dsh-vision-router 2.2.7 → 2.2.8

package/README.md

@@ -375,7 +375,7 @@ Everything is optional; defaults work out of the box. Prefer **Settings → Visi
 | `tool` / `progressiveTools` / `autoActivateOnImage` | `true` / `false` / `true` | vision tools on / progressive mounting (off by default for a stable tool schema) / image-turn auto-mount when progressive mode is enabled; `progressiveTools` is boot-time config |
 | `rewriteImages` | `true` | rewrite image blocks in the model input (cached description or tool-hint marker); the UI log keeps images |
 | `desktopScreenshot` | `false` | privacy opt-in for the model-callable `vision_screenshot` desktop-capture tool; checked live before every capture |
-| `localOnlyVision` | `false` | runtime privacy policy: when enabled, only loopback vision endpoints may execute; cloud/DSH providers and the built-in OVH fallback stay saved but are fail-closed |
+| `localOnlyVision` | `false` | visual-endpoint privacy policy: only loopback vision endpoints may execute, so Vision Router keeps image bytes/crops off cloud vision services; derived result text (descriptions, OCR, coordinates) still goes to the current chat model, so strict end-to-end local use also requires a local chat model |
 | `freeFallback` | `true` | append the anonymous OVH models after explicit local/custom HTTP backends; ignored while `localOnlyVision` is enabled |
 | `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | local vision backend; OpenAI mode disables supported model reasoning by default so the output budget is spent on answer text |
 | `localLmStudio` | `{ enabled: false, baseURL: 'http://localhost:1234/v1', model: '', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | local LM Studio backend after Ollama; LM Studio 0.4+ can use `format: 'lmstudio'` for documented native reasoning control |
@@ -436,7 +436,7 @@ ollama pull qwen2.5vl
 ## Requirements
 
 - DeepSeek Harness Web profile. Normal installs can use `npx @deepseek-ai/dsh ...`; source checkouts use `pnpm dsh ...`. A bare `dsh ...` command only works when the CLI is already on your shell `PATH`.
-- **DSH Host support policy:** DVR 2.2.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.3`. The DSH `0.2.x` train is peer-admitted from the verified `0.2.0-rc.1` boundary (`>=0.2.0-rc.1 <0.3.0-0`); exact `0.2.0-rc.1` (`next`) source, real Host, Windows Desktop, multi-plugin, Settings, mixed-attachment, bundle-recompose, and Host-Sharp gates are preview verification evidence, not a support-floor increase. The final stable `0.2.0` tag and signed Desktop artifact will still be revalidated when published. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
+- **DSH Host support policy:** DVR 2.2.x keeps DSH `0.1.0-rc.8` as the public minimum and currently supports the released stable channel through `0.1.5-rc.3`. The DSH `0.2.x` train is peer-admitted from the verified `0.2.0-rc.1` boundary (`>=0.2.0-rc.1 <0.3.0-0`); exact `0.2.0-rc.2` (`next/rc`) source, real Host, Windows Desktop, multi-plugin, Settings, mixed-attachment, bundle-recompose, and Host-Sharp gates are preview verification evidence, not a support-floor increase. The final stable `0.2.0` tag and signed Desktop artifact will still be revalidated when published. DVR 2.0.x was the final train with public support for rc.6/rc.7. See [DSH Host support window](docs/architecture/dsh-support-window.md).
 - Node ≥ 22 (host side).
 - No API key for the default free chain; a credential reference (`apiKeyEnv`) only for paid `httpProviders`.
 - Chrome / Chromium / Edge is needed only for `vision_html_screenshot`; every other tool works without a browser.

package/README.zh.md

@@ -373,7 +373,7 @@ Web profile 现在提供一级 **设置 → Vision Router** 页面。常规页
 | `tool` / `progressiveTools` / `autoActivateOnImage` | `true` / `false` / `true` | 视觉工具总开关 / 渐进式挂载（默认关闭以稳定工具 schema）/ 渐进模式下图片轮自动挂载；`progressiveTools` 为启动期配置 |
 | `rewriteImages` | `true` | 模型输入层改写图片块（缓存描述或工具提示标记）；界面日志保留图片 |
 | `desktopScreenshot` | `false` | 模型可调用的 `vision_screenshot` 桌面截屏隐私开关；每次截屏前实时检查 |
-| `localOnlyVision` | `false` | 运行时隐私策略：开启后只有回环地址上的视觉端点可执行；云端/DSH Provider 与内置 OVH 兜底保留配置但 fail closed |
+| `localOnlyVision` | `false` | 视觉端点隐私策略：只有回环地址上的视觉端点可执行，Vision Router 不会把图片/裁剪发给云端视觉服务；描述、OCR、坐标等识图结果文本仍会交给当前聊天模型，因此严格端到端纯本地还需同时使用本地聊天模型 |
 | `freeFallback` | `true` | 在显式本地/自定义 HTTP 后端之后追加匿名 OVH 模型；`localOnlyVision` 开启期间不会执行 |
 | `localOllama` | `{ enabled: false, baseURL: 'http://127.0.0.1:11434/v1', model: 'qwen2.5vl', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | 本地视觉后端；OpenAI 模式默认关闭受支持模型的推理，把输出预算留给正文 |
 | `localLmStudio` | `{ enabled: false, baseURL: 'http://localhost:1234/v1', model: '', format: 'openai', maxTokens: 4096, reasoningEffort: 'none' }` | Ollama 之后的本地 LM Studio 后端；LM Studio 0.4+ 可选 `format: 'lmstudio'` 使用官方原生推理控制 |
@@ -434,7 +434,7 @@ ollama pull qwen2.5vl
 ## 环境要求
 
 - DeepSeek Harness 的 Web profile。普通安装可用 `npx @deepseek-ai/dsh ...`；从源码仓库运行时用 `pnpm dsh ...`。只有 CLI 已经进入系统 `PATH` 时才能直接写 `dsh ...`。
-- **DSH Host 支持策略：** DVR 2.2.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前稳定通道已验证并支持到 `0.1.5-rc.3`。DSH `0.2.x` 从已验证的 `0.2.0-rc.1` 边界开始准入（`>=0.2.0-rc.1 <0.3.0-0`）；精确 `0.2.0-rc.1`（`next`）源码、真实 Host、Windows Desktop、多插件、Settings、混合附件、bundle 重组及 Host-Sharp 门禁仅作为预览验证证据，不抬高公开支持下限。上游正式发布稳定版 `0.2.0` tag 和签名 Desktop 安装包后仍会立即复验。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
+- **DSH Host 支持策略：** DVR 2.2.x 的公开最低 Host 仍为 DSH `0.1.0-rc.8`，当前稳定通道已验证并支持到 `0.1.5-rc.3`。DSH `0.2.x` 从已验证的 `0.2.0-rc.1` 边界开始准入（`>=0.2.0-rc.1 <0.3.0-0`）；精确 `0.2.0-rc.2`（`next/rc`）源码、真实 Host、Windows Desktop、多插件、Settings、混合附件、bundle 重组及 Host-Sharp 门禁仅作为预览验证证据，不抬高公开支持下限。上游正式发布稳定版 `0.2.0` tag 和签名 Desktop 安装包后仍会立即复验。DVR 2.0.x 是最后公开支持 rc.6/rc.7 的版本线。详见 [DSH Host 支持窗口](docs/architecture/dsh-support-window.md)。
 - Node ≥ 22（宿主侧）。
 - 默认免费链路无需 API Key；付费 `httpProviders` 只需一个凭据引用（`apiKeyEnv`）。
 - 只有 `vision_html_screenshot` 需要 Chrome / Chromium / Edge；其余工具无浏览器也能用。

package/docs/architecture/dsh-020-rc2-adaptation.md

@@ -0,0 +1,23 @@
+# DSH 0.2.0-rc.2 compatibility audit
+
+- Channel: next/rc (kept distinct from stable and alpha/pre-release)
+- Upstream tag: `dsh-v0.2.0-rc.2`
+- Upstream commit: `639ed015397290b3745d163aafe02ffee4aa3f84`
+- Published: 2026-09-29 09:21:31 UTC
+- Comparison baseline: `dsh-v0.2.0-rc.1` at `4878cdabd87d4041bdaff61d04c966883b9fd07a`
+
+## Seam review
+
+| Area | rc.1 → rc.2 finding | DVR action |
+| --- | --- | --- |
+| Host / Desktop | Desktop now ships a bundled CLI entry, command installation management, login-shell environment import, and Windows console signal bridging. Existing Web profile plugin injection remains available. | Re-run exact-source on Windows/macOS/Linux plus Windows Desktop on Node 22 and 24. |
+| Session | Session controller source is unchanged; its package version advances only. New timed user-question persistence is additive outside DVR's session image ownership seam. | Retain session/adversarial regressions and real Host lifecycle checks. |
+| Settings | Settings controller source is unchanged. Web preset/default and Creator controls are no longer gated by Coding Tools. | Re-run Settings mount/save/reload/readback in real Chromium; no compatibility shim added. |
+| bundle | Published bundle package sources are unchanged apart from versions. Desktop/Host bundles become more self-contained for CLI launch. | Re-run bundle recomposition and cache-manifest validation. |
+| web/client | Model picker search, shortcut modal caching, preset Settings behavior, and long-session rendering changed. | Re-run Vision toggle, mixed attachments, Settings, and client/browser contract suites. |
+| model / attachment | Attachment package sources are unchanged; model-facing work is UI/search and pi-ai/Mistral compatibility. | Re-run mixed-attachment and provider wire contracts. |
+| service injection | API Remotes adds the user-question remote; Gateway adds additive `hasLiveClient()`. DVR's declared injected services and Host-owned proxy authority are unchanged. | Re-run injection, proxy-egress, multi-plugin ordering, and Host-Sharp contracts. |
+
+## Policy
+
+The public minimum Host remains DSH `0.1.0-rc.8`. The current stable evidence remains `0.1.5-rc.3`. The peer range remains `>=0.2.0-rc.1 <0.3.0-0`; rc.2 advances exact next/rc verification evidence and does not widen the range or turn preview evidence into a stable support claim.

package/docs/architecture/dsh-compatibility-matrix.md

@@ -12,7 +12,7 @@ The matrix is capability-based. Runtime code must feature-detect the seam it nee
 | `legacy-contract` | `0.1.0-rc.8` | Public support-floor fixture carrying batch attachments and dimension policy. |
 | `current-contract` | `0.1.5-rc.3` | Current stable Host contract baseline. Must remain green. |
 | `preview-contract` | `0.1.7-rc.2` | Retained predecessor-preview regression fixture. |
-| `DSH 0.2.0-rc.1 validation` | `0.2.0-rc.1` (`next`) | Current exact next/rc evidence; not a public preview-support claim. |
+| `DSH 0.2.0-rc.2 validation` | `0.2.0-rc.2` (`next/rc`) | Current exact next/rc evidence; not a public preview-support claim. |
 | retained preview regression | `0.1.5-alpha.2` | Older preview regression fixture retained as an older preview regression while the 0.1.7 next line is qualified. |
 | release-channel canary | npm `latest` / `next` / `alpha` | Separately labelled stable, next/rc, and alpha/pre-release drift surveillance. Never changes support policy by itself. |
 

package/docs/architecture/dsh-support-window.md

@@ -19,7 +19,7 @@ No later support-floor increase is currently announced.
 
 ### DSH 0.2.x forward admission
 
-DVR 2.2.x peer-admits the DSH `0.2.x` train from the verified rc.1 boundary (`>=0.2.0-rc.1 <0.3.0-0`) without raising the `0.1.0-rc.8` minimum Host floor. Initial forward admission was backed by public pre-0.2.0 master `21638c56315ae6a2b552d6091945d3144c9af32e`. Exact release evidence has now advanced to immutable `dsh-v0.2.0-rc.1` commit `4878cdabd87d4041bdaff61d04c966883b9fd07a`, published on 2026-09-28. Required gates cover three-OS source contracts, real Host + Chromium, Settings mount/save/reload/readback, mixed attachments, bundle recomposition, Windows Node 22/24 Desktop authentication, the Node 24 multi-plugin isolation adversary, and Host-owned Sharp resolution.
+DVR 2.2.x peer-admits the DSH `0.2.x` train from the verified rc.1 boundary (`>=0.2.0-rc.1 <0.3.0-0`) without raising the `0.1.0-rc.8` minimum Host floor. Initial forward admission was backed by public pre-0.2.0 master `21638c56315ae6a2b552d6091945d3144c9af32e`. Exact release evidence has now advanced to immutable `dsh-v0.2.0-rc.2` commit `639ed015397290b3745d163aafe02ffee4aa3f84`, published on 2026-09-29. Required gates cover three-OS source contracts, real Host + Chromium, Settings mount/save/reload/readback, mixed attachments, bundle recomposition, Windows Node 22/24 Desktop authentication, the Node 24 multi-plugin isolation adversary, and Host-owned Sharp resolution.
 
 The final immutable upstream `0.2.0` stable tag and signed official Desktop installer remain release-time revalidation targets. The rc.1 evidence is next-channel verification, not a preview support promise and not a support-floor increase.
 
@@ -30,7 +30,7 @@ Compatibility evidence answers a different question: what exact upstream release
 | Evidence role | DSH source | Meaning |
 |---|---|---|
 | Exact stable evidence | `0.1.5-rc.3` | Required Host/wire and real Host + Chromium coverage for the current stable release. |
-| Exact next/rc evidence | `0.2.0-rc.1` (`next`) | Required Host/wire/lifecycle/browser evidence. This is not a preview support promise. |
+| Exact next/rc evidence | `0.2.0-rc.2` (`next/rc`) | Required Host/wire/lifecycle/browser evidence. This is not a preview support promise. |
 | Stable drift canary | npm dist-tag `latest` | Scheduled, dynamically resolved surveillance. A failure starts compatibility investigation; it does not rewrite support policy. |
 | Next/rc drift canary | npm dist-tag `next` | Scheduled, dynamically resolved surveillance for the rc channel. A failure does not rewrite support policy. |
 | Alpha/pre-release drift canary | npm dist-tag `alpha` | Scheduled, dynamically resolved surveillance for the alpha channel. A failure does not rewrite support policy. |
@@ -76,3 +76,5 @@ DVR must not turn these tables into widespread version-string conditionals. Runt
 ## Compatibility-retirement rule
 
 The 2.1.x floor makes rc.6-only compatibility candidates eligible for a fresh deletion audit, but does not automatically authorize deletion. Durable session formats, replay envelopes, adapter wire shapes, and other historical inputs may outlive the Host version that originally produced them.
+
+See [DSH 0.2.0-rc.2 compatibility audit](dsh-020-rc2-adaptation.md) for the upstream seam review and validation plan.

package/docs/architecture/host-first-proxy-convergence.md

@@ -50,7 +50,7 @@ H1 is complete as an egress contract, not as a new production dependency. Exact
 4. The same contract runs against the exact current stable Host and exact preview evidence on Linux, macOS, and Windows through the existing source-contract matrix.
 5. Production code contains no `@deepseek-ai/dsh-http-proxy` dependency or import. `proxyRouteFor()` is used only by the exact-source test as an oracle for the Host decision.
 
-The current stable evidence remains DSH `0.1.5-rc.3`; `0.1.5-rc.1` / `0.1.5-rc.2` remain explicitly peer-admitted, exact next/rc evidence is `0.2.0-rc.1`, and the public minimum remains `0.1.0-rc.8`.
+The current stable evidence remains DSH `0.1.5-rc.3`; `0.1.5-rc.1` / `0.1.5-rc.2` remain explicitly peer-admitted, exact next/rc evidence is `0.2.0-rc.2`, and the public minimum remains `0.1.0-rc.8`.
 
 ## H2 — Scope Host-owned override authority
 

package/docs/releases/v2.2.8.md

@@ -0,0 +1,25 @@
+# v2.2.8
+
+DSH Vision Router 2.2.8 is a Desktop compatibility and lifecycle reliability patch. It restores conversation-side Vision UI injection in the official static-shell Desktop, prevents stale Vision tool restrictions from surviving plugin reloads, adds real Electron end-to-end coverage on Windows and macOS, hardens DSH build-cache completeness and test diagnostics, clarifies the `localOnlyVision` privacy boundary, and advances exact preview verification to DSH `0.2.0-rc.2` without changing the public Host support floor.
+
+## Highlights
+
+- **Official Desktop conversation injection (#597):** browser-side client preludes now use one capability-detected carrier that publishes structured `webserver/index-inject` rows for the official Desktop shell while retaining `tapIndex()` as the older/Web fallback. The Vision toggle and related client boundaries no longer depend on HTTP-served HTML to appear.
+- **Vision tool lifecycle fix (#597):** Session tool restrictions installed while Vision mode is off are explicitly released when the plugin boundary is disposed. A surviving Agent can no longer inherit an orphaned restriction from an older plugin/HMR instance and keep `vision_describe` and the rest of the DVR tool surface hidden after Vision is re-enabled.
+- **Real Desktop functional gates (#597):** Windows Node 24 and macOS now launch the actual Electron renderer and exercise Settings open/save/reload, workspace/session startup, image attachment, Vision toggle state, real `vision_describe` tool calling, image delivery to a controlled local vision backend, and the final rendered assistant response. Separate adversarial tests still cover duplicate/ordered carriers, failure recovery, OFF→ON→OFF authority, and plugin reload boundaries.
+- **Complete DSH build caches (#597):** trusted exact-Host caches retain both native `packages/*/lib` JavaScript outputs and `packages/*/bin` artifacts under a new cache schema. A cache hit can no longer restore a half-built DSH runtime missing files such as `@deepseek-ai/node-addon-system/lib/flock.js`.
+- **Safer Desktop diagnostics (#597):** failure artifacts persist fixed summaries of Host/network evidence rather than writing arbitrary response bodies to disk. CodeQL verified the previous network-data-to-file path as fixed.
+- **`localOnlyVision` privacy wording (#598):** Settings and documentation now state the actual boundary precisely: raw image bytes stay on local vision backends, while derived OCR/description/tool results can still enter the active chat-model context. This is a disclosure clarification, not a routing-policy change.
+- **DSH `0.2.0-rc.2` verification (#599):** the permanent next/rc compatibility gate now pins exact rc.2 source and covers Linux/macOS/Windows source contracts, Node 22/24 Windows Desktop Host, real Host + Chromium, multi-plugin ordering, Settings, mixed attachments, bundle recomposition, and real Windows/macOS Electron renderer flows. The peer-admission boundary and public minimum remain unchanged.
+
+## Validation
+
+- Final local regression on the rc.2-compatible tree: main suite `1534` passed, `1` intentional skip, `0` failed; backend runtime-policy suite passed `9/9`.
+- DSH `0.2.0-rc.2` passed exact-source checks on Ubuntu, Windows, and macOS; real Host + Chromium; Windows Desktop Host on Node 22 and Node 24; Node 24 multi-plugin ordering; and real Windows/macOS Electron renderer lifecycle tests.
+- The real Desktop Vision flow reached the controlled text model, issued `vision_describe`, delivered actual image content to the controlled vision backend, consumed the tool result, and rendered the expected final response.
+- The post-merge `main` push gates for `f92a6e0` completed with 0 failures, including CI, HOL security, DSH exact-source, DSH 0.1.7 real Host, DSH `0.2.0-rc.2` validation, preview browser smoke, routing parity, data boundary, architecture closure, and compatibility convergence.
+- The public minimum supported DSH Host remains `0.1.0-rc.8`; existing 2.2.x settings require no migration.
+
+## Upgrade
+
+2.2.7 users should upgrade to 2.2.8, especially when using the official Desktop app or frequently reloading/updating plugins in long-lived sessions. No configuration changes are required.

package/lib/client-host-compat-prelude.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const CLIENT_HOST_COMPAT_MARK = 'data-vision-router-host-compat'
 
@@ -243,19 +243,14 @@ export const CLIENT_HOST_COMPAT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectClientHostCompatibility(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_HOST_COMPAT_MARK)) return html
-  const safe = CLIENT_HOST_COMPAT_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${CLIENT_HOST_COMPAT_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_HOST_COMPAT_MARK, CLIENT_HOST_COMPAT_PRELUDE)
 }
 
 export function installClientHostCompatibility(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectClientHostCompatibility),
-      'vision-router: client Host compatibility boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_HOST_COMPAT_MARK,
+    prelude: CLIENT_HOST_COMPAT_PRELUDE,
+    label: 'vision-router: client Host compatibility',
+    injectHtml: injectClientHostCompatibility,
   })
 }

package/lib/client-presentation-boundary-main.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const CLIENT_PRESENTATION_MARK = 'data-vision-router-presentation-boundary'
 const VISION_MODE_WRAPPER_SOURCE = 'deepseek-official'
 
@@ -1304,23 +1305,14 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectClientPresentationBoundary(html) {
-  if (typeof html !== 'string' || html.includes(CLIENT_PRESENTATION_MARK)) return html
-  const safe = CLIENT_PRESENTATION_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${CLIENT_PRESENTATION_MARK}>${safe}</script>`
-  // DSH's client-modules index tap prepends the queue-mode loader bootstrap at
-  // <head>. Run after that parser bootstrap so we can wrap both load() and the
-  // later create() transition. The create wrapper re-applies the boundary when
-  // rc.8 replaces loader.load while entering live mode.
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRESENTATION_MARK, CLIENT_PRESENTATION_PRELUDE)
 }
 
 export function installClientPresentationBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectClientPresentationBoundary),
-      'vision-router: client presentation boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRESENTATION_MARK,
+    prelude: CLIENT_PRESENTATION_PRELUDE,
+    label: 'vision-router: client presentation boundary',
+    injectHtml: injectClientPresentationBoundary,
   })
 }

package/lib/client-presentation-boundary.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import {
   CLIENT_PRESENTATION_PRELUDE as BASE_CLIENT_PRESENTATION_PRELUDE,
   resolveVisionModePair,
@@ -187,20 +187,15 @@ export {
 }
 
 export function injectClientPresentationBoundary(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_PRESENTATION_MARK)) return html
-  const safe = CLIENT_PRESENTATION_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${CLIENT_PRESENTATION_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRESENTATION_MARK, CLIENT_PRESENTATION_PRELUDE)
 }
 
 export function installClientPresentationBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectClientPresentationBoundary),
-      'vision-router: client presentation boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRESENTATION_MARK,
+    prelude: CLIENT_PRESENTATION_PRELUDE,
+    label: 'vision-router: client presentation boundary',
+    injectHtml: injectClientPresentationBoundary,
   })
   // Keep Host-version compatibility in its own capability-detected prelude.
   // This lets the large legacy client factory stay byte-stable while alpha/new

package/lib/client-script-carrier.js

@@ -0,0 +1,90 @@
+import { htmlHasScriptMarker } from './html-script-marker.js'
+
+const CARRIER_REGISTRY = '__dshVisionRouterClientCarriers'
+
+function carrierKey(marker) {
+  const value = String(marker || 'vision-router-client-script')
+  return `vr:${value.replace(/^data-vision-router-/, '')}`
+}
+
+/**
+ * Wrap one browser prelude with a shared one-shot fence. Modern served-Web
+ * pages can receive both structured index rows and tapIndex HTML transforms,
+ * while Desktop/static carriers receive only the structured row. The fence
+ * keeps both delivery paths safe without relying on each prelude to implement
+ * its own duplicate-execution semantics.
+ */
+export function clientCarrierSource(marker, prelude) {
+  const key = JSON.stringify(carrierKey(marker))
+  return `(function(){\n  var root = window;\n  var registry = root.${CARRIER_REGISTRY};\n  if (!registry || typeof registry !== 'object') {\n    registry = Object.create(null);\n    try { Object.defineProperty(root, '${CARRIER_REGISTRY}', { value: registry, configurable: true }); }\n    catch (_) { root.${CARRIER_REGISTRY} = registry; }\n  }\n  var key = ${key};\n  if (registry[key]) return;\n  registry[key] = true;\n  try {\n${prelude}\n  } catch (error) {\n    try { delete registry[key]; } catch (_) { registry[key] = false; }\n    throw error;\n  }\n})();`
+}
+
+export function injectClientCarrierHtml(html, marker, prelude) {
+  const structuredMark = `/* ${marker} */`
+  if (typeof html !== 'string' || htmlHasScriptMarker(html, marker) || html.includes(structuredMark)) return html
+  const safe = clientCarrierSource(marker, prelude).replace(/<\/script/gi, '<\\/script')
+  const script = `<script ${marker}>${safe}</script>`
+  const closeHead = html.indexOf('</head>')
+  return closeHead === -1 ? `${html}${script}` : `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
+}
+
+
+export function injectClientStyleHtml(html, marker, css) {
+  if (typeof html !== 'string' || typeof marker !== 'string' || marker === '') return html
+  if (html.includes(`<style ${marker}>`)) return html
+  const style = `<style ${marker}>${String(css || '')}</style>`
+  const closeHead = html.indexOf('</head>')
+  return closeHead === -1 ? `${html}${style}` : `${html.slice(0, closeHead)}${style}${html.slice(closeHead)}`
+}
+
+export function appendStructuredClientStyle(table, marker, css) {
+  if (!Array.isArray(table) || typeof marker !== 'string' || marker === '') return false
+  const signature = `/* ${marker}:style */`
+  if (table.some((row) => row?.kind === 'style' && typeof row.text === 'string' && row.text.includes(signature))) return false
+  table.push({ kind: 'style', placement: 'head', text: `${signature}
+${String(css || '')}` })
+  return true
+}
+
+export function appendStructuredClientCarrier(table, marker, prelude) {
+  if (!Array.isArray(table)) return false
+  const signature = `/* ${marker} */`
+  if (table.some((row) => row?.kind === 'script' && typeof row.text === 'string' && row.text.includes(signature))) {
+    return false
+  }
+  table.push({
+    kind: 'script',
+    placement: 'head',
+    text: `${signature}\n${clientCarrierSource(marker, prelude)}`,
+  })
+  return true
+}
+
+/**
+ * Register the same client prelude on both supported browser carriers:
+ * - structured `webserver/index-inject` rows for Desktop/static shells;
+ * - `tapIndex()` HTML transforms for served-Web and older Hosts.
+ */
+export function installClientScriptCarriers(ctx, { marker, prelude, label, injectHtml, style }) {
+  if (!ctx || typeof ctx.inject !== 'function') return
+  ctx.inject(['webServer'], (webCtx) => {
+    if (typeof webCtx.on === 'function') {
+      webCtx.on('webserver/index-inject', (table) => {
+        if (style) appendStructuredClientStyle(table, style.marker || marker, style.text)
+        appendStructuredClientCarrier(table, marker, prelude)
+      })
+    }
+    if (typeof webCtx.effect === 'function' && webCtx.webServer?.tapIndex) {
+      const baseTransform = typeof injectHtml === 'function'
+        ? injectHtml
+        : (html) => injectClientCarrierHtml(html, marker, prelude)
+      const transform = style
+        ? (html) => baseTransform(injectClientStyleHtml(html, style.marker || marker, style.text))
+        : baseTransform
+      webCtx.effect(
+        () => webCtx.webServer.tapIndex(transform),
+        label,
+      )
+    }
+  })
+}

package/lib/client.js

@@ -230,7 +230,7 @@ window.__ModuleLoader__.load({
       hintRewriteImages: '避免把无法读取的原始图片直接发送给纯文字模型。推荐保持开启。',
       hintDownscale: '超过像素预算的图片先缩放再送视觉模型，降低延迟与成本；默认开启。',
       hintCache: '缓存识图答案（按图片内容 + 问题）；默认开启。',
-      hintLocalOnlyVision: '开启后仅允许回环地址上的本地视觉后端；云端/DSH Provider 与 OVH 免费兜底会被运行时硬阻止。主聊天模型是否联网不受此开关控制。',
+      hintLocalOnlyVision: '开启后仅允许回环地址上的本地视觉后端；云端/DSH Provider 与 OVH 免费兜底会被运行时硬阻止，因此 Vision Router 不会把图片和裁剪发送到云端视觉服务。视觉后端返回的描述、OCR、坐标等识图结果文本仍会交给当前聊天模型；若聊天模型在云端，图片语义仍可能离开本机。严格纯本地还需同时选择本地聊天模型。',
       hintFreeFallback: '当你选择的识图模型都不可用时，自动尝试内置 OVH 免费模型。免注册、免 API Key。',
       hintFreeCloudFirst:
         '默认关闭。开启后，云端后端先尝试内置 OVH 免费模型（免注册、免 API Key），' +
@@ -519,7 +519,7 @@ window.__ModuleLoader__.load({
       hintRewriteImages: 'Prevents raw image content from being sent to a text-only model that cannot read it. Recommended on.',
       hintDownscale: 'Images beyond the pixel budget are resized before the vision call, cutting latency and cost; on by default.',
       hintCache: 'Caches vision answers (keyed by image content + question); on by default.',
-      hintLocalOnlyVision: 'When enabled, only visual backends on loopback addresses may run. Cloud/DSH providers and the OVH free fallback are blocked at runtime. This does not control whether the main chat model is remote.',
+      hintLocalOnlyVision: 'When enabled, only visual backends on loopback addresses may run. Cloud/DSH providers and the OVH free fallback are blocked at runtime, so Vision Router does not send image bytes or crops to cloud vision services. Derived result text—descriptions, OCR, and coordinates—is still passed to the current chat model; if that model is remote, image semantics may still leave this machine. For a strict end-to-end local workflow, select a local chat model too.',
       hintFreeFallback: 'If your selected vision models fail, automatically try the built-in OVH free models. No signup or API key required.',
       hintFreeCloudFirst:
         'Off by default. When enabled, cloud backends try the built-in OVH free models first (no signup, no API key), ' +

package/lib/dsh-support-window.js

@@ -6,7 +6,7 @@ export const DSH_SUPPORT_WINDOW = Object.freeze({
 
 export const DSH_VERIFICATION_EVIDENCE = Object.freeze({
   exactStable: '0.1.5-rc.3',
-  exactPreview: '0.2.0-rc.1',
+  exactPreview: '0.2.0-rc.2',
   stableCanaryDistTag: 'latest',
   nextCanaryDistTag: 'next',
   previewCanaryDistTag: 'alpha',

package/lib/guide-vision-toggle-highlight.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const CLIENT_PRELUDE_MARK = 'data-vision-router-guide-toggle-highlight'
 
 export function unionGuideRects(first, second) {
@@ -149,18 +150,14 @@ export const GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectGuideVisionToggleHighlight(html) {
-  if (typeof html !== 'string' || html.includes(CLIENT_PRELUDE_MARK)) return html
-  const script = `<script ${CLIENT_PRELUDE_MARK}>${GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRELUDE_MARK, GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE)
 }
 
 export function installGuideVisionToggleHighlight(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectGuideVisionToggleHighlight),
-      'vision-router: onboarding vision-toggle spotlight',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRELUDE_MARK,
+    prelude: GUIDE_VISION_TOGGLE_HIGHLIGHT_PRELUDE,
+    label: 'vision-router: guide Vision toggle highlight',
+    injectHtml: injectGuideVisionToggleHighlight,
   })
 }

package/lib/live-model-client-prelude.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import { htmlHasScriptMarker } from './html-script-marker.js'
 
 const CLIENT_PRELUDE_MARK = 'data-vision-router-live-models'
@@ -588,22 +589,14 @@ export const LIVE_MODEL_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectLiveModelClientPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_PRELUDE_MARK)) return html
-  const script = `<script ${CLIENT_PRELUDE_MARK}>${LIVE_MODEL_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  // DSH's client-modules index tap prepends its queue-mode facade immediately
-  // after <head>. Run after that parser bootstrap so we can wrap both load()
-  // and create(); the create wrapper then re-attaches us after rc.8 swaps in
-  // its live registration sink, before lazy third-party bundles arrive.
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRELUDE_MARK, LIVE_MODEL_CLIENT_PRELUDE)
 }
 
 export function installLiveModelClientPrelude(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectLiveModelClientPrelude),
-      'vision-router: live model client prelude',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRELUDE_MARK,
+    prelude: LIVE_MODEL_CLIENT_PRELUDE,
+    label: 'vision-router: live model client prelude',
+    injectHtml: injectLiveModelClientPrelude,
   })
 }

package/lib/local-remote-settings-permission.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import { isLocalUiRequest } from './web-capability-boundary.js'
 
 const SETTINGS_NS = 'vision-router'
@@ -437,10 +437,7 @@ export const LOCAL_PERMISSION_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectLocalPermissionClientPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, LOCAL_PERMISSION_PRELUDE_MARK)) return html
-  const script = `<script ${LOCAL_PERMISSION_PRELUDE_MARK}>${LOCAL_PERMISSION_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const endHead = html.indexOf('</head>')
-  return endHead === -1 ? `${html}${script}` : `${html.slice(0, endHead)}${script}${html.slice(endHead)}`
+  return injectClientCarrierHtml(html, LOCAL_PERMISSION_PRELUDE_MARK, LOCAL_PERMISSION_CLIENT_PRELUDE)
 }
 
 export function installLocalRemoteSettingsPermissionBridge(ctx, logger) {
@@ -456,9 +453,11 @@ export function installLocalRemoteSettingsPermissionBridge(ctx, logger) {
       }),
       'vision-router: loopback remote-settings permission mutation',
     )
-    localCtx.effect(
-      () => localCtx.webServer.tapIndex(injectLocalPermissionClientPrelude),
-      'vision-router: local settings permission client shim',
-    )
+  })
+  installClientScriptCarriers(ctx, {
+    marker: LOCAL_PERMISSION_PRELUDE_MARK,
+    prelude: LOCAL_PERMISSION_CLIENT_PRELUDE,
+    label: 'vision-router: local settings permission client shim',
+    injectHtml: injectLocalPermissionClientPrelude,
   })
 }

package/lib/session-vision-mode-boundary.js

@@ -134,14 +134,26 @@ function disposeHeldRestriction(held) {
   }
 }
 
-function releaseAgentToolRestriction(agent, restrictions) {
+function releaseAgentToolRestriction(agent, restrictions, activeRestrictions) {
   if (!isObject(agent)) return
   const held = restrictions.get(agent)
   if (!held) return
   disposeHeldRestriction(held)
+  activeRestrictions?.delete(held)
   restrictions.delete(agent)
 }
 
+function rememberAgentToolRestriction(agent, restrictions, activeRestrictions, held) {
+  restrictions.set(agent, held)
+  activeRestrictions?.add(held)
+}
+
+function releaseAllAgentToolRestrictions(activeRestrictions) {
+  if (!(activeRestrictions instanceof Set)) return
+  for (const held of activeRestrictions) disposeHeldRestriction(held)
+  activeRestrictions.clear()
+}
+
 function restrictionFailureLabel(error) {
   const name =
     typeof error?.name === 'string' && error.name !== ''
@@ -165,10 +177,10 @@ function warnRestrictionFailure(agent, error, deny, failed = deny) {
   } catch {}
 }
 
-function syncAgentToolRestriction(agent, enabled, restrictions, owned, registryTools) {
+function syncAgentToolRestriction(agent, enabled, restrictions, owned, registryTools, activeRestrictions) {
   if (!isObject(agent)) return
   if (enabled) {
-    releaseAgentToolRestriction(agent, restrictions)
+    releaseAgentToolRestriction(agent, restrictions, activeRestrictions)
     return
   }
 
@@ -181,19 +193,19 @@ function syncAgentToolRestriction(agent, enabled, restrictions, owned, registryT
   const deny = restrictableOwnedVisionToolNames(registryTools, owned)
   if (typeof restrict !== 'function') return
   if (deny.length === 0) {
-    releaseAgentToolRestriction(agent, restrictions)
+    releaseAgentToolRestriction(agent, restrictions, activeRestrictions)
     return
   }
 
   const held = restrictions.get(agent)
   const signature = deny.join('\u0000')
   if (held?.signature === signature) return
-  releaseAgentToolRestriction(agent, restrictions)
+  releaseAgentToolRestriction(agent, restrictions, activeRestrictions)
 
   try {
     // Current DSH can mask all inherited plugin tools in one scoped operation.
     const dispose = restrict.call(tools, { deny })
-    restrictions.set(agent, {
+    rememberAgentToolRestriction(agent, restrictions, activeRestrictions, {
       signature,
       disposers: typeof dispose === 'function' ? [dispose] : [],
     })
@@ -212,7 +224,9 @@ function syncAgentToolRestriction(agent, enabled, restrictions, owned, registryT
         failed.push(name)
       }
     }
-    if (disposers.length > 0) restrictions.set(agent, { signature, disposers })
+    if (disposers.length > 0) {
+      rememberAgentToolRestriction(agent, restrictions, activeRestrictions, { signature, disposers })
+    }
     if (failed.length > 0 || disposers.length === 0) {
       warnRestrictionFailure(agent, combinedError, deny, failed.length > 0 ? failed : deny)
     }
@@ -311,6 +325,7 @@ function wrapTools(tools, ctx, config, owned) {
 export function installSessionVisionModeBoundary(ctx, config = {}) {
   if (!isObject(ctx)) return { ctx, config }
   const restrictions = new WeakMap()
+  const activeRestrictions = new Set()
   const assemblySnapshots = new WeakMap()
   const ownedVisionTools = new Map()
   let toolsView
@@ -335,6 +350,7 @@ export function installSessionVisionModeBoundary(ctx, config = {}) {
       restrictions,
       ownedVisionTools,
       ctx?.tools,
+      activeRestrictions,
     )
   }
 
@@ -354,6 +370,7 @@ export function installSessionVisionModeBoundary(ctx, config = {}) {
         restrictions,
         ownedVisionTools,
         ctx?.tools,
+        activeRestrictions,
       )
     }
     return authority
@@ -419,13 +436,30 @@ export function installSessionVisionModeBoundary(ctx, config = {}) {
     })
     ctx.on?.('agent/disposed', ({ agent }) => {
       clearAgent(agent)
-      releaseAgentToolRestriction(agent, restrictions)
+      releaseAgentToolRestriction(agent, restrictions, activeRestrictions)
     })
   } catch {
     // Minimum Hosts may not expose every lifecycle event. Prompt assembly and
     // execution guards preserve the safety boundary without making apply fail.
   }
 
+  // tools.restrict() is invoked through the long-lived Agent scope so its
+  // disposer belongs to that scope, not to this plugin fiber. A Settings/HMR
+  // recompose can therefore retire this boundary while the Agent survives. If
+  // we do not release those masks here, the next boundary generation cannot
+  // discover or dispose the old WeakMap entries and Vision tools stay hidden
+  // even after the Session selects a Router-owned route again.
+  try {
+    if (typeof ctx.effect === 'function') {
+      ctx.effect(
+        () => () => releaseAllAgentToolRestrictions(activeRestrictions),
+        'vision-router: Session Vision restriction lifecycle',
+      )
+    }
+  } catch {
+    // Agent disposal / live enable transitions still release their own masks.
+  }
+
   const wrapped = new Proxy(ctx, {
     get(target, property) {
       if (property === 'tools') {
@@ -467,6 +501,7 @@ export function installSessionVisionModeBoundary(ctx, config = {}) {
               restrictions,
               ownedVisionTools,
               target?.tools,
+              activeRestrictions,
             )
             return runWithSessionVisionModeAuthority(
               authority,