dsh-vision-router 3.0.0 → 3.0.2

package/README.md

@@ -42,9 +42,16 @@
 > **Data leaves your machine by default.** When a cloud vision model is used, Vision Router sends the image (or a derived crop), the vision prompt and related request metadata to that provider. A fresh install has an anonymous OVHcloud vision fallback enabled, so "free" and "no key" do **not** mean offline. Do not use the cloud chain for confidential, regulated or classified material. See [Data flow and strict local-only use](#data-flow-and-strict-local-only-use).
 
 > [!WARNING]
-> 📌 **Announcement (v3.0.0)**
+> 📌 **Announcement (v3.0.2)**
 >
-> **v3.0.0: Session Vision policy now has a durable owner.** The supported DSH 0.1.x window now starts at `0.1.5-rc.1`, while the 0.2.x train starts at verified `0.2.0-rc.2`; Vision authority lives in a scoped, Host-storage-backed policy store, hydrates before child sessions publish, and binds delegation to the Host Agent lifecycle. The package root is a deliberate, typed public API, the runtime installation is grouped into explicit composition phases with an explicitly passed provider transport, and a new required peer (`@deepseek-ai/dsh-storage-domain`) is added. This release also closes the R11 adversarial final audit. [What’s new →](docs/releases/v3.0.0.md)
+> **v3.0.2: hardening from a full-repository adversarial review.** Instant local describe now
+> follows the same `proxy` / `proxyHosts` decision as every other provider leg; credential
+> redaction is one shared shape list for the logs and the failure diagnostics; adapter ownership
+> no longer accepts a primitive marker; proxy host admission normalizes IPv6 spellings and makes
+> `*.host` entries work; the background stop cache can neither go stale nor vanish; and failure
+> classification, numeric settings and the retained-image walker are hardened against inherited
+> keys, hostile accessors and pathological nesting. Supported Hosts are unchanged: DSH 0.1.x from
+> `0.1.5-rc.1`, DSH 0.2.x from verified `0.2.0-rc.2`. [What’s new →](docs/releases/v3.0.2.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />

package/README.zh.md

@@ -42,9 +42,14 @@
 > **默认配置会让数据出网。** 使用云端视觉模型时，Vision Router 会将图片（或由它裁剪出的局部）、识图提示词及相关请求元数据发送给对应供应商。新安装默认开启 OVHcloud 匿名视觉兜底，因此“免费”和“免 Key”不等于离线。涉密、涉案、内部或其他受限材料请勿使用云端链路。详见[数据流向与严格纯本地配置](#数据流向与严格纯本地配置)。
 
 > [!WARNING]
-> 📌 **公告（v3.0.0）**
+> 📌 **公告（v3.0.2）**
 >
-> **v3.0.0：Session Vision policy 有了持久归属。DSH 0.1.x 正式支持线提高到 `0.1.5-rc.1` 起，0.2.x 从已验证的 `0.2.0-rc.2` 起；识图权威由作用域化的、Host storage 背书的策略存储持有，子会话发布前完成 hydrate，委派绑定 Host Agent 生命周期；包根改为显式声明且带类型的公共 API，运行时装配显式分阶段、provider transport 必须显式传入，并新增必需 peer `@deepseek-ai/dsh-storage-domain`。本版本同时完成 R11 对抗终审。** [查看完整更新 →](docs/releases/v3.0.0.md)
+> **v3.0.2：一轮全仓对抗审查带来的加固。** instant 本地描述现在与其他 provider 腿遵守同一套
+> `proxy` / `proxyHosts` 判定；日志与失败诊断的凭据脱敏合并为一份共享清单；适配器归属不再接受
+> 基本类型标记；代理主机准入归一了 IPv6 写法并让 `*.host` 条目真正生效；后台停记录缓存既不残留
+> 也不会消失；失败分类、数值设置与 retained-image 遍历也分别对继承键、恶意取值器和畸形嵌套做了
+> 加固。支持的 Host 不变：DSH 0.1.x 自 `0.1.5-rc.1` 起，DSH 0.2.x 自已验证的 `0.2.0-rc.2` 起。
+> [查看完整更新 →](docs/releases/v3.0.2.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />

package/docs/architecture/3.0-r11-adversarial-review.md

@@ -425,11 +425,17 @@ keeps a guarding test here** except the two noted under residual risk.
    mechanism in turn (both edits fail the test, restoring passes). It is wired into
    `pnpm test`, so a regression now fails in the ordinary battery instead of only in
    a real-Host desktop gate.
-2. ~~conditional proxy bypass in the provider probes~~ — **closed in this round**:
-   the two probes now run inside the configured-pair proxy scope and take the
-   transport the proxy boundary currently owns (with a module-load capture as the
-   fallback), so a configured `proxy` reaches them exactly as it reaches vision
-   turns. The first attempt resolved `globalThis.fetch` at call time and was
+2. ~~conditional proxy bypass in the provider probes~~ — **closed in this round,
+   and completed afterwards**: the probes take the Router-owned provider transport
+   (`runtime.providerTransport` handed to the diagnostics routes), which owns the
+   `proxy` / `proxyHosts` decision, so a configured `proxy` reaches them exactly as
+   it reaches vision turns — for every provider shape. The first shape of this fix
+   ran the probes inside the legacy configured-pair scope, which only covers
+   non-router-owned providers; a `vision-http` direct backend (the plugin's default)
+   therefore still probed with ambient fetch (#633). The legacy boundary fetch is
+   kept as the fallback for Hosts that only configure the legacy pair scope, and the
+   same transport now also reaches the LM Studio **native** transport leg, which had
+   dropped it (#634). The first attempt resolved `globalThis.fetch` at call time and was
    **rejected by the project's own `L1-sealed-process-global` rule** — the same
    class as findings 1 and #519 — so the fix instead has the boundary own and
    advertise its wrapper (`currentLegacyGlobalProxyFetch()`), keeping every

package/docs/architecture/ci-risk-posture.md

@@ -0,0 +1,45 @@
+# CI risk posture
+
+This file records security-posture decisions that are deliberate rather than pending, so a
+later reader does not re-litigate them or mistake them for oversights.
+
+## Resolved: Scorecard `TokenPermissionsID` on workflows that publish or open pull requests
+
+Three alerts in this class were open on 2026-10-04 and are now `fixed` (2026-10-04T14:17:06Z):
+
+| Alert | Location | Grant then | Outcome |
+| --- | --- | --- | --- |
+| `#127` | `.github/workflows/dsh-alpha-pin-refresh.yml` | workflow-level `contents: write` + `pull-requests: write` | fixed by moving both grants onto the job that pushes the pin branch and opens its pull request |
+| `#125` | `.github/workflows/release.yml` | job-level `contents: write` (materialize the release tag) | fixed on re-analysis |
+| `#126` | `.github/workflows/release.yml` | job-level `contents: write` (publish the GitHub Release) | fixed on re-analysis |
+
+Scorecard's rule asks for top-level permissions to be `read-all` or `contents: read`, and
+job-level least-privilege grants are accepted. Every workflow here now has that shape:
+`release.yml` declares top-level `permissions: {}`, the alpha gate and the pin refresh declare
+`contents: read`, and each write grant lives on the single job that needs it.
+
+A previous revision of this file claimed the opposite — that the rule reports the grants
+themselves, so moving one between levels could not clear the alert. That claim was wrong. It
+generalised from the presence of alerts on `release.yml`'s job-level grants instead of measuring
+the level change itself; moving the pin refresh's grants to job level cleared its alert, and the
+two `release.yml` alerts cleared on re-analysis. The measurement is recorded above so the next
+reader does not repeat the inference.
+
+What remains true regardless of the score:
+
+- the pin refresh never checks out or executes upstream code: it reads npm and GitHub metadata
+  and rewrites one line, so the write token is never exposed to third-party code;
+- it has no access to secrets beyond the default token, and its pull request is opened with
+  `GITHUB_TOKEN`, which by design starts no workflow runs;
+- the gate that *does* execute upstream code keeps top-level `contents: read`, pins the upstream
+  commit literally, and neither writes nor restores any shared cache;
+- the platform-side control (a protected environment with required reviewers on the publishing
+  jobs) is available but deliberately not adopted: it would break unattended pin discovery, and
+  every write path here is already a reviewed pull request or a dispatched release.
+
+## How to revisit
+
+If the write tokens ever need to shrink, the order is: attach the publishing jobs to a protected
+environment, then drop `pull-requests: write` from the pin refresh by opening the bump as an
+issue instead of a pull request. Both trade automation for score, which is why they are not the
+default.

package/docs/architecture/dsh-021-alpha1-adaptation.md

@@ -0,0 +1,46 @@
+# DSH 0.2.1-alpha.1 compatibility audit
+
+## Release identity and channel
+
+- Upstream tag: `dsh-v0.2.1-alpha.1`
+- Upstream commit: `5badb15009ae1756c3afe0ae0cef1faafc290ccc`
+- npm publication: `2026-10-03T04:53:22.343Z`
+- GitHub release: `2026-10-03T06:42:00Z`
+- Channel: `alpha` only. At publication time both `latest` and `next` remain
+  `0.2.0-rc.2`.
+
+This release is inside the already peer-admitted
+`>=0.2.0-rc.2 <0.3.0-0` train. It does not move the exact supported evidence
+boundary away from `0.2.0-rc.2`, and it does not raise the public DSH 0.1.x
+minimum.
+
+## Compatibility review from 0.2.0-rc.2
+
+| Surface | Upstream change | DVR conclusion |
+| --- | --- | --- |
+| Host / Desktop | Desktop defaults to a system-assigned port. Boot/profile resolution and plugin package metadata were reworked. | Keep capability-based startup and authenticated Desktop tests. No version branch is needed. |
+| Session | Session list generation yields between work slices and honors cancellation. Core Session event signatures and the durable v4 admission surface remain compatible. | The existing post-commit `session/event(session, event)` observer and v4 admission contracts stay valid. |
+| Settings | No breaking Settings controller API change. Client Settings and Agent preset composition changed, and a Host may expose a different reachable Settings seam. | DVR already derives the seam from the installed Host and verifies mount/save/reload/readback in a real browser. |
+| Bundle / HMR | Web adds Schedule rows and `publicUrl`; HMR now reloads package entry/dependency maps and removes stale mappings. | Re-run real bundle recomposition and plugin lifecycle tests; do not pin private HMR helper names. |
+| Web / client | Draft preservation, plugin creation, inspector/devtools, tool preparation, layout, and document frontmatter rendering changed. | DVR's client injection remains capability/slot based. Real Chromium cold Vision, mixed attachment, and Settings tests cover the integration points. |
+| Model / LLM | The LLM base adapter exposes the synchronous `imageRequestPricing()` default used by the Host. | DVR's adapter registration boundary already supplies the inherited undefined default to duck-typed adapters. |
+| Attachment | Published attachment API shapes remain compatible. The alpha line retains the extended image and normalization limits. | DVR's root repair reconciles stale whole-row Cordis configs to the full Host policy and exercises the Host-owned Sharp pipeline. |
+| Service injection | Public `modelCatalog`, credential update, connection rejection, WebServer route, and Cordis lifecycle seams remain present. | Structured injection and authenticated Desktop RPC stay under exact-source and real-Host tests. |
+
+## Validation gate
+
+`.github/workflows/dsh-alpha-settings-host-gate.yml` pins the immutable commit
+above and runs:
+
+- exact-source and Host-owned Sharp contracts on Ubuntu, macOS, and Windows;
+- public 0.2.x peer admission and Host proxy ownership without changing the
+  minimum support window;
+- real macOS Desktop renderer lifecycle;
+- Windows Desktop authentication on Node 22 and 24, plus Node 24 renderer and
+  multi-plugin ordering adversaries;
+- real DSH Web + Chromium cold Vision, mixed attachments, Settings
+  mount/save/reload/readback, and bundle recomposition.
+
+The floating npm alpha canaries remain surveillance. Advancement of the
+ordinary development pin or exact supported evidence boundary is a separate,
+reviewed decision. This audit does not authorize a DVR package release.

package/docs/architecture/dsh-support-window.md

@@ -81,6 +81,14 @@ Version labels describe support policy and CI evidence; runtime branching still
 
 DVR must not turn these tables into widespread version-string conditionals. Runtime compatibility continues to feature-detect the concrete Host seam it needs. If a capability cannot be proven safely, the compatibility path fails open or reports an explicit unsupported/unknown state according to that seam's contract.
 
+The same rule binds the contract gate. `scripts/dsh-host-contract-smoke.mjs` derives the settings
+seam from the Host it is pointed at (`EXPECT_SETTINGS_MODE=auto`): the `0.1.5` train exposes
+`SettingsProvider.register()`, while the `0.1.7` release and every `0.2.x` Host since — `0.2.0-rc.2`
+through the `0.2.1` alpha line — replace it with `SettingsForms.describe()` plus ConfigEditor
+`configuration()`/`edit()`. A gate that pins one shape reports an unsupported Host for a Host DVR
+supports, so the floating canaries derive the seam, the pinned legs keep naming theirs explicitly,
+and a Host with neither reviewed seam fails the gate by name instead of passing silently.
+
 ## Compatibility-retirement rule
 
 The 2.3.x `0.1.5` train floor makes any compatibility path used only by pre-`0.1.5` Hosts eligible for a fresh deletion audit, but does not automatically authorize deletion. Durable session formats, replay envelopes, adapter wire shapes, and other historical inputs may outlive the Host version that originally produced them.

package/docs/releases/v3.0.1.md

@@ -0,0 +1,77 @@
+# v3.0.1
+
+DSH Vision Router 3.0.1 is a corrective release on the 3.0 line. It ships the five
+consumer-visible fixes that were merged after v3.0.0 was tagged: two in the Desktop
+settings surface and three in the provider egress paths, where a configured `proxy` /
+`proxyHosts` must reach every leg that talks to a provider. There are no new peers, no
+settings migration, no Session format change and no public API change.
+
+## Highlights
+
+- **Desktop settings values (#619).** A Host that exposes a legacy-shaped
+  `settingsScope` can return an empty `vision-router` namespace while its native config
+  forms keep working. That scope is now kept only as the delegate for every other
+  namespace instead of bypassing the local settings bridge, so the Vision Router
+  settings surface reads and writes real values on the Desktop shell.
+- **Model picker catalog (#620).** The model-visibility boundary now patches every
+  loader instance it can reach — including one published after the boundary installs —
+  so the picker no longer groups the same model twice.
+- **Background and local provider legs (#623).** The Router-owned provider transport is
+  threaded into the local vision stabilizer, the host/security boundaries and the
+  background benchmark, so those legs honor `proxy` / `proxyHosts` exactly like
+  foreground vision turns.
+- **Connection probe egress (#633).** The settings "test connection" probe now takes the
+  Router-owned transport (`runtime.providerTransport`) instead of relying on the legacy
+  configured-pair scope, which by construction cannot cover a `vision-http` direct
+  backend — the plugin's default shape. The legacy boundary fetch stays as the fallback
+  for Hosts that only configure the legacy scope.
+- **LM Studio native transport (#634).** `callLocalBackend`'s `format: 'lmstudio'`
+  branch no longer drops `providerTransport`, and the native `POST /api/v1/chat` goes
+  through `transport.fetch`, matching the openai and anthropic legs. A remote LM Studio
+  behind a proxy is reached like every other provider.
+- **Internal hardening (no package behavior change).** Exact Node-runtime and Playwright
+  system-package caches, Desktop adversary sharding and scenario concurrency, a Host
+  contract gate that derives the settings seam from the Host it meets, an alpha canary
+  that runs every contract instead of stopping at the first failure, and completed e2e
+  workflow trigger coverage.
+
+## Host support window
+
+Unchanged from 3.0.0:
+
+- DSH 0.1.x: `>=0.1.5-rc.1 <0.2.0-0`
+- DSH 0.2.x: `>=0.2.0-rc.2 <0.3.0-0`
+- ordinary development Host: exact `0.2.0-rc.2`
+
+The 0.2.x train is admitted from the verified `0.2.0-rc.2` boundary. The `0.2.1` alpha
+line is inside that admitted range and is exercised by the scheduled drift canaries,
+which read the settings seam from the Host they install; the exact-evidence boundary is
+still `0.2.0-rc.2`.
+
+## Validation
+
+- every fix carries a failing-first reproduction that fails on the pre-fix commit and
+  passes on this release commit — the Desktop settings and picker boundaries, the local
+  and background transport legs, the `vision-http` probe, and the LM Studio native
+  transport;
+- the full gate battery on the exact release commit: install, build, `build:check`,
+  source-ownership lint, source→artifact evidence, reproducible clean build, typecheck,
+  the test suite, client-source synchronization, the Host support-window contract, and
+  the packed public-API contract;
+- a real-Host pass on this exact build against an installed DSH checkout: the Host proxy
+  egress contract, the settings lifecycle in a real browser (mount, save, reload and
+  readback of the Vision Router section) and the Desktop Host injection contract
+  (structured injections, token exchange, authenticated index and DVR RPC);
+- the real-Host matrix (Windows Node 22/24 Desktop, macOS renderer, Linux real Host +
+  Chromium), the adversarial compatibility/fuzz gates and the resource-stress gates;
+- an adversarial review of this delta, including a provider-egress sweep over every
+  server-side entry point. The one candidate that looked like a further bypass — Ollama
+  cold start — is gated to loopback hosts and was recorded as falsified rather than
+  patched.
+
+## Upgrade
+
+Drop-in replacement for 3.0.0: no settings migration, no Session format change and no
+new peer dependency. Upgrading `dsh plugin --profile web add github:ysr666/dsh-vision-router`
+(or the pinned `dsh-vision-router@3.0.1`) keeps existing Vision Router settings and
+Session data readable as before.

package/docs/releases/v3.0.2.md

@@ -0,0 +1,105 @@
+# v3.0.2
+
+DSH Vision Router 3.0.2 is a hardening release on the 3.0 line. It ships the fixes from a
+full-repository adversarial review plus the follow-up pass over that work, the composer Vision
+control's responsive-design fix (issue #654) and the presented-image delivery fix, together with
+the one consumer-visible transport fix merged after v3.0.1 was tagged. There are no new peers, no
+settings migration, no Session format change and no public API change.
+
+## Highlights
+
+- **The composer Vision chip follows the shipped chip and adapts to narrow rows (#654).** It used
+  to draw its own 1px border, 12px type and a brand-coloured outline/fill while selected, and it
+  kept its label at every width, so on a narrow composer it took more room and read heavier than
+  its shipped neighbours. Its size, radius, hover, focus ring and selected state now come from the
+  shipped chip tokens (the same ones `ui-plan`'s PlanChip and the access-mode trigger use) and it
+  follows the composer row's size container: below the same 460px cut that chip uses, only the
+  14px glyph remains. Measured in one window: 72px → 30px, label hidden, glyph kept.
+- **The collapsed chip keeps the Vision eye; the check appears only while the label is there.** A
+  bare check says nothing about what the chip does, and on a narrow row it is the only thing left
+  on screen. The 14px slot now carries both glyphs and the same container query that collapses the
+  label swaps them: the enabled chip shows the check at `@container (min-width: 460.01px)`, and the
+  eye stays below that cut. Both states use the same fixed 14px slot, so the chip width never
+  changes with the state. The guide copy no longer teaches the check as the on-signal.
+- **A presented image lands in the message body, not only in a tool card.** The card shows a 240px
+  thumbnail and every later message pushes it up (measured on a real host: the same image drifted
+  from inside the viewport to 1692px above it within minutes). `vision_present` now also returns a
+  paste-ready `replyImage` that the visible reply carries, and the host renders an absolute image
+  path inside a message at full size through its own `api/file` route (measured in the DOM at
+  640×200 for the same image the card showed as a thumbnail). The tool card stays, and it now
+  centres itself when it mounts below the viewport — never when it is already visible, and never
+  for history above the reader.
+- **Instant local describe keeps the Router transport (#647, issue #646).** The instant local
+  describe path now hands the Router-owned `providerTransport` to its adapter call, so a configured
+  `proxy` / `proxyHosts` covers it exactly like every other provider leg.
+- **Credential redaction is one shared list (#653, #655).** The log sink and the benchmark-failure
+  diagnostic used to carry partial copies of the credential shapes, and each leaked what the other
+  covered. One shared list now covers `Authorization` with any scheme (including
+  `Proxy-Authorization`), `Cookie` / `Set-Cookie`, URL userinfo, `Bearer`, vendor keys (`sk-`,
+  `ghp_` / `github_pat_`, `AKIA` / `ASIA`, `xox…`, `AIza…`), JWTs, PEM blocks and `key=value`
+  assignments (including `#token=` fragments). A value that contains `;` is redacted whole, and a
+  PEM block truncated before its END marker is redacted to the end of the text.
+- **Adapter ownership no longer accepts a primitive marker (#653).** Three modules used to read the
+  shared ownership symbol on their own, and two of them treated "the marker is not undefined" as
+  ownership. Ownership now means "an object marker is present", so a foreign adapter that writes
+  `'anything'`, `false`, `null` or `0` onto the symbol is no longer mistaken for the Router's own
+  adapter; delegation, Session Vision authority and the tool boundary all read the same rule.
+- **Proxy host admission normalizes what it compares (#653, #655).** A bracketed IPv6 literal and
+  its bare spelling canonicalize to one host, and a `*.host` entry now matches the host it names
+  plus its subdomains instead of silently matching nothing.
+- **The background stop cache can neither go stale nor vanish (#653, #655).** A load that drops a
+  record (expired, malformed or superseded) rewrites the file instead of leaving a stale row
+  behind, and a failed cleanup write no longer discards the records that were read.
+- **Failure classification and numeric settings resolve own keys only (#653).** Error codes and
+  settings field names no longer resolve inherited values such as `constructor` or `__proto__`, and
+  a hostile `message` / `toString` / `code` / `status` accessor can no longer make the classifier
+  throw.
+- **The retained-image walker is depth-bounded (#653).** It now shares the bound `convertBlocks`
+  already applies to the same block tree, so a pathological message tree returns `false` instead of
+  overflowing the stack.
+- **Same-class hardening from the same review (#653).** Session Vision policy rows with
+  prototype-carried fields are treated as malformed; an explicit `null` options bag means "no
+  options" at four entry points instead of throwing from a parameter destructure; host capability
+  evidence is tri-state, so only an explicit `true` proves the support floor; the doctor host probe
+  is bounded even when the fetch ignores `AbortSignal`, and the error text it stores is redacted.
+
+## Host support window
+
+Unchanged from 3.0.1:
+
+- DSH 0.1.x: `>=0.1.5-rc.1 <0.2.0-0`
+- DSH 0.2.x: `>=0.2.0-rc.2 <0.3.0-0`
+- ordinary development Host: exact `0.2.0-rc.2`
+
+The 0.2.1 alpha line stays inside the admitted 0.2.x range and is now covered by a dedicated
+adaptation note (`docs/architecture/dsh-021-alpha1-adaptation.md`) in addition to the scheduled
+drift canaries.
+
+## Validation
+
+- every finding carries a failing-first reproduction that fails on the pre-fix commit and passes on
+  this release commit, and the four residual items found by the follow-up pass were reproduced
+  against the merged code before they were fixed;
+- the full gate battery on the exact release commit: install, build, `build:check`, source-ownership
+  lint, source→artifact evidence, reproducible clean build, typecheck, the test suite, client-source
+  synchronization, the Host support-window contract and the packed public-API contract;
+- a real-Host pass on this exact build against an installed DSH checkout: the Host proxy egress
+  contract, the settings lifecycle in a real browser (mount, save, reload and readback), the Desktop
+  Host injection contract (structured injections, token exchange, authenticated index and DVR RPC)
+  and the macOS Desktop renderer lifecycle with a functional vision turn;
+- counter-probes independent of the test suite: the eight review points go from 7/8 to 8/8 and the
+  pre/post differential from 2/4 to 4/4, with the host-admission differential showing no widening
+  for non-wildcard lists;
+- the real-Host matrix on the release pull request (Windows Node 22/24 Desktop, macOS renderer,
+  Linux real Host + Chromium), the adversarial compatibility/fuzz gates and the resource-stress
+  gates;
+- a write-scoped CI pass: the accepted risk posture is recorded in
+  `docs/architecture/ci-risk-posture.md` and each workflow grant is narrowed to the job that needs
+  it.
+
+## Upgrade
+
+Drop-in replacement for 3.0.1: no settings migration, no Session format change and no new peer
+dependency. Upgrading `dsh plugin --profile web add github:ysr666/dsh-vision-router` (or the pinned
+`dsh-vision-router@3.0.2`) keeps existing Vision Router settings and Session data readable as
+before.

package/index.js

@@ -2442,6 +2442,7 @@ export function apply(ctx, config = {}, runtime = {}) {
               memory: sessionImageMemory,
               timeoutMs: timeoutMs(),
               downscaleMaxPixels: instantLocalMaxPixels(),
+              providerTransport,
             })
             if (instantMap.size > 0) {
               ctx.logger?.info(
@@ -3859,7 +3860,10 @@ ctx.logger?.info(
         'Present a generated local image directly to the user with the host-native image preview. ' +
         'MANDATORY PRESENTATION RULE: when you generate, edit, screenshot, or export an image and want the user to see it, ' +
         'you MUST call vision_present. read_image is only for model-side inspection; NEVER use read_image to present or send ' +
-        'an image to the user. The image is retained in the session UI but sanitized out of later text-only model requests.',
+        'an image to the user. ALWAYS paste the returned replyImage into your visible reply too: the host renders an ' +
+        'absolute image path in a message as a full-size image where the reader is, while the tool card only shows a ' +
+        'thumbnail that later messages push away. The image is retained in the session UI but sanitized out of later ' +
+        'text-only model requests.',
       parameters: {
         type: 'object',
         properties: {
@@ -4770,9 +4774,15 @@ ctx.logger?.info(
                 '2. 还原验证循环（本插件招牌流程）：参考图 → 实现 → `vision_html_screenshot` 截图 → `vision_pixel_diff` 度量差异 → 修复 → 再截图，迭代到差异收敛（0% 是常见终点）；长页面用 `fullPage: true` 一次截整页并拿到 `pageHeight`；\n' +
                 '3. 其余按需取用：配色用 `vision_colors`，文字用 `vision_ocr`，图标矢量化用 `vision_trace`，纯色背景抠图用 `vision_extract_foreground`，本地 HTML 截图用 `vision_html_screenshot`（长页面加 `fullPage: true` 截整页）；\n' +
                 '4. 展示规则（必须遵守）：当你生成、编辑、截图或导出一张图片，并希望用户看到它时，必须调用 `vision_present`。' +
-                '`read_image` 仅用于你自己读取或检查图片内容，绝不能把 `read_image` 当成向用户展示或发送图片的方法。\n' +
+                '`read_image` 仅用于你自己读取或检查图片内容，绝不能把 `read_image` 当成向用户展示或发送图片的方法。' +
+                '调用后必须把返回的 `replyImage` 原样放进你的可见回复：宿主会把消息里的绝对图片路径渲染成完整尺寸的图，' +
+                '而工具卡片只显示缩略图、且会被后续消息顶出视野。\n' +
+
                 '   MANDATORY PRESENTATION RULE: when you generate, edit, screenshot, or export an image and want the user to see it, ' +
-                'you MUST call `vision_present`. `read_image` is only for your own model-side inspection; NEVER use `read_image` to present or send an image to the user.\n' +
+                'you MUST call `vision_present`. `read_image` is only for your own model-side inspection; NEVER use `read_image` to present or send an image to the user. ' +
+                'Also paste the returned `replyImage` into your visible reply: the host renders an absolute image path in a ' +
+                'message at full size, while the tool card only shows a thumbnail that later messages push out of view.\n' +
+
                 '5. 所有坐标都是原图像素（x1/y1/x2/y2）；上传的图片可以直接用其附件 ID（如 `sha256:…`）作为各工具的 image 参数，无需先找磁盘路径。' +
                 'All coordinates are original pixels (x1/y1/x2/y2); uploaded images can be referenced directly by their attachment id (e.g. `sha256:…`) as the image argument. 产物写入工作区 `' +
                 `${artifactsRel}` +
@@ -4849,6 +4859,8 @@ ctx.logger?.info(
   // only the three coherent domain faces it already computes; route lifecycle,
   // bounded /models probing and JSON response semantics live outside Core.
   installVisionDiagnosticsRoutes(ctx, {
+    // Same egress as real vision turns: the Router-owned provider transport.
+    transport: runtime?.providerTransport,
     connection: {
       candidatePairs: pairs,
       localBackends: () => localProvidersOf(current()),

package/lib/adapter-ownership.js

@@ -0,0 +1,51 @@
+/**
+ * Single owner of the Vision Router adapter ownership marker.
+ *
+ * Three modules used to interpret the same process-wide symbol on their own, and
+ * two of them treated "the marker is not undefined" as ownership — so a foreign
+ * adapter that wrote `'anything'`, `false`, `null` or `0` onto the shared symbol
+ * was classified as Vision Router's own adapter. Ownership now means "a marker
+ * *object* is present"; the per-function notes below record what that does and
+ * does not prove.
+ *
+ * The symbol stays `Symbol.for(...)` so separately loaded copies of this package
+ * still recognize each other's adapters; the rule about its *value* lives here
+ * once.
+ */
+export const VISION_ROUTER_ADAPTER_OWNER = Symbol.for('dsh-vision-router.adapter-owner');
+/** Read the marker without letting a hostile proxy/getter escape. */
+export function readVisionRouterAdapterOwner(adapter) {
+    if (adapter === null || (typeof adapter !== 'object' && typeof adapter !== 'function')) {
+        return undefined;
+    }
+    try {
+        return adapter[VISION_ROUTER_ADAPTER_OWNER];
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * True when the adapter carries an owner marker object.
+ *
+ * The marker's value has always been an object — the registration chain mints
+ * `Object.freeze({})`, and composition/tests mark adapters with plain records
+ * such as `{ route: 'deepseek-vision' }`. Requiring "an object" therefore keeps
+ * every genuine owner (including ones marked by another loaded copy) and rejects
+ * the values a foreign adapter can write by accident or in one line: `'anything'`,
+ * `false`, `null`, `0` and any other primitive.
+ *
+ * A first version of this fix also demanded `Object.isFrozen(owner)`. The
+ * repository's own issue-276/289/374/512 suites mark adapters with plain objects,
+ * so that extra requirement classified genuine owners as foreign and broke
+ * delegation; it was reverted here instead of being worked around in the tests.
+ *
+ * Residual risk, stated rather than hidden: in-process code able to run arbitrary
+ * JavaScript can still assign `{}` and be treated as an owner. Removing that needs
+ * one shared authority instead of a process-wide symbol, which is a larger design
+ * change than this fix.
+ */
+export function isVisionRouterOwnedAdapter(adapter) {
+    const owner = readVisionRouterAdapterOwner(adapter);
+    return typeof owner === 'object' && owner !== null;
+}