@goodandready/dsh-image-gen 0.11.29 → 0.11.30

package/lib/frontend-assets.js

@@ -70,7 +70,7 @@ export function getContrastRatio(hex1, hex2) {
  * @returns {Promise<string[]>} Hex colors
  */
 export async function extractSampleColorsFromBuffer(buffer) {
-  if (!buffer || buffer.length < 8) {
+  if (!buffer || buffer.length === 0) {
     return ['#0f172a', '#3b82f6', '#10b981', '#f59e0b', '#ef4444', '#f8fafc']
   }
 
@@ -96,76 +96,79 @@ export async function extractSampleColorsFromBuffer(buffer) {
   }
 
   // Decode raster container to raw RGBA pixels via Sharp
+  let data, info
   try {
-    const { data, info } = await sharp(buffer)
+    const res = await sharp(buffer)
       .raw()
       .ensureAlpha()
       .toBuffer({ resolveWithObject: true })
+    data = res.data
+    info = res.info
+  } catch (err) {
+    throw new Error(`Failed to decode image buffer for color extraction: ${err.message}`)
+  }
 
-    const totalPixels = info.width * info.height
-    const step = Math.max(1, Math.floor(totalPixels / 2048))
-    const colorBuckets = new Map()
-
-    for (let i = 0; i < totalPixels; i += step) {
-      const off = i * 4
-      const r = data[off]
-      const g = data[off + 1]
-      const b = data[off + 2]
-      const a = data[off + 3]
-
-      // Ignore fully or mostly transparent pixels
-      if (a < 128) continue
-
-      // Quantize to 16-level RGB bins to cluster nearby nuances
-      const qr = Math.round(r / 16) * 16
-      const qg = Math.round(g / 16) * 16
-      const qb = Math.round(b / 16) * 16
-      const key = `${qr},${qg},${qb}`
-
-      let bucket = colorBuckets.get(key)
-      if (!bucket) {
-        bucket = { count: 0, rSum: 0, gSum: 0, bSum: 0 }
-        colorBuckets.set(key, bucket)
-      }
-      bucket.count++
-      bucket.rSum += r
-      bucket.gSum += g
-      bucket.bSum += b
+  const totalPixels = info.width * info.height
+  const step = Math.max(1, Math.floor(totalPixels / 2048))
+  const colorBuckets = new Map()
+
+  for (let i = 0; i < totalPixels; i += step) {
+    const off = i * 4
+    const r = data[off]
+    const g = data[off + 1]
+    const b = data[off + 2]
+    const a = data[off + 3]
+
+    // Ignore fully or mostly transparent pixels
+    if (a < 128) continue
+
+    // Quantize to 16-level RGB bins to cluster nearby nuances
+    const qr = Math.round(r / 16) * 16
+    const qg = Math.round(g / 16) * 16
+    const qb = Math.round(b / 16) * 16
+    const key = `${qr},${qg},${qb}`
+
+    let bucket = colorBuckets.get(key)
+    if (!bucket) {
+      bucket = { count: 0, rSum: 0, gSum: 0, bSum: 0 }
+      colorBuckets.set(key, bucket)
     }
+    bucket.count++
+    bucket.rSum += r
+    bucket.gSum += g
+    bucket.bSum += b
+  }
 
-    if (colorBuckets.size > 0) {
-      const sorted = Array.from(colorBuckets.values()).sort((a, b) => b.count - a.count)
-      const dominant = sorted.slice(0, 6).map((b) => {
-        return rgbToHex(b.rSum / b.count, b.gSum / b.count, b.bSum / b.count)
-      })
+  if (colorBuckets.size > 0) {
+    const sorted = Array.from(colorBuckets.values()).sort((a, b) => b.count - a.count)
+    const dominant = sorted.slice(0, 6).map((b) => {
+      return rgbToHex(b.rSum / b.count, b.gSum / b.count, b.bSum / b.count)
+    })
 
-      const result = [...dominant]
-      if (result.length < 5) {
-        const primaryRgb = hexToRgb(result[0])
-        const isNearBlack = primaryRgb.r === 0 && primaryRgb.g === 0 && primaryRgb.b === 0
-        if (isNearBlack) {
-          const darkShades = ['#1a1a1a', '#333333', '#4d4d4d', '#666666', '#808080']
-          for (const s of darkShades) {
-            if (result.length >= 6) break
-            if (!result.includes(s)) result.push(s)
-          }
-        } else {
-          const factors = [0.2, 0.4, 0.6, 0.8, 1.2, 1.4]
-          for (const factor of factors) {
-            if (result.length >= 6) break
-            const shade = rgbToHex(
-              Math.min(255, Math.round(primaryRgb.r * factor)),
-              Math.min(255, Math.round(primaryRgb.g * factor)),
-              Math.min(255, Math.round(primaryRgb.b * factor)),
-            )
-            if (!result.includes(shade)) result.push(shade)
-          }
+    const result = [...dominant]
+    if (result.length < 5) {
+      const primaryRgb = hexToRgb(result[0])
+      const isNearBlack = primaryRgb.r === 0 && primaryRgb.g === 0 && primaryRgb.b === 0
+      if (isNearBlack) {
+        const darkShades = ['#1a1a1a', '#333333', '#4d4d4d', '#666666', '#808080']
+        for (const s of darkShades) {
+          if (result.length >= 6) break
+          if (!result.includes(s)) result.push(s)
+        }
+      } else {
+        const factors = [0.2, 0.4, 0.6, 0.8, 1.2, 1.4]
+        for (const factor of factors) {
+          if (result.length >= 6) break
+          const shade = rgbToHex(
+            Math.min(255, Math.round(primaryRgb.r * factor)),
+            Math.min(255, Math.round(primaryRgb.g * factor)),
+            Math.min(255, Math.round(primaryRgb.b * factor)),
+          )
+          if (!result.includes(shade)) result.push(shade)
         }
       }
-      return result.slice(0, 6)
     }
-  } catch (_err) {
-    // If sharp cannot decode or buffer is non-image, fallback
+    return result.slice(0, 6)
   }
 
   return ['#0f172a', '#3b82f6', '#10b981', '#f59e0b', '#ef4444', '#f8fafc']
@@ -334,6 +337,28 @@ export function checkWcagContrast(colors, textHex = '#ffffff') {
   }
 }
 
+/**
+ * Decode common HTML numeric and named entities in SVG attribute values (#374)
+ * @param {string} str
+ * @returns {string}
+ */
+export function decodeHtmlEntities(str) {
+  if (!str || typeof str !== 'string') return ''
+  return str
+    .replace(/&#x([0-9a-fA-F]+);?/gi, (_, hex) => {
+      try { return String.fromCharCode(parseInt(hex, 16)) } catch (_e) { return '' }
+    })
+    .replace(/&#([0-9]+);?/g, (_, dec) => {
+      try { return String.fromCharCode(parseInt(dec, 10)) } catch (_e) { return '' }
+    })
+    .replace(/&colon;/gi, ':')
+    .replace(/&tab;/gi, '\t')
+    .replace(/&newline;/gi, '\n')
+    .replace(/&quot;/gi, '"')
+    .replace(/&apos;/gi, "'")
+    .replace(/&amp;/gi, '&')
+}
+
 /**
  * Issue #176: optimize_vector_svg
  * Cleans, sanitizes, and minifies SVG content, normalizes viewBox, and exports React TSX component.
@@ -360,14 +385,51 @@ export function optimizeSvgContent(svgString, options = {}) {
   cleaned = cleaned.replace(/<script[^>]*\/?>/gi, '')
   cleaned = cleaned.replace(/<foreignObject[\s\S]*?<\/foreignObject>/gi, '')
   cleaned = cleaned.replace(/<foreignObject[^>]*\/?>/gi, '')
-  cleaned = cleaned.replace(/<(?:iframe|embed|object|applet)[\s\S]*?<\/(?:iframe|embed|object|applet)>/gi, '')
-  cleaned = cleaned.replace(/<(?:iframe|embed|object|applet)[^>]*\/?>/gi, '')
-
-  // Strip event handler attributes (onload, onerror, onclick, etc.)
-  cleaned = cleaned.replace(/\s+on[a-z]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
+  cleaned = cleaned.replace(/<(?:iframe|embed|object|applet|handler|listener)[\s\S]*?<\/(?:iframe|embed|object|applet|handler|listener)>/gi, '')
+  cleaned = cleaned.replace(/<(?:iframe|embed|object|applet|handler|listener)[^>]*\/?>/gi, '')
+
+  // Security (#374): Strip dangerous SMIL animation elements (<animate>, <set>, etc.) targeting href/xlink:href/on* or containing script schemes
+  cleaned = cleaned.replace(/<(animate|set|animateTransform|animateMotion|discard)\b[^>]*>[\s\S]*?<\/\1>/gi, (block) => {
+    const norm = decodeHtmlEntities(block).replace(/[\s\x00-\x20]+/g, ' ').toLowerCase()
+    if (
+      /attributename\s*=\s*['"]?(?:href|xlink:href|src|action|formaction|on[a-z0-9_-]+)/.test(norm) ||
+      /(?:javascript|vbscript|data\s*:\s*text\/html)/.test(norm)
+    ) {
+      return ''
+    }
+    return block
+  })
+  cleaned = cleaned.replace(/<(?:animate|set|animateTransform|animateMotion|discard)\b[^>]*\/?>/gi, (tag) => {
+    const norm = decodeHtmlEntities(tag).replace(/[\s\x00-\x20]+/g, ' ').toLowerCase()
+    if (
+      /attributename\s*=\s*['"]?(?:href|xlink:href|src|action|formaction|on[a-z0-9_-]+)/.test(norm) ||
+      /(?:javascript|vbscript|data\s*:\s*text\/html)/.test(norm)
+    ) {
+      return ''
+    }
+    return tag
+  })
 
-  // Strip dangerous URI schemes (javascript:, data:text/html, vbscript:) in href/xlink:href/src/action
-  cleaned = cleaned.replace(/\s+(?:href|xlink:href|src|action)\s*=\s*(?:"\s*(?:javascript|data:text\/html|vbscript):[^"]*"|'\s*(?:javascript|data:text\/html|vbscript):[^']*')/gi, '')
+  // Strip event handler attributes (onload, onerror, onclick, etc., quoted or unquoted)
+  cleaned = cleaned.replace(/\s+on[a-z0-9_-]+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
+
+  // Security (#374): Strip dangerous URI schemes (javascript:, vbscript:, data:text/html, etc.) in href/xlink:href/src/action/formaction
+  // Handles HTML entity encoding (&#x73;), control chars, and unquoted attributes
+  cleaned = cleaned.replace(/\s+(?:href|xlink:href|src|action|formaction)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi, (match, q1, q2, unquoted) => {
+    const val = q1 !== undefined ? q1 : (q2 !== undefined ? q2 : unquoted)
+    const decoded = decodeHtmlEntities(val)
+    const normalized = decoded.replace(/[\x00-\x20\s]+/g, '').toLowerCase()
+    if (
+      normalized.startsWith('javascript:') ||
+      normalized.startsWith('vbscript:') ||
+      normalized.startsWith('data:text/html') ||
+      normalized.startsWith('data:text/javascript') ||
+      normalized.startsWith('data:image/svg+xml')
+    ) {
+      return ''
+    }
+    return match
+  })
 
   cleaned = cleaned.replace(/\s{2,}/g, ' ')
   cleaned = cleaned.replace(/>\s+</g, '><')

package/lib/generation-helpers.js

@@ -244,6 +244,7 @@ export async function saveGeneratedImageArtifact({
     model: cfg.model,
     size,
     format,
+    aspectRatio: args.aspect_ratio || cfg.defaultAspectRatio,
     seed: gen.seed,
     cacheHash,
     thumbnailUrl: localUrl,

package/lib/history.js

@@ -37,13 +37,38 @@ export function findCachedGeneration(entries, hash) {
   return entries.find((e) => e.cacheHash === hash)
 }
 
-export async function findCachedByPrompt(entries, prompt) {
-  return entries.find((e) => e.prompt === prompt)
+export async function findCachedByPrompt(entries, prompt, criteria = {}) {
+  if (!prompt || !Array.isArray(entries)) return undefined
+  return entries.find((e) => {
+    if (e.prompt !== prompt) return false
+    if (criteria.format) {
+      const entryFmt = (e.format || (e.mediaType || '').replace('image/', '')).toLowerCase().replace('jpeg', 'jpg')
+      const targetFmt = String(criteria.format).toLowerCase().replace('jpeg', 'jpg')
+      if (entryFmt && targetFmt && entryFmt !== targetFmt) return false
+    }
+    if (criteria.aspectRatio && e.aspectRatio && e.aspectRatio !== criteria.aspectRatio) return false
+    if (criteria.width && e.width && criteria.width !== e.width) return false
+    if (criteria.height && e.height && criteria.height !== e.height) return false
+    if (criteria.size && e.size && criteria.size !== criteria.size) return false
+    return true
+  })
 }
 
-export async function findCached(entries, seed, prompt) {
-  if (seed === undefined) return undefined
-  return entries.find((e) => e.seed === seed && e.prompt === prompt)
+export async function findCached(entries, seed, prompt, criteria = {}) {
+  if (seed === undefined || !Array.isArray(entries)) return undefined
+  return entries.find((e) => {
+    if (e.seed !== seed || e.prompt !== prompt) return false
+    if (criteria.format) {
+      const entryFmt = (e.format || (e.mediaType || '').replace('image/', '')).toLowerCase().replace('jpeg', 'jpg')
+      const targetFmt = String(criteria.format).toLowerCase().replace('jpeg', 'jpg')
+      if (entryFmt && targetFmt && entryFmt !== targetFmt) return false
+    }
+    if (criteria.aspectRatio && e.aspectRatio && e.aspectRatio !== criteria.aspectRatio) return false
+    if (criteria.width && e.width && criteria.width !== e.width) return false
+    if (criteria.height && e.height && criteria.height !== e.height) return false
+    if (criteria.size && e.size && criteria.size !== criteria.size) return false
+    return true
+  })
 }
 
 /** Return cached entry if file exists on disk, otherwise undefined. */
@@ -61,6 +86,7 @@ export async function cachedResult(entry) {
     cost: 0,
     format: (entry.mediaType || 'image/png').replace('image/', ''),
     cached: true,
+    fromCache: true,
     attachment: entry.attachmentId ? {
       attachmentId: entry.attachmentId,
       mediaType: entry.mediaType || 'image/png',

package/lib/live-progress.js

@@ -14,8 +14,10 @@ const activeSessions = new Map()
 export function createLiveProgressSession(callId, options = {}) {
   if (!callId) return null
   const existing = activeSessions.get(callId)
-  if (existing) {
-    existing.listeners.clear()
+  const listeners = existing?.listeners ? existing.listeners : new Set()
+
+  if (typeof options.onProgress === 'function') {
+    listeners.add(options.onProgress)
   }
 
   const session = {
@@ -27,7 +29,7 @@ export function createLiveProgressSession(callId, options = {}) {
     done: false,
     error: undefined,
     timestamp: Date.now(),
-    listeners: new Set(),
+    listeners,
   }
 
   if (options.signal) {

package/lib/loop-guard.js

@@ -41,15 +41,27 @@ export function trackAndAssertLoopGuard(sessionId, {
   const current = sessionStates.get(sid) || { count: 0, lastPrompt: '', lastTimestamp: 0, lastTurnId: null }
   const maxLimit = Math.max(1, Number(limit) || DEFAULT_MAX_CONSECUTIVE_GENERATIONS)
 
-  // Derive turn identifier from turnId or exec context
+  // Derive turn identifier from turnId or exec context (#370)
   const session = exec?.agent?.session
-  const derivedTurnId = turnId ??
-    exec?.turnId ??
-    exec?.agent?.turnId ??
-    exec?.message?.id ??
-    session?.lastMessageId ??
-    session?.turnId ??
-    (Array.isArray(session?.messages) ? session.messages.length : null)
+  let derivedTurnId = turnId ?? exec?.turnId ?? exec?.agent?.turnId
+
+  if (derivedTurnId === null || derivedTurnId === undefined) {
+    const rawMessages = typeof session?.deriveMessages === 'function'
+      ? session.deriveMessages()
+      : (Array.isArray(session?.messages) ? session.messages : null)
+
+    if (Array.isArray(rawMessages)) {
+      const userMessages = rawMessages.filter(m => m && (m.role === 'user' || m.type === 'user'))
+      if (userMessages.length > 0) {
+        const lastUser = userMessages[userMessages.length - 1]
+        derivedTurnId = lastUser.id ?? lastUser.turnId ?? `user_turn_${userMessages.length}`
+      }
+    }
+  }
+
+  if (derivedTurnId === null || derivedTurnId === undefined) {
+    derivedTurnId = session?.lastUserMessageId ?? session?.lastMessageId ?? session?.turnId ?? null
+  }
 
   // If turn identifier changed, reset count for the new user turn
   if (derivedTurnId !== null && derivedTurnId !== undefined) {

package/lib/providers/shared-helpers.js

@@ -90,9 +90,6 @@ export async function ensureImageFormat(bytes, targetFormat, { fallbackMime } =
     const verified = detectImageMediaType(transcoded) || targetMime
     return { bytes: transcoded, mediaType: verified }
   } catch (err) {
-    if (buf.length < 64) {
-      return { bytes: buf, mediaType: fallbackMime || targetMime || actualMime || 'image/png' }
-    }
     throw new Error(`Failed to encode image to ${canonical}: ${err.message}`)
   }
 }

package/lib/providers.js

@@ -536,19 +536,7 @@ export async function blendImageBuffers(images, weights) {
     const bytes = await sharp(out, { raw: { width: targetW, height: targetH, channels: 4 } }).png().toBuffer()
     return { bytes, width: targetW, height: targetH, mediaType: 'image/png', weights: normWeights }
   } catch (err) {
-    // Fallback for mock or synthetic test buffers that cannot be parsed by sharp
-    const maxLen = Math.max(...images.map(img => (img.bytes?.length || 0)))
-    const out = Buffer.alloc(maxLen)
-    for (let p = 0; p < maxLen; p++) {
-      let val = 0
-      for (let i = 0; i < images.length; i++) {
-        const b = images[i].bytes || Buffer.alloc(0)
-        const byteVal = p < b.length ? b[p] : 0
-        val += byteVal * normWeights[i]
-      }
-      out[p] = Math.round(Math.min(255, Math.max(0, val)))
-    }
-    return { bytes: out, width: 0, height: 0, mediaType: 'image/png', weights: normWeights }
+    throw new Error(`Failed to decode image buffer for blending: ${err.message}`)
   }
 }
 

package/lib/tools/editing.js

@@ -87,7 +87,8 @@ export function registerEditingTools(ctx, deps, options = {}) {
             if (cfg && cfg.enabled === false) {
               throw new Error('Image generation is disabled in settings (dsh-image-gen.enabled is false); enable it in Settings → Image generation.')
             }
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.prompt || '', exec })
             const estimatedCostEdit = calculateGenerationCost({
               provider: cfg.provider || 'fal',
               model: cfg.model,
@@ -242,7 +243,8 @@ export function registerEditingTools(ctx, deps, options = {}) {
             if (cfg && cfg.enabled === false) {
               throw new Error('Image generation is disabled in settings (dsh-image-gen.enabled is false); enable it in Settings → Image generation.')
             }
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.prompt || '', exec })
             const count = normalizeCount(args.count || 1)
             const estimatedCostVary = calculateGenerationCost({
               provider: cfg.provider || 'fal',
@@ -383,7 +385,8 @@ export function registerEditingTools(ctx, deps, options = {}) {
             if (cfg && cfg.enabled === false) {
               throw new Error('Image generation is disabled in settings (dsh-image-gen.enabled is false); enable it in Settings → Image generation.')
             }
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.prompt || '', exec })
             const count = normalizeCount(args.count || 1)
             const estimatedCost = calculateGenerationCost({
               provider: cfg.provider || 'fal',

package/lib/tools/generation.js

@@ -500,12 +500,17 @@ export function registerGenerationTools(ctx, deps, options = {}) {
           const hPrompt = h
           const found = findCachedGeneration(historyEntries, hPrompt)
           if (found) return await cachedResult(found)
+          const requestedCriteria = {
+            format: args.output_format || cfg.defaultFormat || 'png',
+            aspectRatio: args.aspect_ratio || cfg.defaultAspectRatio,
+            size: args.aspect_ratio ? 'custom' : (args.image_size || cfg.defaultSize),
+          }
           if (cfg.cacheBySeed) {
-            const bySeed = await findCached(historyEntries, seedVal, promptVal)
+            const bySeed = await findCached(historyEntries, seedVal, promptVal, requestedCriteria)
             if (bySeed) return await cachedResult(bySeed)
           }
           if (cfg.cacheByPrompt) {
-            const byPrompt = await findCachedByPrompt(historyEntries, promptVal)
+            const byPrompt = await findCachedByPrompt(historyEntries, promptVal, requestedCriteria)
             if (byPrompt) return await cachedResult(byPrompt)
           }
           return undefined

package/lib/tools/pattern.js

@@ -67,7 +67,8 @@ export function registerPatternTools(ctx, deps) {
         async execute(args, exec) {
           try {
             const cfg = live()
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.motif || '', exec })
             const density = normalizeDensity(args.density)
             const prompt = buildSeamlessPrompt(args.motif, args.style, density)
             const provider = cfg.provider || 'fal'

package/lib/tools/processing-basic.js

@@ -252,7 +252,8 @@ export function registerProcessingTools(ctx, deps) {
         async execute(args, exec) {
           try {
             const cfg = live()
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.prompt || '', exec })
             assertBudgetAvailable(0.05, cfg.dailyBudgetUsd)
             const refs = Array.isArray(args.images) ? args.images : [args.images].filter(Boolean)
           if (refs.length < 2) {

package/lib/tools/responsive.js

@@ -101,7 +101,8 @@ export function registerResponsiveTools(ctx, deps) {
         async execute(args, exec) {
           try {
             const cfg = live()
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.prompt || '', exec })
             if (!args.prompt || !String(args.prompt).trim()) {
               throw new Error('prompt is required for generate_responsive_mockups')
             }

package/lib/tools/sketch.js

@@ -87,7 +87,8 @@ export function registerSketchTools(ctx, deps) {
         async execute(args, exec) {
           try {
             const cfg = live()
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.prompt || '', exec })
             const estimated = calculateGenerationCost({
               provider: cfg.provider || 'fal',
               model: cfg.model,

package/lib/tools/spritesheet.js

@@ -74,7 +74,8 @@ export function registerSpritesheetTools(ctx, deps) {
         async execute(args, exec) {
           try {
             const cfg = live()
-            trackAndAssertLoopGuard(exec?.agent?.session?.id || 'default', { limit: cfg.loopGuardLimit })
+            const sessionId = exec?.agent?.session?.id || exec?.agent?.session?.header?.id || 'session'
+            trackAndAssertLoopGuard(sessionId, { limit: cfg.loopGuardLimit, prompt: args.prompt || '', exec })
             const animation = String(args.animation || 'idle').toLowerCase()
             const animKey = ANIMATION_PRESETS[animation] ? animation : 'idle'
             const frameCount = clampFrames(args.frames, animKey)

package/lib/tools/vision-ocr.js

@@ -150,8 +150,18 @@ export function registerVisionOcrTools(ctx, deps) {
             throw new Error(`Unable to resolve source image for text replacement: ${args.image}`)
           }
 
-          const imgWidth = source.width || 1024
-          const imgHeight = source.height || 1024
+          let imgWidth = 1024
+          let imgHeight = 1024
+          try {
+            const sharpMod = await import('sharp')
+            const sharp = sharpMod.default || sharpMod
+            const meta = await sharp(source.bytes).metadata()
+            imgWidth = meta.width || source.width || 1024
+            imgHeight = meta.height || source.height || 1024
+          } catch (_err) {
+            imgWidth = source.width || 1024
+            imgHeight = source.height || 1024
+          }
 
           // 1. Gather text items and bounding boxes
           const replacements = Array.isArray(args.replacements) ? args.replacements : []
@@ -162,13 +172,14 @@ export function registerVisionOcrTools(ctx, deps) {
             let bbox = item.bbox
             if (!bbox && item.find && ctx.tools?.get) {
               const groundTool = ctx.tools.get('vision_ground')
-              if (groundTool && typeof groundTool.execute === 'function' && source.ref) {
+              if (groundTool && typeof groundTool.execute === 'function') {
                 try {
                   const gRes = await groundTool.execute({
-                    attachmentId: source.ref.startsWith('sha256:') ? source.ref : undefined,
+                    image: args.image,
+                    attachmentId: source.ref?.startsWith('sha256:') ? source.ref : (args.image?.startsWith('sha256:') ? args.image : undefined),
                     target: `text "${item.find}"`,
                   }, execCtx)
-                  if (gRes?.bbox && gRes.bbox.length === 4) {
+                  if (gRes?.bbox && Array.isArray(gRes.bbox) && gRes.bbox.length === 4) {
                     bbox = gRes.bbox
                   }
                 } catch (_err) {
@@ -258,13 +269,23 @@ export function registerVisionOcrTools(ctx, deps) {
 
           // 5. Composite typography overlay on inpainted background
           let finalBytes = inpaintedBytes
+          let composited = false
           try {
             const sharpMod = await import('sharp')
             const sharp = sharpMod.default || sharpMod
+            const inpaintMeta = await sharp(inpaintedBytes).metadata()
+            const compW = inpaintMeta.width || imgWidth
+            const compH = inpaintMeta.height || imgHeight
+            let compOverlay = overlayBuffer
+            if (compW !== imgWidth || compH !== imgHeight) {
+              const scaledOverlaySvg = buildTextOverlaySvg(compW, compH, overlayItems, args.font_family || 'sans-serif')
+              compOverlay = Buffer.from(scaledOverlaySvg, 'utf8')
+            }
             finalBytes = await sharp(inpaintedBytes)
-              .composite([{ input: overlayBuffer, top: 0, left: 0 }])
+              .composite([{ input: compOverlay, top: 0, left: 0 }])
               .png()
               .toBuffer()
+            composited = true
           } catch (sharpErr) {
             if (ctx.logger?.warn) ctx.logger.warn(`Sharp compositing skipped: ${sharpErr.message}`)
           }
@@ -322,7 +343,7 @@ export function registerVisionOcrTools(ctx, deps) {
 
           const response = {
             summary: dualOutput,
-            replacedCount: overlayItems.length,
+            replacedCount: composited ? overlayItems.length : 0,
             bboxes,
             inpaintPrompt,
             targetLanguage: args.target_language || '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.11.29",
+  "version": "0.11.30",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",