dsh-vision-router 2.2.8 → 3.0.0

package/lib/live-model-discovery.js

@@ -5,6 +5,11 @@ import process from 'node:process'
 import { resolveDshHome } from './doctor.js'
 import { MODEL_RESPONSE_MAX_BYTES, readResponseJsonBounded } from './http-body-limit.js'
 import { stripTrailingSlashes } from './string-normalization.js'
+import {
+  currentLegacyGlobalProxyFetch,
+  legacyGlobalProxyPairFor,
+  runWithLegacyGlobalProxyScope,
+} from './legacy-global-proxy-boundary.js'
 import { isLocalUiRequest } from './web-capability-boundary.js'
 
 export const LIVE_MODELS_PATH = '/_dsh/vision-router/live-models'
@@ -17,6 +22,10 @@ export const DEFAULT_MAX_MODELS_PER_PROVIDER = 2_000
 
 const SUPPORTED_DISCOVERY_PROTOCOLS = new Set(['openai-completions', 'openai-responses'])
 
+const moduleFetch = typeof globalThis.fetch === 'function'
+  ? globalThis.fetch.bind(globalThis)
+  : undefined
+
 function nonEmpty(value) {
   return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined
 }
@@ -162,19 +171,57 @@ async function saveCache(file, providers, fsOps) {
   await fsOps.rename(temporary, file)
 }
 
+function plainProviderMap(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined
+}
+
+/**
+ * Host-side provider profiles have two possible homes on a real DSH host:
+ *  - the settings service (some Host lines mirror a plugin's config there), and
+ *  - the profile configuration owned by the Host config editor, which is where
+ *    DSH 0.2.0-rc.2 keeps `llm-pi-ai.providers` (the Models page writes them
+ *    back to the profile patch, never to a settings section).
+ * Reading only the settings section made live discovery a dead path on that
+ * Host: `configuredProviderTransports()` returned `[]` and no `/models` probe
+ * could ever run.
+ */
+function configEditorProviders(ctx) {
+  try {
+    const editor = ctx?.get?.('configEditor')
+    if (editor === undefined || typeof editor.configuration !== 'function') return undefined
+    const rows = editor.configuration()
+    if (!Array.isArray(rows)) return undefined
+    const row = rows.find((candidate) => {
+      const options = candidate?.entry?.options
+      return options?.id === 'llm-pi-ai' || options?.name === '@deepseek-ai/dsh-llm-pi-ai'
+    })
+    if (row === undefined) return undefined
+    // The row exists, so an absent/empty providers map means "no providers are
+    // configured" — authoritative, which lets the cache drop removed entries.
+    // Only a missing row or an unavailable editor stays non-authoritative, so a
+    // transient read can never delete evidence.
+    const inherited = plainProviderMap(row.inherited?.providers) ?? {}
+    const override = plainProviderMap(row.override?.providers) ?? {}
+    return { ...inherited, ...override }
+  } catch {
+    return undefined
+  }
+}
+
 function piProfilesState(ctx) {
   try {
     const settings = ctx?.get?.('settings')
-    if (!settings || typeof settings.get !== 'function') return { authoritative: false, providers: {} }
-    const value = settings.get('llm-pi-ai')
-    const providers = value?.providers
-    if (!providers || typeof providers !== 'object' || Array.isArray(providers)) {
-      return { authoritative: false, providers: {} }
+    if (settings && typeof settings.get === 'function') {
+      const value = settings.get('llm-pi-ai')
+      const providers = plainProviderMap(value?.providers)
+      if (providers !== undefined) return { authoritative: true, providers }
     }
-    return { authoritative: true, providers }
   } catch {
-    return { authoritative: false, providers: {} }
+    // Fall through to the profile-configuration source below.
   }
+  const fromEditor = configEditorProviders(ctx)
+  if (fromEditor !== undefined) return { authoritative: true, providers: fromEditor }
+  return { authoritative: false, providers: {} }
 }
 
 function rawPiProfiles(ctx) {
@@ -190,6 +237,21 @@ function providerConfigurationToken(provider, raw) {
   ])
 }
 
+// The boundary resolves its pair list from the live config; read the same shape so
+// the scope we open is one the boundary will accept.
+function liveProxyConfig(ctx, fallbackConfig = {}) {
+  try {
+    const settings = ctx?.get?.('settings')
+    const live = settings?.get?.('vision-router')
+    if (live !== null && typeof live === 'object' && !Array.isArray(live)) {
+      return { ...fallbackConfig, ...live }
+    }
+  } catch {
+    // Fall back to the composition config.
+  }
+  return fallbackConfig
+}
+
 function visionProviderPriority(ctx, fallbackConfig = {}) {
   const preferred = new Set()
   const collect = (value) => {
@@ -350,7 +412,13 @@ function boundedError(error) {
 
 export function createLiveModelDiscoveryManager(ctx, options = {}) {
   const now = typeof options.now === 'function' ? options.now : Date.now
-  const fetchImpl = typeof options.fetchImpl === 'function' ? options.fetchImpl : globalThis.fetch
+  // The proxy boundary installs its wrapper after apply() returns, so a capture
+  // taken here would keep the raw host fetch and silently ignore a configured
+  // `proxy` in the probes below. Ask the boundary for the fetch it currently owns
+  // instead of reading the process global at call time (L1-sealed-process-global);
+  // the module-load capture stays as the last-resort fallback.
+  const injectedFetch = typeof options.fetchImpl === 'function' ? options.fetchImpl : undefined
+  const resolveFetch = () => injectedFetch ?? currentLegacyGlobalProxyFetch() ?? moduleFetch
   const freshMs = Math.max(1_000, Number(options.freshMs) || DEFAULT_LIVE_MODEL_FRESH_MS)
   const staleMs = Math.max(freshMs, Number(options.staleMs) || DEFAULT_LIVE_MODEL_STALE_MS)
   const timeoutMs = Math.max(500, Number(options.timeoutMs) || DEFAULT_LIVE_MODEL_TIMEOUT_MS)
@@ -510,11 +578,15 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     try {
       const headers = { accept: 'application/json' }
       if (plan.apiKey !== undefined) headers.authorization = `Bearer ${plan.apiKey}`
-      const response = await fetchImpl(listingURL(plan.baseURL), {
+      const probe = () => resolveFetch()(listingURL(plan.baseURL), {
         method: 'GET',
         headers,
         signal: controller.signal,
       })
+      const proxyPair = legacyGlobalProxyPairFor(liveProxyConfig(ctx, fallbackConfig), provider)
+      const response = proxyPair === undefined
+        ? await probe()
+        : await runWithLegacyGlobalProxyScope(proxyPair.provider, proxyPair.model, probe)
       if (!response?.ok) {
         const error = new Error(`provider model listing answered HTTP ${response?.status ?? 'unknown'}`)
         error.status = response?.status
@@ -673,42 +745,61 @@ export function installLiveModelDiscovery(ctx, options = {}) {
     // Event forwarding is an optimization; the request path still refreshes.
   }
 
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(() => webCtx.webServer.register({
-      kind: 'exact',
-      path: LIVE_MODELS_PATH,
-      handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          res.setHeader('Allow', 'GET')
-          sendJson(res, 405, { ok: false, error: 'method not allowed' })
-          return
-        }
-        try {
-          const url = new URL(req.url ?? LIVE_MODELS_PATH, 'http://localhost')
-          // The snapshot itself is safe for an authenticated remote Settings UI,
-          // but refresh drives Host-side provider I/O and may resolve stored
-          // credentials. Preserve local ?refresh=1 behavior while making every
-          // remote GET a passive read of already-owned discovery state.
-          const schedule = isLocalUiRequest(req) && url.searchParams.get('refresh') !== '0'
-          sendJson(res, 200, await manager.snapshot({ schedule }))
-        } catch (error) {
-          sendJson(res, 500, { ok: false, error: boundedError(error) })
-        }
-      },
-    }), 'vision-router: live provider model discovery')
-  })
+  let disposePromise
+  const disposeLifecycle = () => {
+    if (disposePromise) return disposePromise
+    lifecycleDisposed = true
+    if (startupTimer !== undefined) {
+      clearTimeout(startupTimer)
+      startupTimer = undefined
+    }
+    for (const dispose of disposers.splice(0)) {
+      try { dispose() } catch { /* best effort */ }
+    }
+    disposePromise = Promise.resolve(manager.dispose())
+    return disposePromise
+  }
 
+  // Own every timer/listener/manager resource before any later Host seam can
+  // throw. This keeps injection failure from stranding a live generation.
   try {
-    ctx?.effect?.(() => () => {
-      lifecycleDisposed = true
-      if (startupTimer !== undefined) clearTimeout(startupTimer)
-      for (const dispose of disposers) {
-        try { dispose() } catch { /* best effort */ }
-      }
-      void manager.dispose()
-    }, 'vision-router: live model discovery lifecycle')
-  } catch {
-    // Host service disposal still tears down the registered route.
+    ctx?.effect?.(
+      () => disposeLifecycle,
+      'vision-router: live model discovery lifecycle',
+    )
+  } catch (error) {
+    void disposeLifecycle().catch(() => {})
+    throw error
+  }
+
+  try {
+    ctx?.inject?.(['webServer'], (webCtx) => {
+      webCtx.effect(() => webCtx.webServer.register({
+        kind: 'exact',
+        path: LIVE_MODELS_PATH,
+        handler: async (req, res) => {
+          if (req.method !== 'GET') {
+            res.setHeader('Allow', 'GET')
+            sendJson(res, 405, { ok: false, error: 'method not allowed' })
+            return
+          }
+          try {
+            const url = new URL(req.url ?? LIVE_MODELS_PATH, 'http://localhost')
+            // The snapshot itself is safe for an authenticated remote Settings UI,
+            // but refresh drives Host-side provider I/O and may resolve stored
+            // credentials. Preserve local ?refresh=1 behavior while making every
+            // remote GET a passive read of already-owned discovery state.
+            const schedule = isLocalUiRequest(req) && url.searchParams.get('refresh') !== '0'
+            sendJson(res, 200, await manager.snapshot({ schedule }))
+          } catch (error) {
+            sendJson(res, 500, { ok: false, error: boundedError(error) })
+          }
+        },
+      }), 'vision-router: live provider model discovery')
+    })
+  } catch (error) {
+    void disposeLifecycle().catch(() => {})
+    throw error
   }
   return manager
 }

package/lib/local-remote-settings-permission.js

@@ -173,10 +173,16 @@ export function createVisionRouterLocalPermissionHttpHandler(settings, logger) {
   }
 }
 
-export const LOCAL_PERMISSION_CLIENT_PRELUDE = String.raw`(function(){
-  'use strict';
-  var ENDPOINT = '/_dsh/vision-router/remote-settings-permission';
-  var FIELD = 'allowRemoteSettings';
+/**
+ * Current-product browser boundary for the local allowRemoteSettings control.
+ * Host loader lifecycle compatibility stays outside this owner.
+ */
+export function createLocalRemoteSettingsPermissionClientBoundary(options = {}) {
+  var fetchImpl = options.fetchImpl
+  var ENDPOINT = options.endpoint
+  var FIELD = options.field
+  if (typeof ENDPOINT !== 'string' || ENDPOINT === '') throw new TypeError('local permission boundary requires endpoint')
+  if (typeof FIELD !== 'string' || FIELD === '') throw new TypeError('local permission boundary requires field')
   var scopeCache = typeof WeakMap === 'function' ? new WeakMap() : undefined;
   var binderCache = typeof WeakMap === 'function' ? new WeakMap() : undefined;
   var contextCache = typeof WeakMap === 'function' ? new WeakMap() : undefined;
@@ -189,11 +195,11 @@ export const LOCAL_PERMISSION_CLIENT_PRELUDE = String.raw`(function(){
   }
 
   async function writePermission(operation, value, revision) {
-    if (typeof fetch !== 'function') throw new Error('Vision Router local settings transport is unavailable');
+    if (typeof fetchImpl !== 'function') throw new Error('Vision Router local settings transport is unavailable');
     var payload = { operation: operation };
     if (operation === 'set') payload.value = value;
     if (Number.isInteger(revision) && revision >= 0) payload.expectedRevision = revision;
-    var response = await fetch(ENDPOINT, {
+    var response = await fetchImpl(ENDPOINT, {
       method: 'POST',
       headers: { 'content-type': 'application/json', accept: 'application/json' },
       body: JSON.stringify(payload)
@@ -366,6 +372,26 @@ export const LOCAL_PERMISSION_CLIENT_PRELUDE = String.raw`(function(){
     return wrapped;
   }
 
+
+  return { wrapContext: wrapContext }
+}
+
+export const LOCAL_PERMISSION_CLIENT_BOUNDARY_SOURCE =
+  'var createLocalRemoteSettingsPermissionClientBoundary = (' +
+  createLocalRemoteSettingsPermissionClientBoundary.toString() +
+  ');'
+
+export const LOCAL_PERMISSION_CLIENT_PRELUDE = String.raw`(function(){
+  'use strict';
+  ${LOCAL_PERMISSION_CLIENT_BOUNDARY_SOURCE}
+  var localPermissionBoundary = createLocalRemoteSettingsPermissionClientBoundary({
+    endpoint: '${LOCAL_REMOTE_SETTINGS_PERMISSION_PATH}',
+    field: '${LOCAL_REMOTE_SETTINGS_PERMISSION_FIELD}',
+    fetchImpl: typeof fetch === 'function'
+      ? function(url, options) { return fetch(url, options); }
+      : undefined
+  });
+
   function patchLoader(loader) {
     if (!loader || typeof loader.load !== 'function' || loader.load.__visionRouterLocalPermission) return;
     var original = loader.load;
@@ -379,7 +405,7 @@ export const LOCAL_PERMISSION_CLIENT_PRELUDE = String.raw`(function(){
               var apply = exports.apply;
               var wrappedApply = function(ctx) {
                 var rest = Array.prototype.slice.call(arguments, 1);
-                return apply.apply(exports, [wrapContext(ctx)].concat(rest));
+                return apply.apply(exports, [localPermissionBoundary.wrapContext(ctx)].concat(rest));
               };
               Object.defineProperty(wrappedApply, '__visionRouterLocalPermission', { value: true });
               exports.apply = wrappedApply;

package/lib/local-vision-stabilizer.js

@@ -180,7 +180,12 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
   }
 
   const localMessages = async (options) => {
-    const attachments = ctx.get('attachments')
+    let attachments
+    try {
+      attachments = typeof ctx?.get === 'function' ? ctx.get('attachments') : undefined
+    } catch {
+      attachments = undefined
+    }
     const current = actualConfig()
     const messages = []
     for (const message of options.messages ?? []) {
@@ -380,11 +385,8 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
           const scope = target.register(namespace, schema, fixedOptions)
           if (namespace === 'vision-router') {
             rawScope = scope
-            captureConfig(undefined, scope)
-            syncScreenshot()
-            // The Settings service is dynamic. Never keep its scope after the
-            // owning injection fiber unloads; during the gap fall back to the
-            // composition config, then bind the new scope on service restore.
+            // The Settings service is dynamic. Establish ownership before the
+            // scope can change screenshot state or install wrapped watchers.
             try {
               ownerCtx?.effect?.(
                 () => () => {
@@ -396,8 +398,12 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
                 'vision-router: local settings scope lifecycle',
               )
             } catch {
-              /* lifecycle hardening must not block Settings registration */
+              if (rawScope === scope) rawScope = undefined
+              resolvedConfig = config
+              return scope
             }
+            captureConfig(undefined, scope)
+            syncScreenshot()
             return wrapScope(scope)
           }
           return scope
@@ -459,7 +465,10 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
         'vision-router: screenshot permission route lifecycle',
       )
     } catch {
-      /* parent stabilizer cleanup remains a final fallback */
+      // webServer.register() is caller-owned in supported DSH Hosts. If this
+      // injected child cannot own the disposer, withdraw the route now rather
+      // than keeping it alive until the parent DVR generation eventually exits.
+      releaseScreenshotPermissionRoute(webServer, handle)
     }
   }
 
@@ -511,20 +520,25 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
       }
     : undefined
 
+  const disposeLifecycle = () => {
+    rawScope = undefined
+    unmountScreenshot()
+    for (const [webServer, handle] of screenshotPermissionRoutes) {
+      releaseScreenshotPermissionRoute(webServer, handle)
+    }
+    screenshotPermissionRoutes.clear()
+  }
+
   try {
     ctx.effect?.(
-      () => () => {
-        rawScope = undefined
-        unmountScreenshot()
-        for (const [webServer, handle] of screenshotPermissionRoutes) {
-          releaseScreenshotPermissionRoute(webServer, handle)
-        }
-        screenshotPermissionRoutes.clear()
-      },
+      () => disposeLifecycle,
       'vision-router: local vision stabilizer',
     )
   } catch {
-    /* cleanup registration is best effort */
+    // Routes/settings state may already have been admitted above. Roll them
+    // back immediately and do not expose an unowned wrapper to this generation.
+    disposeLifecycle()
+    return { ctx, bootConfig }
   }
 
   const stabilizedCtx = new Proxy(ctx, {

package/lib/maintenance-routes.js

@@ -0,0 +1,134 @@
+import { randomBytes } from 'node:crypto'
+import { createCachedUpdateChecker } from './update-check.js'
+import { detectDshSelfUpdatePlan, runDshPluginUpdate } from './self-update.js'
+
+function json(res, status, body, headers = {}) {
+  res.writeHead(status, {
+    'content-type': 'application/json',
+    ...headers,
+  })
+  res.end(JSON.stringify(body))
+}
+
+/**
+ * Product-maintenance Web routes kept outside the visual Core.
+ *
+ * The supplied context must already carry DVR's Web capability/auth boundary;
+ * this installer deliberately owns only update-product state and the narrow
+ * per-route CSRF/replay checks that existed in Core before extraction.
+ */
+export function installVisionMaintenanceRoutes(ctx, options = {}) {
+  if (!ctx || typeof ctx.inject !== 'function') return
+  const logger = options.logger ?? ctx.logger
+  const updateChecker = options.updateChecker ?? createCachedUpdateChecker()
+  const selfUpdatePlan = options.selfUpdatePlan ?? detectDshSelfUpdatePlan()
+  const updateRunner = options.runUpdate ?? runDshPluginUpdate
+  const tokenFactory = options.tokenFactory ?? (() => randomBytes(24).toString('base64url'))
+  let selfUpdateToken = tokenFactory()
+  let selfUpdateInFlight
+
+  const updateResultForClient = (result) => ({
+    ...result,
+    autoUpdate: {
+      supported: selfUpdatePlan.available === true,
+      method: selfUpdatePlan.available === true ? selfUpdatePlan.method : undefined,
+      profile: selfUpdatePlan.profile,
+      reason: selfUpdatePlan.available === true ? undefined : selfUpdatePlan.reason,
+      token:
+        selfUpdatePlan.available === true &&
+        result &&
+        result.ok === true &&
+        result.updateAvailable === true
+          ? selfUpdateToken
+          : undefined,
+    },
+  })
+
+  void updateChecker.check(false).then((result) => {
+    if (result && result.ok === true && result.updateAvailable === true) {
+      logger?.info?.(
+        'vision-router: update available %s -> %s',
+        result.currentVersion,
+        result.latestVersion,
+      )
+    }
+  })
+
+  ctx.inject(['webServer'], (webCtx) => {
+    webCtx.effect(
+      () => webCtx.webServer.register({
+        kind: 'exact',
+        path: '/_dsh/vision-router/update-check',
+        handler: async (req, res) => {
+          if (req.method !== 'GET') {
+            res.setHeader('Allow', 'GET')
+            res.writeHead(405)
+            res.end()
+            return
+          }
+          const force = /(?:[?&])force=1(?:&|$)/.test(String(req.url ?? ''))
+          const result = await updateChecker.check(force)
+          json(res, 200, updateResultForClient(result), { 'cache-control': 'no-store' })
+        },
+      }),
+      'vision-router: update-check route',
+    )
+
+    webCtx.effect(
+      () => webCtx.webServer.register({
+        kind: 'exact',
+        path: '/_dsh/vision-router/self-update',
+        handler: async (req, res) => {
+          if (req.method !== 'POST') {
+            res.setHeader('Allow', 'POST')
+            res.writeHead(405)
+            res.end()
+            return
+          }
+          const fetchSite = String(req.headers?.['sec-fetch-site'] ?? '')
+          if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'none') {
+            json(res, 403, { ok: false, error: 'cross-origin update request rejected' })
+            return
+          }
+          const token = String(req.headers?.['x-dsh-vision-router-update-token'] ?? '')
+          if (!token || token !== selfUpdateToken) {
+            json(res, 403, { ok: false, error: 'invalid update token' })
+            return
+          }
+          if (selfUpdatePlan.available !== true) {
+            json(res, 409, { ok: false, error: 'automatic update is not safe for this DSH launch' })
+            return
+          }
+          try {
+            const fresh = await updateChecker.check(true)
+            if (!fresh || fresh.ok !== true) {
+              json(res, 502, { ok: false, error: fresh?.error || 'could not refresh update metadata' })
+              return
+            }
+            if (fresh.updateAvailable !== true) {
+              json(res, 409, { ok: false, error: 'no newer version is currently available' })
+              return
+            }
+            if (!selfUpdateInFlight) {
+              const pending = updateRunner(selfUpdatePlan, { targetVersion: fresh.latestVersion })
+              selfUpdateInFlight = pending
+              void pending.then(
+                () => { if (selfUpdateInFlight === pending) selfUpdateInFlight = undefined },
+                () => { if (selfUpdateInFlight === pending) selfUpdateInFlight = undefined },
+              )
+            }
+            const result = await selfUpdateInFlight
+            selfUpdateToken = tokenFactory()
+            json(res, 200, result, { 'cache-control': 'no-store' })
+          } catch (error) {
+            json(res, 500, {
+              ok: false,
+              error: error && error.message ? error.message : String(error),
+            })
+          }
+        },
+      }),
+      'vision-router: self-update route',
+    )
+  })
+}

package/lib/native-image-coexistence.js

@@ -385,7 +385,7 @@ export function currentSessionVisionPolicy() {
   return imageTurn.getStore()?.policy
 }
 
-function settingsServiceView(settings, state) {
+function settingsServiceView(settings, state, ownerCtx) {
   if (!isObject(settings)) return settings
   return new Proxy(settings, {
     get(target, property) {
@@ -394,7 +394,19 @@ function settingsServiceView(settings, state) {
         if (typeof register !== 'function') return register
         return (namespace, ...args) => {
           const scope = register.call(target, namespace, ...args)
-          if (namespace === 'vision-router') state.settingsScope = scope
+          if (namespace !== 'vision-router') return scope
+          try {
+            if (typeof ownerCtx?.effect !== 'function') return scope
+            ownerCtx.effect(
+              () => () => {
+                if (state.settingsScope === scope) state.settingsScope = undefined
+              },
+              'vision-router: native image settings lifecycle',
+            )
+          } catch {
+            return scope
+          }
+          state.settingsScope = scope
           return scope
         }
       }
@@ -406,7 +418,7 @@ function settingsServiceView(settings, state) {
 
 function injectedContextView(child, state) {
   if (!isObject(child)) return child
-  const settings = settingsServiceView(child.settings, state)
+  const settings = settingsServiceView(child.settings, state, child)
   return new Proxy(child, {
     get(target, property) {
       if (property === 'settings') return settings