dsh-vision-router 3.0.0 → 3.0.1

package/README.md

@@ -42,9 +42,15 @@
 > **Data leaves your machine by default.** When a cloud vision model is used, Vision Router sends the image (or a derived crop), the vision prompt and related request metadata to that provider. A fresh install has an anonymous OVHcloud vision fallback enabled, so "free" and "no key" do **not** mean offline. Do not use the cloud chain for confidential, regulated or classified material. See [Data flow and strict local-only use](#data-flow-and-strict-local-only-use).
 
 > [!WARNING]
-> 📌 **Announcement (v3.0.0)**
+> 📌 **Announcement (v3.0.1)**
 >
-> **v3.0.0: Session Vision policy now has a durable owner.** The supported DSH 0.1.x window now starts at `0.1.5-rc.1`, while the 0.2.x train starts at verified `0.2.0-rc.2`; Vision authority lives in a scoped, Host-storage-backed policy store, hydrates before child sessions publish, and binds delegation to the Host Agent lifecycle. The package root is a deliberate, typed public API, the runtime installation is grouped into explicit composition phases with an explicitly passed provider transport, and a new required peer (`@deepseek-ai/dsh-storage-domain`) is added. This release also closes the R11 adversarial final audit. [What’s new →](docs/releases/v3.0.0.md)
+> **v3.0.1: five corrective fixes on the 3.0 line.** The Vision Router settings surface
+> reads and writes real values on the Desktop shell, the model picker no longer groups the
+> same model twice, and every provider leg that can reach a remote provider — background
+> profiling, the local vision stabilizer, the settings "test connection" probe and the
+> LM Studio native transport — now follows the same `proxy` / `proxyHosts` decision as
+> foreground vision turns. Supported Hosts are unchanged: DSH 0.1.x from `0.1.5-rc.1`,
+> DSH 0.2.x from verified `0.2.0-rc.2`. [What’s new →](docs/releases/v3.0.1.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />

package/README.zh.md

@@ -42,9 +42,13 @@
 > **默认配置会让数据出网。** 使用云端视觉模型时，Vision Router 会将图片（或由它裁剪出的局部）、识图提示词及相关请求元数据发送给对应供应商。新安装默认开启 OVHcloud 匿名视觉兜底，因此“免费”和“免 Key”不等于离线。涉密、涉案、内部或其他受限材料请勿使用云端链路。详见[数据流向与严格纯本地配置](#数据流向与严格纯本地配置)。
 
 > [!WARNING]
-> 📌 **公告（v3.0.0）**
+> 📌 **公告（v3.0.1）**
 >
-> **v3.0.0：Session Vision policy 有了持久归属。DSH 0.1.x 正式支持线提高到 `0.1.5-rc.1` 起，0.2.x 从已验证的 `0.2.0-rc.2` 起；识图权威由作用域化的、Host storage 背书的策略存储持有，子会话发布前完成 hydrate，委派绑定 Host Agent 生命周期；包根改为显式声明且带类型的公共 API，运行时装配显式分阶段、provider transport 必须显式传入，并新增必需 peer `@deepseek-ai/dsh-storage-domain`。本版本同时完成 R11 对抗终审。** [查看完整更新 →](docs/releases/v3.0.0.md)
+> **v3.0.1：3.0 线上的五处修正。** Desktop 壳上的 Vision Router 设置面能读取并写入真实值，
+> 模型选择器不再把同一模型重复分组；所有可能触达远程 provider 的腿 —— 后台基准分析、本地视觉
+> 稳定器、设置里的「测试连接」探针、LM Studio native 传输 —— 现在都与前台视觉轮次遵守同一套
+> `proxy` / `proxyHosts` 判定。支持的 Host 不变：DSH 0.1.x 自 `0.1.5-rc.1` 起，DSH 0.2.x 自
+> 已验证的 `0.2.0-rc.2` 起。 [查看完整更新 →](docs/releases/v3.0.1.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />

package/docs/architecture/3.0-r11-adversarial-review.md

@@ -425,11 +425,17 @@ keeps a guarding test here** except the two noted under residual risk.
    mechanism in turn (both edits fail the test, restoring passes). It is wired into
    `pnpm test`, so a regression now fails in the ordinary battery instead of only in
    a real-Host desktop gate.
-2. ~~conditional proxy bypass in the provider probes~~ — **closed in this round**:
-   the two probes now run inside the configured-pair proxy scope and take the
-   transport the proxy boundary currently owns (with a module-load capture as the
-   fallback), so a configured `proxy` reaches them exactly as it reaches vision
-   turns. The first attempt resolved `globalThis.fetch` at call time and was
+2. ~~conditional proxy bypass in the provider probes~~ — **closed in this round,
+   and completed afterwards**: the probes take the Router-owned provider transport
+   (`runtime.providerTransport` handed to the diagnostics routes), which owns the
+   `proxy` / `proxyHosts` decision, so a configured `proxy` reaches them exactly as
+   it reaches vision turns — for every provider shape. The first shape of this fix
+   ran the probes inside the legacy configured-pair scope, which only covers
+   non-router-owned providers; a `vision-http` direct backend (the plugin's default)
+   therefore still probed with ambient fetch (#633). The legacy boundary fetch is
+   kept as the fallback for Hosts that only configure the legacy pair scope, and the
+   same transport now also reaches the LM Studio **native** transport leg, which had
+   dropped it (#634). The first attempt resolved `globalThis.fetch` at call time and was
    **rejected by the project's own `L1-sealed-process-global` rule** — the same
    class as findings 1 and #519 — so the fix instead has the boundary own and
    advertise its wrapper (`currentLegacyGlobalProxyFetch()`), keeping every

package/docs/architecture/dsh-support-window.md

@@ -81,6 +81,14 @@ Version labels describe support policy and CI evidence; runtime branching still
 
 DVR must not turn these tables into widespread version-string conditionals. Runtime compatibility continues to feature-detect the concrete Host seam it needs. If a capability cannot be proven safely, the compatibility path fails open or reports an explicit unsupported/unknown state according to that seam's contract.
 
+The same rule binds the contract gate. `scripts/dsh-host-contract-smoke.mjs` derives the settings
+seam from the Host it is pointed at (`EXPECT_SETTINGS_MODE=auto`): the `0.1.5` train exposes
+`SettingsProvider.register()`, while the `0.1.7` release and every `0.2.x` Host since — `0.2.0-rc.2`
+through the `0.2.1` alpha line — replace it with `SettingsForms.describe()` plus ConfigEditor
+`configuration()`/`edit()`. A gate that pins one shape reports an unsupported Host for a Host DVR
+supports, so the floating canaries derive the seam, the pinned legs keep naming theirs explicitly,
+and a Host with neither reviewed seam fails the gate by name instead of passing silently.
+
 ## Compatibility-retirement rule
 
 The 2.3.x `0.1.5` train floor makes any compatibility path used only by pre-`0.1.5` Hosts eligible for a fresh deletion audit, but does not automatically authorize deletion. Durable session formats, replay envelopes, adapter wire shapes, and other historical inputs may outlive the Host version that originally produced them.

package/docs/releases/v3.0.1.md

@@ -0,0 +1,77 @@
+# v3.0.1
+
+DSH Vision Router 3.0.1 is a corrective release on the 3.0 line. It ships the five
+consumer-visible fixes that were merged after v3.0.0 was tagged: two in the Desktop
+settings surface and three in the provider egress paths, where a configured `proxy` /
+`proxyHosts` must reach every leg that talks to a provider. There are no new peers, no
+settings migration, no Session format change and no public API change.
+
+## Highlights
+
+- **Desktop settings values (#619).** A Host that exposes a legacy-shaped
+  `settingsScope` can return an empty `vision-router` namespace while its native config
+  forms keep working. That scope is now kept only as the delegate for every other
+  namespace instead of bypassing the local settings bridge, so the Vision Router
+  settings surface reads and writes real values on the Desktop shell.
+- **Model picker catalog (#620).** The model-visibility boundary now patches every
+  loader instance it can reach — including one published after the boundary installs —
+  so the picker no longer groups the same model twice.
+- **Background and local provider legs (#623).** The Router-owned provider transport is
+  threaded into the local vision stabilizer, the host/security boundaries and the
+  background benchmark, so those legs honor `proxy` / `proxyHosts` exactly like
+  foreground vision turns.
+- **Connection probe egress (#633).** The settings "test connection" probe now takes the
+  Router-owned transport (`runtime.providerTransport`) instead of relying on the legacy
+  configured-pair scope, which by construction cannot cover a `vision-http` direct
+  backend — the plugin's default shape. The legacy boundary fetch stays as the fallback
+  for Hosts that only configure the legacy scope.
+- **LM Studio native transport (#634).** `callLocalBackend`'s `format: 'lmstudio'`
+  branch no longer drops `providerTransport`, and the native `POST /api/v1/chat` goes
+  through `transport.fetch`, matching the openai and anthropic legs. A remote LM Studio
+  behind a proxy is reached like every other provider.
+- **Internal hardening (no package behavior change).** Exact Node-runtime and Playwright
+  system-package caches, Desktop adversary sharding and scenario concurrency, a Host
+  contract gate that derives the settings seam from the Host it meets, an alpha canary
+  that runs every contract instead of stopping at the first failure, and completed e2e
+  workflow trigger coverage.
+
+## Host support window
+
+Unchanged from 3.0.0:
+
+- DSH 0.1.x: `>=0.1.5-rc.1 <0.2.0-0`
+- DSH 0.2.x: `>=0.2.0-rc.2 <0.3.0-0`
+- ordinary development Host: exact `0.2.0-rc.2`
+
+The 0.2.x train is admitted from the verified `0.2.0-rc.2` boundary. The `0.2.1` alpha
+line is inside that admitted range and is exercised by the scheduled drift canaries,
+which read the settings seam from the Host they install; the exact-evidence boundary is
+still `0.2.0-rc.2`.
+
+## Validation
+
+- every fix carries a failing-first reproduction that fails on the pre-fix commit and
+  passes on this release commit — the Desktop settings and picker boundaries, the local
+  and background transport legs, the `vision-http` probe, and the LM Studio native
+  transport;
+- the full gate battery on the exact release commit: install, build, `build:check`,
+  source-ownership lint, source→artifact evidence, reproducible clean build, typecheck,
+  the test suite, client-source synchronization, the Host support-window contract, and
+  the packed public-API contract;
+- a real-Host pass on this exact build against an installed DSH checkout: the Host proxy
+  egress contract, the settings lifecycle in a real browser (mount, save, reload and
+  readback of the Vision Router section) and the Desktop Host injection contract
+  (structured injections, token exchange, authenticated index and DVR RPC);
+- the real-Host matrix (Windows Node 22/24 Desktop, macOS renderer, Linux real Host +
+  Chromium), the adversarial compatibility/fuzz gates and the resource-stress gates;
+- an adversarial review of this delta, including a provider-egress sweep over every
+  server-side entry point. The one candidate that looked like a further bypass — Ollama
+  cold start — is gated to loopback hosts and was recorded as falsified rather than
+  patched.
+
+## Upgrade
+
+Drop-in replacement for 3.0.0: no settings migration, no Session format change and no
+new peer dependency. Upgrading `dsh plugin --profile web add github:ysr666/dsh-vision-router`
+(or the pinned `dsh-vision-router@3.0.1`) keeps existing Vision Router settings and
+Session data readable as before.

package/index.js

@@ -4849,6 +4849,8 @@ ctx.logger?.info(
   // only the three coherent domain faces it already computes; route lifecycle,
   // bounded /models probing and JSON response semantics live outside Core.
   installVisionDiagnosticsRoutes(ctx, {
+    // Same egress as real vision turns: the Router-owned provider transport.
+    transport: runtime?.providerTransport,
     connection: {
       candidatePairs: pairs,
       localBackends: () => localProvidersOf(current()),

package/lib/core-primitives.js

@@ -1937,7 +1937,11 @@ async function callLmStudioNative(provider, messages, options = {}) {
     ...(typeof options.temperature === 'number' ? { temperature: options.temperature } : {}),
     ...(typeof options.top_p === 'number' ? { top_p: options.top_p } : {}),
   }
-  const response = await fetch(`${apiRoot}/api/v1/chat`, {
+  const transport = options.providerTransport
+  const requestFetch = typeof transport?.fetch === 'function'
+    ? (input, init) => transport.fetch(input, init, { providerName: provider.name, allowProxy: true })
+    : fetch
+  const response = await requestFetch(`${apiRoot}/api/v1/chat`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify(body),
@@ -1984,6 +1988,9 @@ export async function callLocalBackend(provider, messages, options = {}) {
     return callLmStudioNative(provider, messages, {
       maxTokens,
       signal: options.signal,
+      // The native LM Studio transport is a provider leg like the openai/anthropic
+      // ones: it must use the Router-owned transport so proxy/proxyHosts apply.
+      providerTransport: options.providerTransport,
       ...(typeof provider.reasoningEffort === 'string' ? { reasoningEffort: provider.reasoningEffort } : {}),
       ...sampling,
     })

package/lib/local-vision-stabilizer.js

@@ -43,7 +43,7 @@ export async function triggerDesktopScreenshotPermission({
   }
 }
 
-export function installLocalVisionStabilizer(ctx, config = {}, core) {
+export function installLocalVisionStabilizer(ctx, config = {}, core, installOptions = {}) {
   config = normalizeRuntimeVisionConfig(config)
   if (!ctx || typeof ctx !== 'object') return { ctx, bootConfig: config }
 
@@ -270,6 +270,7 @@ export function installLocalVisionStabilizer(ctx, config = {}, core) {
             const text = await core.callLocalBackend(local, await localMessages(options), {
               maxTokens: local.maxTokens ?? 4096,
               signal: options.signal,
+              providerTransport: installOptions?.providerTransport,
               resolveCredential,
             })
             if (text !== '') {

package/lib/runtime-composition.js

@@ -98,7 +98,7 @@ function legacyCoreVisionSettings(ctx, fallback) {
   return { ...current, autoActivateOnImage: false }
 }
 
-function installHostAndSecurityBoundaries(ctx, config, core) {
+function installHostAndSecurityBoundaries(ctx, config, core, providerTransport) {
   // SessionVisionIndex calls planGuardStopShadows before Core.apply. Keep that
   // one helper behind the live-locale facade; the final Core itself still gets
   // the ordinary composition identity and is localized by the scoped context.
@@ -144,6 +144,7 @@ function installHostAndSecurityBoundaries(ctx, config, core) {
     ollamaColdStartCtx,
     hardenedConfig,
     core,
+    { providerTransport },
   )
 
   const routingProduct = resolveVisionRoutingProduct(bootConfig)
@@ -260,7 +261,7 @@ function createRuntimeOwners(host, core) {
   }
 }
 
-function installRoutingAndHostProducts(host, owners, core) {
+function installRoutingAndHostProducts(host, owners, core, providerTransport) {
   const { capabilityStore, logging, runtimeConfig, runtimePerformanceStore } = host
   const { sessionVisionModeCompat } = owners
   // Final structured-flow guard sits closest to core.apply so it sees the
@@ -281,7 +282,7 @@ function installRoutingAndHostProducts(host, owners, core) {
     runtimeConfig,
     core,
     capabilityStore,
-    { logger: logging.logger },
+    { logger: logging.logger, providerTransport },
   )
   const sessionTurnResolver = createSessionTurnResolver(backgroundProfiling.ctx)
   const sessionEventTailReader = createSessionEventTailReader(backgroundProfiling.ctx)
@@ -479,9 +480,10 @@ function applyMatureCoreBridge(host, owners, routing, execution, core, runtime)
 }
 
 export function applyVisionRuntimeComposition(ctx, config = {}, core, runtime = {}) {
-  const host = installHostAndSecurityBoundaries(ctx, config, core)
+  const providerTransport = runtime?.providerTransport
+  const host = installHostAndSecurityBoundaries(ctx, config, core, providerTransport)
   const owners = createRuntimeOwners(host, core)
-  const routing = installRoutingAndHostProducts(host, owners, core)
-  const execution = installExecutionBoundaries(host, owners, routing, core, runtime?.providerTransport)
+  const routing = installRoutingAndHostProducts(host, owners, core, providerTransport)
+  const execution = installExecutionBoundaries(host, owners, routing, core, providerTransport)
   return applyMatureCoreBridge(host, owners, routing, execution, core, runtime)
 }

package/lib/settings-client-017-compat.js

@@ -197,13 +197,17 @@ export const SETTINGS_017_CLIENT_PRELUDE = String.raw`(function(){
       get: function(target, property) {
         if (property === 'settingsScope') {
           var original = safeGet(target, 'settingsScope');
-          if (original && typeof original.bind === 'function') return original;
           // DSH 0.1.7 configForms only mirrors Config fields declared volatile.
           // DVR must keep its public Config ordinary for the older supported Host
           // window, so its namespace intentionally uses the local-only ConfigEditor
-          // bridge while other namespaces may still delegate to native configForms.
+          // bridge. Even when a Host exposes a legacy-shaped settingsScope, its
+          // vision-router view may be empty; keep it only as the delegate for
+          // every other namespace instead of letting it bypass the local bridge.
           var official = configFormsBinder(target);
-          return syntheticBinder(ctx, official);
+          return syntheticBinder(
+            ctx,
+            original && typeof original.bind === 'function' ? original : official
+          );
         }
         if (property === 'get') {
           var getter = Reflect.get(target, property, target);

package/lib/vision-background-benchmark.js

@@ -758,7 +758,7 @@ export function createBackgroundCapabilityProfiler({
       }, interval)
       try { policyTimer?.unref?.() } catch {}
 
-      const runner = runAxisBenchmark ?? ((args) => runAxis({ ...args, options: invokerOptions }))
+      const runner = runAxisBenchmark ?? runAxis
       await runner({
         ctx,
         config: current,
@@ -768,6 +768,7 @@ export function createBackgroundCapabilityProfiler({
         axis: work.axis,
         signal: controller.signal,
         logger,
+        options: invokerOptions,
         onProgress(progress = {}) {
           if (!runningWork || runningWork.candidate.key !== work.candidate.key || runningWork.axis !== work.axis) return
           const completed = Math.max(0, Number(progress.completed) || 0)
@@ -999,6 +1000,16 @@ export function installBackgroundCapabilityProfiling(ctx, config, core, store, o
   const logger = options.logger ?? ctx?.logger
   const imageVerdictStore = options.imageVerdictStore ?? createImageInputVerdictStore({ logger })
   const backgroundStopStore = options.backgroundStopStore ?? createBackgroundBenchmarkStopStore({ logger })
+  // Provider transport is one explicit runtime capability shared by automatic
+  // profiling and the user-triggered exact check. Top-level ownership wins so
+  // a stale nested test/customization bag cannot silently bypass live proxy
+  // policy after composition or HMR changes.
+  const invokerOptions = {
+    ...(options.invokerOptions ?? {}),
+    ...(options.providerTransport === undefined
+      ? {}
+      : { providerTransport: options.providerTransport }),
+  }
   const profiler = createBackgroundCapabilityProfiler({
     ctx,
     config,
@@ -1006,6 +1017,7 @@ export function installBackgroundCapabilityProfiling(ctx, config, core, store, o
     store,
     logger,
     ...options,
+    invokerOptions,
     imageVerdictStore,
     backgroundStopStore,
   })
@@ -1120,7 +1132,7 @@ export function installBackgroundCapabilityProfiling(ctx, config, core, store, o
               provider: body.provider,
               model: body.model,
               signal: AbortSignal.timeout(VISION_CHECK_TIMEOUT_MS),
-              invokerOptions: options.invokerOptions ?? {},
+              invokerOptions,
             })
             await profiler.recordImageSupported(body.provider, body.model)
             sendJson(res, 200, result)

package/lib/vision-diagnostics-routes.js

@@ -106,7 +106,15 @@ export function installVisionDiagnosticsRoutes(ctx, options = {}) {
   // inside the adapter's proxy scope) do not have. Use the fetch the boundary
   // currently owns, with the module-load capture as the fallback.
   const injectedFetch = typeof options.fetchImpl === 'function' ? options.fetchImpl : undefined
-  const resolveFetch = () => injectedFetch ?? currentLegacyGlobalProxyFetch() ?? moduleFetch
+  // Probes must describe the egress real vision turns use. That egress is the
+  // Router-owned provider transport, which also owns the proxy/proxyHosts decision;
+  // the legacy pair scope below only covers non-router-owned providers, so a
+  // vision-http direct backend would otherwise probe with ambient fetch.
+  const transport = options.transport
+  const transportFetch = typeof transport?.fetch === 'function'
+    ? (input, init) => transport.fetch(input, init, { allowProxy: true })
+    : undefined
+  const resolveFetch = () => injectedFetch ?? transportFetch ?? currentLegacyGlobalProxyFetch() ?? moduleFetch
   const connectionConfig = () => {
     try {
       const live = ctx?.get?.('settings')?.get?.('vision-router')

package/lib/vision-model-visibility-boundary-main.js

@@ -419,6 +419,7 @@ export const VISION_MODEL_VISIBILITY_PRELUDE = String.raw`(function(){
       function create() {
         var result = originalCreate.apply(this, arguments);
         patchLoader(loader);
+        if (result && result !== loader) patchLoader(result);
         return result;
       }
       try { Object.defineProperty(create, '__visionRouterModelVisibility', { value: true }); } catch (_) {}
@@ -427,31 +428,29 @@ export const VISION_MODEL_VISIBILITY_PRELUDE = String.raw`(function(){
   }
 
   function install() {
-    if (window.__ModuleLoader__) {
-      patchLoader(window.__ModuleLoader__);
-      return;
-    }
     var descriptor = Object.getOwnPropertyDescriptor(window, '__ModuleLoader__');
+    var current;
+    try { current = window.__ModuleLoader__; } catch (_) { current = undefined; }
+    if (current) patchLoader(current);
     if (descriptor && descriptor.configurable === false) return;
-    var stored;
+    var previousGet = descriptor && descriptor.get;
+    var previousSet = descriptor && descriptor.set;
+    var stored = descriptor && Object.prototype.hasOwnProperty.call(descriptor, 'value')
+      ? descriptor.value
+      : current;
     Object.defineProperty(window, '__ModuleLoader__', {
       configurable: true,
-      enumerable: true,
-      get: function(){ return stored; },
+      enumerable: !descriptor || descriptor.enumerable !== false,
+      get: function(){ return previousGet ? previousGet.call(window) : stored; },
       set: function(value) {
-        stored = value;
-        patchLoader(value);
-        Object.defineProperty(window, '__ModuleLoader__', {
-          configurable: true,
-          enumerable: true,
-          writable: true,
-          value: stored
-        });
+        if (previousSet) previousSet.call(window, value); else stored = value;
+        try { patchLoader(previousGet ? previousGet.call(window) : value); } catch (_) {}
       }
     });
+    if (stored) patchLoader(stored);
   }
 
-  install();
+  try { install(); } catch (_) {}
 })();`
 
 export function injectVisionModelVisibilityBoundary(html) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vision-router",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Eyes for text-only DeepSeek Harness agents: built-in free vision chain + pixel-level tools. Remote vision providers, including the default free fallback, receive image content unless strict local-only use is configured.",
   "license": "MIT",
   "repository": {
@@ -89,7 +89,7 @@
     "@deepseek-ai/dsh-storage-domain": "0.2.0-rc.2"
   },
   "scripts": {
-    "test": "node --test tests/index-modularization.test.js tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/issue-374-delegated-call-config.test.js tests/grounding-coordinate-frame.test.js tests/grounding-coordinate-runtime.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/cache-atomic-write-concurrency.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/degraded-local-evidence.test.js tests/vision-resilience-lifecycle.test.js tests/vision-breaker-readonly.test.js tests/alpha1-browser-lifecycle-integration.test.js tests/issue-367-remote-session-inject.test.js tests/vision-mode-toggle-injection.test.js tests/client.test.js tests/issue-307-regression.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/clipboard-image-paste-compat.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/release-registry-identity.test.js tests/update-check.test.js tests/update-check-signal-lifecycle.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/session-repair-v2.test.js tests/activation-shim-contract.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/official-deepseek-catalog.test.js tests/replay-delegation.test.js tests/twin-image-capability-fallback.test.js tests/twin-image-custom-wrapper.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/architecture-2.3-gate.test.js tests/esm-cycle-audit.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/vision-model-guidance-contract.test.js tests/local-ollama.test.js tests/local-only-vision.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/vision-diagnostics-routes.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/free-cloud-first.test.js tests/dsh-host-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/issue-512-tool-restriction.test.js tests/issue-606-session-source-ownership.test.js tests/pi-ai-bridge-wire-compat.test.js tests/fetch-wrapper-lifecycle.test.js tests/fetch-wrapper-composition.test.js tests/provider-probe-proxy-scope.test.js tests/lifecycle-invariants.test.js tests/vision-tool-settings-generation.test.js tests/release-package-content-identity.test.js tests/release-state-machine.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/security-resource-boundaries.test.js tests/security-property-fuzz.test.js tests/security-adversarial-fuzz-contract.test.js tests/runtime-i18n.test.js tests/long-ocr-empty-retry.test.js tests/tesseract-adaptive-ocr.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/session-vision-event-feed.test.js tests/session-vision-policy.test.js tests/session-vision-policy-domain.test.js tests/session-vision-delegation.test.js tests/session-vision-delegation-boundary.test.js tests/subagent-vision-inheritance-characterization.test.js tests/subagent-vision-runtime-integration.test.js tests/subagent-vision-cold-resume.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-lifecycle.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/settings-native-card-semantics.test.js tests/settings-native-card-lazy-data.test.js tests/settings-invalid-staged-dirty.test.js tests/vision-toggle-root-hardening.test.js && pnpm test:regression-closure && node --test tests/vision-backend-runtime-policy.test.js",
+    "test": "node --test tests/index-modularization.test.js tests/adapter-prepare-call-compat.test.js tests/core.test.js tests/issue-374-delegated-call-config.test.js tests/grounding-coordinate-frame.test.js tests/grounding-coordinate-runtime.test.js tests/capability-advisory.test.js tests/vision-execution-policy.test.js tests/vision-backend-diagnostics.test.js tests/live-model-discovery.test.js tests/cache-atomic-write-concurrency.test.js tests/live-model-credential-resolution.test.js tests/vision-model-registry.test.js tests/live-model-client-stability.test.js tests/providers-persistence.test.js tests/provider-directory-fallback.test.js tests/model-catalog-policy.test.js tests/settings-ia-client-prelude.test.js tests/settings-ia-fj.test.js tests/settings-ia-acceptance-regression.test.js tests/settings-migration.test.js tests/settings-section-order.test.js tests/attachment-admission-policy.test.js tests/vision-resilience.test.js tests/degraded-local-evidence.test.js tests/vision-resilience-lifecycle.test.js tests/vision-breaker-readonly.test.js tests/alpha1-browser-lifecycle-integration.test.js tests/issue-367-remote-session-inject.test.js tests/vision-mode-toggle-injection.test.js tests/client.test.js tests/issue-307-regression.test.js tests/issue-284-vision-mode-toggle.test.js tests/issue-284-vision-mode-hardening.test.js tests/issue-284-attachment-id-hint.test.js tests/issue-284-model-visibility.test.js tests/issue-284-vision-selection-effort.test.js tests/client-presentation-boundary.test.js tests/clipboard-image-paste-compat.test.js tests/remote-settings-bridge.test.js tests/remote-settings-v2-contract.test.js tests/remote-settings-risk-confirmation.test.js tests/local-remote-settings-permission.test.js tests/artifact-path-security.test.js tests/http-compat.test.js tests/catalog-corrections.test.js tests/release-registry-identity.test.js tests/update-check.test.js tests/update-check-signal-lifecycle.test.js tests/self-update.test.js tests/doctor.test.js tests/doctor-cli.test.js tests/legacy-session-repair.test.js tests/profile-pnpm-diagnostics.test.js tests/doctor-v2.test.js tests/doctor-cli-v2.test.js tests/doctor-runtime.test.js tests/dsh-host-capabilities.test.js tests/doctor-host-capabilities.test.js tests/session-repair-v2.test.js tests/activation-shim-contract.test.js tests/bundle-defaults.test.js tests/file-logger.test.js tests/official-deepseek-catalog.test.js tests/replay-delegation.test.js tests/twin-image-capability-fallback.test.js tests/twin-image-custom-wrapper.test.js tests/adversarial-hardening.test.js tests/vision-adversarial-hardening-v2.test.js tests/vision-capability-benchmark-visual-proof.test.js tests/wrapper-directory.test.js tests/logging-ui.test.js tests/manifest-dependencies.test.js tests/architecture-2.3-gate.test.js tests/host-settings-seam.test.js tests/drift-canary-settings-seam.test.js tests/esm-cycle-audit.test.js tests/structured-bootstrap.test.js tests/structured-bootstrap-gate.test.js tests/vision-model-guidance-contract.test.js tests/local-ollama.test.js tests/local-only-vision.test.js tests/ollama-cold-start.test.js tests/ollama-cold-start-loaded.test.js tests/zero-regression-gate.test.js tests/runtime-e2e.test.js tests/local-vision-stabilizer.test.js tests/local-connection-probe.test.js tests/vision-diagnostics-routes.test.js tests/repetition-guard.test.js tests/guide-scroll-gate.test.js tests/settings-scroll-jank-regression.test.js tests/free-cloud-first.test.js tests/dsh-host-compat.test.js tests/native-image-coexistence.test.js tests/issue-276-session-image-ownership.test.js tests/issue-276-entry-policy-bridge.test.js tests/issue-276-policy-hardening.test.js tests/issue-289-native-nonintervention.test.js tests/issue-512-tool-restriction.test.js tests/issue-606-session-source-ownership.test.js tests/pi-ai-bridge-wire-compat.test.js tests/fetch-wrapper-lifecycle.test.js tests/fetch-wrapper-composition.test.js tests/provider-probe-proxy-scope.test.js tests/lifecycle-invariants.test.js tests/vision-tool-settings-generation.test.js tests/release-package-content-identity.test.js tests/release-state-machine.test.js tests/mixed-router.test.js tests/depth-tier.test.js tests/depth-quota-behavior.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-budget-activation.test.js tests/runtime-boundary-fixes.test.js tests/security-resource-boundaries.test.js tests/security-property-fuzz.test.js tests/security-adversarial-fuzz-contract.test.js tests/runtime-i18n.test.js tests/long-ocr-empty-retry.test.js tests/tesseract-adaptive-ocr.test.js tests/tesseract-node24-boot.test.js tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/session-vision-event-feed.test.js tests/session-vision-policy.test.js tests/session-vision-policy-domain.test.js tests/session-vision-delegation.test.js tests/session-vision-delegation-boundary.test.js tests/subagent-vision-inheritance-characterization.test.js tests/subagent-vision-runtime-integration.test.js tests/subagent-vision-cold-resume.test.js tests/image-resource-governor.test.js tests/resource-retention-lifecycle.test.js tests/pixel-diff-stream.test.js tests/large-image-resource-integration.test.js tests/structured-guard-idempotency.test.js tests/vision-routing-product.test.js tests/vision-runtime-performance.test.js tests/vision-routing-settings-prelude.test.js tests/v2-settings-ia-integration.test.js tests/vision-capability-router.test.js tests/vision-capability-reference.test.js tests/vision-capability-benchmark.test.js tests/vision-capability-grounding-proof-contract.test.js tests/vision-capability-probe.test.js tests/vision-capability-axis-freshness.test.js tests/vision-capability-shadow-health.test.js tests/vision-capability-benchmark-service.test.js tests/vision-capability-preflight-hardening.test.js tests/vision-capability-benchmark-contract.test.js tests/vision-capability-benchmark-client.test.js tests/vision-capability-benchmark-client-productization.test.js tests/vision-capability-adapter-route.test.js tests/vision-background-benchmark.test.js tests/vision-background-lifecycle.test.js tests/vision-background-benchmark-productization.test.js tests/vision-capability-benchmark-budget.test.js tests/vision-image-input-verdict.test.js tests/vision-capability-failure-classification.test.js tests/vision-capability-gate-client.test.js tests/v2-product-review-fixes.test.js tests/qa-top5-reliability.test.js tests/qa-screenshot-runtime.test.js tests/qa-runtime-identity.test.js tests/qa-turn-budget-cancellation.test.js tests/qa-cancellation-publication.test.js tests/qa-reliability-tail.test.js tests/qa-endpoint-route-alias.test.js tests/settings-native-card-semantics.test.js tests/settings-native-card-lazy-data.test.js tests/settings-invalid-staged-dirty.test.js tests/vision-toggle-root-hardening.test.js && pnpm test:regression-closure && node --test tests/vision-backend-runtime-policy.test.js",
     "test:core": "node --test tests/core.test.js tests/degraded-local-evidence.test.js tests/runtime-e2e.test.js tests/structured-bootstrap.test.js tests/structured-flow-hardening.test.js tests/structured-flow-adversarial.test.js tests/vision-execution-policy.test.js tests/vision-backend-runtime-policy.test.js",
     "test:routing": "node --test tests/issue-374-delegated-call-config.test.js tests/twin-image-capability-fallback.test.js tests/twin-image-custom-wrapper.test.js tests/vision-routing-product.test.js tests/vision-capability-router.test.js tests/vision-capability-probe.test.js tests/vision-capability-shadow-health.test.js tests/vision-runtime-performance.test.js tests/vision-background-benchmark.test.js tests/vision-image-input-verdict.test.js",
     "test:session": "node --test tests/session-vision-state.test.js tests/session-vision-state-integration.test.js tests/session-vision-policy.test.js tests/session-vision-delegation.test.js tests/session-vision-delegation-boundary.test.js tests/subagent-vision-inheritance-characterization.test.js tests/subagent-vision-runtime-integration.test.js tests/subagent-vision-cold-resume.test.js tests/session-vision-policy-domain.test.js tests/replay-delegation.test.js tests/legacy-session-repair.test.js tests/session-repair-v2.test.js tests/issue-276-session-image-ownership.test.js",