dsh-vision-router 3.0.1 → 3.0.2

package/lib/client-presentation-boundary.js

@@ -10,43 +10,32 @@ import { installVisionModelVisibilityBoundary } from './vision-model-visibility-
 
 const CLIENT_PRESENTATION_MARK = 'data-vision-router-presentation-boundary'
 
-const VISION_TOGGLE_TEXT_GLYPH = String.raw`          // One fixed 14px leading slot carries the state icon: the eye when the
-          // route is ordinary, the check when Vision is on. Appending the check
-          // only while active changed the chip width by ~18px and reflowed the
-          // composer row; reserving trailing space kept the width but left the
-          // inactive chip visually off-centre.
+const VISION_TOGGLE_TEXT_GLYPH = String.raw`          // One fixed 14px leading slot carries both glyphs: the Vision eye and the check that
+          // marks the enabled state. The stylesheet shows the check only while the label is
+          // present (the same 460px container cut that collapses the label), because a bare check
+          // tells a reader nothing — once the label is gone the eye, which still says what the
+          // chip does, stays. The slot is a fixed 14px box either way, so the chip width never
+          // changes with the state.
           React.createElement('span', {
             'aria-hidden': 'true',
-            style: {
-              display: 'inline-flex',
-              alignItems: 'center',
-              justifyContent: 'center',
-              flex: '0 0 auto',
-              width: 14,
-              height: 14,
-              fontSize: 13,
-              lineHeight: 1
-            }
-          }, active ? '✓' : '👁'),
-          React.createElement('span', null, t('label'))`
-
-const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading slot carries the state icon: the eye when the
-          // route is ordinary, the check when Vision is on. Appending the check
-          // only while active changed the chip width by ~18px and reflowed the
-          // composer row; reserving trailing space kept the width but left the
-          // inactive chip visually off-centre.
+            className: 'vr-vision-toggle-glyph'
+          },
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-eye' }, '👁'),
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-check' }, '✓')),
+          React.createElement('span', { className: 'vr-vision-toggle-label' }, t('label'))`
+
+const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading slot carries both glyphs: the Vision eye and the check that
+          // marks the enabled state. The stylesheet shows the check only while the label is
+          // present (the same 460px container cut that collapses the label), because a bare check
+          // tells a reader nothing — once the label is gone the eye, which still says what the
+          // chip does, stays. The slot is a fixed 14px box either way, so the chip width never
+          // changes with the state.
           React.createElement('span', {
             'aria-hidden': 'true',
-            style: {
-              display: 'inline-flex',
-              alignItems: 'center',
-              justifyContent: 'center',
-              flex: '0 0 auto',
-              width: 14,
-              height: 14
-            }
-          }, active
-            ? React.createElement('svg', {
+            className: 'vr-vision-toggle-glyph'
+          },
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-eye' },
+            React.createElement('svg', {
                 width: 14,
                 height: 14,
                 viewBox: '0 0 14 14',
@@ -55,13 +44,13 @@ const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading s
                 focusable: 'false',
                 style: { display: 'block', flex: '0 0 auto' }
               }, React.createElement('path', {
-                d: 'M2.75 7.15 5.6 10 11.25 4.35',
-                stroke: 'currentColor',
-                strokeWidth: 1.5,
-                strokeLinecap: 'round',
-                strokeLinejoin: 'round'
-              }))
-            : React.createElement('svg', {
+                fillRule: 'evenodd',
+                clipRule: 'evenodd',
+                d: 'M7 2.25c-2.84 0-5.04 1.69-6.25 4.25a1.15 1.15 0 0 0 0 1C1.96 10.06 4.16 11.75 7 11.75s5.04-1.69 6.25-4.25a1.15 1.15 0 0 0 0-1C12.04 3.94 9.84 2.25 7 2.25Zm0 1.25c2.16 0 3.96 1.21 5.05 3.5C10.96 9.29 9.16 10.5 7 10.5S3.04 9.29 1.95 7C3.04 4.71 4.84 3.5 7 3.5Zm0 1.25A2.25 2.25 0 1 0 7 9.25a2.25 2.25 0 0 0 0-4.5Zm0 1.25a1 1 0 1 1 0 2 1 1 0 0 1 0-2Z',
+                fill: 'currentColor'
+              }))),
+          React.createElement('span', { className: 'vr-vision-toggle-glyph-part vr-vision-toggle-glyph-check' },
+            React.createElement('svg', {
                 width: 14,
                 height: 14,
                 viewBox: '0 0 14 14',
@@ -70,12 +59,13 @@ const VISION_TOGGLE_FIXED_SVG = String.raw`          // One fixed 14px leading s
                 focusable: 'false',
                 style: { display: 'block', flex: '0 0 auto' }
               }, React.createElement('path', {
-                fillRule: 'evenodd',
-                clipRule: 'evenodd',
-                d: 'M7 2.25c-2.84 0-5.04 1.69-6.25 4.25a1.15 1.15 0 0 0 0 1C1.96 10.06 4.16 11.75 7 11.75s5.04-1.69 6.25-4.25a1.15 1.15 0 0 0 0-1C12.04 3.94 9.84 2.25 7 2.25Zm0 1.25c2.16 0 3.96 1.21 5.05 3.5C10.96 9.29 9.16 10.5 7 10.5S3.04 9.29 1.95 7C3.04 4.71 4.84 3.5 7 3.5Zm0 1.25A2.25 2.25 0 1 0 7 9.25a2.25 2.25 0 0 0 0-4.5Zm0 1.25a1 1 0 1 1 0 2 1 1 0 0 1 0-2Z',
-                fill: 'currentColor'
-              }))),
-          React.createElement('span', null, t('label'))`
+                d: 'M2.75 7.15 5.6 10 11.25 4.35',
+                stroke: 'currentColor',
+                strokeWidth: 1.5,
+                strokeLinecap: 'round',
+                strokeLinejoin: 'round'
+              })))),
+          React.createElement('span', { className: 'vr-vision-toggle-label' }, t('label'))`
 
 const BITMAP_LIMITS_BASE = String.raw`      var maxBitmapSourceBytes = 64 * 1024 * 1024;
       var maxBitmapDimension = 10000;

package/lib/client.js

@@ -4770,6 +4770,7 @@ openLogFolder,
         const imageKeySignature = JSON.stringify(imageKeys)
         const imageOwnerToken = React.useRef({}).current
         const ownedImageKeys = React.useRef(new Set())
+        React.useEffect(() => { if (globalThis.__dvrPresentFocus) globalThis.__dvrPresentFocus() }, [imageKeySignature])
         React.useEffect(() => {
           const current = new Set(imageKeys)
           for (const key of ownedImageKeys.current) {
@@ -4809,7 +4810,7 @@ openLogFolder,
         }
         return React.createElement(
           'div',
-          { style: { display: 'flex', flexDirection: 'column', alignItems: 'flex-start', gap: 6, padding: '4px 0' } },
+          { 'data-dvr-present': 'true', style: { display: 'flex', flexDirection: 'column', alignItems: 'flex-start', gap: 6, padding: '4px 0' } },
           parsed && typeof parsed.label === 'string' && parsed.label !== 'image'
             ? React.createElement(
                 'div',

package/lib/core-primitives.js

@@ -161,6 +161,18 @@ export function eventHasImage(event) {
   return false
 }
 
+/**
+ * Read one options/argument bag as a record, or `undefined` when the value is not
+ * an object at all. Callers write `objectRecord(options) ?? {}`: an explicit
+ * `null` (or a primitive) then means "no options" instead of throwing from a
+ * parameter destructure or a property read.
+ */
+export function objectRecord(value) {
+  return value !== null && typeof value === 'object'
+    ? value
+    : undefined
+}
+
 export function localOnlyVisionEnabled(config = {}) {
   return !!config && config.localOnlyVision === true
 }
@@ -324,6 +336,11 @@ export function rewriteToolResultImages(content, replace) {
 
 export function renderVisionPresent(value) {
   const attachment = value.attachment
+  // The card renders the image next to the tool call, which can sit far above a reader who is at
+  // the end of a long conversation. The reply body is where that reader actually is, and the
+  // client rewrites an absolute local image path written in Markdown into a displayable URL, so
+  // the result hands back a paste-ready snippet plus the rule that says why it matters.
+  const label = String(value.label === undefined ? 'image' : value.label).replace(/[[\]]/g, '')
   return [
     {
       type: 'text',
@@ -335,6 +352,10 @@ export function renderVisionPresent(value) {
         bytes: value.bytes,
         safePresentation: true,
         attachmentId: String(attachment.attachmentId),
+        replyImage: `![${label}](<${value.path}>)`,
+        replyImageHint:
+          'Also put replyImage in your visible reply: the host renders an absolute image path in a message ' +
+          'at full size where the reader is, while this card only shows a thumbnail that later messages push away.',
       }),
     },
     { type: 'image', attachment },

package/lib/core-vision-surface.js

@@ -1,4 +1,5 @@
 import { currentSessionSurfacePolicy } from './session-surface-policy.js'
+import { objectRecord } from './core-primitives.js'
 import {
   CORE_VISION_SURFACE_KEYS,
   projectCoreVisionSurface,
@@ -32,7 +33,8 @@ export function currentCoreVisionSurface(config = {}, options = {}) {
  * The config source stays live, but schema bootstrap is an internal lifecycle
  * bit rather than a fake Settings/config value.
  */
-export function createCoreVisionSurfaceRuntime({ config = {} } = {}) {
+export function createCoreVisionSurfaceRuntime(rawOptions) {
+  const { config = {} } = objectRecord(rawOptions) ?? {}
   let schemaBootstrapping = true
 
   const current = () => {

package/lib/desktop-screenshot-tool.js

@@ -9,6 +9,7 @@ import {
   callLocalBackend,
   localDescribePrompt,
   localProvidersOf,
+  objectRecord,
   toOpenAIContent,
 } from './core-primitives.js'
 import { loadSharp } from './sharp-runtime.js'
@@ -170,15 +171,16 @@ async function identifyDesktopCapture(data, {
  * this module owns only the platform capture and optional local-recognition
  * implementation behind that existing permission boundary.
  */
-export function createDesktopScreenshotTool({
-  current,
-  timeoutMs,
-  saveArtifact,
-  stringOutput,
-  instantLocalStyle,
-  providerTransport,
-  captureDesktop = captureDesktopPng,
-} = {}) {
+export function createDesktopScreenshotTool(rawOptions) {
+  const {
+    current,
+    timeoutMs,
+    saveArtifact,
+    stringOutput,
+    instantLocalStyle,
+    providerTransport,
+    captureDesktop = captureDesktopPng,
+  } = objectRecord(rawOptions) ?? {}
   if (
     typeof current !== 'function' ||
     typeof timeoutMs !== 'function' ||

package/lib/diagnostic-redaction.js

@@ -1,26 +1,75 @@
 const SENSITIVE_QUERY = /^(?:api[_-]?key|key|token|secret|password|authorization|auth|signature|sig)$/i
 
+/**
+ * Credential shapes worth removing from anything that reaches a log, a support
+ * report or a model-visible diagnostic.
+ *
+ * Two callers used to keep their own partial copy of this list, so each one
+ * leaked what the other covered (`Authorization: token ghp_…`, `Cookie:`, bare
+ * platform tokens, `#token=` fragments). One shared list is the fix: callers may
+ * still add their own extra passes, but never their own subset of this one.
+ */
+// One spelling for every caller: the log path's own test pins the uppercase
+// marker (`/\[REDACTED/`), the diagnostic path's test is case-insensitive, so
+// uppercase is the only spelling that keeps both existing contracts intact.
+const REDACTED = '[REDACTED]'
+const CREDENTIAL_SHAPE_PATTERNS = [
+  // Any Authorization scheme, not only Bearer/Basic (`token`, `ApiKey`, `AWS4-…`),
+  // but only the credential itself: a single line may carry safe diagnostics
+  // after the header and a support report must keep them. `;` stays inside the value
+  // (the log sink has always consumed it) while `,` separates what follows.
+  [/\b(Authorization\s*[:=]\s*)(?:[A-Za-z][A-Za-z0-9._-]*\s+)?[^\s,]+/gi, `$1${REDACTED}`],
+  [/\b(Proxy-Authorization\s*[:=]\s*)(?:[A-Za-z][A-Za-z0-9._-]*\s+)?[^\s,]+/gi, `$1${REDACTED}`],
+  // Cookies are `name=value; name=value` on one line and there is no safe way to
+  // guess which pair carries the session, so the whole header value goes.
+  [/\b((?:Set-)?Cookie\s*[:=]\s*)[^\r\n]+/gi, `$1${REDACTED}`],
+  // URL userinfo (`scheme://user:secret@host`) without needing a URL parser, so
+  // the log path — which never parsed URLs — covers it too.
+  [/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s@]+@/gi, `$1${REDACTED}@`],
+  [/\b(Bearer\s+)[A-Za-z0-9._~+/-]{8,}/gi, `$1${REDACTED}`],
+  // Vendor-prefixed keys: OpenAI/Anthropic, GitHub, AWS, Slack, Google, PEM.
+  [/\b(sk-(?:proj-|ant-|or-)?)[A-Za-z0-9_-]{8,}/gi, `$1${REDACTED}`],
+  [/\b(gh[pousr]_|github_pat_)[A-Za-z0-9_]{8,}/gi, `$1${REDACTED}`],
+  [/\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, `${REDACTED}`],
+  [/\b(xox[baprs]-)[A-Za-z0-9-]{8,}/gi, `$1${REDACTED}`],
+  [/\b(AIza)[A-Za-z0-9_-]{16,}/g, `$1${REDACTED}`],
+  // Signed JSON Web Tokens, with or without a leading scheme word.
+  [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, REDACTED],
+  // An unterminated block (a bounded upstream read truncates before the END marker) must
+  // redact to the end of the text: without the `$` alternative its whole body passes through.
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, REDACTED],
+  // `api_key=…`-style assignments, including `apikey` and `access_token`. `;` stays inside the
+  // value for the same reason as above; `&` separates an unrelated parameter a report must keep.
+  [/\b(access[_-]?token|api[_-]?key|apikey|token|secret|password|passwd|signature|sig)\s*[:=]\s*([^\s,&"']+)/gi, `$1=${REDACTED}`],
+]
+
+/** Apply only the shared credential-shape passes (no URL parsing, no truncation). */
+export function redactCredentialShapes(text) {
+  let out = String(text ?? '')
+  for (const [pattern, replacement] of CREDENTIAL_SHAPE_PATTERNS) {
+    out = out.replace(pattern, replacement)
+  }
+  return out
+}
+
 function redactUrl(match) {
   try {
     const url = new URL(match)
-    url.username = url.username ? '[redacted]' : ''
-    url.password = url.password ? '[redacted]' : ''
+    url.username = url.username ? REDACTED : ''
+    url.password = url.password ? REDACTED : ''
     for (const key of [...url.searchParams.keys()]) {
-      if (SENSITIVE_QUERY.test(key)) url.searchParams.set(key, '[redacted]')
+      if (SENSITIVE_QUERY.test(key)) url.searchParams.set(key, REDACTED)
     }
-    return url.toString()
+    return redactCredentialShapes(url.toString())
   } catch {
-    return match
+    return redactCredentialShapes(match)
   }
 }
 
 export function redactDiagnosticText(value, max = 400) {
   const limit = Math.max(32, Math.min(4000, Math.floor(Number(max) || 400)))
-  let text = String(value ?? '').replace(/[\u0000-\u001f\u007f-\u009f]+/g, ' ')
-  text = text.replace(/\bhttps?:\/\/[^\s"'<>]+/gi, redactUrl)
-  text = text.replace(/\b(Authorization\s*:\s*)(?:Bearer|Basic)\s+[^\s,;]+/gi, '$1[redacted]')
-  text = text.replace(/\b(Bearer\s+)[A-Za-z0-9._~+\/-]{12,}/gi, '$1[redacted]')
-  text = text.replace(/\b(sk-(?:proj-)?)[A-Za-z0-9_-]{8,}/gi, '$1[redacted]')
-  text = text.replace(/\b(api[_-]?key|token|secret|password|authorization|signature)\s*[:=]\s*([^\s,;&]+)/gi, '$1=[redacted]')
-  return text.slice(0, limit)
+  const text = String(value ?? '').replace(/[\u0000-\u001f\u007f-\u009f]+/g, ' ')
+  return redactCredentialShapes(
+    text.replace(/\bhttps?:\/\/[^\s"'<>]+/gi, redactUrl),
+  ).slice(0, limit)
 }

package/lib/doctor-cli-p0.js

@@ -8,6 +8,7 @@ import {
   normalizeDshHostCapabilities,
 } from './dsh-host-capabilities.js'
 import { DOCTOR_RESPONSE_MAX_BYTES, readResponseJsonBounded } from './http-body-limit.js'
+import { redactDiagnosticText } from './diagnostic-redaction.js'
 import {
   DSH_SUPPORT_WINDOW,
   DSH_VERIFICATION_EVIDENCE,
@@ -16,6 +17,10 @@ import {
 } from './dsh-support-window.js'
 
 const HOST_CAPABILITIES_PATH = '/_dsh/vision-router/host-capabilities'
+const DOCTOR_PROBE_TIMEOUT_MS = 1500
+// The fence is a backstop, not a competing deadline: it must sit after the signal
+// so a cooperative fetch keeps reporting the abort reason it reports today.
+const DOCTOR_PROBE_FENCE_MS = DOCTOR_PROBE_TIMEOUT_MS + 250
 
 function commandOf(argv) {
   const first = argv.find((value) => typeof value === 'string' && !value.startsWith('-'))
@@ -51,11 +56,34 @@ export async function probeDoctorHostCapabilities({ baseUrl, fetchImpl = globalT
     if (typeof fetchImpl !== 'function') {
       return { ok: false, source: 'runtime-unavailable', capabilities: unknownSnapshot() }
     }
-    const response = await fetchImpl(normalized, {
-      method: 'GET',
-      headers: { accept: 'application/json' },
-      signal: AbortSignal.timeout(1500),
+    // The signal below only bounds a fetch that honours it. A non-cooperative
+    // implementation would leave this probe pending forever, so the same inline
+    // fence the live-model discovery uses (its own timer + explicit cleanup)
+    // bounds the await itself. The signal stays so a cooperative fetch still
+    // reports the aborted reason it reports today.
+    // The fence deliberately keeps the event loop alive: this is a foreground
+    // probe the CLI is waiting on, unlike the background benchmark timers that
+    // unref themselves. (Node's own AbortSignal.timeout timer is unref'd, so
+    // unref'ing this one too would let the process exit before it fires.)
+    let deadlineTimer
+    const deadline = new Promise((_, reject) => {
+      deadlineTimer = setTimeout(() => {
+        reject(new Error(`Doctor Host capability probe exceeded ${DOCTOR_PROBE_TIMEOUT_MS}ms`))
+      }, DOCTOR_PROBE_FENCE_MS)
     })
+    let response
+    try {
+      response = await Promise.race([
+        fetchImpl(normalized, {
+          method: 'GET',
+          headers: { accept: 'application/json' },
+          signal: AbortSignal.timeout(DOCTOR_PROBE_TIMEOUT_MS),
+        }),
+        deadline,
+      ])
+    } finally {
+      clearTimeout(deadlineTimer)
+    }
     if (!response.ok) {
       return {
         ok: false,
@@ -73,10 +101,13 @@ export async function probeDoctorHostCapabilities({ baseUrl, fetchImpl = globalT
       capabilities: normalizeDshHostCapabilities(body?.capabilities),
     }
   } catch (error) {
+    // A fetch failure can echo the request URL, and a proxy failure can echo the
+    // proxy URL with its userinfo; the doctor report is meant to be shareable, so
+    // the message is redacted at the source rather than at each print site.
     return {
       ok: false,
       source: 'runtime-unavailable',
-      error: error instanceof Error ? error.message : String(error),
+      error: redactDiagnosticText(error instanceof Error ? error.message : String(error), 200),
       capabilities: unknownSnapshot(),
     }
   }

package/lib/dsh-support-window.js

@@ -24,7 +24,10 @@ export function supportWindowUpgradeAdvice(capabilities = {}) {
     })
   }
 
-  if (batchAttachments === 'unknown' || maxImageDimension === 'unknown') {
+  // Capability evidence is tri-state (`true` / `false` / `'unknown'`). Only an
+  // explicit `true` proves the support floor, so a missing field, a wrong-typed
+  // value and `'unknown'` all mean "not proven" rather than "capable".
+  if (batchAttachments !== true || maxImageDimension !== true) {
     return Object.freeze({
       level: 'unknown',
       code: 'HOST_CURRENT_FLOOR_UNKNOWN',

package/lib/file-logger.js

@@ -4,6 +4,7 @@ import process from 'node:process'
 import { execFile } from 'node:child_process'
 import { format as formatArgs, promisify } from 'node:util'
 import { createRequire } from 'node:module'
+import { redactCredentialShapes } from './diagnostic-redaction.js'
 import { resolveDshHome } from './doctor.js'
 import { isLoopbackRequest } from './web-capability-boundary.js'
 
@@ -32,20 +33,19 @@ export function resolveVisionRouterLogPaths(dshHome = resolveDshHome()) {
  * Diagnostics are intended to be shareable in bug reports. Existing runtime
  * messages should not contain secrets, but redact common credential shapes as
  * defense in depth before anything reaches disk.
+ *
+ * The shape list lives in one place now: this module used to carry its own
+ * subset, which leaked `Authorization: token ghp_…`, `Cookie:` headers, bare
+ * platform tokens and `#token=` fragments that the other copy already covered.
  */
 export function sanitizeLogText(value) {
-  let text = String(value ?? '')
-  text = text.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, 'Bearer [REDACTED]')
-  text = text.replace(/\bsk-(?:proj-)?[A-Za-z0-9_-]{8,}\b/g, '[REDACTED_KEY]')
-  text = text.replace(
+  // Query strings here keep the historical `key=`/`auth=` spelling; everything
+  // else (schemes, cookies, vendor keys, JWTs) comes from the shared pass.
+  const text = String(value ?? '').replace(
     /([?&](?:api[_-]?key|access[_-]?token|token|key|auth)=)[^&\s]+/gi,
     '$1[REDACTED]',
   )
-  text = text.replace(
-    /\b(authorization|api[_-]?key|access[_-]?token)\s*[:=]\s*["']?[^\s"',}]+/gi,
-    '$1=[REDACTED]',
-  )
-  return text
+  return redactCredentialShapes(text)
 }
 
 function positiveInteger(value, fallback) {

package/lib/image-offload-compat.js

@@ -15,8 +15,15 @@ export function isOffloadedImageBlock(block) {
     const value = objectRecord(block);
     return value?.type === 'image' && value.offloaded === true;
 }
-export function blocksHaveRetainedImage(content) {
-    if (!Array.isArray(content))
+/**
+ * Deepest content nesting this walker inspects, mirroring the bound
+ * `catalog-corrections.convertBlocks` already applies to the same block tree.
+ * The walker only needs message → content → nested content; an unbounded
+ * recursion would turn a pathological tree into a stack overflow.
+ */
+const MAX_CONTENT_NESTING_DEPTH = 4;
+export function blocksHaveRetainedImage(content, depth = 0) {
+    if (!Array.isArray(content) || depth > MAX_CONTENT_NESTING_DEPTH)
         return false;
     for (const block of content) {
         const value = objectRecord(block);
@@ -24,7 +31,7 @@ export function blocksHaveRetainedImage(content) {
             continue;
         if (value.type === 'image' && value.offloaded !== true)
             return true;
-        if (Array.isArray(value.content) && blocksHaveRetainedImage(value.content))
+        if (Array.isArray(value.content) && blocksHaveRetainedImage(value.content, depth + 1))
             return true;
     }
     return false;

package/lib/local-vision-stabilizer.js

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { promisify } from 'node:util'
 import { sameOriginRequest } from './adversarial-hardening.js'
+import { objectRecord } from './core-primitives.js'
 import { normalizeRuntimeVisionConfig } from './runtime-config-normalizer.js'
 import { isOffloadedImageBlock, offloadedImagePlaceholder } from './image-offload-compat.js'
 
@@ -14,12 +15,13 @@ import { isOffloadedImageBlock, offloadedImagePlaceholder } from './image-offloa
  * specific to opt-in local vision, while non-local providers continue through
  * the original adapters byte-for-byte.
  */
-export async function triggerDesktopScreenshotPermission({
-  platform = typeof process !== 'undefined' ? process.platform : '',
-  run = promisify(execFile),
-  remove = unlink,
-  tempDir = tmpdir(),
-} = {}) {
+export async function triggerDesktopScreenshotPermission(rawOptions) {
+  const {
+    platform = typeof process !== 'undefined' ? process.platform : '',
+    run = promisify(execFile),
+    remove = unlink,
+    tempDir = tmpdir(),
+  } = objectRecord(rawOptions) ?? {}
   // Windows has no Screen Recording privacy prompt equivalent and Linux
   // capture permission is compositor-specific. macOS is the platform where
   // enabling this feature must proactively cross an OS privacy boundary.

package/lib/native-image-coexistence.js

@@ -1,4 +1,10 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
+import {
+  VISION_ROUTER_ADAPTER_OWNER,
+  isVisionRouterOwnedAdapter,
+} from './adapter-ownership.js'
+
+export { VISION_ROUTER_ADAPTER_OWNER, isVisionRouterOwnedAdapter }
 
 /**
  * Turn-local image ownership used by the public entry composition.
@@ -21,7 +27,8 @@ export const IMAGE_OWNERSHIP = Object.freeze({
  * an enumerable symbol also survives the rare Object.assign/object-spread
  * adapter wrapper. Normal JSON/Object.keys surfaces still ignore symbols.
  */
-export const VISION_ROUTER_ADAPTER_OWNER = Symbol.for('dsh-vision-router.adapter-owner')
+// The symbol and the ownership rule are owned by ./adapter-ownership.ts and
+// re-exported here so existing importers keep working unchanged.
 
 const imageTurn = new AsyncLocalStorage()
 const markedAdapters = new WeakMap()
@@ -166,6 +173,9 @@ export function visionRouterAdapterOwner(adapter) {
   }
 }
 
+// isVisionRouterOwnedAdapter is owned by ./adapter-ownership.ts (imported and
+// re-exported at the top of this file) so every caller shares one rule.
+
 function routeList(routes) {
   const list = Array.isArray(routes) ? routes : [routes]
   return list

package/lib/proxy-routing.js

@@ -22,10 +22,25 @@ export function canonicalProxyHost(value) {
         host = host.slice(0, -1);
     if (host === '')
         return '';
+    // A `*.host` entry means "this host and its subdomains", which is exactly what the matcher
+    // already does for a bare hostname. `domainToASCII` rejects the star, so leaving it in place
+    // makes the entry equal no real hostname: the configured host silently proxies nothing.
+    if (host.startsWith('*.'))
+        host = host.slice(2);
+    if (host === '')
+        return '';
     // WHATWG URL.hostname keeps IPv6 literals bracketed. domainToASCII does not
-    // accept a bare IPv6 literal, so preserve the bracketed spelling and only
-    // case-fold it. Proxy hosts are otherwise DNS names and can be IDNA-folded.
-    if (host.startsWith('[') && host.endsWith(']'))
+    // accept an IPv6 literal at all, so case-fold it directly. The brackets are
+    // pure spelling for the same address: stripping them is what lets a configured
+    // `::1` match a URL-derived `[::1]`. A bracketed non-literal (say
+    // `[example.com]`) keeps its spelling, so nothing about DNS is widened.
+    if (host.startsWith('[') && host.endsWith(']')) {
+        const literal = host.slice(1, -1).trim();
+        if (literal === '')
+            return '';
+        return literal.includes(':') ? literal.toLowerCase() : host.toLowerCase();
+    }
+    if (host.includes(':'))
         return host.toLowerCase();
     const ascii = domainToASCII(host);
     return (ascii || host).toLowerCase();

package/lib/remote-settings-risk-client-boundary.js

@@ -4,8 +4,13 @@
  *
  * PRODUCT CONTRACT (2.3+): acceptedRisk is reminder/friction only. It is not
  * authentication, authorization, local-presence proof, or a credential.
+ *
+ * This function is serialized with `toString()` into the browser boundary source
+ * below, so its body must stay self-contained: no imported helper and no free
+ * identifier may appear inside it.
  */
-export function createRemoteSettingsRiskClientBoundary(options = {}) {
+export function createRemoteSettingsRiskClientBoundary(rawOptions) {
+  var options = rawOptions !== null && typeof rawOptions === 'object' ? rawOptions : {}
   var confirmImpl = options.confirmImpl
   var alertImpl = options.alertImpl
   var locale = options.locale

package/lib/session-vision-mode-authority.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { isVisionRouterOwnedAdapter } from './adapter-ownership.js';
 import { parseSessionVisionPolicy } from './session-vision-policy.js';
-const VISION_ROUTER_ADAPTER_OWNER = Symbol.for('dsh-vision-router.adapter-owner');
 const VISION_ROUTER_OWNERSHIP = 'vision-router-owned';
 const DEFAULT_WRAPPER_ROUTE = 'deepseek-vision';
 const DEFAULT_CHAIN_ROUTE = 'vision-chain';
@@ -139,12 +139,7 @@ function currentAdapter(ctx, provider) {
 function adapterOwnedByVisionRouter(adapter) {
     if (!isWeakKey(adapter))
         return false;
-    try {
-        return objectRecord(adapter)?.[VISION_ROUTER_ADAPTER_OWNER] !== undefined;
-    }
-    catch {
-        return false;
-    }
+    return isVisionRouterOwnedAdapter(adapter);
 }
 function sameRoute(left, right) {
     const rightRoute = routeFrom(right);

package/lib/session-vision-policy.js

@@ -12,12 +12,15 @@ export function parseSessionVisionPolicy(value) {
     if (value === null || typeof value !== 'object' || Array.isArray(value))
         return undefined;
     const record = value;
-    if (record.revision !== SESSION_VISION_POLICY_REVISION)
+    // Own keys only: a policy row is persisted JSON, so a value inherited from a
+    // prototype is evidence of a malformed row rather than of a policy.
+    if (!Object.hasOwn(record, 'revision') || record.revision !== SESSION_VISION_POLICY_REVISION)
         return undefined;
-    if (typeof record.enabled !== 'boolean')
+    if (!Object.hasOwn(record, 'enabled') || typeof record.enabled !== 'boolean')
         return undefined;
-    if (record.source !== 'user' && record.source !== 'delegation')
+    if (!Object.hasOwn(record, 'source') || (record.source !== 'user' && record.source !== 'delegation')) {
         return undefined;
+    }
     if (record.source === 'user') {
         if (record.inheritedFrom !== undefined)
             return undefined;
@@ -27,7 +30,9 @@ export function parseSessionVisionPolicy(value) {
             source: 'user',
         });
     }
-    const inheritedFrom = nonEmptyString(record.inheritedFrom);
+    const inheritedFrom = Object.hasOwn(record, 'inheritedFrom')
+        ? nonEmptyString(record.inheritedFrom)
+        : undefined;
     if (inheritedFrom === undefined)
         return undefined;
     return Object.freeze({

package/lib/settings-number-contract.js

@@ -10,7 +10,9 @@ export const SETTINGS_NUMBER_META = Object.freeze({
 })
 
 export function parseSettingsNumber(key, raw, { allowClear = false } = {}) {
-  const meta = SETTINGS_NUMBER_META[key]
+  // Own keys only: a bare lookup would resolve inherited names such as
+  // `__proto__` or `constructor` to prototype machinery instead of "unknown key".
+  const meta = Object.hasOwn(SETTINGS_NUMBER_META, key) ? SETTINGS_NUMBER_META[key] : undefined
   if (!meta) return undefined
   if (raw === '' || raw === null || raw === undefined) return allowClear ? { clear: true } : undefined
   const value = Number(raw)