v0.6.22 [DSH v0.2.19]

English

Core Domain Decomposition and Modularization (#438)

• Domain Partitioning: Decomposed monolithic lib/vision-core.js (1317 lines) into four cohesive, decoupled modules:
  • lib/vision-config.js (338 lines): Schemas (Config), wrapConfig, plainConfig, plugin metadata (name, inject), and model capability predicates (sanitizeAllowed, shouldBridgeForModel, acceptsImages, blocksHaveImage).
  • lib/security.js (439 lines): Settings authentication (isTrustedSettingsRequest, isLoopbackAddress), API key masking and stable label derivation (deriveKeyLabel), path traversal protection (resolveInside, isPathAllowed), SSRF protection (safeFetch, isSafeFetchUrl, isPrivateIp), masking helpers, and bounded body reader (readBoundedBody).
  • lib/providers.js (33 lines): Provider definitions (FREE_VISION_PROVIDERS) and key resolution (resolveChannelApiKey).
  • lib/media-utils.js (504 lines): Sharp transforms (compressImage, stripEXIF, deskewImage, enhanceImage), OCR (runLocalOCR), image inspection, perceptual hashes (contentHash, pHash), and session-scoped attachment isolation (SessionScopedAttachmentMap).
• Transparent Backwards-Compatible Facade: lib/vision-core.js reduced to a 14-line facade re-exporting 100% of symbols (48 exports), ensuring zero disruption to existing tools, routes, and tests.
• Strict Line Budget Compliance: All hand-written modules strictly comply with the <= 600 lines limit.
• Verification: Added test/438_vision_core_domains.test.js. 509 tests across 145 suites pass 100% green. Preflight: FAIL=0 WARN=5.

Commit Correspondence

• Gitea commit: e8ffc72ed7b8dd062492f39257e8ce358a329fa5
• Mirror commit: c56d230fcafb6d24c7e7c5e8dddbe27a0c494bd5

中文

核心模块领域解耦与模块化 (#438)

• 领域解耦：将原先庞大的 lib/vision-core.js（1317行）解耦重构为4个职责清晰的高内聚领域模块：
  • lib/vision-config.js（338行）：配置 Schema (Config)、wrapConfig、plainConfig、插件元数据以及模型能力判定。
  • lib/security.js（439行）：设置鉴权、Loopback/Origin 校验、密钥脱敏与指纹生成 (deriveKeyLabel)、路径穿越防御 (resolveInside, isPathAllowed)、SSRF 防御 (safeFetch) 以及请求体边界限制。
  • lib/providers.js（33行）：免费模型列表 (FREE_VISION_PROVIDERS) 及 API 密钥解析。
  • lib/media-utils.js（504行）：Sharp 图像处理、本地 OCR、尺寸测量、感知哈希 (pHash) 与会话级附件隔离缓存 (SessionScopedAttachmentMap)。
• 100% 向后兼容门面：lib/vision-core.js 简化为 14 行的轻量门面，全量重导出 48 个导出符号，保证所有现有工具、路由及测试零破坏。
• 严格代码行数预算：所有手写模块严格满足 <= 600 行上限规范。
• 全量测试验证：新增 test/438_vision_core_domains.test.js，全套 509 项测试（145 个测试套件）100% 通过。Preflight 检查 FAIL=0 WARN=5。

提交对应关系

• Gitea 提交: e8ffc72ed7b8dd062492f39257e8ce358a329fa5
• 镜像公开提交: c56d230fcafb6d24c7e7c5e8dddbe27a0c494bd5

Русский

Декомпозиция ядра vision-core по предметным доменам (#438)

• Разбиение по доменам: Монолитный lib/vision-core.js (1317 строк) разделён на 4 предметных модуля с высокой когезией:
  • lib/vision-config.js (338 строк): Схемы Config, wrapConfig, plainConfig, плагинные константы, предикаты поддержки моделей.
  • lib/security.js (439 строк): Проверка доверенных запросов и origin, маскирование ключей и генерация стабильных меток (deriveKeyLabel), защита от обхода каталогов (resolveInside, isPathAllowed), защита от SSRF (safeFetch, isPrivateIp), маскирование PII/путей/секретов, ограничение тела запросов (readBoundedBody).
  • lib/providers.js (33 строки): Справочник FREE_VISION_PROVIDERS и разрешение ключей каналов (resolveChannelApiKey).
  • lib/media-utils.js (504 строки): Sharp-трансформации, OCR, размеры, FNV/pHash, сессионная изоляция аттачей SessionScopedAttachmentMap, утилита bestEffort.
• Прозрачный фасад: lib/vision-core.js (14 строк) сохраняет 100% обратную совместимость, реэкспортируя все 48 символов.
• Соблюдение лимита строк: Все рукописные модули строго удовлетворяют правилу <= 600 строк.
• Проверка: Добавлен тест test/438_vision_core_domains.test.js. Полный набор тестов: 509 тестов (145 сьютов) — 100% PASS. Preflight: FAIL=0 WARN=5.

Соответствие коммитов

• Gitea commit: e8ffc72ed7b8dd062492f39257e8ce358a329fa5
• Mirror commit: c56d230fcafb6d24c7e7c5e8dddbe27a0c494bd5

v0.6.21 [DSH v0.2.19]

English

Client Slot Modernization and Storage Containment (#435)

• Settings Slot Modernization: Retired the dead settings.plugin.item slot registration from lib/client.js. Configuration card now binds exclusively to modern DSH live seats: plugins.row.config (row seat) and plugins.item (Plugins list seat).
• Storage Directory Containment: Constrained relative evidenceDir in lib/storage.js (resolveStorageDir) to the plugin's base storage directory via resolveInside, preventing directory traversal escapes (../..).
• Comprehensive Regression Suite: Added test/issue-435-audit-dead-slot-storage.test.js validating dead slot retirement and storage directory boundary containment. Full test suite passes 505 green tests across 145 suites.

Commit Correspondence

• Gitea commit: 547fa4e5d4294f162cc6feef6928e761077a6cdd
• Mirror commit: fb93090239edb736a6eedfc4a79d0acaa519930a

中文

客户端设置插槽现代化与存储目录限制 (#435)

• 设置插槽现代化：从 lib/client.js 中移除了已停用的 settings.plugin.item 插槽注册。设置卡片现仅绑定至 DSH 现代活动席位：plugins.row.config（行内设置席位）与 plugins.item（插件列表席位）。
• 存储目录边界限制：在 lib/storage.js（resolveStorageDir）中通过 resolveInside 将相对路径 evidenceDir 限制在基础存储目录内，阻止目录遍历逃逸（../..）。
• 完整回归测试：新增 test/issue-435-audit-dead-slot-storage.test.js，验证插槽废弃及存储路径安全限制。全套 505 项测试（145 个测试套件）全部通过。

提交对应关系

• Gitea 提交: 547fa4e5d4294f162cc6feef6928e761077a6cdd
• 镜像公开提交: fb93090239edb736a6eedfc4a79d0acaa519930a

Русский

Модернизация слотов настроек и ограничение каталога хранилища (#435)

• Модернизация слотов настроек: Удалена устаревшая регистрация слота settings.plugin.item из lib/client.js. Карточка настроек регистрируется только в актуальных посадочных местах ядра DSH: plugins.row.config (строчный слот) и plugins.item (слот списка плагинов).
• Ограничение путей хранилища: В lib/storage.js (resolveStorageDir) относительный путь evidenceDir безопасно ограничен базовым каталогом хранилища плагина через resolveInside, предотвращая обход каталогов (../..).
• Регрессионные тесты: Добавлен сьют test/issue-435-audit-dead-slot-storage.test.js, подтверждающий отсутствие устаревшего слота и изоляцию каталогов хранилища. Все 505 тестов в 145 сьютах успешно пройдены.

Соответствие коммитов

• Gitea commit: 547fa4e5d4294f162cc6feef6928e761077a6cdd
• Mirror commit: fb93090239edb736a6eedfc4a79d0acaa519930a

v0.6.20 [DSH v0.2.19]

English

Channels Persistence Error Handling and Rollback Safety (#432)

• Settings Persistence Error Propagation: In POST /dsh-vision-bridge/channels (lib/routes/config.js), removed silent suppression of persistence failures. Failures from scope.set('channels', ...) now log via logger.error and return HTTP 500 with descriptive error details.
• In-Memory Configuration Rollback: Reverted in-memory config.channels back to pre-mutation state whenever channel persistence rejects, preventing state desynchronization and data loss across restarts.
• Persistence Status Reporting: HTTP 200 channel save response now exposes persisted: Boolean(...), allowing callers and Web UI to verify physical persistence.
• Web UI Diagnostics & Feedback: Web UI checks persisted flag in channel configuration responses, notifying users if storage lacks persistence, with complete English and Chinese localization.
• Regression Suite: Added comprehensive test cases in test/issue-410-channels-persistence.test.js verifying error propagation, rollback, and logger calls. All 499 tests pass.

Commit Correspondence

• Gitea commit: ccf93085c36052569c110a1a08422edaf89906c6
• Mirror commit: c11af2a57c3c3eaa7b7a365e7a0e95d76f67a41f

中文

频道配置持久化错误处理与状态回滚保护 (#432)

• 设置持久化错误传递：在 POST /dsh-vision-bridge/channels (lib/routes/config.js) 中移除了对持久化失败的静默吞没。底层 scope.set('channels', ...) 失败时将调用 logger.error 记录日志并返回 HTTP 500 详细错误信息。
• 内存配置状态安全回滚：当持久化存储失败时，将内存中的 config.channels 自动回滚至变更前状态，避免重启后出现数据静默丢失和状态不一致。
• 持久化状态反馈：HTTP 200 响应中增加 persisted: Boolean(...) 字段，供调用方和前端界面确认是否已真正写入持久化存储。
• Web UI 状态诊断与反馈：更新 Web UI 频道配置保存逻辑，检查 persisted 状态标志，并在未持久化或失败时显示状态徽标，已包含英文和中文多语言支持。
• 回归测试：在 test/issue-410-channels-persistence.test.js 中新增了错误传递、内存回滚和日志记录的完整测试用例。全部 499 项测试均通过。

提交对应关系

• Gitea 提交: ccf93085c36052569c110a1a08422edaf89906c6
• 镜像公开提交: c11af2a57c3c3eaa7b7a365e7a0e95d76f67a41f

Русский

Обработка ошибок сохранения каналов и откат конфигурации (#432)

• Проброс ошибок сохранения настроек: В обработчике POST /dsh-vision-bridge/channels (lib/routes/config.js) устранено подавление сбоев сохранения. При ошибке вызова scope.set('channels', ...) событие логируется через logger.error и возвращается HTTP 500 с подробным описанием ошибки.
• Откат конфигурации в памяти: При отказе сохранения каналов в хранилище config.channels в оперативной памяти откатывается к исходному состоянию до мутации, исключая рассинхронизацию и потерю настроек при перезапуске.
• Индикация статуса персистентности: Ответ HTTP 200 теперь включает флаг persisted: Boolean(...), позволяя клиентам и Web UI проверять факт физической записи на диск.
• Диагностика в Web UI: Web UI проверяет флаг persisted при сохранении каналов и информирует пользователя при отсутствии постоянного хранилища (с поддержкой локализации на английском и китайском).
• Регрессионные тесты: Добавлены проверки обработки ошибок, отката состояния и вызова логгера в test/issue-410-channels-persistence.test.js. Все 499 тестов успешно пройдены.

Соответствие коммитов

• Gitea commit: ccf93085c36052569c110a1a08422edaf89906c6
• Mirror commit: c11af2a57c3c3eaa7b7a365e7a0e95d76f67a41f

v0.6.19 [DSH v0.2.19]

v0.6.19 [DSH v0.2.19]

Audit Verification Residual Defect Resolution (#429)

• Settings Persistence Reflection & Volatile Metadata (#363, #374, #401): Marked all 49 configurable fields in lib/vision-core.js Config schema with .volatile() to ensure reliable DSH API configuration persistence. Reflected persistence capability (persisted: true/false) in GET /dsh-vision-bridge/config.
• Symlink Traversal Containment in resolveInside (#369, #373, #376): Refactored resolveInside in lib/vision-core.js to isolate realpathSync lookups, ensuring path traversal escaping the target boundary throws clear Path escapes directory errors rather than getting suppressed by ENOENT handling.
• Cache Key Parameter Granularity for detail (#377): Added detail (auto/low/high) into the cache key derivation in lib/cache.js and lib/vision-pipeline.js, ensuring detail variations do not collide or share cache entries.
• Suppression of Local Disk Bypass on DSH FS Denial (#380): In lib/image-resolution.js, when dshFs.readBytes fails or denies access, immediately return null instead of falling back to direct readFileSync from local storage.
• PNG Decoder Hardening (#383): Enhanced decodePng in lib/image-processing.js with zlib.crc32 validation for IDAT chunks, rejection of invalid filter values (< 0 or > 4) and unsupported interlacing (interlace > 0), and enforcement of maximum decompressed byte boundaries.
• Accurate Preprocessed State Reporting (#384): In lib/image-processing.js smartOptimizeImage, report preprocessed: false and surface descriptive warnings when downscaling is requested but sharp is unavailable.
• Execution Context Session Isolation (#379): Extracted execution context sessionId across analysis, OCR, document, and grounding tools (lib/tools/analysis.js, lib/tools/grounding.js, lib/tools/document.js, lib/tools/ocr.js) and passed it to attachmentById.get(id, sessionId) to prevent cross-session attachment leaks.
• Multi-Channel Provider Routing in vision_compare (#387): Routed vision_compare through callVisionModelWithBytes, honoring configured HTTP providers and channel fallbacks instead of bypassing to catalog streams.
• Strict Boolean Type Validation for Tool Assessments (#394): Enforced typeof parsed.passed === 'boolean' in vision_audit_accessibility and vision_verify_generated_image, rejecting string "true"/"false" evaluations.
• Comprehensive Regression Suite: Added test/429_audit_residual_fixes.test.js validating all 9 domain defect areas, bringing full test suite to 497 green tests across 144 suites.

SHA Correspondence

• Gitea commit: 08d4c55311e492c6ad1239f67ca7c188b77a1211
• Public sanitized commit: 10fec8f0e7537db681229aa96da774cd337ec384

v0.6.18 [DSH v0.2.19]

v0.6.18 [DSH v0.2.19]

Diagnostics Logger & Facade Modularization (Block 8)

• Host Diagnostics Logger Integration (#366): Routed all host-side diagnostics and error reporting through the DSH plugin logger (getLogger(ctx, 'vision-bridge')) instead of bare console.* calls across lib/image-processing.js, lib/vision-core.js, lib/tools/*, and lib/index.js. Browser-side diagnostics in lib/client.js preserved intact. Added test/366_host_logger_diagnostics.test.js enforcing zero host-side console.* calls.
• Modularization of Facade Monolith (#412): Decomposed monolithic lib/index.js (previously ~1600 lines) into focused single-responsibility domain modules:
  • lib/agent-boundary.js: agent/pre-step image sanitization, llm/stream backstop, and modality bridge.
  • lib/vision-pipeline.js: multi-channel routing, model selection, pHash & LRU caching, and complexity classification.
  • lib/image-resolution.js: attachment and filesystem image resolution (resolveImageBytes & resolveSourceBytes).
  • lib/journal-evidence.js: in-flight batch manager, audit journal, and evidence persistence.
  • lib/storage.js: storage directory resolution and persistence probing.
  • lib/provider-discovery.js: Ollama and free provider auto-discovery.
  • lib/routes-deps.js: HTTP route registrations wiring.
  • Shrank lib/index.js down to 553 lines (< 800 lines criterion), maintaining 100% test coverage with 488 passing tests across 143 suites.

v0.6.17 [DSH v0.2.19]

Release v0.6.17 [DSH v0.2.19]

Flagship multimodal vision hub for DeepSeek Harness: WebUI localization, client lifecycle disposers, composer attachment bindings, design contract modernization.

What's Changed

• #399 (fix(i18n)): Wired complete Chinese dictionary (zh) and slot translator props.t to WebUI in lib/client.js. Supported flexible parameter signatures in makeT, delegating to companion translator first, resolving Chinese locales, and falling back to English.
• #400 (fix(client)): Cleaned up global DOM event listeners (document click, window dragover/drop, lightbox keydown) and locale disposer on unmount; reset applied and global window flags on unmount.
• #408 (fix(composer)): Bound PDF import pages directly to composer inputActions.addAttachments(attachmentIds) and fallback event dsh:add-attachments, eliminating plaintext [Attachment: ...] string injection into textarea.value. Localized PDF toasts in English and Chinese.
• #402 (docs(design)): Modernized internal docs/design/DESIGN.md specification to mandate DSH 0.2 plugins.row.config (@goodandready/dsh-vision-bridge#dsh-vision-bridge) with ctx.configForms (update(), page/summary views), keeping settings.plugin.item strictly as legacy fallback. Preserved owner policy excluding internal docs/ from npm and git.
• #403: Confirmed public GitHub mirror parity with npm release at 0.6.16.
• CI Guards: Guarded optional host Chrome and Tesseract OCR executions in test suites 404, 406, and 407 to skip gracefully in containerized CI environments without external binaries.

Validation

• 486 unit and integration tests passing across 143 suites (npm test).
• Zero Cyrillic characters in lib/.
• Zero unannotated empty catch blocks.

Package and Mirror Correspondence

• npm: @goodandready/dsh-vision-bridge@0.6.17
• Gitea: 8fc025c3203e87c5400c1a6754ca5db37c24319d
• GitHub: 04b1dc5a450e44a7df8b0c3934dd08d0a938cc3e

v0.6.16: Agent Tools & Export Correctness (Block 6)

Bug Fixes & Improvements

• Agent Tools & Export Correctness (Block 6):
  • Canonical English OCR Default & Language Discovery (#404): Replaced hardcoded rus+eng / eng+rus language defaults in runLocalOCR, vision_ocr, and vision_ocr_local with canonical English ('eng'). Added dynamic host capabilities discovery via getTesseractLanguages() (tesseract --list-langs). Added normalization and aliases for Chinese language packs (zh, zh-cn, chinese -> chi_sim, zh-tw -> chi_tra). Provided graceful fallback to vision LLM with informative warnings when requested language packs are missing in vision_ocr, and truthful reporting in vision_ocr_local. Added ocrLang configuration option.
  • Truthful Contract for vision_export_report (#406): Fixed vision_export_report when given format: 'pdf' to generate genuine %PDF- document artifacts via headless Chrome, publishing the artifact with report.pdf filename and application/pdf mediaType. Aligned output.schema (report, format, filename, mediaType, attachmentId), and enforced strict format validation rejecting unsupported formats with clear errors.
  • Full-Page Screenshot Beyond Fixed Viewport (#407): Enhanced vision_html_screenshot to honor fullPage: true by measuring document scrollHeight dynamically and capturing the complete document beyond the fixed 1024 viewport height using Chrome CDP (Page.captureScreenshot, captureBeyondViewport). Kept standard 1024 viewport clipping when fullPage === false.

Refs: #404, #406, #407

v0.6.15

Release v0.6.15: Channel pipeline, routing, resilience & cancellation (Block 5 fixes: #386, #387, #388, #397, #398, #405)

v0.6.14

Release v0.6.14 (Block 4: Output Schemas, Truthfulness, Security Trust & Harness Contracts)

v0.6.13 [DSH v0.2.0-rc.1]

@goodandready/dsh-vision-bridge v0.6.13 [DSH v0.2.0-rc.1]

Overview & Purpose

Production release v0.6.13 delivers Block 3: Cache Identity, Bbox Normalization, Pixel Diff, Crop Parsing, and Quality Metrics, ensuring accurate caching across varied prompts and modes, deterministic bounding box scaling across resolutions, exact alpha-aware visual diffing, and authentic image quality diagnostics.

Key Changes & Bug Fixes

1. Cache Identity & Null Cache Safety (#377, #378)

• Task-Specific Perceptual Cache Keys: Prevented pHash cache cross-contamination on identical images by generating perceptual cache keys incorporating prompt, model, mode, and promptVersion (pHashKeyFor). Different prompts or modes on identical image bytes no longer return stale answers from previous tasks.
• Null Cache Guarding: Added null-guards on descriptionByHash across all lookups and writes when config.cacheEnabled === false, eliminating TypeError: Cannot read properties of null (reading 'has').

2. Vision Crop Parsing & Attachment Cap Enforcement (#390, #409)

• Deterministic Numeric Bbox Parsing: Corrected regex in vision_crop from ^s*\[?s*d to ^\s*\[?\s*-?\d and supported numeric array/string coordinates, preventing unnecessary VLM grounding on deterministic regions and rejecting invalid coordinates.
• Enforced 300 Attachment Cap: Routed crop and annotate attachment writes through recordAttachment() instead of raw attachmentById.set(), strictly enforcing the 300-entry capacity limit and preventing memory leaks of image buffers.

3. Bbox Normalization Consistency (#391)

• Resolution-Invariant Bbox Scaling: Removed dimension-based heuristics (>1000px vs <=1000px) and axis-swapping in normalizeBbox(). Standardized 0..1000 and 0..1 scale preservation across arbitrary resolutions while supporting explicit pixel units for rect objects and unit options.

4. Pixel Diff Alpha, Tolerance=0 & Dimension Mismatch (#392)

• Alpha Channel Awareness: Factored alpha channel differences (da) into pixel comparison, detecting transparency regressions.
• Strict Tolerance=0: Honored explicit tolerance: 0 without fallback to default 30.
• Consistent Dimension Mismatch Metrics: Fixed dimension mismatch calculation to maintain consistent totalPixels and diffPixels, stripping undeclared properties to comply with the tool output schema.

5. Optimizer Auto Format & Deterministic Quality Measurements (#393, #395)

• Fixed Undeclared Variable: Resolved undeclared auto variable in smartOptimizeImage() image compression options (format: options.format || 'auto'), eliminating runtime ReferenceError.
• Authentic Quality Diagnostics: Enhanced analyzeImageQuality() to perform genuine decoding (PNG or via sharp for other supported formats) and throw on corrupt/invalid input instead of fabricating constant 50/50/100 fake metrics with undeclared note properties.

Quality Gates & Verification

• Full Test Suite: 421 tests passing (npm test).
• New Test Coverage:
  • test/issue-377-cache-identity.test.js
  • test/issue-390-crop-and-attachment-cap.test.js
  • test/issue-391-normalize-bbox.test.js
  • test/issue-392-pixel-diff.test.js
  • test/issue-393-optimizer-and-quality.test.js
• Preflight: Verified zero Cyrillic in lib/ and zero unannotated catch blocks.
• npm Package: Published @goodandready/dsh-vision-bridge@0.6.13 (29 files, 131.4 kB).
• Public Mirror: Synchronized with GitHub GooDAnDReaDY/dsh-vision-bridge tag v0.6.13.

Related Issues & PRs

• Block 3 PR: #417
• Release PR: #418
• Issues closed: #377, #378, #390, #391, #392, #393, #395, #409