@duyquangnvx/image-gen 0.13.0 → 0.13.2

package/CHANGELOG.md

@@ -6,6 +6,27 @@ A release turns `## Unreleased` into `## vX.Y.Z (YYYY-MM-DD)`, which from the se
 
 ## Unreleased
 
+## v0.13.2 (2026-10-12)
+
+### Upgrade from v0.13.1
+
+- Nothing to do.
+
+### Fixed
+
+- `image-gen update` and the `registry` row of `image-gen doctor` work under npm 12, which answers `npm view` in an array; they failed with `E_NO_LATEST` there.
+
+## v0.13.1 (2026-10-12)
+
+### Upgrade from v0.13.0
+
+- Nothing to do.
+
+### Changed
+
+- The skill and the README no longer tell an agent to raise the Bash tool's timeout: Claude Code moves a command past it to the background and delivers the output when the command exits.
+- The skill's `E_REGISTRY_AUTH` row for a sandboxed Bash now covers every command, not only `update`: the agent asks the user to type the command with `!` in front.
+
 ## v0.13.0 (2026-10-09)
 
 ### Upgrade from v0.12.1

package/README.md

@@ -180,7 +180,7 @@ be written has `null` for everything but `plate` and `kept`.
 `hint` naming the next command, and `details`. A plan call takes 30–145 s and gets up to 270 s, less when the
 run's 9 minutes are nearly used, so that the whole run, writes included, ends within them; the
 `E_NO_ANSWER` message gives the time the call actually had. A run with under 10 s left for its call
-does not send it (`E_TIMEOUT`). Give the tool a timeout of 10 minutes.
+does not send it (`E_TIMEOUT`).
 Ctrl-C stops a run from sending more, but lets the calls already sent finish and writes their images.
 [`skills/image-gen/`](./skills/image-gen/SKILL.md) is a Claude Code skill for driving the CLI; it
 ships in the package, `image-gen skill install` copies it to

package/dist/cli.mjs

@@ -614,11 +614,11 @@ function createProviders() {
 }
 //#endregion
 //#region src/cli/version.ts
-const VERSION = "0.13.0";
+const VERSION = "0.13.2";
 /** The short SHA, with `+dirty` when the tree had uncommitted changes. */
-const COMMIT = "b279cf3";
+const COMMIT = "0ee0cb5";
 /** ISO 8601, UTC. */
-const BUILT_AT = "2026-10-09T16:13:14.981Z";
+const BUILT_AT = "2026-10-12T07:02:35.631Z";
 /** `engines.node` from package.json, always `>=X.Y`. */
 const NODE_ENGINE = ">=22.12";
 const BUILD = {
@@ -702,7 +702,11 @@ function npmContext(host, child) {
 //#region src/cli/adapters/packages/npm-run.ts
 const NPM_ERROR_CODE = /^npm (?:error|ERR!) code (\S+)$/mu;
 const NPM_ERROR_PATH = /^npm (?:error|ERR!) path (.+)$/mu;
-/** The `code` npm prints when the registry refuses its credentials, or has none from it. */
+/**
+* The `code` npm prints when the registry refuses its credentials, or has none from it. Claude Code's
+* sandbox refuses a host with the same 403, and npm prints none of its proxy's headers, so only the
+* skill's Failures row tells them apart.
+*/
 const AUTH_CODES = /* @__PURE__ */ new Set(["E401", "E403"]);
 /** The `code` npm prints when it cannot reach the registry at all. */
 const NETWORK_CODES = /* @__PURE__ */ new Set([
@@ -1007,7 +1011,8 @@ async function latest(ctx, signal) {
 		code: done.code,
 		said: done.stderr
 	}, "E_NPM_FAILED");
-	const version = jsonOf(done.stdout);
+	const answer = jsonOf(done.stdout);
+	const version = Array.isArray(answer) && answer.length === 1 ? answer[0] : answer;
 	if (!isVersion(version)) throw new UserError("E_NO_LATEST", `npm answered no version ${doing}: '${done.stdout.trim()}'`);
 	return version;
 }
@@ -1036,7 +1041,7 @@ async function install(ctx, version) {
 		}
 	});
 }
-/** The npm channel: `latest` and `install` through the npm beside the running Node. */
+/** `latest` and `install` through the npm beside the running Node, on the package's registry. */
 function createPackages(host, child = {
 	spawn,
 	spawnSync
@@ -3253,7 +3258,7 @@ function differences(asked, recorded) {
 //#endregion
 //#region src/cli/commands/image/timeouts.ts
 const MS_PER_MINUTE = 6e4;
-/** How long a run may take, writes included; under the 10 minutes an agent's Bash tool allows at most. */
+/** Bounds a hang before sending. A sent call is bounded by `REQUEST_TIMEOUT_MS` instead (ADR-0013). */
 const RUN_TIMEOUT_MS = 9 * MS_PER_MINUTE;
 /** A sent call's own bound, which fires before undici gives up on headers (ADR-0013). */
 const REQUEST_TIMEOUT_MS = 27e4;
@@ -3801,7 +3806,7 @@ async function update(ctx) {
 	if (problem !== null) throw problem;
 	const latest = await packages.latest(ctx.signal);
 	const before = await skill.state();
-	if (standing("0.13.0", latest) !== "behind") {
+	if (standing("0.13.2", latest) !== "behind") {
 		deliver(ctx, latest, {
 			installed: null,
 			skill: before,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duyquangnvx/image-gen",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Generate, edit and cut out images through the AI SDK, as a TypeScript library and the image-gen CLI",
   "license": "UNLICENSED",
   "type": "module",

package/skills/image-gen/SKILL.md

@@ -15,7 +15,7 @@ Each image is billed to whoever the chosen model bills: `--model provider:id` fo
 1. **Intent.** An existing image the user wants changed while keeping the rest is an **edit**; images given only for style, composition, or mood are references to a **generate**; no images is a generate. Assume a new image unless the user clearly asks to change one.
 2. **Destination.** A file the project will use goes where the user says, or where the project keeps such assets. A preview or a round of iteration goes to a scratch directory inside the project, such as `previews/` (create it first): the sandbox may let a command write nowhere else. Keep existing files: write a sibling such as `hero-v2.png`, and pass `--force` only when the user asked for the file to be replaced.
 3. **Prompt.** Read [references/prompting.md](references/prompting.md) once per session before the first prompt. An entry from a game's art manifest goes through [references/art-entries.md](references/art-entries.md) first: it maps each field to the prompt and flags, and the game's gate to what the CLI reports. Classify the request into a [use-case slug](references/prompting.md#use-case-taxonomy), then write it in the [prompt schema](references/prompting.md#prompt-schema); [references/sample-prompts.md](references/sample-prompts.md) has a recipe per slug. Pick the [flags](#commands) the request needs, `--aspect` for its shape first.
-4. **Run** the [command](#commands) through the Bash tool with `timeout: 600000` (its maximum): a call takes 30–145 s and gets up to 270 s, less when the run's 9 minutes are nearly used, past Bash's 120 s default. Several distinct assets follow [Many assets](#many-assets).
+4. **Run** the [command](#commands) through the Bash tool: a call takes 30–145 s and gets up to 270 s, less when the run's 9 minutes are nearly used. Several distinct assets follow [Many assets](#many-assets).
 5. **Read the envelope.** Every file in `data.images` was written and billed, whether `ok` is `true` or not, and goes into the report even when the run failed. On `ok: false`, act on the [failure](#failures); a rerun asks only for the images still missing, under new names unless it reruns a set.
 6. **Look.** With two or more candidates, or any image with alpha, build a [`contact-sheet`](#commands) of them and `Read` it once; `Read` a single opaque image directly. Check subject, style, composition, verbatim text, and every invariant. On a miss, change one thing in the prompt, repeat the invariants, and run again to a new `--out`.
 7. **Report** the final path(s), the final prompt, who was billed (`data.billing`), and any `data.warnings`.
@@ -73,17 +73,17 @@ A failure has `ok: false` and a diagnostic with a `code`, a `message`, often a `
 | `E_OUT_OF_CREDIT` (exit 2) | Stop. Tell the user the OpenAI account needs Credit, and offer the plan's route from `hint` as a choice. Never switch to it unasked. |
 | `E_LOGIN_REQUIRED`, `E_NO_TTY` | Stop. Ask the user to type `! image-gen login`: its sign-in needs a person at a browser. To see which provider is ready without spending quota, run `image-gen --json doctor`. |
 | `E_LOGIN_DENIED`; or in Claude Code's sandbox `E_FILE_DENIED`, or `E_NETWORK` or `E_NO_ANSWER` from a provider no run has reached yet | The sandbox is blocking image-gen. Keep `--out` inside the project, stop, and follow [Sandbox](references/setup.md#sandbox). When the user says these are allowed already, follow the row below that fits the code. |
-| `E_REGISTRY_AUTH` while Bash runs sandboxed | The sandbox's proxy refused the registry's host with a 403, which npm reports as a refused login, so the `hint` does not apply. For `update`, ask the user to type `! image-gen update`, which runs outside the sandbox; in `doctor`, only the `registry` row is affected. |
 | `E_PROVIDER_WARNED`, `E_WRONG_SIZE` | Billed, and the images were written anyway (`data.images`). `Read` them and tell the user what the provider dropped or what size came back (an image's `askedFor` is the size asked for); keep one that serves. Do not rerun just to keep it: `--allow-warnings` only turns the same miss into a success. |
 | `E_UNSUPPORTED_REQUEST` | Nothing was billed: the model cannot honour the request as asked, such as `--transparent` on Gemini or a `--mask` on the plan. Rerun with what `hint` names changed; when only another model can do it, ask the user, since the model decides who is billed. |
 | `E_OUTPUT_EXISTS` | While rerunning a set, that asset is done: skip it, per [Many assets](#many-assets). Otherwise pick a new sibling name, per step 2. `message` names the file in the way: the image, its `.json` record, or under `--cutout` its `.plate.png`. When `hint` says the call was billed, another program took the name during the run: tell the user. |
-| `E_INTERRUPTED` (exit 130, 143) | The run was stopped, usually by a tool timeout. It sent nothing more, but let the calls already sent finish: every image that came back was billed and written, and `data.images` lists them. Rerun the same command with `--resume`, which sends only for what is missing, with the `timeout` from step 4. |
+| `E_INTERRUPTED` (exit 130, 143) | The run was stopped by a signal: Ctrl-C (130) or SIGTERM (143). It sent nothing more, but let the calls already sent finish: every image that came back was billed and written, and `data.images` lists them. Rerun the same command with `--resume`, which sends only for what is missing. |
 | `E_NO_ANSWER` (exit 2) | Stop. A request may have reached the provider and been billed, yet no image came back for it, at all or within the time it had, which `message` gives. Every image that did come back was written, and `data.images` lists them. Tell the user; once they accept paying again for what is missing, run the `--resume` command the `hint` names, which sends only for that. |
 | `E_NO_IMAGE` | The model answered without an image, usually because it declined the content. Rephrase once, then tell the user. |
 | `E_HTTP` with `details.status` 400 | The provider refused the request; `message` quotes its words. For a content refusal, rephrase once, then tell the user. |
 | `command not found` (exit 127) | Under nvm every Node version has its own global packages, so image-gen may sit under another one. Look with `ls ~/.nvm/versions/node/*/bin/image-gen` (nvm-windows: `ls "$NVM_HOME"/v*/image-gen.cmd`) and `node --version`; tell the user which Node holds it and which one this shell runs. Otherwise install it as [setup](references/setup.md#install) says. |
 | exit 70 | A bug in image-gen, with no envelope. Stop, give the user its stderr verbatim, and offer the message [Feedback](#feedback) describes. |
 | `E_SKILL_DENIED` | Claude Code's sandbox cannot write the skill's folder. Ask the user to type `! image-gen skill install`, which runs outside it. |
+| `E_REGISTRY_AUTH` while Bash runs sandboxed | The sandbox's proxy refuses a registry it does not allow with a 403, which npm reports as a refused login, so the `hint` does not apply. Ask the user to type the command with `!` in front, which runs it outside the sandbox; in `doctor`, it touches only the `registry` row. |
 | `E_SKILL_REINSTALL_FAILED` | `update` installed the new version, whose own `skill install` then failed with the code in `details.code`, which this skill may not know. Follow the `hint`, then load the skill again. |
 | `E_NODE_VERSION` | This shell runs a Node older than image-gen needs, as when nvm gives your shell another version than the user's terminal. Give the user the `hint` verbatim. |
 | exit 2 | The user must act on their machine: give them the `message` and `hint` verbatim, never ask for a secret in the conversation, and run the command again once they say it is done. |