dsh-vision-router 3.0.1 → 3.0.2

package/README.md

@@ -42,15 +42,16 @@
 > **Data leaves your machine by default.** When a cloud vision model is used, Vision Router sends the image (or a derived crop), the vision prompt and related request metadata to that provider. A fresh install has an anonymous OVHcloud vision fallback enabled, so "free" and "no key" do **not** mean offline. Do not use the cloud chain for confidential, regulated or classified material. See [Data flow and strict local-only use](#data-flow-and-strict-local-only-use).
 
 > [!WARNING]
-> 📌 **Announcement (v3.0.1)**
+> 📌 **Announcement (v3.0.2)**
 >
-> **v3.0.1: five corrective fixes on the 3.0 line.** The Vision Router settings surface
-> reads and writes real values on the Desktop shell, the model picker no longer groups the
-> same model twice, and every provider leg that can reach a remote provider — background
-> profiling, the local vision stabilizer, the settings "test connection" probe and the
-> LM Studio native transport — now follows the same `proxy` / `proxyHosts` decision as
-> foreground vision turns. Supported Hosts are unchanged: DSH 0.1.x from `0.1.5-rc.1`,
-> DSH 0.2.x from verified `0.2.0-rc.2`. [What’s new →](docs/releases/v3.0.1.md)
+> **v3.0.2: hardening from a full-repository adversarial review.** Instant local describe now
+> follows the same `proxy` / `proxyHosts` decision as every other provider leg; credential
+> redaction is one shared shape list for the logs and the failure diagnostics; adapter ownership
+> no longer accepts a primitive marker; proxy host admission normalizes IPv6 spellings and makes
+> `*.host` entries work; the background stop cache can neither go stale nor vanish; and failure
+> classification, numeric settings and the retained-image walker are hardened against inherited
+> keys, hostile accessors and pathological nesting. Supported Hosts are unchanged: DSH 0.1.x from
+> `0.1.5-rc.1`, DSH 0.2.x from verified `0.2.0-rc.2`. [What’s new →](docs/releases/v3.0.2.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="Demo: paste an image, the agent locates the send button with vision_ground / vision_crop / vision_pixel_diff and answers with coordinates" />

package/README.zh.md

@@ -42,13 +42,14 @@
 > **默认配置会让数据出网。** 使用云端视觉模型时，Vision Router 会将图片（或由它裁剪出的局部）、识图提示词及相关请求元数据发送给对应供应商。新安装默认开启 OVHcloud 匿名视觉兜底，因此“免费”和“免 Key”不等于离线。涉密、涉案、内部或其他受限材料请勿使用云端链路。详见[数据流向与严格纯本地配置](#数据流向与严格纯本地配置)。
 
 > [!WARNING]
-> 📌 **公告（v3.0.1）**
+> 📌 **公告（v3.0.2）**
 >
-> **v3.0.1：3.0 线上的五处修正。** Desktop 壳上的 Vision Router 设置面能读取并写入真实值，
-> 模型选择器不再把同一模型重复分组；所有可能触达远程 provider 的腿 —— 后台基准分析、本地视觉
-> 稳定器、设置里的「测试连接」探针、LM Studio native 传输 —— 现在都与前台视觉轮次遵守同一套
-> `proxy` / `proxyHosts` 判定。支持的 Host 不变：DSH 0.1.x 自 `0.1.5-rc.1` 起，DSH 0.2.x 自
-> 已验证的 `0.2.0-rc.2` 起。 [查看完整更新 →](docs/releases/v3.0.1.md)
+> **v3.0.2：一轮全仓对抗审查带来的加固。** instant 本地描述现在与其他 provider 腿遵守同一套
+> `proxy` / `proxyHosts` 判定；日志与失败诊断的凭据脱敏合并为一份共享清单；适配器归属不再接受
+> 基本类型标记；代理主机准入归一了 IPv6 写法并让 `*.host` 条目真正生效；后台停记录缓存既不残留
+> 也不会消失；失败分类、数值设置与 retained-image 遍历也分别对继承键、恶意取值器和畸形嵌套做了
+> 加固。支持的 Host 不变：DSH 0.1.x 自 `0.1.5-rc.1` 起，DSH 0.2.x 自已验证的 `0.2.0-rc.2` 起。
+> [查看完整更新 →](docs/releases/v3.0.2.md)
 
 <p align="center">
   <img src="assets/vision-demo.gif" width="640" alt="演示：粘贴图片，Agent 用 vision_ground / vision_crop / vision_pixel_diff 定位发送按钮并给出坐标" />

package/docs/architecture/ci-risk-posture.md

@@ -0,0 +1,45 @@
+# CI risk posture
+
+This file records security-posture decisions that are deliberate rather than pending, so a
+later reader does not re-litigate them or mistake them for oversights.
+
+## Resolved: Scorecard `TokenPermissionsID` on workflows that publish or open pull requests
+
+Three alerts in this class were open on 2026-10-04 and are now `fixed` (2026-10-04T14:17:06Z):
+
+| Alert | Location | Grant then | Outcome |
+| --- | --- | --- | --- |
+| `#127` | `.github/workflows/dsh-alpha-pin-refresh.yml` | workflow-level `contents: write` + `pull-requests: write` | fixed by moving both grants onto the job that pushes the pin branch and opens its pull request |
+| `#125` | `.github/workflows/release.yml` | job-level `contents: write` (materialize the release tag) | fixed on re-analysis |
+| `#126` | `.github/workflows/release.yml` | job-level `contents: write` (publish the GitHub Release) | fixed on re-analysis |
+
+Scorecard's rule asks for top-level permissions to be `read-all` or `contents: read`, and
+job-level least-privilege grants are accepted. Every workflow here now has that shape:
+`release.yml` declares top-level `permissions: {}`, the alpha gate and the pin refresh declare
+`contents: read`, and each write grant lives on the single job that needs it.
+
+A previous revision of this file claimed the opposite — that the rule reports the grants
+themselves, so moving one between levels could not clear the alert. That claim was wrong. It
+generalised from the presence of alerts on `release.yml`'s job-level grants instead of measuring
+the level change itself; moving the pin refresh's grants to job level cleared its alert, and the
+two `release.yml` alerts cleared on re-analysis. The measurement is recorded above so the next
+reader does not repeat the inference.
+
+What remains true regardless of the score:
+
+- the pin refresh never checks out or executes upstream code: it reads npm and GitHub metadata
+  and rewrites one line, so the write token is never exposed to third-party code;
+- it has no access to secrets beyond the default token, and its pull request is opened with
+  `GITHUB_TOKEN`, which by design starts no workflow runs;
+- the gate that *does* execute upstream code keeps top-level `contents: read`, pins the upstream
+  commit literally, and neither writes nor restores any shared cache;
+- the platform-side control (a protected environment with required reviewers on the publishing
+  jobs) is available but deliberately not adopted: it would break unattended pin discovery, and
+  every write path here is already a reviewed pull request or a dispatched release.
+
+## How to revisit
+
+If the write tokens ever need to shrink, the order is: attach the publishing jobs to a protected
+environment, then drop `pull-requests: write` from the pin refresh by opening the bump as an
+issue instead of a pull request. Both trade automation for score, which is why they are not the
+default.

package/docs/architecture/dsh-021-alpha1-adaptation.md

@@ -0,0 +1,46 @@
+# DSH 0.2.1-alpha.1 compatibility audit
+
+## Release identity and channel
+
+- Upstream tag: `dsh-v0.2.1-alpha.1`
+- Upstream commit: `5badb15009ae1756c3afe0ae0cef1faafc290ccc`
+- npm publication: `2026-10-03T04:53:22.343Z`
+- GitHub release: `2026-10-03T06:42:00Z`
+- Channel: `alpha` only. At publication time both `latest` and `next` remain
+  `0.2.0-rc.2`.
+
+This release is inside the already peer-admitted
+`>=0.2.0-rc.2 <0.3.0-0` train. It does not move the exact supported evidence
+boundary away from `0.2.0-rc.2`, and it does not raise the public DSH 0.1.x
+minimum.
+
+## Compatibility review from 0.2.0-rc.2
+
+| Surface | Upstream change | DVR conclusion |
+| --- | --- | --- |
+| Host / Desktop | Desktop defaults to a system-assigned port. Boot/profile resolution and plugin package metadata were reworked. | Keep capability-based startup and authenticated Desktop tests. No version branch is needed. |
+| Session | Session list generation yields between work slices and honors cancellation. Core Session event signatures and the durable v4 admission surface remain compatible. | The existing post-commit `session/event(session, event)` observer and v4 admission contracts stay valid. |
+| Settings | No breaking Settings controller API change. Client Settings and Agent preset composition changed, and a Host may expose a different reachable Settings seam. | DVR already derives the seam from the installed Host and verifies mount/save/reload/readback in a real browser. |
+| Bundle / HMR | Web adds Schedule rows and `publicUrl`; HMR now reloads package entry/dependency maps and removes stale mappings. | Re-run real bundle recomposition and plugin lifecycle tests; do not pin private HMR helper names. |
+| Web / client | Draft preservation, plugin creation, inspector/devtools, tool preparation, layout, and document frontmatter rendering changed. | DVR's client injection remains capability/slot based. Real Chromium cold Vision, mixed attachment, and Settings tests cover the integration points. |
+| Model / LLM | The LLM base adapter exposes the synchronous `imageRequestPricing()` default used by the Host. | DVR's adapter registration boundary already supplies the inherited undefined default to duck-typed adapters. |
+| Attachment | Published attachment API shapes remain compatible. The alpha line retains the extended image and normalization limits. | DVR's root repair reconciles stale whole-row Cordis configs to the full Host policy and exercises the Host-owned Sharp pipeline. |
+| Service injection | Public `modelCatalog`, credential update, connection rejection, WebServer route, and Cordis lifecycle seams remain present. | Structured injection and authenticated Desktop RPC stay under exact-source and real-Host tests. |
+
+## Validation gate
+
+`.github/workflows/dsh-alpha-settings-host-gate.yml` pins the immutable commit
+above and runs:
+
+- exact-source and Host-owned Sharp contracts on Ubuntu, macOS, and Windows;
+- public 0.2.x peer admission and Host proxy ownership without changing the
+  minimum support window;
+- real macOS Desktop renderer lifecycle;
+- Windows Desktop authentication on Node 22 and 24, plus Node 24 renderer and
+  multi-plugin ordering adversaries;
+- real DSH Web + Chromium cold Vision, mixed attachments, Settings
+  mount/save/reload/readback, and bundle recomposition.
+
+The floating npm alpha canaries remain surveillance. Advancement of the
+ordinary development pin or exact supported evidence boundary is a separate,
+reviewed decision. This audit does not authorize a DVR package release.

package/docs/releases/v3.0.2.md

@@ -0,0 +1,105 @@
+# v3.0.2
+
+DSH Vision Router 3.0.2 is a hardening release on the 3.0 line. It ships the fixes from a
+full-repository adversarial review plus the follow-up pass over that work, the composer Vision
+control's responsive-design fix (issue #654) and the presented-image delivery fix, together with
+the one consumer-visible transport fix merged after v3.0.1 was tagged. There are no new peers, no
+settings migration, no Session format change and no public API change.
+
+## Highlights
+
+- **The composer Vision chip follows the shipped chip and adapts to narrow rows (#654).** It used
+  to draw its own 1px border, 12px type and a brand-coloured outline/fill while selected, and it
+  kept its label at every width, so on a narrow composer it took more room and read heavier than
+  its shipped neighbours. Its size, radius, hover, focus ring and selected state now come from the
+  shipped chip tokens (the same ones `ui-plan`'s PlanChip and the access-mode trigger use) and it
+  follows the composer row's size container: below the same 460px cut that chip uses, only the
+  14px glyph remains. Measured in one window: 72px → 30px, label hidden, glyph kept.
+- **The collapsed chip keeps the Vision eye; the check appears only while the label is there.** A
+  bare check says nothing about what the chip does, and on a narrow row it is the only thing left
+  on screen. The 14px slot now carries both glyphs and the same container query that collapses the
+  label swaps them: the enabled chip shows the check at `@container (min-width: 460.01px)`, and the
+  eye stays below that cut. Both states use the same fixed 14px slot, so the chip width never
+  changes with the state. The guide copy no longer teaches the check as the on-signal.
+- **A presented image lands in the message body, not only in a tool card.** The card shows a 240px
+  thumbnail and every later message pushes it up (measured on a real host: the same image drifted
+  from inside the viewport to 1692px above it within minutes). `vision_present` now also returns a
+  paste-ready `replyImage` that the visible reply carries, and the host renders an absolute image
+  path inside a message at full size through its own `api/file` route (measured in the DOM at
+  640×200 for the same image the card showed as a thumbnail). The tool card stays, and it now
+  centres itself when it mounts below the viewport — never when it is already visible, and never
+  for history above the reader.
+- **Instant local describe keeps the Router transport (#647, issue #646).** The instant local
+  describe path now hands the Router-owned `providerTransport` to its adapter call, so a configured
+  `proxy` / `proxyHosts` covers it exactly like every other provider leg.
+- **Credential redaction is one shared list (#653, #655).** The log sink and the benchmark-failure
+  diagnostic used to carry partial copies of the credential shapes, and each leaked what the other
+  covered. One shared list now covers `Authorization` with any scheme (including
+  `Proxy-Authorization`), `Cookie` / `Set-Cookie`, URL userinfo, `Bearer`, vendor keys (`sk-`,
+  `ghp_` / `github_pat_`, `AKIA` / `ASIA`, `xox…`, `AIza…`), JWTs, PEM blocks and `key=value`
+  assignments (including `#token=` fragments). A value that contains `;` is redacted whole, and a
+  PEM block truncated before its END marker is redacted to the end of the text.
+- **Adapter ownership no longer accepts a primitive marker (#653).** Three modules used to read the
+  shared ownership symbol on their own, and two of them treated "the marker is not undefined" as
+  ownership. Ownership now means "an object marker is present", so a foreign adapter that writes
+  `'anything'`, `false`, `null` or `0` onto the symbol is no longer mistaken for the Router's own
+  adapter; delegation, Session Vision authority and the tool boundary all read the same rule.
+- **Proxy host admission normalizes what it compares (#653, #655).** A bracketed IPv6 literal and
+  its bare spelling canonicalize to one host, and a `*.host` entry now matches the host it names
+  plus its subdomains instead of silently matching nothing.
+- **The background stop cache can neither go stale nor vanish (#653, #655).** A load that drops a
+  record (expired, malformed or superseded) rewrites the file instead of leaving a stale row
+  behind, and a failed cleanup write no longer discards the records that were read.
+- **Failure classification and numeric settings resolve own keys only (#653).** Error codes and
+  settings field names no longer resolve inherited values such as `constructor` or `__proto__`, and
+  a hostile `message` / `toString` / `code` / `status` accessor can no longer make the classifier
+  throw.
+- **The retained-image walker is depth-bounded (#653).** It now shares the bound `convertBlocks`
+  already applies to the same block tree, so a pathological message tree returns `false` instead of
+  overflowing the stack.
+- **Same-class hardening from the same review (#653).** Session Vision policy rows with
+  prototype-carried fields are treated as malformed; an explicit `null` options bag means "no
+  options" at four entry points instead of throwing from a parameter destructure; host capability
+  evidence is tri-state, so only an explicit `true` proves the support floor; the doctor host probe
+  is bounded even when the fetch ignores `AbortSignal`, and the error text it stores is redacted.
+
+## Host support window
+
+Unchanged from 3.0.1:
+
+- DSH 0.1.x: `>=0.1.5-rc.1 <0.2.0-0`
+- DSH 0.2.x: `>=0.2.0-rc.2 <0.3.0-0`
+- ordinary development Host: exact `0.2.0-rc.2`
+
+The 0.2.1 alpha line stays inside the admitted 0.2.x range and is now covered by a dedicated
+adaptation note (`docs/architecture/dsh-021-alpha1-adaptation.md`) in addition to the scheduled
+drift canaries.
+
+## Validation
+
+- every finding carries a failing-first reproduction that fails on the pre-fix commit and passes on
+  this release commit, and the four residual items found by the follow-up pass were reproduced
+  against the merged code before they were fixed;
+- the full gate battery on the exact release commit: install, build, `build:check`, source-ownership
+  lint, source→artifact evidence, reproducible clean build, typecheck, the test suite, client-source
+  synchronization, the Host support-window contract and the packed public-API contract;
+- a real-Host pass on this exact build against an installed DSH checkout: the Host proxy egress
+  contract, the settings lifecycle in a real browser (mount, save, reload and readback), the Desktop
+  Host injection contract (structured injections, token exchange, authenticated index and DVR RPC)
+  and the macOS Desktop renderer lifecycle with a functional vision turn;
+- counter-probes independent of the test suite: the eight review points go from 7/8 to 8/8 and the
+  pre/post differential from 2/4 to 4/4, with the host-admission differential showing no widening
+  for non-wildcard lists;
+- the real-Host matrix on the release pull request (Windows Node 22/24 Desktop, macOS renderer,
+  Linux real Host + Chromium), the adversarial compatibility/fuzz gates and the resource-stress
+  gates;
+- a write-scoped CI pass: the accepted risk posture is recorded in
+  `docs/architecture/ci-risk-posture.md` and each workflow grant is narrowed to the job that needs
+  it.
+
+## Upgrade
+
+Drop-in replacement for 3.0.1: no settings migration, no Session format change and no new peer
+dependency. Upgrading `dsh plugin --profile web add github:ysr666/dsh-vision-router` (or the pinned
+`dsh-vision-router@3.0.2`) keeps existing Vision Router settings and Session data readable as
+before.

package/index.js

@@ -2442,6 +2442,7 @@ export function apply(ctx, config = {}, runtime = {}) {
               memory: sessionImageMemory,
               timeoutMs: timeoutMs(),
               downscaleMaxPixels: instantLocalMaxPixels(),
+              providerTransport,
             })
             if (instantMap.size > 0) {
               ctx.logger?.info(
@@ -3859,7 +3860,10 @@ ctx.logger?.info(
         'Present a generated local image directly to the user with the host-native image preview. ' +
         'MANDATORY PRESENTATION RULE: when you generate, edit, screenshot, or export an image and want the user to see it, ' +
         'you MUST call vision_present. read_image is only for model-side inspection; NEVER use read_image to present or send ' +
-        'an image to the user. The image is retained in the session UI but sanitized out of later text-only model requests.',
+        'an image to the user. ALWAYS paste the returned replyImage into your visible reply too: the host renders an ' +
+        'absolute image path in a message as a full-size image where the reader is, while the tool card only shows a ' +
+        'thumbnail that later messages push away. The image is retained in the session UI but sanitized out of later ' +
+        'text-only model requests.',
       parameters: {
         type: 'object',
         properties: {
@@ -4770,9 +4774,15 @@ ctx.logger?.info(
                 '2. 还原验证循环（本插件招牌流程）：参考图 → 实现 → `vision_html_screenshot` 截图 → `vision_pixel_diff` 度量差异 → 修复 → 再截图，迭代到差异收敛（0% 是常见终点）；长页面用 `fullPage: true` 一次截整页并拿到 `pageHeight`；\n' +
                 '3. 其余按需取用：配色用 `vision_colors`，文字用 `vision_ocr`，图标矢量化用 `vision_trace`，纯色背景抠图用 `vision_extract_foreground`，本地 HTML 截图用 `vision_html_screenshot`（长页面加 `fullPage: true` 截整页）；\n' +
                 '4. 展示规则（必须遵守）：当你生成、编辑、截图或导出一张图片，并希望用户看到它时，必须调用 `vision_present`。' +
-                '`read_image` 仅用于你自己读取或检查图片内容，绝不能把 `read_image` 当成向用户展示或发送图片的方法。\n' +
+                '`read_image` 仅用于你自己读取或检查图片内容，绝不能把 `read_image` 当成向用户展示或发送图片的方法。' +
+                '调用后必须把返回的 `replyImage` 原样放进你的可见回复：宿主会把消息里的绝对图片路径渲染成完整尺寸的图，' +
+                '而工具卡片只显示缩略图、且会被后续消息顶出视野。\n' +
+
                 '   MANDATORY PRESENTATION RULE: when you generate, edit, screenshot, or export an image and want the user to see it, ' +
-                'you MUST call `vision_present`. `read_image` is only for your own model-side inspection; NEVER use `read_image` to present or send an image to the user.\n' +
+                'you MUST call `vision_present`. `read_image` is only for your own model-side inspection; NEVER use `read_image` to present or send an image to the user. ' +
+                'Also paste the returned `replyImage` into your visible reply: the host renders an absolute image path in a ' +
+                'message at full size, while the tool card only shows a thumbnail that later messages push out of view.\n' +
+
                 '5. 所有坐标都是原图像素（x1/y1/x2/y2）；上传的图片可以直接用其附件 ID（如 `sha256:…`）作为各工具的 image 参数，无需先找磁盘路径。' +
                 'All coordinates are original pixels (x1/y1/x2/y2); uploaded images can be referenced directly by their attachment id (e.g. `sha256:…`) as the image argument. 产物写入工作区 `' +
                 `${artifactsRel}` +

package/lib/adapter-ownership.js

@@ -0,0 +1,51 @@
+/**
+ * Single owner of the Vision Router adapter ownership marker.
+ *
+ * Three modules used to interpret the same process-wide symbol on their own, and
+ * two of them treated "the marker is not undefined" as ownership — so a foreign
+ * adapter that wrote `'anything'`, `false`, `null` or `0` onto the shared symbol
+ * was classified as Vision Router's own adapter. Ownership now means "a marker
+ * *object* is present"; the per-function notes below record what that does and
+ * does not prove.
+ *
+ * The symbol stays `Symbol.for(...)` so separately loaded copies of this package
+ * still recognize each other's adapters; the rule about its *value* lives here
+ * once.
+ */
+export const VISION_ROUTER_ADAPTER_OWNER = Symbol.for('dsh-vision-router.adapter-owner');
+/** Read the marker without letting a hostile proxy/getter escape. */
+export function readVisionRouterAdapterOwner(adapter) {
+    if (adapter === null || (typeof adapter !== 'object' && typeof adapter !== 'function')) {
+        return undefined;
+    }
+    try {
+        return adapter[VISION_ROUTER_ADAPTER_OWNER];
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * True when the adapter carries an owner marker object.
+ *
+ * The marker's value has always been an object — the registration chain mints
+ * `Object.freeze({})`, and composition/tests mark adapters with plain records
+ * such as `{ route: 'deepseek-vision' }`. Requiring "an object" therefore keeps
+ * every genuine owner (including ones marked by another loaded copy) and rejects
+ * the values a foreign adapter can write by accident or in one line: `'anything'`,
+ * `false`, `null`, `0` and any other primitive.
+ *
+ * A first version of this fix also demanded `Object.isFrozen(owner)`. The
+ * repository's own issue-276/289/374/512 suites mark adapters with plain objects,
+ * so that extra requirement classified genuine owners as foreign and broke
+ * delegation; it was reverted here instead of being worked around in the tests.
+ *
+ * Residual risk, stated rather than hidden: in-process code able to run arbitrary
+ * JavaScript can still assign `{}` and be treated as an owner. Removing that needs
+ * one shared authority instead of a process-wide symbol, which is a larger design
+ * change than this fix.
+ */
+export function isVisionRouterOwnedAdapter(adapter) {
+    const owner = readVisionRouterAdapterOwner(adapter);
+    return typeof owner === 'object' && owner !== null;
+}

package/lib/client-presentation-boundary-main.js

@@ -432,21 +432,21 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     if (next.zh && typeof next.zh === 'object') {
       next.zh = Object.assign({}, next.zh, {
         quickStartTitle: '聊天模型 + 识图模式',
-        quickStartBody: '先选择你平时使用的聊天模型。需要看图时，点击输入框旁的「识图」；出现 ✓ 表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。',
+        quickStartBody: '先选择你平时使用的聊天模型。需要看图时，点击输入框旁的「识图」；它变成选中态（高亮底色）表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。',
         onboardingStep1Title: '1 · 选择聊天模型并开启识图',
-        onboardingStep1Body: '先在聊天页右下角选择你平时使用的模型。需要看图时，点击模型选择器左侧的「识图」；出现 ✓ 表示已开启，不需要时再主动关闭。',
+        onboardingStep1Body: '先在聊天页右下角选择你平时使用的模型。需要看图时，点击模型选择器左侧的「识图」；它变成选中态（高亮底色）表示已开启，不需要时再主动关闭。',
         guideStep1Title: '第 1 步 · 选择聊天模型并认识「识图」',
-        guideStep1Body: '高亮的是聊天模型选择器；它左侧就是「识图」按钮。先选择你平时使用的聊天模型；需要看图时点击「识图」，出现 ✓ 表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。选好后点击「下一步」。'
+        guideStep1Body: '高亮的是聊天模型选择器；它左侧就是「识图」按钮。先选择你平时使用的聊天模型；需要看图时点击「识图」，它变成选中态（高亮底色）表示已开启。开启后会持续生效；在同一模型组内切换到另一个支持识图模式的模型也会保持开启，直到你主动关闭或切到没有对应识图模式的普通模型。选好后点击「下一步」。'
       });
     }
     if (next.en && typeof next.en === 'object') {
       next.en = Object.assign({}, next.en, {
         quickStartTitle: 'Chat model + Vision mode',
-        quickStartBody: 'Choose the chat model you normally use first. When you need image understanding, click “Vision” beside the composer; a ✓ means it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route.',
+        quickStartBody: 'Choose the chat model you normally use first. When you need image understanding, click “Vision” beside the composer; the chip lights up in its selected state to mean it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route.',
         onboardingStep1Title: '1 · Choose your chat model and enable Vision',
-        onboardingStep1Body: 'Choose the model you normally use from the lower-right chat selector. When you need image understanding, click “Vision” immediately to the left of the model selector; a ✓ means it is on. Turn it off again when you no longer need it.',
+        onboardingStep1Body: 'Choose the model you normally use from the lower-right chat selector. When you need image understanding, click “Vision” immediately to the left of the model selector; the chip lights up in its selected state to mean it is on. Turn it off again when you no longer need it.',
         guideStep1Title: 'Step 1 · Choose your chat model and find “Vision”',
-        guideStep1Body: 'The highlighted control is the chat model selector; the “Vision” button is immediately to its left. Choose your normal chat model first, then click “Vision” when you need image understanding. A ✓ means it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route. Click “Next” when done.'
+        guideStep1Body: 'The highlighted control is the chat model selector; the “Vision” button is immediately to its left. Choose your normal chat model first, then click “Vision” when you need image understanding. The chip lights up in its selected state to mean it is on. It stays on when you switch to another Vision-enabled model in the same model group, until you turn it off or choose a normal model with no matching Vision route. Click “Next” when done.'
       });
     }
     return next;
@@ -948,6 +948,89 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     }, 'vision-router: clipboard image paste normalization');
   }
 
+  // The composer chip chrome follows the shipped mode chips (ui-plan's PlanChip and the
+  // access-mode trigger): 28px tall, token radius, no border, token hover fill, the shipped
+  // focus ring, and the shipped "selected chip" treatment while Vision is on. The composer row
+  // is a size container (InputBar .row), so the label collapses to the 14px glyph below the
+  // shipped 460px cut — the same cut the access-mode trigger uses — instead of squeezing the
+  // model trigger on narrow windows.
+  var VISION_TOGGLE_CSS = '' +
+    '.vr-vision-toggle{display:inline-flex;align-items:center;gap:4px;min-width:0;height:28px;' +
+    'padding:0 8px;border:none;border-radius:var(--dsw-radius-sm);background:transparent;' +
+    'color:var(--dsw-alias-label-secondary);font:inherit;font-size:13px;font-weight:500;' +
+    'line-height:20px;cursor:pointer;white-space:nowrap}' +
+    '.vr-vision-toggle:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}' +
+    '.vr-vision-toggle:focus-visible{outline:var(--dsw-focus-ring-width) solid ' +
+    'var(--dsw-focus-ring-color,var(--dsw-alias-brand-primary));outline-offset:2px}' +
+    '.vr-vision-toggle:disabled{cursor:default}' +
+    // Dim only the states that read as "cannot be used right now". A disabled chip that is
+    // merely waiting for this toggle's own selection keeps full opacity, so the composer does
+    // not flash a greyed control while the model swap it owns is still settling.
+    '.vr-vision-toggle[data-dimmed="true"]{opacity:.45}' +
+    '.vr-vision-toggle[data-active="true"]{color:var(--dsw-alias-label-primary);' +
+    'background:var(--dsw-alias-button-ghost-active-fill);' +
+    'box-shadow:inset 0 0 0 1px var(--dsw-alias-button-ghost-active-border)}' +
+    '.vr-vision-toggle[data-active="true"]:hover:not(:disabled){' +
+    'background:var(--dsw-alias-button-ghost-active-hover)}' +
+    '.vr-vision-toggle-glyph{display:inline-flex;align-items:center;justify-content:center;' +
+    'flex:0 0 auto;width:14px;height:14px;font-size:13px;line-height:1;color:currentColor}' +
+    '.vr-vision-toggle-glyph-part{display:inline-flex;align-items:center;justify-content:center;' +
+    'width:14px;height:14px}' +
+    // The check carries the state only while the label is there to explain it. Once the label
+    // collapses (the shipped 460px cut below) a bare check means nothing, so the Vision eye —
+    // the only thing that still says what the chip does — stays, and the chip's selected chrome
+    // marks on/off on its own.
+    '.vr-vision-toggle-glyph-check{display:none}' +
+    '@container (min-width:460.01px){' +
+    '.vr-vision-toggle[data-active="true"] .vr-vision-toggle-glyph-eye{display:none}' +
+    '.vr-vision-toggle[data-active="true"] .vr-vision-toggle-glyph-check{display:inline-flex}}' +
+    '@container (max-width:460px){.vr-vision-toggle-label{display:none}}';
+
+  function installVisionToggleStyles() {
+    if (typeof document === 'undefined' || !document.head) return undefined;
+    var tag = document.createElement('style');
+    tag.dataset.plugin = 'dsh-vision-router';
+    tag.dataset.pluginCss = 'dsh-vision-router/mode-toggle';
+    tag.textContent = VISION_TOGGLE_CSS;
+    document.head.appendChild(tag);
+    return function(){ tag.remove(); };
+  }
+
+  // A presented image that mounts below the reader is the same as not being shown: the card
+  // renders next to its tool call, and a reader who is at the end of a long conversation has
+  // that call thousands of pixels above them. The card calls this on mount; it only moves the
+  // reader for content that arrived below the viewport — a card that is already visible is left
+  // alone, and so is history above the reader when a session is opened.
+  function focusPresentedCard(node, viewportHeight) {
+    if (!node || typeof node.getBoundingClientRect !== 'function') return false;
+    var rect = node.getBoundingClientRect();
+    if (rect.top <= viewportHeight) return false;
+    var scroller = node.parentElement;
+    var hops = 0;
+    while (scroller && hops < 20) {
+      var style = typeof getComputedStyle === 'function' ? getComputedStyle(scroller) : undefined;
+      var scrollable = /(auto|scroll)/.test(String(style && style.overflowY)) &&
+        scroller.scrollHeight > scroller.clientHeight + 4;
+      if (scrollable) {
+        var box = scroller.getBoundingClientRect();
+        scroller.scrollTop += (rect.top - box.top) - (box.height / 2 - rect.height / 2);
+        return true;
+      }
+      scroller = scroller.parentElement;
+      hops += 1;
+    }
+    return false;
+  }
+
+  try {
+    globalThis.__dvrPresentFocus = function () {
+      if (typeof document === 'undefined') return false;
+      var cards = document.querySelectorAll('[data-dvr-present]');
+      var last = cards[cards.length - 1];
+      return last ? focusPresentedCard(last, globalThis.innerHeight || 0) : false;
+    };
+  } catch (_) {}
+
   function installVisionModeToggle(ctx, React, primitives) {
     if (!ctx || typeof ctx.inject !== 'function' || !React) return;
     var zh = {
@@ -974,6 +1057,9 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     try {
       ctx.effect(function(){ return ctx.locale.register(VISION_MODE_NS, { zh: zh, en: en }); }, 'vision-router: mode toggle locale');
     } catch (_) {}
+    try {
+      ctx.effect(function(){ return installVisionToggleStyles(); }, 'vision-router: mode toggle styles');
+    } catch (_) {}
 
     function FallbackToast(props) {
       React.useEffect(function(){
@@ -1004,9 +1090,13 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
     }
 
     var ToastComponent = primitives && typeof primitives.Toast === 'function' ? primitives.Toast : FallbackToast;
-    var WarningIcon = primitives && typeof primitives.IconWarningOutline16 === 'function'
-      ? primitives.IconWarningOutline16
-      : undefined;
+    // The product icon set names weights, not sizes (IconWarningOutlineRegular); the old
+    // "…16" spelling never existed, so the toast silently fell back to a text glyph.
+    var WarningIcon = primitives && typeof primitives.IconWarningOutlineRegular === 'function'
+      ? primitives.IconWarningOutlineRegular
+      : primitives && typeof primitives.IconWarningOutline16 === 'function'
+        ? primitives.IconWarningOutline16
+        : undefined;
 
     var settings = bindVisionModeSettings(ctx);
     var unavailableSettingsState = { value: undefined };
@@ -1106,29 +1196,6 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
             : livePair.mode === 'unavailable'
               ? t('unavailable')
               : active ? t('disable') : t('enable');
-        var style = {
-          appearance: 'none',
-          minHeight: 28,
-          display: 'inline-flex',
-          alignItems: 'center',
-          gap: 5,
-          padding: '4px 8px',
-          borderRadius: 8,
-          border: '1px solid ' + (active ? 'var(--dsw-alias-brand-primary)' : 'var(--dsw-alias-border-l2)'),
-          background: active
-            ? 'color-mix(in srgb, var(--dsw-alias-brand-primary) 14%, transparent)'
-            : 'transparent',
-          color: active ? 'var(--dsw-alias-brand-primary)' : 'var(--dsw-alias-label-secondary)',
-          boxShadow: active ? 'inset 0 0 0 1px var(--dsw-alias-brand-primary)' : 'none',
-          font: 'inherit',
-          fontSize: 12,
-          lineHeight: 1.4,
-          fontWeight: active ? 650 : 500,
-          cursor: disabled ? 'default' : 'pointer',
-          opacity: disabled && !ownSettling && (livePair.mode === 'unavailable' || loading) ? 0.45 : 1,
-          whiteSpace: 'nowrap'
-        };
-
         function announceRejectedSelection() {
           var latest;
           try {
@@ -1155,7 +1222,9 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
           'aria-busy': busy || loading,
           title: title,
           disabled: disabled,
-          style: style,
+          className: 'vr-vision-toggle',
+          'data-active': active ? 'true' : 'false',
+          'data-dimmed': disabled && !ownSettling && (livePair.mode === 'unavailable' || loading) ? 'true' : 'false',
           onClick: function() {
             if (disabled || !pair.target || typeof props.select !== 'function') return;
             var target = pair.target;
@@ -1179,25 +1248,19 @@ export const CLIENT_PRESENTATION_PRELUDE = String.raw`(function(){
             });
           }
         },
-          // One fixed 14px leading slot carries the state icon: the eye when the
-          // route is ordinary, the check when Vision is on. Appending the check
-          // only while active changed the chip width by ~18px and reflowed the
-          // composer row; reserving trailing space kept the width but left the
-          // inactive chip visually off-centre.
+          // One fixed 14px leading slot carries both glyphs: the Vision eye and the check that
+          // marks the enabled state. The stylesheet shows the check only while the label is
+          // present (the same 460px container cut that collapses the label), because a bare check
+          // tells a reader nothing — once the label is gone the eye, which still says what the
+          // chip does, stays. The slot is a fixed 14px box either way, so the chip width never
+          // changes with the state.
           React.createElement('span', {
             'aria-hidden': 'true',
-            style: {
-              display: 'inline-flex',
-              alignItems: 'center',
-              justifyContent: 'center',
-              flex: '0 0 auto',
-              width: 14,
-              height: 14,
-              fontSize: 13,
-              lineHeight: 1
-            }
-          }, active ? '✓' : '👁'),
-          React.createElement('span', null, t('label'))
+            className: 'vr-vision-toggle-glyph'
+          },
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-eye' }, '👁'),
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-check' }, '✓')),
+          React.createElement('span', { className: 'vr-vision-toggle-label' }, t('label'))
         );
 
         var toastNode = toast