dsh-vision-router 2.2.7 → 2.3.0

package/lib/vision-background-benchmark.js

@@ -8,7 +8,7 @@ import {
 import { withHardDeadline } from './vision-capability-benchmark-hardening.js'
 import { resolveVisionRoutingAuthority } from './vision-routing-authority.js'
 import { redactDiagnosticText } from './diagnostic-redaction.js'
-import { injectVisionExactCheckClient } from './vision-exact-check-client.js'
+import { installVisionExactCheckClient } from './vision-exact-check-client.js'
 import { createImageInputVerdictStore } from './vision-image-input-verdict.js'
 import { createBackgroundBenchmarkStopStore } from './vision-background-stop-store.js'
 import { backgroundFailurePolicy } from './vision-background-failure-policy.js'
@@ -1033,12 +1033,10 @@ export function installBackgroundCapabilityProfiling(ctx, config, core, store, o
     // Cleanup registration is best-effort; the profiler remains process-scoped.
   }
 
+  installVisionExactCheckClient(ctx)
+
   try {
     ctx?.inject?.(['webServer'], (webCtx) => {
-      webCtx.effect(
-        () => webCtx.webServer.tapIndex(injectVisionExactCheckClient),
-        'vision-router: exact image check product control',
-      )
       webCtx.effect(() => webCtx.webServer.register({
         kind: 'exact',
         path: VISION_CAPABILITY_RUNTIME_PATH,

package/lib/vision-capability-benchmark-client.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const CLIENT_MARK = 'data-vision-router-capability-benchmark'
 
@@ -412,17 +412,14 @@ export const CAPABILITY_BENCHMARK_CLIENT = String.raw`(function(){
 })();`
 
 export function injectCapabilityBenchmarkClient(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_MARK)) return html
-  const script = `<script ${CLIENT_MARK}>${CAPABILITY_BENCHMARK_CLIENT.replace(/<\/script/gi, '<\\/script')}</script>`
-  const head = html.indexOf('<head>')
-  return head === -1 ? `${script}${html}` : `${html.slice(0, head + 6)}${script}${html.slice(head + 6)}`
+  return injectClientCarrierHtml(html, CLIENT_MARK, CAPABILITY_BENCHMARK_CLIENT)
 }
 
 export function installCapabilityBenchmarkClient(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectCapabilityBenchmarkClient),
-      'vision-router: capability benchmark Host presentation client controls',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_MARK,
+    prelude: CAPABILITY_BENCHMARK_CLIENT,
+    label: 'vision-router: capability benchmark client',
+    injectHtml: injectCapabilityBenchmarkClient,
   })
 }

package/lib/vision-capability-benchmark-service.js

@@ -307,6 +307,7 @@ export function createExactCapabilityInvoker(ctx, core, candidate, config, optio
             maxTokens: benchmarkMaxTokensForProvider(exactHttpProvider),
             signal: callSignal,
             affinityId: benchmarkAffinityId,
+            providerTransport: options.providerTransport,
             resolveCredential: (ref) => resolvedCredentialValue(ctx, ref),
           }),
           fixtureTimeoutMs,

package/lib/vision-diagnostics-routes.js

@@ -0,0 +1,216 @@
+import { probeLocalBackends } from './local-connection-probe.js'
+import {
+  METADATA_RESPONSE_MAX_BYTES,
+  readResponseJsonBounded,
+} from './http-body-limit.js'
+
+export const VISION_TEST_CONNECTION_PATH = '/_dsh/vision-router/test-connection'
+export const VISION_MODEL_CAPABILITIES_PATH = '/_dsh/vision-router/model-capabilities'
+
+function adapterAvailable(llm, provider) {
+  if (!llm || typeof llm.registration !== 'function') return false
+  try {
+    llm.registration(provider)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function probeModels(fetchImpl, baseURL, expectedModel, startedAt) {
+  try {
+    const response = await fetchImpl(`${String(baseURL).replace(/\/$/, '')}/models`, {
+      method: 'GET',
+      signal: AbortSignal.timeout(8000),
+    })
+    const latencyMs = Date.now() - startedAt
+    if (!response.ok) {
+      return { ok: false, latencyMs, status: response.status, error: `HTTP ${response.status}` }
+    }
+    const data = await readResponseJsonBounded(
+      response,
+      METADATA_RESPONSE_MAX_BYTES,
+      { label: 'vision backend /models response' },
+    ).catch(() => undefined)
+    const models = data && Array.isArray(data.data) ? data.data : undefined
+    const count = models ? models.length : undefined
+    if (
+      typeof expectedModel === 'string' &&
+      expectedModel !== '' &&
+      models &&
+      !models.some((entry) => entry && String(entry.id) === expectedModel)
+    ) {
+      return {
+        ok: false,
+        latencyMs,
+        status: response.status,
+        models: count,
+        endpoint: baseURL,
+        error: `configured model "${expectedModel}" was not returned by /models`,
+      }
+    }
+    return { ok: true, latencyMs, status: response.status, models: count, endpoint: baseURL }
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - startedAt,
+      error: error && error.message ? error.message : String(error),
+    }
+  }
+}
+
+function getArray(factory) {
+  const value = typeof factory === 'function' ? factory() : factory
+  return Array.isArray(value) ? value : []
+}
+
+/**
+ * Product diagnostics/settings-support routes kept outside visual Core.
+ *
+ * The caller supplies three coherent domain faces instead of a Core facade:
+ * connection candidates/probes, capability snapshot production, and the
+ * Host-ownership state rendered in the connection response. Authentication
+ * and remote/local capability policy stay outside this module in the existing
+ * scoped WebServer boundary.
+ */
+export function installVisionDiagnosticsRoutes(ctx, options = {}) {
+  if (!ctx || typeof ctx.inject !== 'function') return ctx
+
+  const connection = options.connection ?? {}
+  const capabilities = options.capabilities ?? {}
+  const ownership = options.ownership ?? {}
+  const resolveCapability = connection.resolveCapability
+  const collectCapabilities = capabilities.collect
+  if (typeof resolveCapability !== 'function') {
+    throw new TypeError('vision diagnostics routes require a connection capability resolver')
+  }
+  if (typeof collectCapabilities !== 'function') {
+    throw new TypeError('vision diagnostics routes require a capability collector')
+  }
+
+  const llm = ctx.llm
+  const httpRoute = typeof connection.httpRoute === 'string' && connection.httpRoute !== ''
+    ? connection.httpRoute
+    : 'vision-http'
+  const fetchImpl = typeof options.fetchImpl === 'function' ? options.fetchImpl : globalThis.fetch
+
+  const probeConnection = async () => {
+    const started = Date.now()
+    let first
+    for (const pair of getArray(connection.candidatePairs)) {
+      if (!pair) continue
+      if (pair.provider !== httpRoute && !adapterAvailable(llm, pair.provider)) continue
+      const capability = await resolveCapability(pair.provider, pair.model)
+      if (capability?.attemptable !== false) {
+        first = pair
+        break
+      }
+    }
+
+    const localProbe = await probeLocalBackends(
+      getArray(connection.localBackends),
+      (provider) => probeModels(fetchImpl, provider.baseURL, provider.model, started),
+      started,
+    )
+    if (localProbe !== undefined) return localProbe
+
+    const httpBackends = getArray(connection.httpBackends)
+    if (first !== undefined && first.provider === httpRoute) {
+      const entry = httpBackends.find((provider) => `${provider.name}/${provider.model}` === first.model)
+      if (entry !== undefined) return probeModels(fetchImpl, entry.baseURL, entry.model, started)
+    }
+
+    if (first !== undefined) {
+      try {
+        await llm.resolveModelInfo(first.provider, first.model)
+        return {
+          ok: true,
+          latencyMs: Date.now() - started,
+          detail: `${first.provider}/${first.model} metadata resolved (no network call)`,
+        }
+      } catch (error) {
+        return {
+          ok: false,
+          latencyMs: Date.now() - started,
+          error: error && error.message ? error.message : String(error),
+        }
+      }
+    }
+
+    const httpFirst = httpBackends[0]
+    if (httpFirst !== undefined) return probeModels(fetchImpl, httpFirst.baseURL, httpFirst.model, started)
+    return { ok: false, error: 'no usable vision provider configured' }
+  }
+
+  ctx.inject(['webServer'], (webCtx) => {
+    webCtx.effect(() => {
+      return webCtx.webServer.register({
+        kind: 'exact',
+        path: VISION_TEST_CONNECTION_PATH,
+        handler: async (req, res) => {
+          if (req.method !== 'GET') {
+            res.setHeader('Allow', 'GET')
+            res.writeHead(405)
+            res.end()
+            return
+          }
+          try {
+            const result = await probeConnection()
+            const officialRouteAvailable = adapterAvailable(llm, 'deepseek-official')
+            result.stealth = {
+              configured: ownership.stealthConfigured,
+              active: false,
+              reason: ownership.hostOwnsOfficialDeepSeek && !officialRouteAvailable
+                ? 'host-owned-official-unavailable'
+                : undefined,
+              hostOwned: ownership.hostOwnsOfficialDeepSeek,
+            }
+            res.writeHead(result.ok ? 200 : 502, { 'content-type': 'application/json' })
+            res.end(JSON.stringify(result))
+          } catch (error) {
+            res.writeHead(500, { 'content-type': 'application/json' })
+            res.end(JSON.stringify({
+              ok: false,
+              error: error && error.message ? error.message : String(error),
+            }))
+          }
+        },
+      })
+    }, 'vision-router: test-connection route')
+  })
+
+  ctx.inject(['webServer'], (webCtx) => {
+    webCtx.effect(
+      () => webCtx.webServer.register({
+        kind: 'exact',
+        path: VISION_MODEL_CAPABILITIES_PATH,
+        handler: async (req, res) => {
+          if (req.method !== 'GET') {
+            res.setHeader('Allow', 'GET')
+            res.writeHead(405)
+            res.end()
+            return
+          }
+          try {
+            const snapshot = await collectCapabilities()
+            res.writeHead(200, { 'content-type': 'application/json' })
+            res.end(JSON.stringify({
+              capabilities: snapshot,
+              builtinFallback: getArray(capabilities.builtinFallback),
+              anonymousRpmPerModel: 2,
+            }))
+          } catch (error) {
+            res.writeHead(500, { 'content-type': 'application/json' })
+            res.end(JSON.stringify({
+              capabilities: {},
+              error: error && error.message ? error.message : String(error),
+            }))
+          }
+        },
+      }),
+      'vision-router: model capabilities route',
+    )
+  })
+
+  return ctx
+}

package/lib/vision-evidence-guidance.js

@@ -1,3 +1,5 @@
+import { visionRouterMessageSource } from './session-message-source-compat.js'
+
 export const VISION_SUCCESS_GUIDANCE =
   'Vision Router trusted execution metadata: the preceding vision_describe call SUCCEEDED. ' +
   'This metadata is not image content. If that successful evidence resolves the visual fact needed for the current task, stop making additional vision calls for that fact and continue the remaining user task from this evidence. ' +
@@ -34,6 +36,6 @@ export function visionDescribeSuccessContext(exec, result) {
     role: 'user',
     id: `vision-router-evidence-success-${String(exec.callId)}`,
     content: [{ type: 'text', text: VISION_SUCCESS_GUIDANCE }],
-    source: { kind: 'plugin', plugin: 'dsh-vision-router' },
+    source: visionRouterMessageSource(exec.agent.session),
   }
 }

package/lib/vision-exact-check-client.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const CLIENT_MARK = 'data-vision-router-exact-check'
 
@@ -185,9 +185,14 @@ export const VISION_EXACT_CHECK_CLIENT = String.raw`(function(){
 })();`
 
 export function injectVisionExactCheckClient(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, CLIENT_MARK)) return html
-  const script = `<script ${CLIENT_MARK}>${VISION_EXACT_CHECK_CLIENT.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_MARK, VISION_EXACT_CHECK_CLIENT)
+}
+
+export function installVisionExactCheckClient(ctx) {
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_MARK,
+    prelude: VISION_EXACT_CHECK_CLIENT,
+    label: 'vision-router: exact image check product control',
+    injectHtml: injectVisionExactCheckClient,
+  })
 }

package/lib/vision-model-visibility-boundary-main.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const VISION_MODE_WRAPPER_SOURCE = 'deepseek-official'
 const DEFAULT_WRAPPER_ROUTE = 'deepseek-vision'
 const MODEL_SELECTION_TARGET = '@deepseek-ai/dsh-client-ui-model-selection'
@@ -454,19 +455,14 @@ export const VISION_MODEL_VISIBILITY_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectVisionModelVisibilityBoundary(html) {
-  if (typeof html !== 'string' || html.includes(VISIBILITY_MARK)) return html
-  const safe = VISION_MODEL_VISIBILITY_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${VISIBILITY_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, VISIBILITY_MARK, VISION_MODEL_VISIBILITY_PRELUDE)
 }
 
 export function installVisionModelVisibilityBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionModelVisibilityBoundary),
-      'vision-router: model visibility boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: VISIBILITY_MARK,
+    prelude: VISION_MODEL_VISIBILITY_PRELUDE,
+    label: 'vision-router: model visibility boundary',
+    injectHtml: injectVisionModelVisibilityBoundary,
   })
 }

package/lib/vision-model-visibility-boundary.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 import { VISION_MODEL_VISIBILITY_PRELUDE } from './vision-model-visibility-boundary-main.js'
 
 const VISIBILITY_MARK = 'data-vision-router-model-visibility-boundary'
@@ -10,19 +10,14 @@ export {
 } from './vision-model-visibility-boundary-main.js'
 
 export function injectVisionModelVisibilityBoundary(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, VISIBILITY_MARK)) return html
-  const safe = VISION_MODEL_VISIBILITY_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${VISIBILITY_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, VISIBILITY_MARK, VISION_MODEL_VISIBILITY_PRELUDE)
 }
 
 export function installVisionModelVisibilityBoundary(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionModelVisibilityBoundary),
-      'vision-router: model visibility boundary',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: VISIBILITY_MARK,
+    prelude: VISION_MODEL_VISIBILITY_PRELUDE,
+    label: 'vision-router: model visibility boundary',
+    injectHtml: injectVisionModelVisibilityBoundary,
   })
 }

package/lib/vision-provider-transport.js

@@ -33,8 +33,6 @@ const moduleFetch =
     ? globalThis.fetch.bind(globalThis)
     : undefined
 
-const installed = []
-
 function live(value) {
   return typeof value === 'function' ? value() : value
 }
@@ -175,30 +173,3 @@ export function createVisionProviderTransport({
     },
   })
 }
-
-/**
- * Scoped process/profile carrier for Router-owned compatibility calls whose
- * mature signatures do not yet accept an explicit VisionProviderTransport.
- * The registry never patches global fetch and is released with the public
- * plugin lifecycle. Remove it only after every production compatibility caller
- * receives the transport explicitly and no production code reads
- * currentVisionProviderTransport().
- */
-export function installVisionProviderTransport(transport) {
-  if (!transport || typeof transport.fetch !== 'function') {
-    throw new TypeError('invalid vision provider transport')
-  }
-  const token = Object.freeze({ transport })
-  installed.push(token)
-  let active = true
-  return () => {
-    if (!active) return
-    active = false
-    const index = installed.indexOf(token)
-    if (index >= 0) installed.splice(index, 1)
-  }
-}
-
-export function currentVisionProviderTransport() {
-  return installed[installed.length - 1]?.transport
-}

package/lib/vision-routing-settings-prelude.js

@@ -1,4 +1,4 @@
-import { htmlHasScriptMarker } from './html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 
 const ROUTING_SETTINGS_PRELUDE_MARK = 'data-vision-router-routing-settings'
 
@@ -536,18 +536,14 @@ export const VISION_ROUTING_SETTINGS_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectVisionRoutingSettingsPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, ROUTING_SETTINGS_PRELUDE_MARK)) return html
-  const script = `<script ${ROUTING_SETTINGS_PRELUDE_MARK}>${VISION_ROUTING_SETTINGS_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, ROUTING_SETTINGS_PRELUDE_MARK, VISION_ROUTING_SETTINGS_PRELUDE)
 }
 
 export function installVisionRoutingSettingsPrelude(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionRoutingSettingsPrelude),
-      'vision-router: v2 routing settings product panel',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: ROUTING_SETTINGS_PRELUDE_MARK,
+    prelude: VISION_ROUTING_SETTINGS_PRELUDE,
+    label: 'vision-router: Vision routing Settings prelude',
+    injectHtml: injectVisionRoutingSettingsPrelude,
   })
 }

package/lib/vision-toggle-root-hardening.js

@@ -251,6 +251,7 @@ const CLIENT_PRELUDE = String.raw`(function(){
   var listeners = new Set();
   var pending = new WeakMap();
   var recoveries = new WeakMap();
+  var selectionGenerations = new WeakMap();
   var inFlight = null;
   var refreshedAt = 0;
   function emit(){ listeners.forEach(function(fn){ try { fn(); } catch (_) {} }); }
@@ -302,13 +303,29 @@ const CLIENT_PRELUDE = String.raw`(function(){
     var key = JSON.stringify(selection || {});
     var held = pending.get(directory);
     if (held && held.key === key) return held.promise;
+    var generation = (selectionGenerations.get(directory) || 0) + 1;
+    selectionGenerations.set(directory, generation);
+    var current = function(){ return selectionGenerations.get(directory) === generation; };
     var recovery = recoveryFor(directory);
     recovery.clear();
     var promise = Promise.resolve().then(function(){ return directory.select(selection); }).then(
-      function(value){ recovery.clear(); return value; },
-      function(error){ recovery.fail(error); throw error; }
+      function(value){
+        if (!current()) return value;
+        if (value && value.ok === false) {
+          var failure = value.error;
+          var message = failure && failure.message
+            ? String(failure.message)
+            : String(failure || 'model operation failed');
+          if (failure && failure.code) message = String(failure.code) + ': ' + message;
+          recovery.fail(new Error(message));
+          return value;
+        }
+        recovery.clear();
+        return value;
+      },
+      function(error){ if (current()) recovery.fail(error); throw error; }
     );
-    pending.set(directory, { key: key, promise: promise });
+    pending.set(directory, { key: key, promise: promise, generation: generation });
     promise.finally(function(){
       var latest = pending.get(directory);
       if (latest && latest.promise === promise) pending.delete(directory);
@@ -331,9 +348,9 @@ function replaceAll(source, before, after) {
   return source.includes(before) ? source.split(before).join(after) : source
 }
 
-export function hardenVisionToggleHtml(html) {
-  if (typeof html !== 'string') return html
-  let next = html
+export function hardenVisionClientSource(source) {
+  if (typeof source !== 'string') return source
+  let next = source
 
   next = replaceAll(
     next,
@@ -391,8 +408,8 @@ export function hardenVisionToggleHtml(html) {
 
   next = replaceAll(
     next,
-    `                  try {\n                    return Promise.resolve(directory.select(selection)).then(\n                      function(){ return true; },\n                      function(){ return false; }\n                    );\n                  } catch (_) {\n                    return Promise.resolve(false);\n                  }`,
-    `                  var hardening = window.__dshVisionRouterRootHardening;\n                  var operation;\n                  try { operation = hardening ? hardening.select(directory, selection) : Promise.resolve(directory.select(selection)); }\n                  catch (_) { return Promise.resolve(false); }\n                  return Promise.resolve(operation).then(function(){ return true; }, function(){ return false; });`,
+    `                  try {\n                    return Promise.resolve(directory.select(selection)).then(\n                      function(result){ return !result || result.ok !== false; },\n                      function(){ return false; }\n                    );\n                  } catch (_) {\n                    return Promise.resolve(false);\n                  }`,
+    `                  var hardening = window.__dshVisionRouterRootHardening;\n                  var operation;\n                  try { operation = hardening ? hardening.select(directory, selection) : Promise.resolve(directory.select(selection)); }\n                  catch (_) { return Promise.resolve(false); }\n                  return Promise.resolve(operation).then(function(result){ return !result || result.ok !== false; }, function(){ return false; });`,
   )
 
   next = replaceAll(
@@ -430,6 +447,13 @@ export function hardenVisionToggleHtml(html) {
     `    var hardening = window.__dshVisionRouterRootHardening;\n    var recovery = hardening ? hardening.recoveryFor(directory) : undefined;\n    var store = wrapStore(directory.store, settings, recovery);`,
   )
 
+  return next
+}
+
+export function hardenVisionToggleHtml(html) {
+  if (typeof html !== 'string') return html
+  let next = hardenVisionClientSource(html)
+
   if (!next.includes(OWNERSHIP_MARK)) {
     const safe = CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')
     const script = `<script ${OWNERSHIP_MARK}>${safe}</script>`
@@ -474,6 +498,24 @@ export function createVisionToggleRootHardening(ctx, config = {}) {
           }),
           'vision-router: route ownership',
         )
+        if (typeof webCtx.on === 'function') {
+          webCtx.on('webserver/index-inject', (table) => {
+            if (!Array.isArray(table)) return
+            for (const row of table) {
+              if (row?.kind === 'script' && typeof row.text === 'string') {
+                row.text = hardenVisionClientSource(row.text)
+              }
+            }
+            const signature = `/* ${OWNERSHIP_MARK} */`
+            if (!table.some((row) => row?.kind === 'script' && typeof row.text === 'string' && row.text.includes(signature))) {
+              table.push({
+                kind: 'script',
+                placement: 'head',
+                text: `${signature}\n${CLIENT_PRELUDE}`,
+              })
+            }
+          })
+        }
         webCtx.effect(
           () => webCtx.webServer.tapIndex(hardenVisionToggleHtml),
           'vision-router: vision toggle root hardening',

package/lib/vision-tool-runtime-boundary.js

@@ -540,7 +540,11 @@ function wrapLlm(llm, runtimeState) {
             : state?.callConfigAuthority === 'transparent'
               ? projectTransparentCallConfig(options, state, runtimeState)
               : options
-          return stream.call(target, projected)
+          const signal = combineSignals(projected?.signal, state?.signal)
+          const call = signal === undefined || signal === projected?.signal
+            ? projected
+            : { ...(projected ?? {}), signal }
+          return stream.call(target, call)
         }
       }
       if (property === 'registerAdapter') {

package/lib/vision-turn-budget-client-prelude.js

@@ -1,3 +1,4 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
 const CLIENT_PRELUDE_MARK = 'data-vision-router-turn-budget'
 
 export const VISION_TURN_BUDGET_CLIENT_PRELUDE = String.raw`(function(){
@@ -259,18 +260,14 @@ export const VISION_TURN_BUDGET_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectVisionTurnBudgetClientPrelude(html) {
-  if (typeof html !== 'string' || html.includes(CLIENT_PRELUDE_MARK)) return html
-  const script = `<script ${CLIENT_PRELUDE_MARK}>${VISION_TURN_BUDGET_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')}</script>`
-  const closeHead = html.indexOf('</head>')
-  if (closeHead !== -1) return `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
-  return `${html}${script}`
+  return injectClientCarrierHtml(html, CLIENT_PRELUDE_MARK, VISION_TURN_BUDGET_CLIENT_PRELUDE)
 }
 
 export function installVisionTurnBudgetClientPrelude(ctx) {
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectVisionTurnBudgetClientPrelude),
-      'vision-router: turn budget client prelude',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: CLIENT_PRELUDE_MARK,
+    prelude: VISION_TURN_BUDGET_CLIENT_PRELUDE,
+    label: 'vision-router: turn budget client prelude',
+    injectHtml: injectVisionTurnBudgetClientPrelude,
   })
 }

package/lib/web/remote-settings-client.js

@@ -1,6 +1,6 @@
-import { htmlHasScriptMarker } from '../html-script-marker.js'
+import { injectClientCarrierHtml, installClientScriptCarriers } from '../client-script-carrier.js'
 import { installVisionRouterRemoteSettingsBridge } from '../remote-settings-bridge.js'
-import { installSettingsRc8ClientLifecycle } from '../settings-client-rc8-lifecycle.js'
+import { installSettingsClientLoaderLifecycle } from '../settings-client-loader-lifecycle.js'
 
 const SETTINGS_CONFIG_FORMS_MARK = 'data-vision-router-settings-configforms-compat'
 
@@ -187,26 +187,21 @@ export const SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE = String.raw`(function(){
 })();`
 
 export function injectSettingsConfigFormsCompatPrelude(html) {
-  if (typeof html !== 'string' || htmlHasScriptMarker(html, SETTINGS_CONFIG_FORMS_MARK)) return html
-  const safe = SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE.replace(/<\/script/gi, '<\\/script')
-  const script = `<script ${SETTINGS_CONFIG_FORMS_MARK}>${safe}</script>`
-  const closeHead = html.indexOf('</head>')
-  return closeHead === -1 ? `${html}${script}` : `${html.slice(0, closeHead)}${script}${html.slice(closeHead)}`
+  return injectClientCarrierHtml(html, SETTINGS_CONFIG_FORMS_MARK, SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE)
 }
 
 export function installSettingsConfigFormsCompat(ctx) {
-  if (!ctx || typeof ctx.inject !== 'function') return
-  ctx.inject(['webServer'], (webCtx) => {
-    webCtx.effect(
-      () => webCtx.webServer.tapIndex(injectSettingsConfigFormsCompatPrelude),
-      'vision-router: settings configForms compatibility',
-    )
+  installClientScriptCarriers(ctx, {
+    marker: SETTINGS_CONFIG_FORMS_MARK,
+    prelude: SETTINGS_CONFIG_FORMS_CLIENT_PRELUDE,
+    label: 'vision-router: settings configForms compatibility',
+    injectHtml: injectSettingsConfigFormsCompatPrelude,
   })
 }
 
 export function installVisionRemoteSettingsClient(ctx, logger) {
   installVisionRouterRemoteSettingsBridge(ctx, logger)
   installSettingsConfigFormsCompat(ctx)
-  installSettingsRc8ClientLifecycle(ctx)
+  installSettingsClientLoaderLifecycle(ctx)
   return ctx
 }