VisionPower 3.2.5

VisionPower 3.2.5

Changes

• Switched the default DeepSeek model to deepseek-flash, while retaining retired DeepSeek IDs for existing configurations.
• Added glm-5.3-flash, gemini-3.8-flash, gemini-3.7-flash, and qwen3.8-flash vision presets.
• Retired qwen3.8-max, qwen3.8-omni-flash, and glm-5v-turbo from new WebUI and Skill selections while preserving explicit existing configurations.
• Updated Chinese and English README guidance, Kimi Code setup instructions, Skill defaults, and dsh compatibility documentation.
• Updated patched transitive dependencies (fast-uri, hono, and qs); production dependency audit is clean.

Verification

• npm test
• npm run lint
• npm run smoke
• npm audit --omit=dev
• npm audit signatures
• Skill and generated bundle checks

v3.2.4

• Added DeepSeek as a vision provider: a deepseek-v4-flash-vision-exp preset on https://api.deepseek.com (OpenAI-compatible) now sits at the top of the model preset list in the WebUI and dsh console, with a "Get DeepSeek API Key" link to platform.deepseek.com and a deepseek entry in the provider capability table (bearer auth, max_tokens, system role). Verified with a live end-to-end vision request (generated-image OCR round-trip, ~1.7 s).
• First-install defaults switched to DeepSeek: with no env vars and no ~/.visionpower/config.json, VisionPower now resolves to deepseek-v4-flash-vision-exp / https://api.deepseek.com instead of qwen3-vl-flash / DashScope. Existing installations are unaffected — a saved config or env override always wins.
• Documentation examples now use visionpower@latest instead of pinning 3.2.1, and the manual-config snippet / env-table default column show the new DeepSeek defaults.

Upgrade: this is config-compatible; nothing to migrate. To try DeepSeek, pick the new preset at the top of the CONFIG page, paste your API key, and test in PLAYGROUND.

v3.2.3

• Added DeepSeek Harness 0.1.1-rc.2 support. The pi-ai stream() image call changed shape in rc.2 — the multimodal branch now spreads { ...options, signal: watchdog.signal } across multiple lines and appends a trailing { maxPixels, maxBytes } budget object — so the patcher gained a dedicated rc.2 variant that preserves the new call shape and only substitutes the image-stripped messages. Covered by self-tests (S5rc2).
• The apiproxy selectModel patch now treats dsh 0.1.1's native image admission (serializeImageAdmission) as already-achieved: rc.2 deleted the old rejection code outright, which previously failed the whole install with "old rejection code not found".

v3.2.2 — dsh 0.1.1-rc.1 支持与规则 v4

新增

• DeepSeek Harness 0.1.1-rc.1 支持：补丁全量命中（8 处，结构/语法 0 失败），静态与运行时双重验证。补丁器新增 eraRc() 版本分类器——凡晚于 0.1.0-rc.8 的版本（0.1.1-rc.1、0.2+、稳定版）一律映射到 rc.8 补丁集，不再出现「无法识别版本号」警告，也绝不因新版本自身的 rc 小号被误判为早于 rc.8 而跳过补丁；分类器排序规则有 11 个自测用例钉死。
• 注入规则 v4（路由感知的 read_image 指引）：多模态路由（能直接看到消息图片，如 0.1.1-rc.1 官方目录新内置的 deepseek-v4-flash-vision-exp）优先原生看图、可直接用 read_image 读本地图片；纯文本路由维持禁用 read_image + describe_image 成功后不做二次确认。
• 0.1.1-rc.1 起 dsh 官方模型目录内置 deepseek-v4-flash-vision-exp（首个声明 inputModalities: [text, image] 的官方模型）——VisionPower 补丁保留其原生发图路由不动，同时继续为纯文本模型放行图片消息。

修复

• 本地 file: 源重装插件静默失效：pnpm 对同一 file: 规格会复用 lockfile 的目录导入快照（即使 --force），源目录更新不落盘（pnpm 11.22 实测）。安装器现先 pnpm remove 清掉 lockfile 条目再 add，强制全新导入。
• setup-dsh 最后手段的 npx 兜底版本钉到 @deepseek-ai/dsh@0.1.1-rc.1。

npm 发布由作者执行；npx 用户在 npm 上可见本版之前，visionpower@latest 仍为旧版。

v3.1.1 — 渠道适配器失配不再阻塞安装

3.1.1 是 3.1.0 的快速修复版(npm 上一版为 3.0.1,本版包含 3.1.0 全部内容)。

修复

• 渠道适配器补丁失配不再卡死安装:dsh-llm-deepseek / dsh-llm-pi-ai 是可选渠道的适配层——没配该渠道的用户,补丁跟不上 dsh 新结构时(如 3.0.1 面对 rc.7 的「结构不匹配」报错)只警告并跳过,警告中说明后果(该渠道拖图仍会被拒);宿主核心 dsh-host-apiproxy 的补丁失配仍然报错并回滚
• 安装结束必定打开配置控制台:已配置的复跑场景也会弹出 http://127.0.0.1:17900 供确认(--no-console 仍可完全跳过)
• AGENTS.md 相关提示以 ~/.dsh/AGENTS.md 形式显示,不再打印绝对路径

升级

npx -y visionpower@latest setup-dsh --launch

完整变更见 CHANGELOG。

v3.1.0 — dsh rc.7 集成与全面加固

VisionPower 3.1.0:dsh rc.7 + Settings 面板 + 加固

从 3.0.1 升级。核心是 dsh 基线升级到 DeepSeek Harness 0.1.0-rc.7、原生 Settings 面板,以及两轮审查驱动的全面加固。

安装 / 升级(幂等,随时重跑)

npx -y visionpower@latest setup-dsh --launch

dsh 升级 / 重装后补丁丢失,重跑同一条命令即可自动重打;--check 现在能如实报告「有 N 处补丁待打」,不再误报通过。

dsh rc.7 与 Settings

• 拖拽 / 粘贴图片经宿主持久 AttachmentStore 按消息顺序直接读取,不再解析附件 ID、解压会话日志或推导私有存储路径
• 原生 Settings → Plugins → VisionPower 标签页:嵌入配置控制台,与 MCP / 独立 WebUI 共享同一份配置、预设、连接测试与保存流程
• dsh 专属默认开启的开关:关闭后停止识图规则注入、describe_image 拒绝新请求,MCP / Skill / 独立 WebUI 不受影响,重新启用无需重启 dsh

加固(审查驱动)

• describe_image 严格 current-turn 语义:上一回合的图片绝不被隐式复用;追问旧图用显式 attachment_scope="latest_in_session"(修复了该参数此前必触发未知字段报错的问题)
• image_url 下载:已验证地址集内顺序故障切换;修复 Node 20+ 上必然抛 ERR_INVALID_IP_ADDRESS 的存量问题;支持公网 IPv6 字面量直链
• 补丁事务化:patch-dsh 写入走 temp+rename,结构漂移或语法失败时全量回滚,绝不留半补丁安装;--check 不再对缺失补丁误报「通过」
• 连接测试真验视觉:随机四位数字挑战图,返回 visionVerified/reason,纯文本模型无法再蒙混「连接成功」
• SSE 标准多行 data: 事件解析;注释行不再解除首字节看门狗
• 磁盘缓存 TOCTOU 关闭:经已验证的文件描述符刷新访问时间
• 福利渠道端点仅以密文存储与分发(仓库 / bundle / WebUI 响应均无明文)
• setup_visionpower 安装器运行器:有界输出、超时/取消杀整棵进程组、等待子进程收尾
• PUT /api/config 保留本版本不认识的已持久化字段;安装器 spawn 全部挂错误处理,Windows 下 .cmd 启动路径支持空格
• CI 测试矩阵增加 macOS

完整变更见 CHANGELOG。

v3.0.1 — VisionPower × dsh：一键安装与拖图/粘贴识图

VisionPower 3.0：dsh（DeepSeek Harness）完整支持

从 2.8.0 升级，核心是 dsh 图片理解全套能力（经从零安装实测打磨，期间修复 8 个实测 bug）：

一条命令装完

npx -y visionpower@latest setup-dsh --launch

幂等可重跑：装插件 → 挂载 cordis → 打「拖图不拒绝」补丁（含状态追踪，dsh 升级后重跑自动重打）→ 启动并自动弹出配置控制台 → 验证 → 启动 dsh web。已配置后复跑不再多起进程；在 dsh 里新增/更换纯文本模型自动被补丁覆盖，无需任何操作。

对 dsh 说一句话也能装

请你帮我按照 GitHub 项目 RunhuaHuang/visionpower，来完成 DeepSeek Harness 版 VisionPower 插件的配置

仓库根 AGENTS.md 提供快速通道（dsh 自动加载工作区 AGENTS.md），装好后插件注册 setup_visionpower 工具，后续任何「配置 / 修复 / 检查 VisionPower」的说法直接触发。

插件形态

• describe_image 为普通工具：agent 在正常工具调用阶段按需识图（可见进度、每图一次视觉调用、回合开始零阻塞）
• 图片相关回合自动注入识图规则（拖拽与粘贴共用一条链路；纯图片消息、不提「图」字也能被识别；规则含 read_image 禁令与正向动作指令）
• 服务端补丁模型无关：多模态路由原生链路完全不受影响

3.0.1（本版）

三个并行验收 agent 的修复：setup_visionpower 改异步执行（不再阻塞 dsh 进程）、--check 真正只读（patch-dsh --dry-run）、配置控制台等就绪再弹浏览器；补 compareVersions/cordis 变换单测与补丁自测入 npm test。

完整变更见 CHANGELOG。

v2.8.0 — Streaming requests, first-byte watchdog, cross-process result cache

What's Changed

⚡ Streaming requests + first-byte watchdog

• Provider requests are now sent streamed (stream: true) and aggregated internally into the complete answer — callers see no behavior change, and answers can arrive slightly sooner because the gateway no longer buffers the whole response before sending.
• A new first-byte watchdog (firstByteTimeoutMs, default 15000 ms, capped at timeoutMs) aborts and retries early when an upstream accepts the request but stalls before emitting its first token (queue congestion, gateway hang) — worst-case waits drop from minutes to seconds instead of idling to the full request timeout.
• Full gateway compatibility ladder: gateways that ignore the stream flag (plain JSON answers, even SSE-shaped ones) are parsed as before, and gateways that explicitly reject the parameter are retried once non-streamed — for both OpenAI-compatible and Anthropic protocols.
• Streamed reads enforce the same 5MB raw-body safety cap as buffered reads.

💾 Cross-process result cache

• The in-memory result cache now has an on-disk mirror (default ~/.visionpower/cache, override with VISIONPOWER_CACHE_DIR), so short-lived processes such as the standalone Skill script reuse a recent identical image+prompt answer instead of billing a second model call — repeated identical requests drop from seconds to milliseconds.
• Owner-only files (0600), atomic writes, mtime-LRU eviction, same TTL/entry budget as the memory cache; any disk failure or an insecure (group/world-accessible or symlinked) cache directory degrades to a plain cache miss and never fails the image request.

🔢 Fewer truncated answers, faster focused questions

• Default maxTokens raised 2048 → 4096: long OCR answers no longer get cut off mid-result (which previously forced agents to re-run the whole call). Configs saved by an older WebUI with the historical 2048 default still count as "unset" so provider-recommended budgets (e.g. Kimi's 32768) keep applying.
• Tool and parameter descriptions, plus the Skill guide, now steer agents toward focused prompts ("Read the error message text") over open-ended "describe everything" requests — output length is the dominant per-call latency factor.

🖥️ WebUI

• New First-Byte Timeout setting (synced with firstByteTimeoutMs / VISIONPOWER_FIRST_BYTE_TIMEOUT_MS).
• The result-cache toggle copy now accurately describes the on-disk mirror instead of claiming "no disk usage".
• GET /api/config no longer exposes the server-side cache directory.

Full Changelog: v2.7.2...v2.8.0

v2.7.1

What's Changed

• Updated the welfare preset's Base URL placeholder copy in the WebUI to make
  it clear the built-in welfare channel is pre-configured and needs no user
  modification.

Full Changelog: v2.7.0...v2.7.1

v2.7.0

What's Changed

🛡️ Welfare gateway endpoint privacy

• The private welfare gateway endpoint is now stored as an XOR+Base64 cipher instead of plaintext, and its hostname in the capability registry is derived from that cipher.
• All WebUI/API responses (presets, config GET/PUT, export) only ever expose the opaque builtin:welfare alias; the server resolves the alias back to the real endpoint for validation, persistence, and connection probes.
• The welfare alias is restricted to MiniMax-M3 with a clear error for other models, so the private gateway cannot be reused for arbitrary model IDs.

🔧 WebUI hardening

• Unified API-key preservation rules between PUT /api/config and /api/test-connection into one shared resolveApiKeyChoice helper.
• Oversized request bodies now get the connection dropped after the 413 response instead of letting a peer stream indefinitely.
• Fixed a WebUI foot-gun where editing (not changing) the masked API key could persist the display mask as the real credential on save.
• Simplified WebUI routing; query string stripped once per request.
• normalizeModelForKnownEndpoint now tolerates an unparsable Base URL.

Full Changelog: v2.6.1...v2.7.0