dsh-ollama-vision-bridge

patchController() splices code into @deepseek-ai/dsh-api-session-controller under $DSH_HOME/profiles and into every copy returned by npxControllerDirs(); writeFileAtomic() renames over the original without a .bak, and when the patched file fails `node --check` the script only logs a warning and leaves the modified file in place. A moved anchor or interrupted run can leave the host controller broken, and the modification silently persists for all future npx runs.

For a text-only model with attached images the patched branch no longer follows the host's native refusal/admission path: it calls dshOllamaAdmit() — executed from the string-defined HELPERS_LINES in patch/source.mjs — and on success returns immediately from the controller's admit function. Validation the host performed after the modality check for image prompts is skipped, and the injected helpers run in-process with the controller's ctx (attachments, agent) and the selected model's identity.

DSH_VISION_BRIDGE_BASE_URL / DSH_VISION_BRIDGE_MODEL take precedence over the profile config, and normalizeBaseURL() only enforces an http(s) scheme with no embedded credentials, so any host (plaintext http included) is allowed. Whoever controls the process environment or the config can silently have attached screenshots described by — and transmitted in full base64 to — a remote endpoint.

package.json ships bin/cli.js (documented as `npx dsh-ollama-vision-bridge setup`), which performs the patching described above, yet the file was not harvested. Its argument handling, path resolution and network behavior could not be verified, so the audit covers only part of the code that actually modifies the host.