@goodandready/dsh-image-gen 0.10.15 → 0.10.16

package/README.md

@@ -84,6 +84,14 @@
 * **Subscription Aspect Ratio Mapping**: maps aspect ratios (`16:9`, `3:2`, `9:16`, `2:3`) to appropriate subscription dimensions (`1536x1024` / `1024x1536`) instead of falling back to default square `1024x1024`.
 
 
+### 🚀 What's New in v0.10.16
+* **Safe Attachment Service Fallback (#214)**: Added graceful fallback handling in `saveAttachmentSafe` across all 8 visual tools (`generate_image`, variations, `remove_background`, `upscale_image`, `blend_images`, etc.). When running in headless CLI mode or when the attachment store is unavailable, outputs are safely written to disk with full file paths and data references rather than crashing tool execution.
+* **HTTP Image Endpoint Strict Validation**: Hardened `/dsh-image-gen/image` route against malformed or NaN parameters (`b`, `w`, `h`), cleanly responding with HTTP 400 or 404 without leaking internal system traces.
+* **ComfyUI Node Error Extraction**: Integrated `extractComfyNodeErrors` to parse node execution errors from `/history/{pid}` status responses, immediately reporting root-cause node diagnostics rather than timing out.
+* **Custom Provider Error Normalization**: Standardized gateway error extracts through `formatErrorMessage`, eliminating raw JSON or `[object Object]` artifacts on 4xx/5xx API responses.
+* **Cache & History Consistency**: Ensured content-addressed disk cache hits synchronize seamlessly with generation history and sidecar metadata.
+* **Test Suite Expansion**: Added `test/batch4-hardening.test.mjs`, expanding test coverage to **128 automated unit tests (100% pass)**.
+
 ### 🚀 What's New in v0.10.15
 * **Loop Guard Zero-Limit Bypass (#212)**: Fixed an edge case where setting `loopGuardLimit: 0` (configured to disable protection) enforced a limit of 1 due to `Math.max(1, limit)`. Setting limit to 0 now properly bypasses loop checks.
 * **Security Hardening (Token Masking)**: Added automatic pattern masking for Replicate API tokens (`r8_...`) and Google Gemini API keys (`AIza...`) in `sanitizeErrorAndLogs`.

package/README.ru.md

@@ -130,6 +130,14 @@ graph LR
 - **100% интернационализация (#140)**: устранены захардкоженные русские строки, добавлены переводы на русский, английский и китайский языки.
 
 
+### 🚀 Что нового в v0.10.16
+* **Безопасный Fallback сервиса вложений (#214)**: Реализована функция `saveAttachmentSafe` во всех 8 визуальных инструментах (`generate_image`, вариации, `remove_background`, `upscale_image`, `blend_images` и др.). При запуске в автономном режиме без сервиса вложений или при сбое хранилища инструмент гарантированно сохраняет файл на диск и отдает пути без падения.
+* **Строгая валидация HTTP-эндпоинта картинок**: В обработчике `/dsh-image-gen/image` усилена проверка query-параметров (`b`, `w`, `h`), защищающая от `NaN` и отрицательных чисел, а также исключающая утечку внутренних трассировок при 404/500 ошибках.
+* **Диагностика ошибок нод ComfyUI**: Добавлена функция `extractComfyNodeErrors`, мгновенно извлекающая сообщения об ошибках нод из `/history/{pid}` при сбое генерации вместо бесконечного ожидания таймаута.
+* **Нормализация ошибок Custom/OpenAI API**: Ошибки сторонних шлюзов и API провайдеров единообразно форматируются через `formatErrorMessage`, предотвращая появление `[object Object]` или громоздких дампов JSON.
+* **Согласованность истории и дискового кэша**: Попадания в кэш корректно поддерживают актуальность метаданных sidecar и истории генераций.
+* **Расширение тестов**: Добавлен тестовый набор `test/batch4-hardening.test.mjs`, общее количество тестов выросло до **128 (100% pass)**.
+
 ### 🚀 Что нового в v0.10.15
 * **Обход Loop Guard при нулевом лимите (#212)**: Исправлена ошибка, когда при значении `loopGuardLimit: 0` (отключение защиты) срабатывал `Math.max(1, 0) = 1` и блокировал вызовы на 2-й итерации. При значении 0 лимит теперь полностью отключается.
 * **Усиление безопасности токенов**: В `sanitizeErrorAndLogs` добавлено маскирование токенов Replicate (`r8_...`) и ключей Google Gemini (`AIza...`).

package/lib/index.js

@@ -47,6 +47,7 @@ import {
   resolveStylePreset,
   blendImagesFal,
   toLosslessJson,
+  saveAttachmentSafe,
 } from './providers.js'
 
 import { resolveConversationImage, analyzeImageWithVision, buildDualOutputMarkdown } from './resolve-image.js'
@@ -72,6 +73,9 @@ export { IMAGE_SIZES, OUTPUT_FORMATS, PROVIDER_KEYS, buildSidecar, normalizeMedi
 /**
  * Сохраняет сгенерированный ассет в воркспейс, регистрирует в attachments и возвращает Dual-Output (#150).
  */
+
+
+
 export async function saveAndAttachResult(ctx, exec, cfg, {
   bytes,
   mediaType,
@@ -89,11 +93,7 @@ export async function saveAndAttachResult(ctx, exec, cfg, {
   args = {},
   action = 'generated',
 }) {
-  const attachment = await ctx.attachments.saveImage({
-    data: new Uint8Array(bytes),
-    mediaType,
-    name,
-  })
+  const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes, mediaType, name })
 
   const sessionCwd = exec?.agent?.session?.header?.cwd
   const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
@@ -102,12 +102,6 @@ export async function saveAndAttachResult(ctx, exec, cfg, {
   const filePath = path.join(outDir, name)
   await writeFile(filePath, bytes)
 
-  const localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(attachment.attachmentId)
-    + '&mt=' + encodeURIComponent(attachment.mediaType)
-    + '&b=' + encodeURIComponent(String(attachment.bytes))
-    + '&w=' + encodeURIComponent(String(attachment.width))
-    + '&h=' + encodeURIComponent(String(attachment.height))
-
   await writeFile(
     path.join(outDir, `${stem}.json`),
     JSON.stringify(buildSidecar({
@@ -614,14 +608,26 @@ export function apply(ctx, config) {
       // The tool result carries all of them, so the card sends them back.
       // Nothing is gained by forging them — the bytes are still verified
       // against the sha256 in the id, and a mismatch is simply a 404.
+      const rawBytes = Number(query.get('b'))
+      const rawW = Number(query.get('w'))
+      const rawH = Number(query.get('h'))
+      const safeBytes = Number.isFinite(rawBytes) && rawBytes >= 0 ? rawBytes : 0
+      const safeW = Number.isFinite(rawW) && rawW >= 0 ? rawW : 0
+      const safeH = Number.isFinite(rawH) && rawH >= 0 ? rawH : 0
+
       const ref = {
         attachmentId: id,
         mediaType: query.get('mt') || 'image/png',
-        bytes: Number(query.get('b')) || 0,
-        width: Number(query.get('w')) || 0,
-        height: Number(query.get('h')) || 0,
+        bytes: safeBytes,
+        width: safeW,
+        height: safeH,
       }
       try {
+        if (!ctx.attachments || typeof ctx.attachments.readImage !== 'function') {
+          res.writeHead(404, { 'Content-Type': 'application/json' })
+          res.end(JSON.stringify({ error: 'attachment service unavailable' }))
+          return
+        }
         const stored = await ctx.attachments.readImage(ref)
         res.writeHead(200, {
           'Content-Type': stored.ref?.mediaType || 'image/png',
@@ -631,7 +637,7 @@ export function apply(ctx, config) {
         res.end(Buffer.from(stored.data))
       } catch (error) {
         res.writeHead(404, { 'Content-Type': 'application/json' })
-        res.end(JSON.stringify({ error: String(error && error.message ? error.message : error) }))
+        res.end(JSON.stringify({ error: 'image not found or reference mismatch' }))
       }
     }
   })()
@@ -907,11 +913,7 @@ export function apply(ctx, config) {
           const stem = `${slugify(args.output_name || promptArg)}-${Date.now().toString(36)}-${jobSeed}`
           const name = `${stem}.${extension}`
 
-          const attachment = await ctx.attachments.saveImage({
-            data: new Uint8Array(bytes),
-            mediaType,
-            name,
-          })
+          const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes, mediaType, name })
 
           const sessionCwd = exec.agent?.session?.header?.cwd
           const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
@@ -920,12 +922,6 @@ export function apply(ctx, config) {
           const filePath = path.join(outDir, name)
           await writeFile(filePath, bytes)
 
-          const localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(attachment.attachmentId)
-            + '&mt=' + encodeURIComponent(attachment.mediaType)
-            + '&b=' + encodeURIComponent(String(attachment.bytes))
-            + '&w=' + encodeURIComponent(String(attachment.width))
-            + '&h=' + encodeURIComponent(String(attachment.height))
-
           // Sidecar: рядом с картинкой — метаданные генерации. Каталог становится
           // самодокументируемым (галерея/повтор/диагностика читают их без БД).
           await writeFile(
@@ -1055,11 +1051,7 @@ export function apply(ctx, config) {
               const extension = diskHit.mediaType === 'image/jpeg' ? 'jpg' : diskHit.mediaType === 'image/webp' ? 'webp' : 'png'
               const stem = `${slugify(args.output_name || promptVal)}-${Date.now().toString(36)}-${seedVal}`
               const name = `${stem}.${extension}`
-              const attachment = await ctx.attachments.saveImage({
-                data: new Uint8Array(diskHit.bytes),
-                mediaType: diskHit.mediaType,
-                name,
-              })
+              const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes: diskHit.bytes, mediaType: diskHit.mediaType, name })
               const sessionCwd = exec.agent?.session?.header?.cwd
               const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
               const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
@@ -1067,12 +1059,6 @@ export function apply(ctx, config) {
               const filePath = path.join(outDir, name)
               await writeFile(filePath, diskHit.bytes)
 
-              const localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(attachment.attachmentId)
-                + '&mt=' + encodeURIComponent(attachment.mediaType)
-                + '&b=' + encodeURIComponent(String(attachment.bytes))
-                + '&w=' + encodeURIComponent(String(attachment.width))
-                + '&h=' + encodeURIComponent(String(attachment.height))
-
               return {
                 path: filePath,
                 url: localUrl,
@@ -1211,17 +1197,12 @@ export function apply(ctx, config) {
         )
         const stem = `${slugify(args.output_name || 'nobg')}-${Date.now().toString(36)}`
         const name = `${stem}.png`
-        const attachment = await ctx.attachments.saveImage({
-          data: new Uint8Array(res.bytes),
-          mediaType: 'image/png',
-          name,
-        })
+        const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes: res.bytes, mediaType: 'image/png', name })
         const sessionCwd = exec.agent?.session?.header?.cwd
         const outDir = path.resolve(sessionCwd || process.cwd(), cfg.outputDir || 'generated/images')
         await mkdir(outDir, { recursive: true })
         const filePath = path.join(outDir, name)
         await writeFile(filePath, res.bytes)
-        const localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(attachment.attachmentId)
         const summary = buildDualOutputMarkdown({
           action: 'background removed',
           filePath,
@@ -1284,17 +1265,12 @@ export function apply(ctx, config) {
         )
         const stem = `${slugify(args.output_name || 'upscaled')}-${Date.now().toString(36)}`
         const name = `${stem}.png`
-        const attachment = await ctx.attachments.saveImage({
-          data: new Uint8Array(res.bytes),
-          mediaType: 'image/png',
-          name,
-        })
+        const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes: res.bytes, mediaType: 'image/png', name })
         const sessionCwd = exec.agent?.session?.header?.cwd
         const outDir = path.resolve(sessionCwd || process.cwd(), cfg.outputDir || 'generated/images')
         await mkdir(outDir, { recursive: true })
         const filePath = path.join(outDir, name)
         await writeFile(filePath, res.bytes)
-        const localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(attachment.attachmentId)
         const summary = buildDualOutputMarkdown({
           action: `upscaled (${args.scale || 2}x)`,
           filePath,
@@ -1425,17 +1401,12 @@ export function apply(ctx, config) {
         )
         const stem = `${slugify(args.output_name || 'blended')}-${Date.now().toString(36)}`
         const name = `${stem}.png`
-        const attachment = await ctx.attachments.saveImage({
-          data: new Uint8Array(res.bytes),
-          mediaType: 'image/png',
-          name,
-        })
+        const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes: res.bytes, mediaType: 'image/png', name })
         const sessionCwd = exec.agent?.session?.header?.cwd
         const outDir = path.resolve(sessionCwd || process.cwd(), cfg.outputDir || 'generated/images')
         await mkdir(outDir, { recursive: true })
         const filePath = path.join(outDir, name)
         await writeFile(filePath, res.bytes)
-        const localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(attachment.attachmentId)
         const summary = buildDualOutputMarkdown({
           action: 'blended composition',
           filePath,

package/lib/providers.js

@@ -461,6 +461,60 @@ export async function pixelDiff(a, b) {
   return { diffRatio: diff / a.length }
 }
 
+/** Извлечение детальных сообщений об ошибках нод ComfyUI из ответа /history/{pid}. */
+
+/** Безопасное сохранение вложения с fallback'ом при отсутствии ctx.attachments */
+export async function saveAttachmentSafe(ctx, { bytes, mediaType, name }) {
+  if (ctx && ctx.attachments && typeof ctx.attachments.saveImage === 'function') {
+    try {
+      const att = await ctx.attachments.saveImage({
+        data: new Uint8Array(bytes),
+        mediaType,
+        name,
+      })
+      if (att && att.attachmentId) {
+        const localUrl = '/dsh-image-gen/image?id=' + encodeURIComponent(att.attachmentId)
+          + '&mt=' + encodeURIComponent(att.mediaType || mediaType)
+          + '&b=' + encodeURIComponent(String(att.bytes || bytes.length))
+          + '&w=' + encodeURIComponent(String(att.width || 0))
+          + '&h=' + encodeURIComponent(String(att.height || 0))
+        return { attachment: att, localUrl }
+      }
+    } catch (err) {
+      // Fallback below if attachment service fails
+    }
+  }
+  return {
+    attachment: {
+      attachmentId: '',
+      mediaType,
+      bytes: bytes.length,
+      width: 0,
+      height: 0,
+      name,
+    },
+    localUrl: '',
+  }
+}
+
+export function extractComfyNodeErrors(entry) {
+  if (!entry || typeof entry !== 'object') return ''
+  const status = entry.status
+  if (status && status.status_str === 'error') {
+    const msgs = status.messages || []
+    const errList = []
+    for (const m of msgs) {
+      if (Array.isArray(m) && m[0] === 'execution_error') {
+        const d = m[1] || {}
+        errList.push(`node ${d.node_id || 'unknown'} (${d.node_type || ''}): ${d.exception_message || d.exception_type || 'execution failed'}`)
+      }
+    }
+    if (errList.length) return errList.join('; ')
+    return status.status_str || 'execution error'
+  }
+  return ''
+}
+
 export function makeProviders(deps, job) {
   const { fetchImpl, resolveKey, cfg } = deps
   const { prompt, size, format, seed, signal, negativePrompt, guidanceScale, source, mask, strength, quality, style, aspectPixels, aspectRatio } = job
@@ -553,7 +607,7 @@ export function makeProviders(deps, job) {
           throw new Error(`Custom image API has no provisioned channel for "${cfg.customModel}" (HTTP 503); check gateway channel and routing configuration`)
         }
       }
-      const detail = data?.error?.message || JSON.stringify(data).slice(0, 600)
+      const detail = formatErrorMessage(data?.error || data)
       throw new Error(`Image API failed (HTTP ${res.status}): ${detail}`)
     }
     const item = data?.data?.[0]
@@ -727,6 +781,12 @@ export function makeProviders(deps, job) {
       if (!hist.ok) continue
       const histData = await hist.json().catch(() => ({}))
       const entry = histData[pid]
+      if (entry) {
+        const comfyErr = extractComfyNodeErrors(entry)
+        if (comfyErr) {
+          throw new Error(`Local ComfyUI execution failed: ${comfyErr}`)
+        }
+      }
       if (entry && entry.outputs) {
         const outputs = entry.outputs
         const img = Object.values(outputs).flatMap((o) => o.images || []).find((i) => i && i.filename)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.10.15",
+  "version": "0.10.16",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",