dsh-vision-router 3.0.0 → 3.0.2

package/lib/client-presentation-boundary-main.js

@@ -432,21 +432,21 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     if (next.zh && typeof next.zh === 'object') {
       next.zh = Object.assign({}, next.zh, {
         quickStartTitle: '聊天模型 + 识图模式',
-        quickStartBody: '先选择你平时使用的聊天模型。需要看图时，点击输入框旁的「识图」；出现 ✓ 表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。',
+        quickStartBody: '先选择你平时使用的聊天模型。需要看图时，点击输入框旁的「识图」；它变成选中态（高亮底色）表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。',
         onboardingStep1Title: '1 · 选择聊天模型并开启识图',
-        onboardingStep1Body: '先在聊天页右下角选择你平时使用的模型。需要看图时，点击模型选择器左侧的「识图」；出现 ✓ 表示已开启，不需要时再主动关闭。',
+        onboardingStep1Body: '先在聊天页右下角选择你平时使用的模型。需要看图时，点击模型选择器左侧的「识图」；它变成选中态（高亮底色）表示已开启，不需要时再主动关闭。',
         guideStep1Title: '第 1 步 · 选择聊天模型并认识「识图」',
-        guideStep1Body: '高亮的是聊天模型选择器；它左侧就是「识图」按钮。先选择你平时使用的聊天模型；需要看图时点击「识图」，出现 ✓ 表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。选好后点击「下一步」。'
+        guideStep1Body: '高亮的是聊天模型选择器；它左侧就是「识图」按钮。先选择你平时使用的聊天模型；需要看图时点击「识图」，它变成选中态（高亮底色）表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。选好后点击「下一步」。'
       });
     }
     if (next.en && typeof next.en === 'object') {
       next.en = Object.assign({}, next.en, {
         quickStartTitle: 'Chat model + Vision mode',
-        quickStartBody: 'Choose the chat model you normally use first. When you need image understanding, click “Vision” beside the composer; a ✓ means it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route.',
+        quickStartBody: 'Choose the chat model you normally use first. When you need image understanding, click “Vision” beside the composer; the chip lights up in its selected state to mean it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route.',
         onboardingStep1Title: '1 · Choose your chat model and enable Vision',
-        onboardingStep1Body: 'Choose the model you normally use from the lower-right chat selector. When you need image understanding, click “Vision” immediately to the left of the model selector; a ✓ means it is on. Turn it off again when you no longer need it.',
+        onboardingStep1Body: 'Choose the model you normally use from the lower-right chat selector. When you need image understanding, click “Vision” immediately to the left of the model selector; the chip lights up in its selected state to mean it is on. Turn it off again when you no longer need it.',
         guideStep1Title: 'Step 1 · Choose your chat model and find “Vision”',
-        guideStep1Body: 'The highlighted control is the chat model selector; the “Vision” button is immediately to its left. Choose your normal chat model first, then click “Vision” when you need image understanding. A ✓ means it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route. Click “Next” when done.'
+        guideStep1Body: 'The highlighted control is the chat model selector; the “Vision” button is immediately to its left. Choose your normal chat model first, then click “Vision” when you need image understanding. The chip lights up in its selected state to mean it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route. Click “Next” when done.'
       });
     }
     return next;
@@ -948,6 +948,89 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     }, 'vision-router: clipboard image paste normalization');
   }
 
+  // The composer chip chrome follows the shipped mode chips (ui-plan's PlanChip and the
+  // access-mode trigger): 28px tall, token radius, no border, token hover fill, the shipped
+  // focus ring, and the shipped "selected chip" treatment while Vision is on. The composer row
+  // is a size container (InputBar .row), so the label collapses to the 14px glyph below the
+  // shipped 460px cut — the same cut the access-mode trigger uses — instead of squeezing the
+  // model trigger on narrow windows.
+  var VISION_TOGGLE_CSS = '' +
+    '.vr-vision-toggle{display:inline-flex;align-items:center;gap:4px;min-width:0;height:28px;' +
+    'padding:0 8px;border:none;border-radius:var(--dsw-radius-sm);background:transparent;' +
+    'color:var(--dsw-alias-label-secondary);font:inherit;font-size:13px;font-weight:500;' +
+    'line-height:20px;cursor:pointer;white-space:nowrap}' +
+    '.vr-vision-toggle:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}' +
+    '.vr-vision-toggle:focus-visible{outline:var(--dsw-focus-ring-width) solid ' +
+    'var(--dsw-focus-ring-color,var(--dsw-alias-brand-primary));outline-offset:2px}' +
+    '.vr-vision-toggle:disabled{cursor:default}' +
+    // Dim only the states that read as "cannot be used right now". A disabled chip that is
+    // merely waiting for this toggle's own selection keeps full opacity, so the composer does
+    // not flash a greyed control while the model swap it owns is still settling.
+    '.vr-vision-toggle[data-dimmed="true"]{opacity:.45}' +
+    '.vr-vision-toggle[data-active="true"]{color:var(--dsw-alias-label-primary);' +
+    'background:var(--dsw-alias-button-ghost-active-fill);' +
+    'box-shadow:inset 0 0 0 1px var(--dsw-alias-button-ghost-active-border)}' +
+    '.vr-vision-toggle[data-active="true"]:hover:not(:disabled){' +
+    'background:var(--dsw-alias-button-ghost-active-hover)}' +
+    '.vr-vision-toggle-glyph{display:inline-flex;align-items:center;justify-content:center;' +
+    'flex:0 0 auto;width:14px;height:14px;font-size:13px;line-height:1;color:currentColor}' +
+    '.vr-vision-toggle-glyph-part{display:inline-flex;align-items:center;justify-content:center;' +
+    'width:14px;height:14px}' +
+    // The check carries the state only while the label is there to explain it. Once the label
+    // collapses (the shipped 460px cut below) a bare check means nothing, so the Vision eye —
+    // the only thing that still says what the chip does — stays, and the chip's selected chrome
+    // marks on/off on its own.
+    '.vr-vision-toggle-glyph-check{display:none}' +
+    '@container (min-width:460.01px){' +
+    '.vr-vision-toggle[data-active="true"] .vr-vision-toggle-glyph-eye{display:none}' +
+    '.vr-vision-toggle[data-active="true"] .vr-vision-toggle-glyph-check{display:inline-flex}}' +
+    '@container (max-width:460px){.vr-vision-toggle-label{display:none}}';
+
+  function installVisionToggleStyles() {
+    if (typeof document === 'undefined' || !document.head) return undefined;
+    var tag = document.createElement('style');
+    tag.dataset.plugin = 'dsh-vision-router';
+    tag.dataset.pluginCss = 'dsh-vision-router/mode-toggle';
+    tag.textContent = VISION_TOGGLE_CSS;
+    document.head.appendChild(tag);
+    return function(){ tag.remove(); };
+  }
+
+  // A presented image that mounts below the reader is the same as not being shown: the card
+  // renders next to its tool call, and a reader who is at the end of a long conversation has
+  // that call thousands of pixels above them. The card calls this on mount; it only moves the
+  // reader for content that arrived below the viewport — a card that is already visible is left
+  // alone, and so is history above the reader when a session is opened.
+  function focusPresentedCard(node, viewportHeight) {
+    if (!node || typeof node.getBoundingClientRect !== 'function') return false;
+    var rect = node.getBoundingClientRect();
+    if (rect.top <= viewportHeight) return false;
+    var scroller = node.parentElement;
+    var hops = 0;
+    while (scroller && hops < 20) {
+      var style = typeof getComputedStyle === 'function' ? getComputedStyle(scroller) : undefined;
+      var scrollable = /(auto|scroll)/.test(String(style && style.overflowY)) &&
+        scroller.scrollHeight > scroller.clientHeight + 4;
+      if (scrollable) {
+        var box = scroller.getBoundingClientRect();
+        scroller.scrollTop += (rect.top - box.top) - (box.height / 2 - rect.height / 2);
+        return true;
+      }
+      scroller = scroller.parentElement;
+      hops += 1;
+    }
+    return false;
+  }
+
+  try {
+    globalThis.__dvrPresentFocus = function () {
+      if (typeof document === 'undefined') return false;
+      var cards = document.querySelectorAll('[data-dvr-present]');
+      var last = cards[cards.length - 1];
+      return last ? focusPresentedCard(last, globalThis.innerHeight || 0) : false;
+    };
+  } catch (_) {}
+
   function installVisionModeToggle(ctx, React, primitives) {
     if (!ctx || typeof ctx.inject !== 'function' || !React) return;
     var zh = {
@@ -974,6 +1057,9 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     try {
       ctx.effect(function(){ return ctx.locale.register(VISION_MODE_NS, { zh: zh, en: en }); }, 'vision-router: mode toggle locale');
     } catch (_) {}
+    try {
+      ctx.effect(function(){ return installVisionToggleStyles(); }, 'vision-router: mode toggle styles');
+    } catch (_) {}
 
     function FallbackToast(props) {
       React.useEffect(function(){
@@ -1004,9 +1090,13 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     }
 
     var ToastComponent = primitives && typeof primitives.Toast === 'function' ? primitives.Toast : FallbackToast;
-    var WarningIcon = primitives && typeof primitives.IconWarningOutline16 === 'function'
-      ? primitives.IconWarningOutline16
-      : undefined;
+    // The product icon set names weights, not sizes (IconWarningOutlineRegular); the old
+    // "…16" spelling never existed, so the toast silently fell back to a text glyph.
+    var WarningIcon = primitives && typeof primitives.IconWarningOutlineRegular === 'function'
+      ? primitives.IconWarningOutlineRegular
+      : primitives && typeof primitives.IconWarningOutline16 === 'function'
+        ? primitives.IconWarningOutline16
+        : undefined;
 
     var settings = bindVisionModeSettings(ctx);
     var unavailableSettingsState = { value: undefined };
@@ -1106,29 +1196,6 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
             : livePair.mode === 'unavailable'
               ? t('unavailable')
               : active ? t('disable') : t('enable');
-        var style = {
-          appearance: 'none',
-          minHeight: 28,
-          display: 'inline-flex',
-          alignItems: 'center',
-          gap: 5,
-          padding: '4px 8px',
-          borderRadius: 8,
-          border: '1px solid ' + (active ? 'var(--dsw-alias-brand-primary)' : 'var(--dsw-alias-border-l2)'),
-          background: active
-            ? 'color-mix(in srgb, var(--dsw-alias-brand-primary) 14%, transparent)'
-            : 'transparent',
-          color: active ? 'var(--dsw-alias-brand-primary)' : 'var(--dsw-alias-label-secondary)',
-          boxShadow: active ? 'inset 0 0 0 1px var(--dsw-alias-brand-primary)' : 'none',
-          font: 'inherit',
-          fontSize: 12,
-          lineHeight: 1.4,
-          fontWeight: active ? 650 : 500,
-          cursor: disabled ? 'default' : 'pointer',
-          opacity: disabled && !ownSettling && (livePair.mode === 'unavailable' || loading) ? 0.45 : 1,
-          whiteSpace: 'nowrap'
-        };
-
         function announceRejectedSelection() {
           var latest;
           try {
@@ -1155,7 +1222,9 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
           'aria-busy': busy || loading,
           title: title,
           disabled: disabled,
-          style: style,
+          className: 'vr-vision-toggle',
+          'data-active': active ? 'true' : 'false',
+          'data-dimmed': disabled && !ownSettling && (livePair.mode === 'unavailable' || loading) ? 'true' : 'false',
           onClick: function() {
             if (disabled || !pair.target || typeof props.select !== 'function') return;
             var target = pair.target;
@@ -1179,25 +1248,19 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
             });
           }
         },
-          // One fixed 14px leading slot carries the state icon: the eye when the
-          // route is ordinary, the check when Vision is on. Appending the check
-          // only while active changed the chip width by ~18px and reflowed the
-          // composer row; reserving trailing space kept the width but left the
-          // inactive chip visually off-centre.
+          // One fixed 14px leading slot carries both glyphs: the Vision eye and the check that
+          // marks the enabled state. The stylesheet shows the check only while the label is
+          // present (the same 460px container cut that collapses the label), because a bare check
+          // tells a reader nothing — once the label is gone the eye, which still says what the
+          // chip does, stays. The slot is a fixed 14px box either way, so the chip width never
+          // changes with the state.
           React.createElement('span', {
             'aria-hidden': 'true',
-            style: {
-              display: 'inline-flex',
-              alignItems: 'center',
-              justifyContent: 'center',
-              flex: '0 0 auto',
-              width: 14,
-              height: 14,
-              fontSize: 13,
-              lineHeight: 1
-            }
-          }, active ? '✓' : '👁'),
-          React.createElement('span', null, t('label'))
+            className: 'vr-vision-toggle-glyph'
+          },
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-eye' }, '👁'),
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-check' }, '✓')),
+          React.createElement('span', { className: 'vr-vision-toggle-label' }, t('label'))
         );
 
         var toastNode = toast

package/lib/client-presentation-boundary.js

@@ -10,43 +10,32 @@ import { installVisionModelVisibilityBoundary } from './vision-model-visibility-
 
 const CLIENT_PRESENTATION_MARK = 'data-vision-router-presentation-boundary'
 
-const VISION_TOGGLE_TEXT_GLYPH = String.raw`          // One fixed 14px leading slot carries the state icon: the eye when the
-          // route is ordinary, the check when Vision is on. Appending the check
-          // only while active changed the chip width by ~18px and reflowed the
-          // composer row; reserving trailing space kept the width but left the
-          // inactive chip visually off-centre.
+const VISION_TOGGLE_TEXT_GLYPH = String.raw`          // One fixed 14px leading slot carries both glyphs: the Vision eye and the check that
+          // marks the enabled state. The stylesheet shows the check only while the label is
+          // present (the same 460px container cut that collapses the label), because a bare check
+          // tells a reader nothing — once the label is gone the eye, which still says what the
+          // chip does, stays. The slot is a fixed 14px box either way, so the chip width never
+          // changes with the state.
           React.createElement('span', {
             'aria-hidden': 'true',
-            style: {
-              display: 'inline-flex',
-              alignItems: 'center',
-              justifyContent: 'center',
-              flex: '0 0 auto',
-              width: 14,
-              height: 14,
-              fontSize: 13,
-              lineHeight: 1
-            }
-          }, active ? '✓' : '👁'),
-          React.createElement('span', null, t('label'))`
-
-const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading slot carries the state icon: the eye when the
-          // route is ordinary, the check when Vision is on. Appending the check
-          // only while active changed the chip width by ~18px and reflowed the
-          // composer row; reserving trailing space kept the width but left the
-          // inactive chip visually off-centre.
+            className: 'vr-vision-toggle-glyph'
+          },
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-eye' }, '👁'),
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-check' }, '✓')),
+          React.createElement('span', { className: 'vr-vision-toggle-label' }, t('label'))`
+
+const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading slot carries both glyphs: the Vision eye and the check that
+          // marks the enabled state. The stylesheet shows the check only while the label is
+          // present (the same 460px container cut that collapses the label), because a bare check
+          // tells a reader nothing — once the label is gone the eye, which still says what the
+          // chip does, stays. The slot is a fixed 14px box either way, so the chip width never
+          // changes with the state.
           React.createElement('span', {
             'aria-hidden': 'true',
-            style: {
-              display: 'inline-flex',
-              alignItems: 'center',
-              justifyContent: 'center',
-              flex: '0 0 auto',
-              width: 14,
-              height: 14
-            }
-          }, active
-            ? React.createElement('svg', {
+            className: 'vr-vision-toggle-glyph'
+          },
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-eye' },
+            React.createElement('svg', {
                 width: 14,
                 height: 14,
                 viewBox: '0 0 14 14',
@@ -55,13 +44,13 @@ const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading s
                 focusable: 'false',
                 style: { display: 'block', flex: '0 0 auto' }
               }, React.createElement('path', {
-                d: 'M2.75 7.15 5.6 10 11.25 4.35',
-                stroke: 'currentColor',
-                strokeWidth: 1.5,
-                strokeLinecap: 'round',
-                strokeLinejoin: 'round'
-              }))
-            : React.createElement('svg', {
+                fillRule: 'evenodd',
+                clipRule: 'evenodd',
+                d: 'M7 2.25c-2.84 0-5.04 1.69-6.25 4.25a1.15 1.15 0 0 0 0 1C1.96 10.06 4.16 11.75 7 11.75s5.04-1.69 6.25-4.25a1.15 1.15 0 0 0 0-1C12.04 3.94 9.84 2.25 7 2.25Zm0 1.25c2.16 0 3.96 1.21 5.05 3.5C10.96 9.29 9.16 10.5 7 10.5S3.04 9.29 1.95 7C3.04 4.71 4.84 3.5 7 3.5Zm0 1.25A2.25 2.25 0 1 0 7 9.25a2.25 2.25 0 0 0 0-4.5Zm0 1.25a1 1 0 1 1 0 2 1 1 0 0 1 0-2Z',
+                fill: 'currentColor'
+              }))),
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-check' },
+            React.createElement('svg', {
                 width: 14,
                 height: 14,
                 viewBox: '0 0 14 14',
@@ -70,12 +59,13 @@ const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading s
                 focusable: 'false',
                 style: { display: 'block', flex: '0 0 auto' }
               }, React.createElement('path', {
-                fillRule: 'evenodd',
-                clipRule: 'evenodd',
-                d: 'M7 2.25c-2.84 0-5.04 1.69-6.25 4.25a1.15 1.15 0 0 0 0 1C1.96 10.06 4.16 11.75 7 11.75s5.04-1.69 6.25-4.25a1.15 1.15 0 0 0 0-1C12.04 3.94 9.84 2.25 7 2.25Zm0 1.25c2.16 0 3.96 1.21 5.05 3.5C10.96 9.29 9.16 10.5 7 10.5S3.04 9.29 1.95 7C3.04 4.71 4.84 3.5 7 3.5Zm0 1.25A2.25 2.25 0 1 0 7 9.25a2.25 2.25 0 0 0 0-4.5Zm0 1.25a1 1 0 1 1 0 2 1 1 0 0 1 0-2Z',
-                fill: 'currentColor'
-              }))),
-          React.createElement('span', null, t('label'))`
+                d: 'M2.75 7.15 5.6 10 11.25 4.35',
+                stroke: 'currentColor',
+                strokeWidth: 1.5,
+                strokeLinecap: 'round',
+                strokeLinejoin: 'round'
+              })))),
+          React.createElement('span', { className: 'vr-vision-toggle-label' }, t('label'))`
 
 const BITMAP_LIMITS_BASE = String.raw`      var maxBitmapSourceBytes = 64 * 1024 * 1024;
       var maxBitmapDimension = 10000;

package/lib/client.js

@@ -4770,6 +4770,7 @@ openLogFolder,
         const imageKeySignature = JSON.stringify(imageKeys)
         const imageOwnerToken = React.useRef({}).current
         const ownedImageKeys = React.useRef(new Set())
+        React.useEffect(() => { if (globalThis.__dvrPresentFocus) globalThis.__dvrPresentFocus() }, [imageKeySignature])
         React.useEffect(() => {
           const current = new Set(imageKeys)
           for (const key of ownedImageKeys.current) {
@@ -4809,7 +4810,7 @@ openLogFolder,
         }
         return React.createElement(
           'div',
-          { style: { display: 'flex', flexDirection: 'column', alignItems: 'flex-start', gap: 6, padding: '4px 0' } },
+          { 'data-dvr-present': 'true', style: { display: 'flex', flexDirection: 'column', alignItems: 'flex-start', gap: 6, padding: '4px 0' } },
           parsed && typeof parsed.label === 'string' && parsed.label !== 'image'
             ? React.createElement(
                 'div',

package/lib/core-primitives.js

@@ -161,6 +161,18 @@ export function eventHasImage(event) {
   return false
 }
 
+/**
+ * Read one options/argument bag as a record, or `undefined` when the value is not
+ * an object at all. Callers write `objectRecord(options) ?? {}`: an explicit
+ * `null` (or a primitive) then means "no options" instead of throwing from a
+ * parameter destructure or a property read.
+ */
+export function objectRecord(value) {
+  return value !== null && typeof value === 'object'
+    ? value
+    : undefined
+}
+
 export function localOnlyVisionEnabled(config = {}) {
   return !!config && config.localOnlyVision === true
 }
@@ -324,6 +336,11 @@ export function rewriteToolResultImages(content, replace) {
 
 export function renderVisionPresent(value) {
   const attachment = value.attachment
+  // The card renders the image next to the tool call, which can sit far above a reader who is at
+  // the end of a long conversation. The reply body is where that reader actually is, and the
+  // client rewrites an absolute local image path written in Markdown into a displayable URL, so
+  // the result hands back a paste-ready snippet plus the rule that says why it matters.
+  const label = String(value.label === undefined ? 'image' : value.label).replace(/[[\]]/g, '')
   return [
     {
       type: 'text',
@@ -335,6 +352,10 @@ export function renderVisionPresent(value) {
         bytes: value.bytes,
         safePresentation: true,
         attachmentId: String(attachment.attachmentId),
+        replyImage: `![${label}](<${value.path}>)`,
+        replyImageHint:
+          'Also put replyImage in your visible reply: the host renders an absolute image path in a message ' +
+          'at full size where the reader is, while this card only shows a thumbnail that later messages push away.',
       }),
     },
     { type: 'image', attachment },
@@ -1937,7 +1958,11 @@ async function callLmStudioNative(provider, messages, options = {}) {
     ...(typeof options.temperature === 'number' ? { temperature: options.temperature } : {}),
     ...(typeof options.top_p === 'number' ? { top_p: options.top_p } : {}),
   }
-  const response = await fetch(`${apiRoot}/api/v1/chat`, {
+  const transport = options.providerTransport
+  const requestFetch = typeof transport?.fetch === 'function'
+    ? (input, init) => transport.fetch(input, init, { providerName: provider.name, allowProxy: true })
+    : fetch
+  const response = await requestFetch(`${apiRoot}/api/v1/chat`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify(body),
@@ -1984,6 +2009,9 @@ export async function callLocalBackend(provider, messages, options = {}) {
     return callLmStudioNative(provider, messages, {
       maxTokens,
       signal: options.signal,
+      // The native LM Studio transport is a provider leg like the openai/anthropic
+      // ones: it must use the Router-owned transport so proxy/proxyHosts apply.
+      providerTransport: options.providerTransport,
       ...(typeof provider.reasoningEffort === 'string' ? { reasoningEffort: provider.reasoningEffort } : {}),
       ...sampling,
     })

package/lib/core-vision-surface.js

@@ -1,4 +1,5 @@
 import { currentSessionSurfacePolicy } from './session-surface-policy.js'
+import { objectRecord } from './core-primitives.js'
 import {
   CORE_VISION_SURFACE_KEYS,
   projectCoreVisionSurface,
@@ -32,7 +33,8 @@ export function currentCoreVisionSurface(config = {}, options = {}) {
  * The config source stays live, but schema bootstrap is an internal lifecycle
  * bit rather than a fake Settings/config value.
  */
-export function createCoreVisionSurfaceRuntime({ config = {} } = {}) {
+export function createCoreVisionSurfaceRuntime(rawOptions) {
+  const { config = {} } = objectRecord(rawOptions) ?? {}
   let schemaBootstrapping = true
 
   const current = () => {

package/lib/desktop-screenshot-tool.js

@@ -9,6 +9,7 @@ import {
   callLocalBackend,
   localDescribePrompt,
   localProvidersOf,
+  objectRecord,
   toOpenAIContent,
 } from './core-primitives.js'
 import { loadSharp } from './sharp-runtime.js'
@@ -170,15 +171,16 @@ async function identifyDesktopCapture(data, {
  * this module owns only the platform capture and optional local-recognition
  * implementation behind that existing permission boundary.
  */
-export function createDesktopScreenshotTool({
-  current,
-  timeoutMs,
-  saveArtifact,
-  stringOutput,
-  instantLocalStyle,
-  providerTransport,
-  captureDesktop = captureDesktopPng,
-} = {}) {
+export function createDesktopScreenshotTool(rawOptions) {
+  const {
+    current,
+    timeoutMs,
+    saveArtifact,
+    stringOutput,
+    instantLocalStyle,
+    providerTransport,
+    captureDesktop = captureDesktopPng,
+  } = objectRecord(rawOptions) ?? {}
   if (
     typeof current !== 'function' ||
     typeof timeoutMs !== 'function' ||

package/lib/diagnostic-redaction.js

@@ -1,26 +1,75 @@
 const SENSITIVE_QUERY = /^(?:api[_-]?key|key|token|secret|password|authorization|auth|signature|sig)$/i
 
+/**
+ * Credential shapes worth removing from anything that reaches a log, a support
+ * report or a model-visible diagnostic.
+ *
+ * Two callers used to keep their own partial copy of this list, so each one
+ * leaked what the other covered (`Authorization: token ghp_…`, `Cookie:`, bare
+ * platform tokens, `#token=` fragments). One shared list is the fix: callers may
+ * still add their own extra passes, but never their own subset of this one.
+ */
+// One spelling for every caller: the log path's own test pins the uppercase
+// marker (`/\[REDACTED/`), the diagnostic path's test is case-insensitive, so
+// uppercase is the only spelling that keeps both existing contracts intact.
+const REDACTED = '[REDACTED]'
+const CREDENTIAL_SHAPE_PATTERNS = [
+  // Any Authorization scheme, not only Bearer/Basic (`token`, `ApiKey`, `AWS4-…`),
+  // but only the credential itself: a single line may carry safe diagnostics
+  // after the header and a support report must keep them. `;` stays inside the value
+  // (the log sink has always consumed it) while `,` separates what follows.
+  [/\b(Authorization\s*[:=]\s*)(?:[A-Za-z][A-Za-z0-9._-]*\s+)?[^\s,]+/gi, `$1${REDACTED}`],
+  [/\b(Proxy-Authorization\s*[:=]\s*)(?:[A-Za-z][A-Za-z0-9._-]*\s+)?[^\s,]+/gi, `$1${REDACTED}`],
+  // Cookies are `name=value; name=value` on one line and there is no safe way to
+  // guess which pair carries the session, so the whole header value goes.
+  [/\b((?:Set-)?Cookie\s*[:=]\s*)[^\r\n]+/gi, `$1${REDACTED}`],
+  // URL userinfo (`scheme://user:secret@host`) without needing a URL parser, so
+  // the log path — which never parsed URLs — covers it too.
+  [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s@]+@/gi, `$1${REDACTED}@`],
+  [/\b(Bearer\s+)[A-Za-z0-9._~+/-]{8,}/gi, `$1${REDACTED}`],
+  // Vendor-prefixed keys: OpenAI/Anthropic, GitHub, AWS, Slack, Google, PEM.
+  [/\b(sk-(?:proj-|ant-|or-)?)[A-Za-z0-9_-]{8,}/gi, `$1${REDACTED}`],
+  [/\b(gh[pousr]_|github_pat_)[A-Za-z0-9_]{8,}/gi, `$1${REDACTED}`],
+  [/\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, `${REDACTED}`],
+  [/\b(xox[baprs]-)[A-Za-z0-9-]{8,}/gi, `$1${REDACTED}`],
+  [/\b(AIza)[A-Za-z0-9_-]{16,}/g, `$1${REDACTED}`],
+  // Signed JSON Web Tokens, with or without a leading scheme word.
+  [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, REDACTED],
+  // An unterminated block (a bounded upstream read truncates before the END marker) must
+  // redact to the end of the text: without the `$` alternative its whole body passes through.
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, REDACTED],
+  // `api_key=…`-style assignments, including `apikey` and `access_token`. `;` stays inside the
+  // value for the same reason as above; `&` separates an unrelated parameter a report must keep.
+  [/\b(access[_-]?token|api[_-]?key|apikey|token|secret|password|passwd|signature|sig)\s*[:=]\s*([^\s,&"']+)/gi, `$1=${REDACTED}`],
+]
+
+/** Apply only the shared credential-shape passes (no URL parsing, no truncation). */
+export function redactCredentialShapes(text) {
+  let out = String(text ?? '')
+  for (const [pattern, replacement] of CREDENTIAL_SHAPE_PATTERNS) {
+    out = out.replace(pattern, replacement)
+  }
+  return out
+}
+
 function redactUrl(match) {
   try {
     const url = new URL(match)
-    url.username = url.username ? '[redacted]' : ''
-    url.password = url.password ? '[redacted]' : ''
+    url.username = url.username ? REDACTED : ''
+    url.password = url.password ? REDACTED : ''
     for (const key of [...url.searchParams.keys()]) {
-      if (SENSITIVE_QUERY.test(key)) url.searchParams.set(key, '[redacted]')
+      if (SENSITIVE_QUERY.test(key)) url.searchParams.set(key, REDACTED)
     }
-    return url.toString()
+    return redactCredentialShapes(url.toString())
   } catch {
-    return match
+    return redactCredentialShapes(match)
   }
 }
 
 export function redactDiagnosticText(value, max = 400) {
   const limit = Math.max(32, Math.min(4000, Math.floor(Number(max) || 400)))
-  let text = String(value ?? '').replace(/[\u0000-\u001f\u007f-\u009f]+/g, ' ')
-  text = text.replace(/\bhttps?:\/\/[^\s"'<>]+/gi, redactUrl)
-  text = text.replace(/\b(Authorization\s*:\s*)(?:Bearer|Basic)\s+[^\s,;]+/gi, '$1[redacted]')
-  text = text.replace(/\b(Bearer\s+)[A-Za-z0-9._~+\/-]{12,}/gi, '$1[redacted]')
-  text = text.replace(/\b(sk-(?:proj-)?)[A-Za-z0-9_-]{8,}/gi, '$1[redacted]')
-  text = text.replace(/\b(api[_-]?key|token|secret|password|authorization|signature)\s*[:=]\s*([^\s,;&]+)/gi, '$1=[redacted]')
-  return text.slice(0, limit)
+  const text = String(value ?? '').replace(/[\u0000-\u001f\u007f-\u009f]+/g, ' ')
+  return redactCredentialShapes(
+    text.replace(/\bhttps?:\/\/[^\s"'<>]+/gi, redactUrl),
+  ).slice(0, limit)
 }

package/lib/doctor-cli-p0.js

@@ -8,6 +8,7 @@ import {
   normalizeDshHostCapabilities,
 } from './dsh-host-capabilities.js'
 import { DOCTOR_RESPONSE_MAX_BYTES, readResponseJsonBounded } from './http-body-limit.js'
+import { redactDiagnosticText } from './diagnostic-redaction.js'
 import {
   DSH_SUPPORT_WINDOW,
   DSH_VERIFICATION_EVIDENCE,
@@ -16,6 +17,10 @@ import {
 } from './dsh-support-window.js'
 
 const HOST_CAPABILITIES_PATH = '/_dsh/vision-router/host-capabilities'
+const DOCTOR_PROBE_TIMEOUT_MS = 1500
+// The fence is a backstop, not a competing deadline: it must sit after the signal
+// so a cooperative fetch keeps reporting the abort reason it reports today.
+const DOCTOR_PROBE_FENCE_MS = DOCTOR_PROBE_TIMEOUT_MS + 250
 
 function commandOf(argv) {
   const first = argv.find((value) => typeof value === 'string' && !value.startsWith('-'))
@@ -51,11 +56,34 @@ export async function probeDoctorHostCapabilities({ baseUrl, fetchImpl = globalT
     if (typeof fetchImpl !== 'function') {
       return { ok: false, source: 'runtime-unavailable', capabilities: unknownSnapshot() }
     }
-    const response = await fetchImpl(normalized, {
-      method: 'GET',
-      headers: { accept: 'application/json' },
-      signal: AbortSignal.timeout(1500),
+    // The signal below only bounds a fetch that honours it. A non-cooperative
+    // implementation would leave this probe pending forever, so the same inline
+    // fence the live-model discovery uses (its own timer + explicit cleanup)
+    // bounds the await itself. The signal stays so a cooperative fetch still
+    // reports the aborted reason it reports today.
+    // The fence deliberately keeps the event loop alive: this is a foreground
+    // probe the CLI is waiting on, unlike the background benchmark timers that
+    // unref themselves. (Node's own AbortSignal.timeout timer is unref'd, so
+    // unref'ing this one too would let the process exit before it fires.)
+    let deadlineTimer
+    const deadline = new Promise((_, reject) => {
+      deadlineTimer = setTimeout(() => {
+        reject(new Error(`Doctor Host capability probe exceeded ${DOCTOR_PROBE_TIMEOUT_MS}ms`))
+      }, DOCTOR_PROBE_FENCE_MS)
     })
+    let response
+    try {
+      response = await Promise.race([
+        fetchImpl(normalized, {
+          method: 'GET',
+          headers: { accept: 'application/json' },
+          signal: AbortSignal.timeout(DOCTOR_PROBE_TIMEOUT_MS),
+        }),
+        deadline,
+      ])
+    } finally {
+      clearTimeout(deadlineTimer)
+    }
     if (!response.ok) {
       return {
         ok: false,
@@ -73,10 +101,13 @@ export async function probeDoctorHostCapabilities({ baseUrl, fetchImpl = globalT
       capabilities: normalizeDshHostCapabilities(body?.capabilities),
     }
   } catch (error) {
+    // A fetch failure can echo the request URL, and a proxy failure can echo the
+    // proxy URL with its userinfo; the doctor report is meant to be shareable, so
+    // the message is redacted at the source rather than at each print site.
     return {
       ok: false,
       source: 'runtime-unavailable',
-      error: error instanceof Error ? error.message : String(error),
+      error: redactDiagnosticText(error instanceof Error ? error.message : String(error), 200),
       capabilities: unknownSnapshot(),
     }
   }