@goodandready/dsh-image-gen 0.11.33 → 0.11.35

package/lib/attachment-helper.js

@@ -1,6 +1,7 @@
 import path from 'node:path'
 import { mkdir, writeFile } from 'node:fs/promises'
 import { saveAttachmentSafe, buildSidecar, toLosslessJson, ensureImageFormat } from './providers.js'
+import { resolveInside } from './security.js'
 import { recordSpend } from './cost-meter.js'
 import { buildDualOutputMarkdown } from './resolve-image.js'
 
@@ -29,7 +30,7 @@ export async function saveAndAttachResult(ctx, exec, cfg, {
 
   const sessionCwd = exec?.agent?.session?.header?.cwd
   const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-  const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+  const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
   await mkdir(outDir, { recursive: true })
   const filePath = path.join(outDir, name)
   await writeFile(filePath, bytes)

package/lib/config-schema.js

@@ -1,7 +1,7 @@
 // lib/config-schema.js — Zod configuration schema and normalization helpers (#317)
 
 import z from '@deepseek-ai/schemastery'
-import { IMAGE_SIZES, OUTPUT_FORMATS, PROVIDER_KEYS } from './providers.js'
+import { IMAGE_SIZES, OUTPUT_FORMATS, PROVIDER_KEYS } from './provider-utils.js'
 
 // Polyfill for .volatile() schema annotation if runtime schemastery lacks it (#295)
 if (typeof z.prototype?.volatile !== 'function') {
@@ -343,15 +343,25 @@ export function isVolatileRef(value) {
   return !!value && typeof value === 'object' && !Array.isArray(value) && typeof value.get === 'function'
 }
 
-export function plainConfig(cfg) {
-  if (isVolatileRef(cfg)) return plainConfig(cfg.get())
-  if (!cfg || typeof cfg !== 'object') return cfg
-  const out = {}
-  for (const key of Object.keys(cfg)) {
-    const value = cfg[key]
-    out[key] = isVolatileRef(value) ? value.get() : value
+/**
+ * Deeply unwrap Cosmokit/Schemastery Volatile boxes into plain primitives/objects/arrays (#282, #417).
+ */
+export function plainConfig(value) {
+  if (value === null || value === undefined) return value
+  if (typeof value === 'function') return plainConfig(value())
+  if (isVolatileRef(value)) return plainConfig(value.get())
+  if (Array.isArray(value)) return value.map(plainConfig)
+  if (typeof value === 'object') {
+    if (Buffer.isBuffer(value) || value instanceof Date || value instanceof RegExp || value instanceof URL) {
+      return value
+    }
+    const out = {}
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = plainConfig(v)
+    }
+    return out
   }
-  return out
+  return value
 }
 
 export function volatileConfig(cfg) {

package/lib/frontend-assets.js

@@ -1,3 +1,4 @@
+import { resolveInside } from './security.js'
 import sharp from 'sharp'
 // @ts-check
 import path from 'node:path'
@@ -712,20 +713,20 @@ export async function generatePwaIconSuite({
   // 6. Write files to outDir if provided
   const exportedFiles = []
   if (outDir) {
-    const fullIconsDir = path.resolve(outDir, iconsDir)
+    const fullIconsDir = resolveInside(outDir, iconsDir || 'icons')
     await fs.mkdir(fullIconsDir, { recursive: true })
 
     for (const item of generatedIcons) {
-      const filePath = path.resolve(outDir, item.filename)
+      const filePath = resolveInside(outDir, item.filename)
       await fs.writeFile(filePath, item.bytes)
       exportedFiles.push(filePath)
     }
 
-    const icoPath = path.resolve(outDir, faviconIcoFilename)
+    const icoPath = resolveInside(outDir, faviconIcoFilename)
     await fs.writeFile(icoPath, faviconIcoBuffer)
     exportedFiles.push(icoPath)
 
-    const manifestPath = path.resolve(outDir, 'manifest.json')
+    const manifestPath = resolveInside(outDir, 'manifest.json')
     await fs.writeFile(manifestPath, manifestJson)
     exportedFiles.push(manifestPath)
   }

package/lib/generation-helpers.js

@@ -20,6 +20,7 @@ import { enhancePrompt } from './prompt-enhancer.js'
 import { buildFaceConsistencyPrompt, getSessionAnchor, applyAnchorPromptHints } from './anchor-helpers.js'
 import { sanitizeNegativePrompt, supportsNegativePrompt } from './negative-sanitizer.js'
 import { recordSpend } from './cost-meter.js'
+import { resolveInside } from './security.js'
 import { setCachedGeneration } from './generation-cache.js'
 import {
   readHistory,
@@ -183,7 +184,7 @@ export async function saveGeneratedImageArtifact({
 
   const sessionCwd = exec?.agent?.session?.header?.cwd
   const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-  const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+  const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
   await mkdir(outDir, { recursive: true })
   const filePath = path.join(outDir, name)
   await writeFile(filePath, bytes)

package/lib/index.js

@@ -367,13 +367,14 @@ export function apply(ctx, rawConfig) {
       try {
         const u = new URL(req.url, 'http://localhost')
         const qProvider = u.searchParams.get('provider')
+        const effectiveCfg = live()
         const provider = (typeof qProvider === 'string' && qProvider.trim())
-          || (typeof config?.provider === 'string' && config.provider.trim())
+          || (typeof effectiveCfg?.provider === 'string' && effectiveCfg.provider.trim())
           || 'fal'
         const deps = {
           fetchImpl: fetch,
           resolveKey: (ref) => resolveApiKey(ctx, ref),
-          cfg: (typeof getConfig === 'function') ? getConfig() : config,
+          cfg: effectiveCfg,
           ctx,
         }
         const result = await testProviderConnection(deps, provider)

package/lib/providers.js

@@ -1,4 +1,5 @@
 import sharp from 'sharp'
+import { plainConfig } from './config-schema.js'
 import { CURATED_STYLES, normalizeStyleKey } from './prompt-polisher.js'
 /**
  * Returns candidate API key names considering known aliases (e.g. FAL_API_KEY <-> FAL_KEY).
@@ -221,16 +222,17 @@ export async function saveAttachmentSafe(ctx, { bytes, mediaType, name }) {
 
 
 export function makeProviders(deps, job) {
-  const subscription = createSubscriptionGenerator(deps, job)
+  const safeDeps = deps?.cfg ? { ...deps, cfg: plainConfig(deps.cfg) } : deps
+  const subscription = createSubscriptionGenerator(safeDeps, job)
   return {
-    fal: createFalGenerator(deps, job),
-    custom: createCustomGenerator(deps, job),
+    fal: createFalGenerator(safeDeps, job),
+    custom: createCustomGenerator(safeDeps, job),
     codex: subscription('codex'),
     grok: subscription('grok'),
-    local: createLocalGenerator(deps, job),
-    seedream: createSeedreamGenerator(deps, job),
-    gemini: createGeminiGenerator(deps, job),
-    replicate: createReplicateGenerator(deps, job),
+    local: createLocalGenerator(safeDeps, job),
+    seedream: createSeedreamGenerator(safeDeps, job),
+    gemini: createGeminiGenerator(safeDeps, job),
+    replicate: createReplicateGenerator(safeDeps, job),
   }
 }
 
@@ -279,7 +281,8 @@ export function embedPngMetadata(pngBytes, metadata = {}) {
   return Buffer.concat([buf.subarray(0, insertPos), chunk, buf.subarray(insertPos)])
 }
 
-export async function removeBackgroundFal({ fetchImpl, resolveKey, cfg }, { imageBytes, mediaType = 'image/png', model = 'fal-ai/birefnet', signal }) {
+export async function removeBackgroundFal({ fetchImpl, resolveKey, cfg: rawCfg }, { imageBytes, mediaType = 'image/png', model = 'fal-ai/birefnet', signal }) {
+  const cfg = plainConfig(rawCfg)
   const key = await resolveKey(cfg.apiKeyEnv)
   const base64 = Buffer.isBuffer(imageBytes) ? imageBytes.toString('base64') : Buffer.from(imageBytes).toString('base64')
   const dataUrl = `data:${mediaType};base64,${base64}`
@@ -297,7 +300,8 @@ export async function removeBackgroundFal({ fetchImpl, resolveKey, cfg }, { imag
   return { bytes, mediaType: 'image/png', width: img.width || 0, height: img.height || 0, sourceUrl: img.url }
 }
 
-export async function upscaleImageFal({ fetchImpl, resolveKey, cfg }, { imageBytes, mediaType = 'image/png', scale = 2, creativity, prompt, model = 'fal-ai/clarity-upscaler', signal }) {
+export async function upscaleImageFal({ fetchImpl, resolveKey, cfg: rawCfg }, { imageBytes, mediaType = 'image/png', scale = 2, creativity, prompt, model = 'fal-ai/clarity-upscaler', signal }) {
+  const cfg = plainConfig(rawCfg)
   const key = await resolveKey(cfg.apiKeyEnv)
   const base64 = Buffer.isBuffer(imageBytes) ? imageBytes.toString('base64') : Buffer.from(imageBytes).toString('base64')
   const dataUrl = `data:${mediaType};base64,${base64}`
@@ -579,8 +583,9 @@ export async function blendImagesFal({ fetchImpl, resolveKey, cfg }, { images, w
 /** Direct image editing (inpainting / img2img) via selected provider. */
 /** @internal — direct provider call path for integration tests */
 export async function editImageDirect(deps, job) {
-  const providers = makeProviders(deps, job)
-  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof deps?.cfg?.provider === 'string' && deps.cfg.provider.trim()) || (typeof deps?.cfg?.defaultProvider === 'string' && deps.cfg.defaultProvider.trim()) || 'fal'
+  const safeDeps = deps?.cfg ? { ...deps, cfg: plainConfig(deps.cfg) } : deps
+  const providers = makeProviders(safeDeps, job)
+  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof safeDeps?.cfg?.provider === 'string' && safeDeps.cfg.provider.trim()) || (typeof safeDeps?.cfg?.defaultProvider === 'string' && safeDeps.cfg.defaultProvider.trim()) || 'fal'
   const fn = providers[providerKey] || providers.fal || providers.custom
   if (!fn) throw new Error(`Provider "${providerKey}" does not support image editing`)
   return fn(job.seed, job.prompt)
@@ -589,11 +594,12 @@ export async function editImageDirect(deps, job) {
 /** Direct image variation via selected provider. */
 /** @internal — direct provider call path for integration tests */
 export async function varyImageDirect(deps, job) {
-  const providers = makeProviders(deps, {
+  const safeDeps = deps?.cfg ? { ...deps, cfg: plainConfig(deps.cfg) } : deps
+  const providers = makeProviders(safeDeps, {
     ...job,
     strength: job.variationStrength ?? job.strength ?? 0.35,
   })
-  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof deps?.cfg?.provider === 'string' && deps.cfg.provider.trim()) || (typeof deps?.cfg?.defaultProvider === 'string' && deps.cfg.defaultProvider.trim()) || 'fal'
+  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof safeDeps?.cfg?.provider === 'string' && safeDeps.cfg.provider.trim()) || (typeof safeDeps?.cfg?.defaultProvider === 'string' && safeDeps.cfg.defaultProvider.trim()) || 'fal'
   const fn = providers[providerKey] || providers.fal || providers.custom
   if (!fn) throw new Error(`Provider "${providerKey}" does not support image variations`)
   return fn(job.seed, job.prompt)
@@ -628,7 +634,8 @@ export function toLosslessJson(val) {
  * Returns { ok: boolean, latencyMs: number, message: string }.
  */
 export async function testProviderConnection(deps, providerId) {
-  const { fetchImpl = fetch, resolveKey, cfg } = deps || {}
+  const { fetchImpl = fetch, resolveKey } = deps || {}
+  const cfg = plainConfig(deps?.cfg)
   const start = Date.now()
   const rawProvider = (typeof providerId === 'string' && providerId.trim())
     || (typeof cfg?.provider === 'string' && cfg.provider.trim())

package/lib/security.js

@@ -1,8 +1,5 @@
-// lib/security.js
-// Secure credential handling, 0600 file permissions, and token masking (#169)
-// Address validation and trusted request guards against DNS rebinding & cross-site leaks (Refs: GitHub #1, #280, #276, #277)
-
-import { chmodSync, existsSync } from 'node:fs'
+import path from 'node:path'
+import { chmodSync, existsSync, realpathSync } from 'node:fs'
 
 /**
  * Masks sensitive API keys, leaving only the prefix/suffix.
@@ -233,4 +230,67 @@ export function isTrustedLocalRequest(req) {
   }
 
   return true
-}
+}
+
+/**
+ * Resolves candidatePath strictly inside baseDir.
+ * If candidatePath is absolute or contains '..', it must resolve inside baseDir.
+ * Both lexical containment check and realpath check (for baseDir and existing targets/ancestors)
+ * are performed to prevent symlink and lexical directory traversal attacks (#409, #410, #411, #412, #420).
+ *
+ * @param {string} baseDir Base directory (e.g. sessionCwd or workspace root)
+ * @param {string} candidatePath Relative or sub-path to resolve
+ * @returns {string} Absolute resolved path guaranteed to be contained within baseDir
+ * @throws {Error} if candidatePath escapes baseDir
+ */
+export function resolveInside(baseDir, candidatePath) {
+  const root = path.resolve(baseDir || '.')
+  const sub = candidatePath ? String(candidatePath).trim() : '.'
+  const resolved = path.resolve(root, sub)
+  const rel = path.relative(root, resolved)
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`Path traversal denied: "${candidatePath}" escapes base directory "${root}"`)
+  }
+
+  let realRoot = root
+  try {
+    realRoot = realpathSync(root)
+  } catch (_err) {
+    // If baseDir does not exist yet on disk, lexical containment check above is sufficient
+    return resolved
+  }
+
+  try {
+    const realTarget = realpathSync(resolved)
+    const relReal = path.relative(realRoot, realTarget)
+    if (relReal.startsWith('..') || path.isAbsolute(relReal)) {
+      throw new Error(`Path traversal denied: "${candidatePath}" resolves via symlink outside "${realRoot}"`)
+    }
+  } catch (err) {
+    if (err?.code === 'ENOENT') {
+      let curr = path.dirname(resolved)
+      while (curr === root || curr.startsWith(root + path.sep)) {
+        try {
+          const realCurr = realpathSync(curr)
+          const relCurr = path.relative(realRoot, realCurr)
+          if (relCurr.startsWith('..') || path.isAbsolute(relCurr)) {
+            throw new Error(`Path traversal denied: ancestor in "${candidatePath}" resolves via symlink outside "${realRoot}"`)
+          }
+          break
+        } catch (ancestorErr) {
+          if (ancestorErr?.code === 'ENOENT') {
+            const parent = path.dirname(curr)
+            if (parent === curr) break
+            curr = parent
+            continue
+          }
+          throw ancestorErr
+        }
+      }
+    } else {
+      throw err
+    }
+  }
+
+  return resolved
+}

package/lib/tools/frontend.js

@@ -4,7 +4,7 @@ import { renderToolOutput } from "../attachment-helper.js"
 import path from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { toLosslessJson } from '../providers.js'
-import { sanitizeErrorAndLogs } from '../security.js'
+import { sanitizeErrorAndLogs, resolveInside } from '../security.js'
 import {
   extractDesignTokens,
   generateCssGradient,
@@ -219,7 +219,7 @@ export function registerFrontendTools(ctx, deps) {
               }
             }
             const sessionCwd = exec?.agent?.session?.header?.cwd || process.cwd()
-            const outDir = path.resolve(sessionCwd, args.out_dir || '.')
+            const outDir = resolveInside(sessionCwd, args.out_dir || args.output_dir || '.')
 
             const res = await generatePwaIconSuite({
               name: args.name || 'App',

package/lib/tools/generation.js

@@ -1,4 +1,5 @@
 import { buildPresentationMeta } from '../attachment-helper.js'
+import { resolveInside } from '../security.js'
 import { registerGenerationPackTool } from './generation-pack.js'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import path from 'node:path'
@@ -496,7 +497,7 @@ export function registerGenerationTools(ctx, deps, options = {}) {
               const { attachment, localUrl } = await saveAttachmentSafe(ctx, { bytes: diskHit.bytes, mediaType: diskHit.mediaType, name })
               const sessionCwd = exec?.agent?.session?.header?.cwd
               const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-              const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+              const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
               await mkdir(outDir, { recursive: true })
               const filePath = path.join(outDir, name)
               await writeFile(filePath, diskHit.bytes)

package/lib/tools/processing-advanced.js

@@ -10,7 +10,7 @@ import {
   toLosslessJson,
   saveAttachmentSafe,
 } from '../providers.js'
-import { sanitizeErrorAndLogs } from '../security.js'
+import { sanitizeErrorAndLogs, resolveInside } from '../security.js'
 import { resolveConversationImage } from '../resolve-image.js'
 
 export function registerProcessingAdvancedTools(ctx, deps) {
@@ -408,7 +408,7 @@ export function registerProcessingAdvancedTools(ctx, deps) {
         async execute(args, exec) {
           try {
             const sessionCwd = exec?.agent?.session?.header?.cwd || process.cwd()
-            const targetDir = path.resolve(sessionCwd, args.output_dir || './assets/branding')
+            const targetDir = resolveInside(sessionCwd, args.output_dir || './assets/branding')
             await mkdir(targetDir, { recursive: true })
 
             const projectName = args.project_name || 'Project Brand'

package/lib/tools/responsive.js

@@ -13,7 +13,7 @@ import {
   PROVIDER_KEYS,
 } from '../providers.js'
 import { trackAndAssertLoopGuard } from '../loop-guard.js'
-import { sanitizeErrorAndLogs } from '../security.js'
+import { sanitizeErrorAndLogs, resolveInside } from '../security.js'
 import { buildDualOutputMarkdown } from '../resolve-image.js'
 import {
   buildResponsivePrompt,
@@ -119,7 +119,7 @@ export function registerResponsiveTools(ctx, deps) {
             const paletteColors = Array.isArray(args.palette_colors) ? args.palette_colors : undefined
             const sessionCwd = exec?.agent?.session?.header?.cwd
             const targetDir = (args.output_dir && String(args.output_dir).trim()) || cfg.outputDir || 'generated/images'
-            const outDir = path.resolve(sessionCwd || process.cwd(), targetDir)
+            const outDir = resolveInside(sessionCwd || process.cwd(), targetDir)
             await mkdir(outDir, { recursive: true })
 
             const pdeps = {

package/lib/vault.js

@@ -1,3 +1,5 @@
+import path from 'node:path'
+import os from 'node:os'
 import { existsSync, unlinkSync } from 'node:fs'
 import { readHistory, writeHistory, withHistoryLock } from './history.js'
 import { isTrustedLocalRequest } from './security.js'
@@ -131,7 +133,26 @@ export async function readBoundedRequestBody(req, maxBytes = MAX_VAULT_BODY_BYTE
   return Buffer.concat(chunks)
 }
 
-export async function deleteVaultEntry(id) {
+
+export function isPathContainedInRoots(targetPath, allowedRoots = []) {
+  if (!targetPath || typeof targetPath !== 'string') return false
+  const resolvedTarget = path.resolve(targetPath)
+  for (const root of allowedRoots) {
+    if (!root) continue
+    try {
+      const resolvedRoot = path.resolve(root)
+      const rel = path.relative(resolvedRoot, resolvedTarget)
+      if (!rel.startsWith('..') && !path.isAbsolute(rel)) {
+        return true
+      }
+    } catch (_err) {
+      /* ignore invalid root */
+    }
+  }
+  return false
+}
+
+export async function deleteVaultEntry(id, options = {}) {
   if (!id) return { success: false, error: 'Missing entry id' }
   return await withHistoryLock(async () => {
     const entries = await readHistory()
@@ -140,8 +161,17 @@ export async function deleteVaultEntry(id) {
       return { success: false, error: 'Vault entry not found' }
     }
 
+    const allowedRoots = options.allowedRoots || [
+      process.env.DSH_HOME || path.join(os.homedir(), '.dsh'),
+      process.cwd(),
+      os.tmpdir(),
+    ]
     const [entry] = entries.splice(idx, 1)
     if (entry && entry.path) {
+      if (!isPathContainedInRoots(entry.path, allowedRoots)) {
+        await writeHistory(entries)
+        return { success: false, id, error: `Refusing to delete file outside allowed roots: ${entry.path}` }
+      }
       try {
         unlinkSync(entry.path)
       } catch (_err) { /* ignore missing file */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.11.33",
+  "version": "0.11.35",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",