dsh-vision-router 2.2.6 → 2.2.8

package/lib/vision-capability-benchmark-client.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const CLIENT_MARK = 'data-vision-router-capability-benchmark'
 
@@ -412,17 +412,14 @@ export const CAPABILITY_BENCHMARK_CLIENT = String.raw`(function(){
 })();`
 
 export function injectCapabilityBenchmarkClient(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_MARK)) return html
-  const script = `<script ${CLIENT_MARK}>${CAPABILITY_BENCHMARK_CLIENT.replace(/<\/script/gi, '<\\/script')}</script>`
-  const head = html.indexOf('<head>')
-  return head === -1 ? `${script}${html}` : `${html.slice(0, head + 6)}${script}${html.slice(head + 6)}`
+  return injectClientCarrierHtml(html, CLIENT_MARK, CAPABILITY_BENCHMARK_CLIENT)
 }
 
 export function installCapabilityBenchmarkClient(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectCapabilityBenchmarkClient),
-      'vision-router: capability benchmark Host presentation client controls',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_MARK,
+    prelude: CAPABILITY_BENCHMARK_CLIENT,
+    label: 'vision-router: capability benchmark client',
+    injectHtml: injectCapabilityBenchmarkClient,
   })
 }

package/lib/vision-capability-probe.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto'
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import process from 'node:process'
@@ -374,7 +375,7 @@ async function loadCache(file, fsOps, maxEntries) {
 
 async function saveCache(file, records, fsOps, maxEntries) {
   const directory = path.dirname(file)
-  const temporary = `${file}.${process.pid}.${Date.now()}.tmp`
+  const temporary = `${file}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`
   const profiles = selectRetainedCapabilityProfiles(records.values(), maxEntries)
   await fsOps.mkdir(directory, { recursive: true })
   await fsOps.writeFile(temporary, JSON.stringify(cacheEnvelope(profiles)), { encoding: 'utf8', mode: 0o600 })

package/lib/vision-exact-check-client.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const CLIENT_MARK = 'data-vision-router-exact-check'
 
@@ -19,8 +19,8 @@ export const VISION_EXACT_CHECK_CLIENT = String.raw`(function(){
   function text(cn,en){ return zh() ? cn : en; }
   function localPage(){
     try {
-      var host=String(window.location.hostname||'').toLowerCase();
-      return host==='localhost'||host.endsWith('.localhost')||host==='::1'||host==='[::1]'||/^127(?:\.\d{1,3}){3}$/.test(host);
+      var location=window.location||{},host=String(location.hostname||'').toLowerCase(),protocol=String(location.protocol||'').toLowerCase();
+      return (protocol==='dsh-app:'&&host==='app')||host==='localhost'||host.endsWith('.localhost')||host==='::1'||host==='[::1]'||/^127(?:\.\d{1,3}){3}$/.test(host);
     } catch (_) { return false; }
   }
   function rowSelection(row){
@@ -185,9 +185,14 @@ export const VISION_EXACT_CHECK_CLIENT = String.raw`(function(){
 })();`
 
 export function injectVisionExactCheckClient(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_MARK)) return html
-  const script = `<script ${CLIENT_MARK}>${VISION_EXACT_CHECK_CLIENT.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_MARK, VISION_EXACT_CHECK_CLIENT)
+}
+
+export function installVisionExactCheckClient(ctx) {
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_MARK,
+    prelude: VISION_EXACT_CHECK_CLIENT,
+    label: 'vision-router: exact image check product control',
+    injectHtml: injectVisionExactCheckClient,
+  })
 }

package/lib/vision-image-input-verdict.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto'
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
 import path from 'node:path'
 import process from 'node:process'
@@ -69,7 +70,7 @@ async function load(file, fsOps) {
 }
 
 async function save(file, records, fsOps) {
-  const temporary = `${file}.${process.pid}.${Date.now()}.tmp`
+  const temporary = `${file}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`
   const verdicts = selectRetainedVerdicts(records.values())
   await fsOps.mkdir(path.dirname(file), { recursive: true })
   await fsOps.writeFile(temporary, JSON.stringify({ version: CACHE_VERSION, verdicts }), { encoding: 'utf8', mode: 0o600 })

package/lib/vision-model-visibility-boundary-main.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const VISION_MODE_WRAPPER_SOURCE = 'deepseek-official'
 const DEFAULT_WRAPPER_ROUTE = 'deepseek-vision'
 const MODEL_SELECTION_TARGET = '@deepseek-ai/dsh-client-ui-model-selection'
@@ -454,19 +455,14 @@ export const VISION_MODEL_VISIBILITY_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectVisionModelVisibilityBoundary(html) {
-  if (typeof html !== 'string' || html.includes(VISIBILITY_MARK)) return html
-  const safe = VISION_MODEL_VISIBILITY_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${VISIBILITY_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, VISIBILITY_MARK, VISION_MODEL_VISIBILITY_PRELUDE)
 }
 
 export function installVisionModelVisibilityBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionModelVisibilityBoundary),
-      'vision-router: model visibility boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: VISIBILITY_MARK,
+    prelude: VISION_MODEL_VISIBILITY_PRELUDE,
+    label: 'vision-router: model visibility boundary',
+    injectHtml: injectVisionModelVisibilityBoundary,
   })
 }

package/lib/vision-model-visibility-boundary.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import { VISION_MODEL_VISIBILITY_PRELUDE } from './vision-model-visibility-boundary-main.js'
 
 const VISIBILITY_MARK = 'data-vision-router-model-visibility-boundary'
@@ -10,19 +10,14 @@ export {
 } from './vision-model-visibility-boundary-main.js'
 
 export function injectVisionModelVisibilityBoundary(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, VISIBILITY_MARK)) return html
-  const safe = VISION_MODEL_VISIBILITY_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${VISIBILITY_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, VISIBILITY_MARK, VISION_MODEL_VISIBILITY_PRELUDE)
 }
 
 export function installVisionModelVisibilityBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionModelVisibilityBoundary),
-      'vision-router: model visibility boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: VISIBILITY_MARK,
+    prelude: VISION_MODEL_VISIBILITY_PRELUDE,
+    label: 'vision-router: model visibility boundary',
+    injectHtml: injectVisionModelVisibilityBoundary,
   })
 }

package/lib/vision-routing-settings-prelude.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const ROUTING_SETTINGS_PRELUDE_MARK = 'data-vision-router-routing-settings'
 
@@ -536,18 +536,14 @@ export const VISION_ROUTING_SETTINGS_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectVisionRoutingSettingsPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, ROUTING_SETTINGS_PRELUDE_MARK)) return html
-  const script = `<script ${ROUTING_SETTINGS_PRELUDE_MARK}>${VISION_ROUTING_SETTINGS_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, ROUTING_SETTINGS_PRELUDE_MARK, VISION_ROUTING_SETTINGS_PRELUDE)
 }
 
 export function installVisionRoutingSettingsPrelude(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionRoutingSettingsPrelude),
-      'vision-router: v2 routing settings product panel',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: ROUTING_SETTINGS_PRELUDE_MARK,
+    prelude: VISION_ROUTING_SETTINGS_PRELUDE,
+    label: 'vision-router: Vision routing Settings prelude',
+    injectHtml: injectVisionRoutingSettingsPrelude,
   })
 }

package/lib/vision-toggle-root-hardening.js

@@ -331,9 +331,9 @@ function replaceAll(source, before, after) {
   return source.includes(before) ? source.split(before).join(after) : source
 }
 
-export function hardenVisionToggleHtml(html) {
-  if (typeof html !== 'string') return html
-  let next = html
+export function hardenVisionClientSource(source) {
+  if (typeof source !== 'string') return source
+  let next = source
 
   next = replaceAll(
     next,
@@ -430,6 +430,13 @@ export function hardenVisionToggleHtml(html) {
     `    var hardening = window.__dshVisionRouterRootHardening;\n    var recovery = hardening ? hardening.recoveryFor(directory) : undefined;\n    var store = wrapStore(directory.store, settings, recovery);`,
   )
 
+  return next
+}
+
+export function hardenVisionToggleHtml(html) {
+  if (typeof html !== 'string') return html
+  let next = hardenVisionClientSource(html)
+
   if (!next.includes(OWNERSHIP_MARK)) {
     const safe = CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')
     const script = `<script ${OWNERSHIP_MARK}>${safe}</script>`
@@ -474,6 +481,24 @@ export function createVisionToggleRootHardening(ctx, config = {}) {
           }),
           'vision-router: route ownership',
         )
+        if (typeof webCtx.on === 'function') {
+          webCtx.on('webserver/index-inject', (table) => {
+            if (!Array.isArray(table)) return
+            for (const row of table) {
+              if (row?.kind === 'script' && typeof row.text === 'string') {
+                row.text = hardenVisionClientSource(row.text)
+              }
+            }
+            const signature = `/* ${OWNERSHIP_MARK} */`
+            if (!table.some((row) => row?.kind === 'script' && typeof row.text === 'string' && row.text.includes(signature))) {
+              table.push({
+                kind: 'script',
+                placement: 'head',
+                text: `${signature}\n${CLIENT_PRELUDE}`,
+              })
+            }
+          })
+        }
         webCtx.effect(
           () => webCtx.webServer.tapIndex(hardenVisionToggleHtml),
           'vision-router: vision toggle root hardening',

package/lib/vision-turn-budget-client-prelude.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const CLIENT_PRELUDE_MARK = 'data-vision-router-turn-budget'
 
 export const VISION_TURN_BUDGET_CLIENT_PRELUDE = String.raw`(function(){
@@ -259,18 +260,14 @@ export const VISION_TURN_BUDGET_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectVisionTurnBudgetClientPrelude(html) {
-  if (typeof html !== 'string' || html.includes(CLIENT_PRELUDE_MARK)) return html
-  const script = `<script ${CLIENT_PRELUDE_MARK}>${VISION_TURN_BUDGET_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRELUDE_MARK, VISION_TURN_BUDGET_CLIENT_PRELUDE)
 }
 
 export function installVisionTurnBudgetClientPrelude(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionTurnBudgetClientPrelude),
-      'vision-router: turn budget client prelude',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRELUDE_MARK,
+    prelude: VISION_TURN_BUDGET_CLIENT_PRELUDE,
+    label: 'vision-router: turn budget client prelude',
+    injectHtml: injectVisionTurnBudgetClientPrelude,
   })
 }

package/lib/web/remote-settings-client.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from '../html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from '../client-script-carrier.js'
 import { installVisionRouterRemoteSettingsBridge } from '../remote-settings-bridge.js'
 import { installSettingsRc8ClientLifecycle } from '../settings-client-rc8-lifecycle.js'
 
@@ -34,6 +34,10 @@ export const SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE = String.raw`(function(){
     var hostname = locationLike && typeof locationLike.hostname === 'string'
       ? locationLike.hostname.toLowerCase().replace(/^\[|\]$/g, '')
       : '';
+    var protocol = locationLike && typeof locationLike.protocol === 'string'
+      ? locationLike.protocol.toLowerCase()
+      : '';
+    if (protocol === 'dsh-app:' && hostname === 'app') return true;
     if (hostname === 'localhost' || hostname.endsWith('.localhost') || hostname === '::1') return true;
     return /^127(?:\.\d{1,3}){3}$/.test(hostname);
   }
@@ -183,20 +187,15 @@ export const SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectSettingsConfigFormsCompatPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, SETTINGS_CONFIG_FORMS_MARK)) return html
-  const safe = SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${SETTINGS_CONFIG_FORMS_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  return closeHead === -1 ? `${html}${script}` : `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
+  return injectClientCarrierHtml(html, SETTINGS_CONFIG_FORMS_MARK, SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE)
 }
 
 export function installSettingsConfigFormsCompat(ctx) {
-  if (!ctx || typeof ctx.inject !== 'function') return
-  ctx.inject(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectSettingsConfigFormsCompatPrelude),
-      'vision-router: settings configForms compatibility',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: SETTINGS_CONFIG_FORMS_MARK,
+    prelude: SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE,
+    label: 'vision-router: settings configForms compatibility',
+    injectHtml: injectSettingsConfigFormsCompatPrelude,
   })
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vision-router",
-  "version": "2.2.6",
+  "version": "2.2.8",
   "description": "Eyes for text-only DeepSeek Harness agents: built-in free vision chain + pixel-level tools. Remote vision providers, including the default free fallback, receive image content unless strict local-only use is configured.",
   "license": "MIT",
   "repository": {
@@ -70,7 +70,7 @@
     "sharp": "^0.35.4"
   },
   "scripts": {
-    "test": "node --test tests/index-modularization.test.js tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/issue-374-delegated-call-config.test.js tests/grounding-coordinate-frame.test.js tests/grounding-coordinate-runtime.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/degraded-local-evidence.test.js tests/vision-resilience-lifecycle.test.js tests/vision-breaker-readonly.test.js tests/alpha1-browser-lifecycle-integration.test.js tests/issue-367-remote-session-inject.test.js tests/vision-mode-toggle-injection.test.js tests/client.test.js tests/issue-307-regression.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/clipboard-image-paste-compat.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/release-registry-identity.test.js tests/update-check.test.js tests/update-check-signal-lifecycle.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/session-repair-v2.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/official-deepseek-catalog.test.js tests/replay-delegation.test.js tests/twin-image-capability-fallback.test.js tests/twin-image-custom-wrapper.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/vision-model-guidance-contract.test.js tests/local-ollama.test.js tests/local-only-vision.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/issue-512-tool-restriction.test.js tests/pi-ai-bridge-wire-compat.test.js tests/fetch-wrapper-lifecycle.test.js tests/fetch-wrapper-composition.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/security-resource-boundaries.test.js tests/security-property-fuzz.test.js tests/security-adversarial-fuzz-contract.test.js tests/runtime-i18n.test.js tests/long-ocr-empty-retry.test.js tests/tesseract-adaptive-ocr.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/session-vision-event-feed.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-lifecycle.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/settings-native-card-semantics.test.js tests/settings-native-card-lazy-data.test.js tests/settings-invalid-staged-dirty.test.js tests/vision-toggle-root-hardening.test.js && node --test tests/vision-backend-runtime-policy.test.js",
+    "test": "node --test tests/index-modularization.test.js tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/issue-374-delegated-call-config.test.js tests/grounding-coordinate-frame.test.js tests/grounding-coordinate-runtime.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/cache-atomic-write-concurrency.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/degraded-local-evidence.test.js tests/vision-resilience-lifecycle.test.js tests/vision-breaker-readonly.test.js tests/alpha1-browser-lifecycle-integration.test.js tests/issue-367-remote-session-inject.test.js tests/vision-mode-toggle-injection.test.js tests/client.test.js tests/issue-307-regression.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/clipboard-image-paste-compat.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/rc6-real-settings-persistence.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/release-registry-identity.test.js tests/update-check.test.js tests/update-check-signal-lifecycle.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/session-repair-v2.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/official-deepseek-catalog.test.js tests/replay-delegation.test.js tests/twin-image-capability-fallback.test.js tests/twin-image-custom-wrapper.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/vision-model-guidance-contract.test.js tests/local-ollama.test.js tests/local-only-vision.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/android-attachment-compat.test.js tests/free-cloud-first.test.js tests/rc6-rc7-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/issue-512-tool-restriction.test.js tests/pi-ai-bridge-wire-compat.test.js tests/fetch-wrapper-lifecycle.test.js tests/fetch-wrapper-composition.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/security-resource-boundaries.test.js tests/security-property-fuzz.test.js tests/security-adversarial-fuzz-contract.test.js tests/runtime-i18n.test.js tests/long-ocr-empty-retry.test.js tests/tesseract-adaptive-ocr.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/session-vision-event-feed.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-lifecycle.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/settings-native-card-semantics.test.js tests/settings-native-card-lazy-data.test.js tests/settings-invalid-staged-dirty.test.js tests/vision-toggle-root-hardening.test.js && node --test tests/vision-backend-runtime-policy.test.js",
     "test:core": "node --test tests/core.test.js tests/degraded-local-evidence.test.js tests/runtime-e2e.test.js tests/structured-bootstrap.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-execution-policy.test.js tests/vision-backend-runtime-policy.test.js",
     "test:routing": "node --test tests/issue-374-delegated-call-config.test.js tests/twin-image-capability-fallback.test.js tests/twin-image-custom-wrapper.test.js tests/vision-routing-product.test.js tests/vision-capability-router.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow-health.test.js tests/vision-runtime-performance.test.js tests/vision-background-benchmark.test.js tests/vision-image-input-verdict.test.js",
     "test:session": "node --test tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/replay-delegation.test.js tests/legacy-session-repair.test.js tests/session-repair-v2.test.js tests/issue-276-session-image-ownership.test.js",
@@ -88,9 +88,6 @@
     "quality:round2:run": "node quality/vision-round2/run-host-api.mjs",
     "quality:round2:report": "node quality/vision-round2/report-results.mjs"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": ["sharp"]
-  },
   "dsh": {
     "client": {
       "platform": "web",