dsh-vision-router 2.3.0 → 3.0.0

package/lib/live-model-discovery.js

@@ -5,6 +5,11 @@ import process from 'node:process'
 import { resolveDshHome } from './doctor.js'
 import { MODEL_RESPONSE_MAX_BYTES, readResponseJsonBounded } from './http-body-limit.js'
 import { stripTrailingSlashes } from './string-normalization.js'
+import {
+  currentLegacyGlobalProxyFetch,
+  legacyGlobalProxyPairFor,
+  runWithLegacyGlobalProxyScope,
+} from './legacy-global-proxy-boundary.js'
 import { isLocalUiRequest } from './web-capability-boundary.js'
 
 export const LIVE_MODELS_PATH = '/_dsh/vision-router/live-models'
@@ -17,6 +22,10 @@ export const DEFAULT_MAX_MODELS_PER_PROVIDER = 2_000
 
 const SUPPORTED_DISCOVERY_PROTOCOLS = new Set(['openai-completions', 'openai-responses'])
 
+const moduleFetch = typeof globalThis.fetch === 'function'
+  ? globalThis.fetch.bind(globalThis)
+  : undefined
+
 function nonEmpty(value) {
   return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined
 }
@@ -162,19 +171,57 @@ async function saveCache(file, providers, fsOps) {
   await fsOps.rename(temporary, file)
 }
 
+function plainProviderMap(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined
+}
+
+/**
+ * Host-side provider profiles have two possible homes on a real DSH host:
+ *  - the settings service (some Host lines mirror a plugin's config there), and
+ *  - the profile configuration owned by the Host config editor, which is where
+ *    DSH 0.2.0-rc.2 keeps `llm-pi-ai.providers` (the Models page writes them
+ *    back to the profile patch, never to a settings section).
+ * Reading only the settings section made live discovery a dead path on that
+ * Host: `configuredProviderTransports()` returned `[]` and no `/models` probe
+ * could ever run.
+ */
+function configEditorProviders(ctx) {
+  try {
+    const editor = ctx?.get?.('configEditor')
+    if (editor === undefined || typeof editor.configuration !== 'function') return undefined
+    const rows = editor.configuration()
+    if (!Array.isArray(rows)) return undefined
+    const row = rows.find((candidate) => {
+      const options = candidate?.entry?.options
+      return options?.id === 'llm-pi-ai' || options?.name === '@deepseek-ai/dsh-llm-pi-ai'
+    })
+    if (row === undefined) return undefined
+    // The row exists, so an absent/empty providers map means "no providers are
+    // configured" — authoritative, which lets the cache drop removed entries.
+    // Only a missing row or an unavailable editor stays non-authoritative, so a
+    // transient read can never delete evidence.
+    const inherited = plainProviderMap(row.inherited?.providers) ?? {}
+    const override = plainProviderMap(row.override?.providers) ?? {}
+    return { ...inherited, ...override }
+  } catch {
+    return undefined
+  }
+}
+
 function piProfilesState(ctx) {
   try {
     const settings = ctx?.get?.('settings')
-    if (!settings || typeof settings.get !== 'function') return { authoritative: false, providers: {} }
-    const value = settings.get('llm-pi-ai')
-    const providers = value?.providers
-    if (!providers || typeof providers !== 'object' || Array.isArray(providers)) {
-      return { authoritative: false, providers: {} }
+    if (settings && typeof settings.get === 'function') {
+      const value = settings.get('llm-pi-ai')
+      const providers = plainProviderMap(value?.providers)
+      if (providers !== undefined) return { authoritative: true, providers }
     }
-    return { authoritative: true, providers }
   } catch {
-    return { authoritative: false, providers: {} }
+    // Fall through to the profile-configuration source below.
   }
+  const fromEditor = configEditorProviders(ctx)
+  if (fromEditor !== undefined) return { authoritative: true, providers: fromEditor }
+  return { authoritative: false, providers: {} }
 }
 
 function rawPiProfiles(ctx) {
@@ -190,6 +237,21 @@ function providerConfigurationToken(provider, raw) {
   ])
 }
 
+// The boundary resolves its pair list from the live config; read the same shape so
+// the scope we open is one the boundary will accept.
+function liveProxyConfig(ctx, fallbackConfig = {}) {
+  try {
+    const settings = ctx?.get?.('settings')
+    const live = settings?.get?.('vision-router')
+    if (live !== null && typeof live === 'object' && !Array.isArray(live)) {
+      return { ...fallbackConfig, ...live }
+    }
+  } catch {
+    // Fall back to the composition config.
+  }
+  return fallbackConfig
+}
+
 function visionProviderPriority(ctx, fallbackConfig = {}) {
   const preferred = new Set()
   const collect = (value) => {
@@ -350,7 +412,13 @@ function boundedError(error) {
 
 export function createLiveModelDiscoveryManager(ctx, options = {}) {
   const now = typeof options.now === 'function' ? options.now : Date.now
-  const fetchImpl = typeof options.fetchImpl === 'function' ? options.fetchImpl : globalThis.fetch
+  // The proxy boundary installs its wrapper after apply() returns, so a capture
+  // taken here would keep the raw host fetch and silently ignore a configured
+  // `proxy` in the probes below. Ask the boundary for the fetch it currently owns
+  // instead of reading the process global at call time (L1-sealed-process-global);
+  // the module-load capture stays as the last-resort fallback.
+  const injectedFetch = typeof options.fetchImpl === 'function' ? options.fetchImpl : undefined
+  const resolveFetch = () => injectedFetch ?? currentLegacyGlobalProxyFetch() ?? moduleFetch
   const freshMs = Math.max(1_000, Number(options.freshMs) || DEFAULT_LIVE_MODEL_FRESH_MS)
   const staleMs = Math.max(freshMs, Number(options.staleMs) || DEFAULT_LIVE_MODEL_STALE_MS)
   const timeoutMs = Math.max(500, Number(options.timeoutMs) || DEFAULT_LIVE_MODEL_TIMEOUT_MS)
@@ -510,11 +578,15 @@ export function createLiveModelDiscoveryManager(ctx, options = {}) {
     try {
       const headers = { accept: 'application/json' }
       if (plan.apiKey !== undefined) headers.authorization = `Bearer ${plan.apiKey}`
-      const response = await fetchImpl(listingURL(plan.baseURL), {
+      const probe = () => resolveFetch()(listingURL(plan.baseURL), {
         method: 'GET',
         headers,
         signal: controller.signal,
       })
+      const proxyPair = legacyGlobalProxyPairFor(liveProxyConfig(ctx, fallbackConfig), provider)
+      const response = proxyPair === undefined
+        ? await probe()
+        : await runWithLegacyGlobalProxyScope(proxyPair.provider, proxyPair.model, probe)
       if (!response?.ok) {
         const error = new Error(`provider model listing answered HTTP ${response?.status ?? 'unknown'}`)
         error.status = response?.status
@@ -673,42 +745,61 @@ export function installLiveModelDiscovery(ctx, options = {}) {
     // Event forwarding is an optimization; the request path still refreshes.
   }
 
-  ctx?.inject?.(['webServer'], (webCtx) => {
-    webCtx.effect(() => webCtx.webServer.register({
-      kind: 'exact',
-      path: LIVE_MODELS_PATH,
-      handler: async (req, res) => {
-        if (req.method !== 'GET') {
-          res.setHeader('Allow', 'GET')
-          sendJson(res, 405, { ok: false, error: 'method not allowed' })
-          return
-        }
-        try {
-          const url = new URL(req.url ?? LIVE_MODELS_PATH, 'http://localhost')
-          // The snapshot itself is safe for an authenticated remote Settings UI,
-          // but refresh drives Host-side provider I/O and may resolve stored
-          // credentials. Preserve local ?refresh=1 behavior while making every
-          // remote GET a passive read of already-owned discovery state.
-          const schedule = isLocalUiRequest(req) && url.searchParams.get('refresh') !== '0'
-          sendJson(res, 200, await manager.snapshot({ schedule }))
-        } catch (error) {
-          sendJson(res, 500, { ok: false, error: boundedError(error) })
-        }
-      },
-    }), 'vision-router: live provider model discovery')
-  })
+  let disposePromise
+  const disposeLifecycle = () => {
+    if (disposePromise) return disposePromise
+    lifecycleDisposed = true
+    if (startupTimer !== undefined) {
+      clearTimeout(startupTimer)
+      startupTimer = undefined
+    }
+    for (const dispose of disposers.splice(0)) {
+      try { dispose() } catch { /* best effort */ }
+    }
+    disposePromise = Promise.resolve(manager.dispose())
+    return disposePromise
+  }
 
+  // Own every timer/listener/manager resource before any later Host seam can
+  // throw. This keeps injection failure from stranding a live generation.
   try {
-    ctx?.effect?.(() => () => {
-      lifecycleDisposed = true
-      if (startupTimer !== undefined) clearTimeout(startupTimer)
-      for (const dispose of disposers) {
-        try { dispose() } catch { /* best effort */ }
-      }
-      void manager.dispose()
-    }, 'vision-router: live model discovery lifecycle')
-  } catch {
-    // Host service disposal still tears down the registered route.
+    ctx?.effect?.(
+      () => disposeLifecycle,
+      'vision-router: live model discovery lifecycle',
+    )
+  } catch (error) {
+    void disposeLifecycle().catch(() => {})
+    throw error
+  }
+
+  try {
+    ctx?.inject?.(['webServer'], (webCtx) => {
+      webCtx.effect(() => webCtx.webServer.register({
+        kind: 'exact',
+        path: LIVE_MODELS_PATH,
+        handler: async (req, res) => {
+          if (req.method !== 'GET') {
+            res.setHeader('Allow', 'GET')
+            sendJson(res, 405, { ok: false, error: 'method not allowed' })
+            return
+          }
+          try {
+            const url = new URL(req.url ?? LIVE_MODELS_PATH, 'http://localhost')
+            // The snapshot itself is safe for an authenticated remote Settings UI,
+            // but refresh drives Host-side provider I/O and may resolve stored
+            // credentials. Preserve local ?refresh=1 behavior while making every
+            // remote GET a passive read of already-owned discovery state.
+            const schedule = isLocalUiRequest(req) && url.searchParams.get('refresh') !== '0'
+            sendJson(res, 200, await manager.snapshot({ schedule }))
+          } catch (error) {
+            sendJson(res, 500, { ok: false, error: boundedError(error) })
+          }
+        },
+      }), 'vision-router: live provider model discovery')
+    })
+  } catch (error) {
+    void disposeLifecycle().catch(() => {})
+    throw error
   }
   return manager
 }

package/lib/local-vision-stabilizer.js

@@ -180,7 +180,12 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
   }
 
   const localMessages = async (options) => {
-    const attachments = ctx.get('attachments')
+    let attachments
+    try {
+      attachments = typeof ctx?.get === 'function' ? ctx.get('attachments') : undefined
+    } catch {
+      attachments = undefined
+    }
     const current = actualConfig()
     const messages = []
     for (const message of options.messages ?? []) {
@@ -380,11 +385,8 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
           const scope = target.register(namespace, schema, fixedOptions)
           if (namespace === 'vision-router') {
             rawScope = scope
-            captureConfig(undefined, scope)
-            syncScreenshot()
-            // The Settings service is dynamic. Never keep its scope after the
-            // owning injection fiber unloads; during the gap fall back to the
-            // composition config, then bind the new scope on service restore.
+            // The Settings service is dynamic. Establish ownership before the
+            // scope can change screenshot state or install wrapped watchers.
             try {
               ownerCtx?.effect?.(
                 () => () => {
@@ -396,8 +398,12 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
                 'vision-router: local settings scope lifecycle',
               )
             } catch {
-              /* lifecycle hardening must not block Settings registration */
+              if (rawScope === scope) rawScope = undefined
+              resolvedConfig = config
+              return scope
             }
+            captureConfig(undefined, scope)
+            syncScreenshot()
             return wrapScope(scope)
           }
           return scope
@@ -459,7 +465,10 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
         'vision-router: screenshot permission route lifecycle',
       )
     } catch {
-      /* parent stabilizer cleanup remains a final fallback */
+      // webServer.register() is caller-owned in supported DSH Hosts. If this
+      // injected child cannot own the disposer, withdraw the route now rather
+      // than keeping it alive until the parent DVR generation eventually exits.
+      releaseScreenshotPermissionRoute(webServer, handle)
     }
   }
 
@@ -511,20 +520,25 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
       }
     : undefined
 
+  const disposeLifecycle = () => {
+    rawScope = undefined
+    unmountScreenshot()
+    for (const [webServer, handle] of screenshotPermissionRoutes) {
+      releaseScreenshotPermissionRoute(webServer, handle)
+    }
+    screenshotPermissionRoutes.clear()
+  }
+
   try {
     ctx.effect?.(
-      () => () => {
-        rawScope = undefined
-        unmountScreenshot()
-        for (const [webServer, handle] of screenshotPermissionRoutes) {
-          releaseScreenshotPermissionRoute(webServer, handle)
-        }
-        screenshotPermissionRoutes.clear()
-      },
+      () => disposeLifecycle,
       'vision-router: local vision stabilizer',
     )
   } catch {
-    /* cleanup registration is best effort */
+    // Routes/settings state may already have been admitted above. Roll them
+    // back immediately and do not expose an unowned wrapper to this generation.
+    disposeLifecycle()
+    return { ctx, bootConfig }
   }
 
   const stabilizedCtx = new Proxy(ctx, {

package/lib/maintenance-routes.js

@@ -20,9 +20,7 @@ function json(res, status, body, headers = {}) {
 export function installVisionMaintenanceRoutes(ctx, options = {}) {
   if (!ctx || typeof ctx.inject !== 'function') return
   const logger = options.logger ?? ctx.logger
-  const updateChecker = options.updateChecker ?? createCachedUpdateChecker({
-    fetchImpl: (...args) => globalThis.fetch(...args),
-  })
+  const updateChecker = options.updateChecker ?? createCachedUpdateChecker()
   const selfUpdatePlan = options.selfUpdatePlan ?? detectDshSelfUpdatePlan()
   const updateRunner = options.runUpdate ?? runDshPluginUpdate
   const tokenFactory = options.tokenFactory ?? (() => randomBytes(24).toString('base64url'))

package/lib/native-image-coexistence.js

@@ -385,7 +385,7 @@ export function currentSessionVisionPolicy() {
   return imageTurn.getStore()?.policy
 }
 
-function settingsServiceView(settings, state) {
+function settingsServiceView(settings, state, ownerCtx) {
   if (!isObject(settings)) return settings
   return new Proxy(settings, {
     get(target, property) {
@@ -394,7 +394,19 @@ function settingsServiceView(settings, state) {
         if (typeof register !== 'function') return register
         return (namespace, ...args) => {
           const scope = register.call(target, namespace, ...args)
-          if (namespace === 'vision-router') state.settingsScope = scope
+          if (namespace !== 'vision-router') return scope
+          try {
+            if (typeof ownerCtx?.effect !== 'function') return scope
+            ownerCtx.effect(
+              () => () => {
+                if (state.settingsScope === scope) state.settingsScope = undefined
+              },
+              'vision-router: native image settings lifecycle',
+            )
+          } catch {
+            return scope
+          }
+          state.settingsScope = scope
           return scope
         }
       }
@@ -406,7 +418,7 @@ function settingsServiceView(settings, state) {
 
 function injectedContextView(child, state) {
   if (!isObject(child)) return child
-  const settings = settingsServiceView(child.settings, state)
+  const settings = settingsServiceView(child.settings, state, child)
   return new Proxy(child, {
     get(target, property) {
       if (property === 'settings') return settings

package/lib/ollama-cold-start.js

@@ -10,6 +10,17 @@ export const OLLAMA_WARMUP_KEEP_ALIVE = '30m'
 export const OLLAMA_WARMUP_TIMEOUT_MS = 120000
 export const OLLAMA_PROBE_TIMEOUT_MS = 1500
 
+// Capture the process fetch once, at module evaluation, exactly like the
+// Router-owned provider transport. A per-call `(...args) =>
+// globalThis.fetch(...args)` default would re-admit DVR's own later-installed
+// process-wide fetch wrappers (legacy proxy boundary, i18n/pi-ai bridge) into
+// Ollama warmup traffic, so the transport a warmup uses would depend on when
+// the warmup happens to run. Probe-only traffic must stay on the same frozen
+// transport as Router-owned provider calls.
+const moduleFetch = typeof globalThis.fetch === 'function'
+  ? globalThis.fetch.bind(globalThis)
+  : undefined
+
 function errorText(error) {
   return error && error.message ? error.message : String(error)
 }
@@ -71,6 +82,32 @@ function timeoutSignal(ms, controllers) {
   }
 }
 
+function abortReason(signal) {
+  return signal?.reason instanceof Error
+    ? signal.reason
+    : new Error('Ollama warmup aborted')
+}
+
+function awaitAbortable(task, signal) {
+  if (!signal || typeof signal.addEventListener !== 'function') return Promise.resolve(task)
+  if (signal.aborted) return Promise.reject(abortReason(signal))
+  return new Promise((resolve, reject) => {
+    let settled = false
+    const finish = (callback, value) => {
+      if (settled) return
+      settled = true
+      signal.removeEventListener('abort', onAbort)
+      callback(value)
+    }
+    const onAbort = () => finish(reject, abortReason(signal))
+    signal.addEventListener('abort', onAbort, { once: true })
+    Promise.resolve(task).then(
+      (value) => finish(resolve, value),
+      (error) => finish(reject, error),
+    )
+  })
+}
+
 async function cancelBody(response) {
   try {
     await response?.body?.cancel?.()
@@ -112,7 +149,7 @@ async function readOllamaJson(response, label) {
  * that the model finished loading.
  */
 export function createOllamaWarmupManager({
-  fetchImpl = (...args) => globalThis.fetch(...args),
+  fetchImpl = moduleFetch,
   logger,
   probeTimeoutMs = OLLAMA_PROBE_TIMEOUT_MS,
   warmupTimeoutMs = OLLAMA_WARMUP_TIMEOUT_MS,
@@ -121,6 +158,7 @@ export function createOllamaWarmupManager({
   const inFlight = new Map()
   const controllers = new Set()
   let disposed = false
+  let disposePromise
 
   const run = async (provider, reason, forceKeepAlive) => {
     const key = providerKey(provider)
@@ -136,12 +174,18 @@ export function createOllamaWarmupManager({
 
     const probe = timeoutSignal(probeTimeoutMs, controllers)
     try {
-      const response = await fetchImpl(psUrl, { method: 'GET', signal: probe.signal })
+      const response = await awaitAbortable(
+        fetchImpl(psUrl, { method: 'GET', signal: probe.signal }),
+        probe.signal,
+      )
       if (!response?.ok) {
-        await cancelBody(response)
+        await awaitAbortable(cancelBody(response), probe.signal)
         return { ok: false, reason: `probe-http-${response?.status ?? 'unknown'}` }
       }
-      const payload = await readOllamaJson(response, 'Ollama /api/ps response')
+      const payload = await awaitAbortable(
+        readOllamaJson(response, 'Ollama /api/ps response'),
+        probe.signal,
+      )
       loaded = psContainsModel(payload, provider.model)
       if (loaded && forceKeepAlive !== true) {
         return {
@@ -159,7 +203,7 @@ export function createOllamaWarmupManager({
 
     const warm = timeoutSignal(warmupTimeoutMs, controllers)
     try {
-      const response = await fetchImpl(generateUrl, {
+      const response = await awaitAbortable(fetchImpl(generateUrl, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({
@@ -169,16 +213,19 @@ export function createOllamaWarmupManager({
           keep_alive: keepAlive,
         }),
         signal: warm.signal,
-      })
+      }), warm.signal)
       if (!response?.ok) {
-        await cancelBody(response)
+        await awaitAbortable(cancelBody(response), warm.signal)
         return { ok: false, reason: `warmup-http-${response?.status ?? 'unknown'}` }
       }
       // Do not cancel a successful preload body. A real HTTP fetch resolves as
       // soon as headers are available, so draining the bounded JSON response is
       // what proves Ollama finished loading the model before the inference
       // deadline is allowed to start.
-      await readOllamaJson(response, 'Ollama preload response')
+      await awaitAbortable(
+        readOllamaJson(response, 'Ollama preload response'),
+        warm.signal,
+      )
       const durationMs = Date.now() - startedAt
       if (durationMs >= 1000) {
         try {
@@ -240,12 +287,17 @@ export function createOllamaWarmupManager({
   }
 
   const dispose = () => {
+    if (disposePromise) return disposePromise
     disposed = true
     for (const controller of controllers) {
       try { controller.abort(new Error('Vision Router disposed')) } catch { /* best effort */ }
     }
-    controllers.clear()
-    inFlight.clear()
+    const admitted = [...inFlight.values()]
+    disposePromise = Promise.allSettled(admitted).then(() => {
+      controllers.clear()
+      inFlight.clear()
+    })
+    return disposePromise
   }
 
   return { ensure, background, dispose }
@@ -291,7 +343,7 @@ export function installOllamaColdStartGuard(ctx, config = {}, core, options = {}
 
   let rawScope
   let scopeUnwatch
-  const manager = options.manager || createOllamaWarmupManager({ logger: ctx.logger })
+  const manager = options.manager || createOllamaWarmupManager({ logger: options.logger ?? ctx.logger })
   const rawInject = typeof ctx.inject === 'function' ? ctx.inject.bind(ctx) : undefined
   const rawOn = typeof ctx.on === 'function' ? ctx.on.bind(ctx) : undefined
   const rawLlm = ctx.llm
@@ -325,14 +377,10 @@ export function installOllamaColdStartGuard(ctx, config = {}, core, options = {}
       try { scopeUnwatch() } catch { /* best effort */ }
       scopeUnwatch = undefined
     }
-    backgroundWarm('settings-ready')
-    if (typeof scope.watch === 'function') {
-      try {
-        scopeUnwatch = scope.watch(() => backgroundWarm('settings-changed'))
-      } catch {
-        scopeUnwatch = undefined
-      }
-    }
+
+    // Own this dynamic Settings generation before it can start warmup work or
+    // install a watcher. A rejected child fiber must never leave rawScope
+    // pointing at a dead Settings service.
     try {
       ownerCtx?.effect?.(
         () => () => {
@@ -345,7 +393,17 @@ export function installOllamaColdStartGuard(ctx, config = {}, core, options = {}
         'vision-router: Ollama warmup settings lifecycle',
       )
     } catch {
-      /* lifecycle registration is best effort */
+      if (rawScope === scope) rawScope = undefined
+      return
+    }
+
+    backgroundWarm('settings-ready')
+    if (typeof scope.watch === 'function') {
+      try {
+        scopeUnwatch = scope.watch(() => backgroundWarm('settings-changed'))
+      } catch {
+        scopeUnwatch = undefined
+      }
     }
   }
 
@@ -455,18 +513,24 @@ export function installOllamaColdStartGuard(ctx, config = {}, core, options = {}
 
   try {
     ctx.effect?.(
-      () => () => {
+      () => async () => {
         rawScope = undefined
         if (typeof scopeUnwatch === 'function') {
           try { scopeUnwatch() } catch { /* best effort */ }
           scopeUnwatch = undefined
         }
-        manager.dispose()
+        await manager.dispose()
       },
       'vision-router: Ollama cold-start guard',
     )
   } catch {
-    /* cleanup registration is best effort */
+    rawScope = undefined
+    if (typeof scopeUnwatch === 'function') {
+      try { scopeUnwatch() } catch { /* best effort */ }
+      scopeUnwatch = undefined
+    }
+    void Promise.resolve(manager.dispose()).catch(() => {})
+    return ctx
   }
 
   // Composition-level localOllama may already be enabled before Settings

package/lib/pi-ai-bridge-wire-compat.js

@@ -342,8 +342,9 @@ export function installPiAiBridgeWireCompat(ctx, logger) {
   }
   try {
     ctx?.effect?.(() => cleanup, 'vision-router: pi-ai bridge wire compatibility')
-  } catch {
-    // Direct callers without Cordis lifecycle still receive the cleanup below.
+  } catch (error) {
+    cleanup()
+    throw error
   }
   return cleanup
 }