dsh-vision-router 2.2.8 → 3.0.0

package/lib/settings-client-017-compat.js

@@ -14,14 +14,11 @@ export const SETTINGS_017_CLIENT_PRELUDE = String.raw`(function(){
   var connectionCache = typeof WeakMap === 'function' ? new WeakMap() : undefined;
 
   function safeGet(ctx, name) {
-    if (!ctx) return undefined;
+    if (!ctx || typeof ctx.get !== 'function') return undefined;
     try {
-      if (typeof ctx.get === 'function') {
-        var value = ctx.get(name);
-        if (value !== undefined && value !== null) return value;
-      }
-    } catch (_) {}
-    try { return ctx[name]; } catch (_) { return undefined; }
+      var value = ctx.get(name);
+      return value === undefined || value === null ? undefined : value;
+    } catch (_) { return undefined; }
   }
 
   function isLoopbackLocation(locationLike) {
@@ -212,6 +209,11 @@ export const SETTINGS_017_CLIENT_PRELUDE = String.raw`(function(){
           var getter = Reflect.get(target, property, target);
           if (typeof getter !== 'function') return getter;
           return function(name) {
+            if (name === 'settingsScope') {
+              var original = safeGet(target, 'settingsScope');
+              if (original && typeof original.bind === 'function') return original;
+              return syntheticBinder(ctx, configFormsBinder(target));
+            }
             var value = getter.call(target, name);
             return name === 'connection' ? normalizeConnection(value) : value;
           };

package/lib/settings-client-loader-lifecycle.js

@@ -0,0 +1,129 @@
+import { injectClientCarrierHtml, installClientScriptCarriers } from './client-script-carrier.js'
+import {
+  LOCAL_PERMISSION_CLIENT_BOUNDARY_SOURCE,
+  LOCAL_REMOTE_SETTINGS_PERMISSION_FIELD,
+  LOCAL_REMOTE_SETTINGS_PERMISSION_PATH,
+} from './local-remote-settings-permission.js'
+import { REMOTE_SETTINGS_RISK_CLIENT_BOUNDARY_SOURCE } from './remote-settings-risk-client-boundary.js'
+
+// Keep the legacy marker value so mixed-generation/HMR pages do not install
+// a second lifecycle wrapper after the source/API rename.
+const SETTINGS_CLIENT_LOADER_LIFECYCLE_MARK = 'data-vision-router-settings-rc8-lifecycle'
+
+/**
+ * Supported Hosts can replace ModuleLoader.load() inside loader.create(). This
+ * compatibility owner only re-attaches the current local-permission and
+ * remote-risk product boundaries after that queue-to-live transition; product
+ * semantics stay in their capability owners.
+ */
+export const SETTINGS_CLIENT_LOADER_LIFECYCLE_PRELUDE = String.raw`(function(){
+  'use strict';
+  var TARGET = 'dsh-vision-router';
+  ${LOCAL_PERMISSION_CLIENT_BOUNDARY_SOURCE}
+  var localPermissionBoundary = createLocalRemoteSettingsPermissionClientBoundary({
+    endpoint: '${LOCAL_REMOTE_SETTINGS_PERMISSION_PATH}',
+    field: '${LOCAL_REMOTE_SETTINGS_PERMISSION_FIELD}',
+    fetchImpl: typeof fetch === 'function'
+      ? function(url, options) { return fetch(url, options); }
+      : undefined
+  });
+
+  ${REMOTE_SETTINGS_RISK_CLIENT_BOUNDARY_SOURCE}
+  var riskBoundary = createRemoteSettingsRiskClientBoundary({
+    confirmImpl: function(message) {
+      return typeof window.confirm === 'function' && window.confirm(message) === true;
+    },
+    alertImpl: function(message) {
+      try { if (typeof window.alert === 'function') window.alert(message); } catch (_) {}
+    },
+    locale: function() {
+      try {
+        return String((document && document.documentElement && document.documentElement.lang)
+          || (navigator && navigator.language) || '');
+      } catch (_) { return ''; }
+    },
+    location: function() {
+      try { return window && window.location; } catch (_) { return undefined; }
+    },
+    normalizeLoopback: true
+  });
+
+  function patchLiveLoader(loader) {
+    if (!loader || typeof loader.load !== 'function' || loader.load.__visionRouterSettingsRc8Lifecycle) return;
+    var original = loader.load;
+    function load(spec) {
+      if (spec && spec.id === TARGET && typeof spec.factory === 'function') {
+        var factory = spec.factory;
+        spec = Object.assign({}, spec, {
+          factory: function(require) {
+            var exports = factory(require);
+            if (exports && typeof exports.apply === 'function' && !exports.apply.__visionRouterSettingsRc8Lifecycle) {
+              var apply = exports.apply;
+              var wrappedApply = function(ctx) {
+                var rest = Array.prototype.slice.call(arguments, 1);
+                var nextCtx = riskBoundary.wrapContext(localPermissionBoundary.wrapContext(ctx));
+                return apply.apply(exports, [nextCtx].concat(rest));
+              };
+              Object.defineProperty(wrappedApply, '__visionRouterSettingsRc8Lifecycle', { value: true });
+              exports.apply = wrappedApply;
+            }
+            return exports;
+          }
+        });
+      }
+      return original.call(this, spec);
+    }
+    Object.defineProperty(load, '__visionRouterSettingsRc8Lifecycle', { value: true });
+    loader.load = load;
+  }
+
+  function patchCreate(loader) {
+    if (!loader || typeof loader.create !== 'function' || loader.create.__visionRouterSettingsRc8Lifecycle) return;
+    var originalCreate = loader.create;
+    function create() {
+      var result = originalCreate.apply(this, arguments);
+      patchLiveLoader(loader);
+      return result;
+    }
+    Object.defineProperty(create, '__visionRouterSettingsRc8Lifecycle', { value: true });
+    loader.create = create;
+    if (loader.mode === 'live') patchLiveLoader(loader);
+  }
+
+  function install() {
+    if (window.__ModuleLoader__) {
+      patchCreate(window.__ModuleLoader__);
+      return;
+    }
+    var descriptor = Object.getOwnPropertyDescriptor(window, '__ModuleLoader__');
+    if (descriptor && descriptor.configurable === false) return;
+    var previousGet = descriptor && descriptor.get;
+    var previousSet = descriptor && descriptor.set;
+    var stored = descriptor && Object.prototype.hasOwnProperty.call(descriptor, 'value') ? descriptor.value : undefined;
+    Object.defineProperty(window, '__ModuleLoader__', {
+      configurable: true,
+      enumerable: !descriptor || descriptor.enumerable !== false,
+      get: function(){ return previousGet ? previousGet.call(window) : stored; },
+      set: function(value) {
+        if (previousSet) previousSet.call(window, value); else stored = value;
+        try { patchCreate(previousGet ? previousGet.call(window) : value); } catch (_) {}
+      }
+    });
+    if (stored) patchCreate(stored);
+  }
+
+  try { install(); } catch (_) {}
+})();`
+
+export function injectSettingsClientLoaderLifecyclePrelude(html) {
+  return injectClientCarrierHtml(html, SETTINGS_CLIENT_LOADER_LIFECYCLE_MARK, SETTINGS_CLIENT_LOADER_LIFECYCLE_PRELUDE)
+}
+
+export function installSettingsClientLoaderLifecycle(ctx) {
+  installClientScriptCarriers(ctx, {
+    marker: SETTINGS_CLIENT_LOADER_LIFECYCLE_MARK,
+    prelude: SETTINGS_CLIENT_LOADER_LIFECYCLE_PRELUDE,
+    label: 'vision-router: settings client loader lifecycle',
+    injectHtml: injectSettingsClientLoaderLifecyclePrelude,
+  })
+}

package/lib/sharp-runtime.js

@@ -10,7 +10,6 @@ import { Worker } from 'node:worker_threads'
 import { createRequire } from 'node:module'
 import { pathToFileURL } from 'node:url'
 import { promisify } from 'node:util'
-import { appendPromptToImageOnlyMessage, fetchWithOpenAICompatibility } from './http-compat.js'
 import {
   directSessionAffinityHeaders,
   isOfficialOpenCodeGoUrl,
@@ -19,12 +18,6 @@ import {
   sessionIdentityOf,
 } from './session-affinity.js'
 import { runWithVisionSessionAffinity, streamWithVisionSessionAffinity } from './session-affinity-runtime.js'
-import {
-  routingCorrectionFor,
-  toAnthropicMessages,
-  callAnthropicCompatible,
-  anthropicMediaType,
-} from './catalog-corrections.js'
 import { createCachedUpdateChecker } from './update-check.js'
 import { probeLocalBackends } from './local-connection-probe.js'
 import { detectDshSelfUpdatePlan, runDshPluginUpdate } from './self-update.js'

package/lib/structured-flow-hardening.js

@@ -4,6 +4,7 @@ import {
 } from './turn-budget-context.js'
 import { runWithDepthConfig } from './depth-guidance.js'
 import { runtimeLanguageFor } from './runtime-i18n.js'
+import { visionRouterMessageSource } from './session-message-source-compat.js'
 
 const STRUCTURED_EVIDENCE_TOOLS = new Set([
   'vision_describe',
@@ -440,7 +441,7 @@ function appendGuardMessage(decision, payload, state, config) {
               ? '已达到本轮设置的深挖次数上限。不要再调用视觉工具；请基于已经获得的证据作答，并明确仍存在的不确定性。'
               : '连续多次后续视觉调用都没有产出可用证据。不要继续重复调用视觉工具；请基于已经获得的证据作答，并明确仍存在的不确定性。',
       }],
-      source: { kind: 'plugin', plugin: 'dsh-vision-router' },
+      source: visionRouterMessageSource(payload?.agent?.session),
     }
     return appendSyntheticGuardOnce(decision, baseMessages, state, message, true)
   }
@@ -461,7 +462,7 @@ function appendGuardMessage(decision, payload, state, config) {
         ? 'The structured bootstrap is complete, but no usable task-directed visual evidence has been produced yet. Call at least one vision tool that can add or verify evidence, then answer after it succeeds.'
         : '结构化预识别已经完成，但目前还没有产出可用的任务定向视觉证据。请至少调用一个能新增或验证证据的视觉工具，成功后再作答。',
     }],
-    source: { kind: 'plugin', plugin: 'dsh-vision-router' },
+    source: visionRouterMessageSource(payload?.agent?.session),
   }
   return appendSyntheticGuardOnce(decision, baseMessages, state, message)
 }
@@ -629,7 +630,7 @@ function wrapSettingsScope(scope) {
   })
 }
 
-function wrapSettingsService(settings, setScope) {
+function wrapSettingsService(settings, bindScope) {
   if (!settings || typeof settings !== 'object') return settings
   return new Proxy(settings, {
     get(target, property) {
@@ -642,7 +643,7 @@ function wrapSettingsService(settings, setScope) {
       return (namespace, ...args) => {
         const scope = register.call(target, namespace, ...args)
         if (namespace !== 'vision-router') return scope
-        setScope(scope)
+        if (bindScope(scope) !== true) return scope
         return wrapSettingsScope(scope)
       }
     },
@@ -651,7 +652,8 @@ function wrapSettingsService(settings, setScope) {
 
 function wrapSettingsContext(childCtx, setScope) {
   if (!childCtx || typeof childCtx !== 'object' || !childCtx.settings) return childCtx
-  const settings = wrapSettingsService(childCtx.settings, setScope)
+  const bindScope = (scope) => setScope(scope, childCtx)
+  const settings = wrapSettingsService(childCtx.settings, bindScope)
   return new Proxy(childCtx, {
     get(target, property) {
       if (property === 'settings') return settings
@@ -665,7 +667,24 @@ export function installStructuredFlowHardening(ctx, config = {}) {
   if (!ctx || typeof ctx !== 'object') return ctx
   const states = new WeakMap()
   let settingsScope
-  const setSettingsScope = (scope) => { settingsScope = scope }
+  const setSettingsScope = (scope, ownerCtx) => {
+    if (!scope || (typeof scope !== 'object' && typeof scope !== 'function')) return false
+    // Settings is a dynamic child service. Never retain a scope unless the
+    // child fiber owns its lifetime; otherwise an HMR gap can read stale config.
+    try {
+      if (typeof ownerCtx?.effect !== 'function') return false
+      ownerCtx.effect(
+        () => () => {
+          if (settingsScope === scope) settingsScope = undefined
+        },
+        'vision-router: structured flow settings lifecycle',
+      )
+    } catch {
+      return false
+    }
+    settingsScope = scope
+    return true
+  }
   const activeConfig = () => {
     try {
       const value = settingsScope && typeof settingsScope.get === 'function' ? settingsScope.get() : config

package/lib/tesseract-exec-compat.js

@@ -326,7 +326,15 @@ export function installVisionRouterExecFileCompat(ctx, options = {}) {
   }
 
   if (ctx && typeof ctx.effect === 'function') {
-    ctx.effect(() => dispose, 'vision-router: execFile compatibility')
+    try {
+      ctx.effect(() => dispose, 'vision-router: execFile compatibility')
+    } catch (error) {
+      // The process-global execFile seam was already mutated above. If Cordis
+      // cannot own this generation, undo exactly this installation before the
+      // failure escapes so no orphan patch survives HMR/startup failure.
+      dispose()
+      throw error
+    }
   }
   return dispose
 }

package/lib/turn-budget-context.js

@@ -1,58 +1,64 @@
-import { AsyncLocalStorage } from 'node:async_hooks'
-
-const turnBudgetScope = new AsyncLocalStorage()
-
+import { AsyncLocalStorage } from 'node:async_hooks';
+const turnBudgetScope = new AsyncLocalStorage();
 function usableSignal(value) {
-  return value && typeof value === 'object' && typeof value.aborted === 'boolean' ? value : undefined
+    return value !== null
+        && typeof value === 'object'
+        && typeof value.aborted === 'boolean'
+        ? value
+        : undefined;
 }
-
 function finiteDeadline(value) {
-  const number = Number(value)
-  return Number.isFinite(number) ? number : undefined
+    const number = Number(value);
+    return Number.isFinite(number) ? number : undefined;
+}
+function objectBudget(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
 }
-
 /**
  * Run one async tool execution inside an ambient turn-level budget.
  * Nested budgets may tighten the parent, but may not discard an earlier parent
  * deadline, cancellation signal or artifact-run identity.
  */
 export function runWithVisionTurnBudget(budget, fn) {
-  if (typeof fn !== 'function') throw new TypeError('runWithVisionTurnBudget: fn must be a function')
-  const parent = turnBudgetScope.getStore()
-  const parentSignal = usableSignal(parent?.signal)
-  const childSignal = usableSignal(budget?.signal)
-  const parentDeadline = finiteDeadline(parent?.deadlineAt)
-  const childDeadline = finiteDeadline(budget?.deadlineAt)
-  let next = budget
-  if (parentSignal && childSignal && parentSignal !== childSignal) {
-    next = { ...(next ?? {}), signal: AbortSignal.any([parentSignal, childSignal]) }
-  } else if (parentSignal && !childSignal) {
-    next = { ...(next ?? {}), signal: parentSignal }
-  }
-  if (parentDeadline !== undefined && (childDeadline === undefined || parentDeadline < childDeadline)) {
-    next = { ...(next ?? {}), deadlineAt: parentDeadline }
-  }
-  if (
-    typeof parent?.artifactRunId === 'string' &&
-    parent.artifactRunId !== '' &&
-    !(typeof next?.artifactRunId === 'string' && next.artifactRunId !== '')
-  ) {
-    next = { ...(next ?? {}), artifactRunId: parent.artifactRunId }
-  }
-  return turnBudgetScope.run(next, fn)
+    if (typeof fn !== 'function')
+        throw new TypeError('runWithVisionTurnBudget: fn must be a function');
+    const parent = turnBudgetScope.getStore();
+    const parentSignal = usableSignal(parent?.signal);
+    const childSignal = usableSignal(budget?.signal);
+    const parentDeadline = finiteDeadline(parent?.deadlineAt);
+    const childDeadline = finiteDeadline(budget?.deadlineAt);
+    let next = objectBudget(budget);
+    if (parentSignal && childSignal && parentSignal !== childSignal) {
+        next = { ...(next ?? {}), signal: AbortSignal.any([parentSignal, childSignal]) };
+    }
+    else if (parentSignal && !childSignal) {
+        next = { ...(next ?? {}), signal: parentSignal };
+    }
+    if (parentDeadline !== undefined && (childDeadline === undefined || parentDeadline < childDeadline)) {
+        next = { ...(next ?? {}), deadlineAt: parentDeadline };
+    }
+    if (typeof parent?.artifactRunId === 'string'
+        && parent.artifactRunId !== ''
+        && !(typeof next?.artifactRunId === 'string' && next.artifactRunId !== '')) {
+        next = { ...(next ?? {}), artifactRunId: parent.artifactRunId };
+    }
+    return turnBudgetScope.run(next, fn);
 }
-
 export function currentVisionTurnBudget() {
-  return turnBudgetScope.getStore()
+    return turnBudgetScope.getStore();
 }
-
 export function currentVisionTurnBudgetSignal() {
-  return turnBudgetScope.getStore()?.signal
+    return usableSignal(turnBudgetScope.getStore()?.signal);
 }
-
 export function remainingVisionTurnBudgetMs(now = Date.now) {
-  const budget = turnBudgetScope.getStore()
-  if (!budget || !Number.isFinite(Number(budget.deadlineAt))) return undefined
-  const clock = typeof now === 'function' ? now : Date.now
-  return Math.max(0, Number(budget.deadlineAt) - Number(clock()))
+    const budget = turnBudgetScope.getStore();
+    const deadlineAt = finiteDeadline(budget?.deadlineAt);
+    if (deadlineAt === undefined)
+        return undefined;
+    const clock = typeof now === 'function'
+        ? now
+        : Date.now;
+    return Math.max(0, deadlineAt - Number(clock()));
 }

package/lib/update-check.js

@@ -5,6 +5,15 @@ import { stripTrailingSlashes } from './string-normalization.js'
 const require = createRequire(import.meta.url)
 const packageJson = require('../package.json')
 
+// Capture the process fetch once, at module evaluation, exactly like the
+// Router-owned provider transport. Reading `globalThis.fetch` per call would
+// re-admit DVR's own later-installed process-wide wrappers (legacy proxy,
+// i18n/pi-ai bridge) into DVR's product-metadata requests, and would make the
+// transport used for a request depend on when the request happens to run.
+const moduleFetch = typeof globalThis.fetch === 'function'
+  ? globalThis.fetch.bind(globalThis)
+  : undefined
+
 export const PACKAGE_NAME = 'dsh-vision-router'
 export const CURRENT_VERSION = String(packageJson.version ?? '')
 export const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org'
@@ -149,7 +158,7 @@ async function fetchLatestReleaseVersion({ fetchImpl, releaseApi, signal, timeou
  * read-only metadata request against npmjs instead of showing a false failure.
  */
 export async function checkPackageUpdate({
-  fetchImpl = globalThis.fetch,
+  fetchImpl = moduleFetch,
   currentVersion = CURRENT_VERSION,
   registry = registryBaseFromEnv(),
   fallbackRegistry = DEFAULT_NPM_REGISTRY,
@@ -247,7 +256,7 @@ export async function checkPackageUpdate({
  * settings card reuses that result, and the manual button can force a refresh.
  */
 export function createCachedUpdateChecker({
-  fetchImpl = (...args) => globalThis.fetch(...args),
+  fetchImpl = moduleFetch,
   currentVersion = CURRENT_VERSION,
   registry = registryBaseFromEnv(),
   fallbackRegistry = DEFAULT_NPM_REGISTRY,