@goodandready/dsh-image-gen 0.10.13 → 0.10.15

package/lib/cost-meter.js

@@ -135,11 +135,12 @@ export function assertBudgetAvailable(estimatedCost, dailyBudgetUsd) {
   const budget = Number(dailyBudgetUsd) || 0
   if (budget <= 0) return true // Budget 0 = unlimited
 
+  const cost = Number(estimatedCost) || 0
   const current = loadDailySpend()
-  const projected = +(current.totalSpendUsd + estimatedCost).toFixed(4)
+  const projected = +(current.totalSpendUsd + cost).toFixed(4)
   if (projected > budget) {
     throw new Error(
-      `Daily image generation budget exceeded: current spend $${current.totalSpendUsd.toFixed(2)} + estimated $${estimatedCost.toFixed(2)} exceeds limit $${budget.toFixed(2)} (Settings → Image generation → dailyBudgetUsd)`
+      `Daily image generation budget exceeded: current spend $${current.totalSpendUsd.toFixed(2)} + estimated $${cost.toFixed(2)} exceeds limit $${budget.toFixed(2)} (Settings → Image generation → dailyBudgetUsd)`
     )
   }
   return true

package/lib/frontend-assets.js

@@ -306,6 +306,9 @@ export function optimizeSvgContent(svgString, options = {}) {
   }
 
   let cleaned = svgString.trim()
+  if (!cleaned.includes('<svg')) {
+    throw new Error('Content does not contain valid SVG markup (<svg ...>)')
+  }
 
   cleaned = cleaned.replace(/<\?xml[\s\S]*?\?>/gi, '')
   cleaned = cleaned.replace(/<!DOCTYPE[\s\S]*?>/gi, '')

package/lib/generation-cache.js

@@ -33,9 +33,13 @@ export function getCachedGeneration(hash, { force = false } = {}) {
     const meta = JSON.parse(readFileSync(metaPath, 'utf8'))
     const bytes = readFileSync(dataPath)
 
-    // Touch meta file for LRU update
-    meta.lastAccessed = Date.now()
-    writeFileSync(metaPath, JSON.stringify(meta, null, 2), 'utf8')
+    // Touch meta file for LRU update in isolated block
+    try {
+      meta.lastAccessed = Date.now()
+      writeFileSync(metaPath, JSON.stringify(meta, null, 2), 'utf8')
+    } catch {
+      // Non-fatal touch failure: still return valid cache entry
+    }
 
     return {
       bytes,

package/lib/index.js

@@ -274,6 +274,10 @@ export const Config = z.object({
     .number()
     .description('provider=local: CFG scale.')
     .default(7),
+  seedreamBaseURL: z
+    .string()
+    .description('provider=seedream: base URL, e.g. https://api.bytedanceapi.com/v1 or Volcengine Ark.')
+    .default('https://api.bytedanceapi.com/v1'),
   seedreamKeyEnv: z
     .string()
     .role('credential-ref')
@@ -1197,8 +1201,9 @@ export function apply(ctx, config) {
         },
       },
       async execute(args, exec) {
-        const source = await resolveSource(ctx, exec, args.image)
-        if (!source || !source.bytes) throw new Error('Source image not found: ' + args.image)
+        try {
+          const source = await resolveSource(ctx, exec, args.image)
+          if (!source || !source.bytes) throw new Error('Source image not found: ' + args.image)
         const cfg = live()
         const res = await removeBackgroundFal(
           { fetchImpl: fetch, resolveKey: (ref) => resolveApiKey(ctx, ref), cfg },
@@ -1236,6 +1241,9 @@ export function apply(ctx, config) {
           format: 'png',
           attachment,
         })
+        } catch (err) {
+          throw new Error(sanitizeErrorAndLogs(err.message || err))
+        }
       },
     }),
   )
@@ -1266,8 +1274,9 @@ export function apply(ctx, config) {
         },
       },
       async execute(args, exec) {
-        const source = await resolveSource(ctx, exec, args.image)
-        if (!source || !source.bytes) throw new Error('Source image not found: ' + args.image)
+        try {
+          const source = await resolveSource(ctx, exec, args.image)
+          if (!source || !source.bytes) throw new Error('Source image not found: ' + args.image)
         const cfg = live()
         const res = await upscaleImageFal(
           { fetchImpl: fetch, resolveKey: (ref) => resolveApiKey(ctx, ref), cfg },
@@ -1305,6 +1314,9 @@ export function apply(ctx, config) {
           height: res.height || attachment.height,
           attachment,
         })
+        } catch (err) {
+          throw new Error(sanitizeErrorAndLogs(err.message || err))
+        }
       },
     }),
   )
@@ -1331,24 +1343,42 @@ export function apply(ctx, config) {
         },
       },
       async execute(args, exec) {
-        const source = await resolveSource(ctx, exec, args.image)
-        if (!source || !source.bytes) throw new Error('Source image not found: ' + args.image)
-        const cfg = live()
-        const res = traceToSvg(source.bytes, { colorMode: args.color_mode })
-        const stem = `${slugify(args.output_name || 'vector')}-${Date.now().toString(36)}`
-        const name = `${stem}.svg`
-        const sessionCwd = exec.agent?.session?.header?.cwd
-        const outDir = path.resolve(sessionCwd || process.cwd(), cfg.outputDir || 'generated/images')
-        await mkdir(outDir, { recursive: true })
-        const filePath = path.join(outDir, name)
-        await writeFile(filePath, res.bytes)
-        const summary = `### Vectorized SVG Export\n- **File**: ${filePath}\n- **Format**: SVG (XML vector)\n- **Color mode**: ${args.color_mode || 'color'}\n- **Palette size**: ${res.palette ? res.palette.length : 16} colors\n`
-        return toLosslessJson({
-          summary,
-          path: filePath,
-          svg: res.svg,
-          format: 'svg',
-        })
+        try {
+          const source = await resolveSource(ctx, exec, args.image)
+          if (!source || !source.bytes) throw new Error('Source image not found: ' + args.image)
+          const cfg = live()
+          const res = traceToSvg(source.bytes, { colorMode: args.color_mode })
+          const stem = `${slugify(args.output_name || 'vector')}-${Date.now().toString(36)}`
+          const name = `${stem}.svg`
+          const sessionCwd = exec.agent?.session?.header?.cwd
+          const outDir = path.resolve(sessionCwd || process.cwd(), cfg.outputDir || 'generated/images')
+          await mkdir(outDir, { recursive: true })
+          const filePath = path.join(outDir, name)
+          await writeFile(filePath, res.bytes)
+
+          let attachment = null
+          let localUrl = ''
+          if (ctx.attachments?.saveImage) {
+            attachment = await ctx.attachments.saveImage({
+              data: new Uint8Array(res.bytes),
+              mediaType: 'image/svg+xml',
+              name,
+            })
+            localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(attachment.attachmentId)
+          }
+
+          const summary = `### Vectorized SVG Export\n- **File**: ${filePath}\n- **Format**: SVG (XML vector)\n- **Color mode**: ${args.color_mode || 'color'}\n- **Palette size**: ${res.palette ? res.palette.length : 16} colors\n`
+          return toLosslessJson({
+            summary,
+            path: filePath,
+            url: localUrl,
+            svg: res.svg,
+            format: 'svg',
+            attachment,
+          })
+        } catch (err) {
+          throw new Error(sanitizeErrorAndLogs(err.message || err))
+        }
       },
     }),
   )
@@ -1378,14 +1408,17 @@ export function apply(ctx, config) {
         },
       },
       async execute(args, exec) {
-        const refs = Array.isArray(args.images) ? args.images : [args.images].filter(Boolean)
+        try {
+          const cfg = live()
+          trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+          assertBudgetAvailable(0.05, cfg.dailyBudgetUsd)
+          const refs = Array.isArray(args.images) ? args.images : [args.images].filter(Boolean)
         const sources = []
         for (const r of refs) {
           const s = await resolveSource(ctx, exec, r)
           if (s && s.bytes) sources.push(s)
         }
         if (sources.length === 0) throw new Error('No valid images found to blend')
-        const cfg = live()
         const res = await blendImagesFal(
           { fetchImpl: fetch, resolveKey: (ref) => resolveApiKey(ctx, ref), cfg },
           { images: sources, weights: args.weights, prompt: args.prompt, signal: exec.signal }
@@ -1421,6 +1454,9 @@ export function apply(ctx, config) {
           height: res.height || attachment.height,
           attachment,
         })
+        } catch (err) {
+          throw new Error(sanitizeErrorAndLogs(err.message || err))
+        }
       },
     }),
   )
@@ -1542,7 +1578,16 @@ export function apply(ctx, config) {
         },
       },
       async execute(args, exec) {
-        const source = await resolveConversationImage(ctx, exec, args.image)
+        try {
+          trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+          const estimatedCostEdit = calculateGenerationCost({
+            provider: cfg.provider || 'fal',
+            model: cfg.model,
+            size: cfg.defaultSize || 'square_hd',
+            count: 1,
+          })
+          assertBudgetAvailable(estimatedCostEdit, cfg.dailyBudgetUsd)
+          const source = await resolveConversationImage(ctx, exec, args.image)
         const mask = args.mask ? await resolveSource(ctx, exec, args.mask) : undefined
         const vision = await analyzeImageWithVision(ctx, exec, source)
 
@@ -1603,6 +1648,9 @@ export function apply(ctx, config) {
           result.visionAnalysis = vision.summary
         }
         return toLosslessJson(result)
+        } catch (err) {
+          throw new Error(sanitizeErrorAndLogs(err.message || err))
+        }
       },
     }),
   )
@@ -1662,7 +1710,17 @@ export function apply(ctx, config) {
         },
       },
       async execute(args, exec) {
-        const source = await resolveConversationImage(ctx, exec, args.image)
+        try {
+          trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+          const count = normalizeCount(args.count || 1)
+          const estimatedCostVary = calculateGenerationCost({
+            provider: cfg.provider || 'fal',
+            model: cfg.model,
+            size: cfg.defaultSize || 'square_hd',
+            count,
+          })
+          assertBudgetAvailable(estimatedCostVary, cfg.dailyBudgetUsd)
+          const source = await resolveConversationImage(ctx, exec, args.image)
         const vision = await analyzeImageWithVision(ctx, exec, source)
 
         const provider = cfg.provider || 'fal'
@@ -1671,8 +1729,6 @@ export function apply(ctx, config) {
           resolveKey: (ref) => resolveApiKey(ctx, ref),
           cfg,
         }
-
-        const count = normalizeCount(args.count || 1)
         const variationStrength = Math.max(0.05, Math.min(0.95, args.variation_strength ?? 0.35))
         const baseSeed = Math.floor(Math.random() * 100000)
         const format = cfg.defaultFormat || 'png'
@@ -1727,6 +1783,9 @@ export function apply(ctx, config) {
           ...first,
           variations: results.map((r) => ({ path: r.path, attachmentId: r.attachment?.attachmentId, seed: r.seed })),
         })
+        } catch (err) {
+          throw new Error(sanitizeErrorAndLogs(err.message || err))
+        }
       },
     }),
   )

package/lib/loop-guard.js

@@ -29,8 +29,13 @@ export function trackAndAssertLoopGuard(sessionId, {
     return { count: 0, allowed: true }
   }
 
+  // A limit of 0 explicitly disables loop guard protection
+  if (limit === 0 || limit === '0') {
+    return { count: 0, remaining: Infinity, allowed: true }
+  }
+
   const current = sessionStates.get(sid) || { count: 0, lastPrompt: '', lastTimestamp: 0 }
-  const maxLimit = Math.max(1, limit)
+  const maxLimit = Math.max(1, Number(limit) || DEFAULT_MAX_CONSECUTIVE_GENERATIONS)
 
   if (current.count >= maxLimit) {
     throw new Error(

package/lib/providers.js

@@ -749,7 +749,7 @@ export function makeProviders(deps, job) {
   // Seedream (ByteDance): OpenAI-совместимый API картинок.
   async function seedream(seedArg = seed, promptArg = prompt) {
     const key = await resolveKey(cfg.seedreamKeyEnv)
-    const base = 'https://api.bytedanceapi.com/v1'
+    const base = (cfg.seedreamBaseURL || 'https://api.bytedanceapi.com/v1').replace(/\/+$/, '')
     const res = await fetchImpl(`${base}/images/generations`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${key}` },

package/lib/resolve-image.js

@@ -1,4 +1,4 @@
-import { readFile } from 'node:fs/promises'
+import { readFile, stat } from 'node:fs/promises'
 import path from 'node:path'
 import { estimateSharpnessAndVariance } from './providers.js'
 
@@ -158,6 +158,17 @@ export async function resolveConversationImage(ctx, exec, targetRef) {
     ? effectiveRef
     : path.resolve(sessionCwd, effectiveRef)
 
+  const fileStat = await stat(absPath).catch(() => null)
+  if (!fileStat) {
+    throw new Error(`Image file not found: ${effectiveRef}`)
+  }
+  if (fileStat.size === 0) {
+    throw new Error(`Image file is empty (0 bytes): ${effectiveRef}`)
+  }
+  if (fileStat.size > 50 * 1024 * 1024) {
+    throw new Error(`Image file too large (${(fileStat.size / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
+  }
+
   const bytes = await readFile(absPath)
   const mediaType = detectMediaType(absPath, bytes)
   return {

package/lib/security.js

@@ -42,6 +42,16 @@ export function sanitizeErrorAndLogs(input) {
     return maskApiKey(token)
   })
 
+  // Mask Replicate tokens r8_...
+  text = text.replace(/(r8_[a-zA-Z0-9_\-]{8,})/gi, (match, token) => {
+    return maskApiKey(token)
+  })
+
+  // Mask Google Gemini API keys (starts with AIza and ~35-45 chars)
+  text = text.replace(/(AIza[0-9A-Za-z\-_]{30,45})/g, (match, token) => {
+    return maskApiKey(token)
+  })
+
   return text
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.10.13",
+  "version": "0.10.15",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",