,
   })
 }

package/lib/live-model-discovery.js

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto'
+import { createHash, randomUUID } from 'node:crypto'
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import process from 'node:process'
@@ -151,7 +151,7 @@ async function loadCache(file, fsOps) {
 
 async function saveCache(file, providers, fsOps) {
   const directory = path.dirname(file)
-  const temporary = `${file}.${process.pid}.${Date.now()}.tmp`
+  const temporary = `${file}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`
   await fsOps.mkdir(directory, { recursive: true })
   const entries = [...providers.values()]
     .filter((entry) => entry && entry.routeMismatch !== true)

package/lib/local-remote-settings-permission.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import { isLocalUiRequest } from './web-capability-boundary.js'
 
 const SETTINGS_NS = 'vision-router'
@@ -437,10 +437,7 @@ export const LOCAL_PERMISSION_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectLocalPermissionClientPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, LOCAL_PERMISSION_PRELUDE_MARK)) return html
-  const script = `<script ${LOCAL_PERMISSION_PRELUDE_MARK}>${LOCAL_PERMISSION_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const endHead = html.indexOf('</head>')
-  return endHead === -1 ? `${html}${script}` : `${html.slice(0, endHead)}${script}${html.slice(endHead)}`
+  return injectClientCarrierHtml(html, LOCAL_PERMISSION_PRELUDE_MARK, LOCAL_PERMISSION_CLIENT_PRELUDE)
 }
 
 export function installLocalRemoteSettingsPermissionBridge(ctx, logger) {
@@ -456,9 +453,11 @@ export function installLocalRemoteSettingsPermissionBridge(ctx, logger) {
       }),
       'vision-router: loopback remote-settings permission mutation',
     )
-    localCtx.effect(
-      () => localCtx.webServer.tapIndex(injectLocalPermissionClientPrelude),
-      'vision-router: local settings permission client shim',
-    )
+  })
+  installClientScriptCarriers(ctx, {
+    marker: LOCAL_PERMISSION_PRELUDE_MARK,
+    prelude: LOCAL_PERMISSION_CLIENT_PRELUDE,
+    label: 'vision-router: local settings permission client shim',
+    injectHtml: injectLocalPermissionClientPrelude,
   })
 }