@goodandready/dsh-image-gen 0.11.34 → 0.11.36

package/lib/config-schema.js

@@ -1,7 +1,7 @@
 // lib/config-schema.js — Zod configuration schema and normalization helpers (#317)
 
 import z from '@deepseek-ai/schemastery'
-import { IMAGE_SIZES, OUTPUT_FORMATS, PROVIDER_KEYS } from './providers.js'
+import { IMAGE_SIZES, OUTPUT_FORMATS, PROVIDER_KEYS } from './provider-utils.js'
 
 // Polyfill for .volatile() schema annotation if runtime schemastery lacks it (#295)
 if (typeof z.prototype?.volatile !== 'function') {
@@ -343,15 +343,25 @@ export function isVolatileRef(value) {
   return !!value && typeof value === 'object' && !Array.isArray(value) && typeof value.get === 'function'
 }
 
-export function plainConfig(cfg) {
-  if (isVolatileRef(cfg)) return plainConfig(cfg.get())
-  if (!cfg || typeof cfg !== 'object') return cfg
-  const out = {}
-  for (const key of Object.keys(cfg)) {
-    const value = cfg[key]
-    out[key] = isVolatileRef(value) ? value.get() : value
+/**
+ * Deeply unwrap Cosmokit/Schemastery Volatile boxes into plain primitives/objects/arrays (#282, #417).
+ */
+export function plainConfig(value) {
+  if (value === null || value === undefined) return value
+  if (typeof value === 'function') return plainConfig(value())
+  if (isVolatileRef(value)) return plainConfig(value.get())
+  if (Array.isArray(value)) return value.map(plainConfig)
+  if (typeof value === 'object') {
+    if (Buffer.isBuffer(value) || value instanceof Date || value instanceof RegExp || value instanceof URL) {
+      return value
+    }
+    const out = {}
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = plainConfig(v)
+    }
+    return out
   }
-  return out
+  return value
 }
 
 export function volatileConfig(cfg) {

package/lib/frontend-assets.js

@@ -1,4 +1,4 @@
-import { resolveInside } from './security.js'
+import { resolveInside, escapeXml, sanitizeSvgColor } from './security.js'
 import sharp from 'sharp'
 // @ts-check
 import path from 'node:path'
@@ -593,9 +593,11 @@ export function buildIcoBuffer(pngFrames) {
 
 async function getDefaultIconBytes(name, themeColor) {
   const initial = (name || 'A').trim().charAt(0).toUpperCase() || 'A'
+  const escapedInitial = escapeXml(initial)
+  const safeThemeColor = sanitizeSvgColor(themeColor || '#0f172a', '#0f172a')
   const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512">
-    <rect width="512" height="512" rx="100" fill="${themeColor || '#0f172a'}"/>
-    <text x="50%" y="54%" font-family="system-ui, -apple-system, sans-serif" font-size="280" font-weight="bold" fill="#ffffff" dominant-baseline="middle" text-anchor="middle">${initial}</text>
+    <rect width="512" height="512" rx="100" fill="${safeThemeColor}"/>
+    <text x="50%" y="54%" font-family="system-ui, -apple-system, sans-serif" font-size="280" font-weight="bold" fill="#ffffff" dominant-baseline="middle" text-anchor="middle">${escapedInitial}</text>
   </svg>`
   return sharp(Buffer.from(svg)).png().toBuffer()
 }

package/lib/index.js

@@ -367,13 +367,14 @@ export function apply(ctx, rawConfig) {
       try {
         const u = new URL(req.url, 'http://localhost')
         const qProvider = u.searchParams.get('provider')
+        const effectiveCfg = live()
         const provider = (typeof qProvider === 'string' && qProvider.trim())
-          || (typeof config?.provider === 'string' && config.provider.trim())
+          || (typeof effectiveCfg?.provider === 'string' && effectiveCfg.provider.trim())
           || 'fal'
         const deps = {
           fetchImpl: fetch,
           resolveKey: (ref) => resolveApiKey(ctx, ref),
-          cfg: (typeof getConfig === 'function') ? getConfig() : config,
+          cfg: effectiveCfg,
           ctx,
         }
         const result = await testProviderConnection(deps, provider)

package/lib/providers.js

@@ -1,4 +1,5 @@
 import sharp from 'sharp'
+import { plainConfig } from './config-schema.js'
 import { CURATED_STYLES, normalizeStyleKey } from './prompt-polisher.js'
 /**
  * Returns candidate API key names considering known aliases (e.g. FAL_API_KEY <-> FAL_KEY).
@@ -221,16 +222,17 @@ export async function saveAttachmentSafe(ctx, { bytes, mediaType, name }) {
 
 
 export function makeProviders(deps, job) {
-  const subscription = createSubscriptionGenerator(deps, job)
+  const safeDeps = deps?.cfg ? { ...deps, cfg: plainConfig(deps.cfg) } : deps
+  const subscription = createSubscriptionGenerator(safeDeps, job)
   return {
-    fal: createFalGenerator(deps, job),
-    custom: createCustomGenerator(deps, job),
+    fal: createFalGenerator(safeDeps, job),
+    custom: createCustomGenerator(safeDeps, job),
     codex: subscription('codex'),
     grok: subscription('grok'),
-    local: createLocalGenerator(deps, job),
-    seedream: createSeedreamGenerator(deps, job),
-    gemini: createGeminiGenerator(deps, job),
-    replicate: createReplicateGenerator(deps, job),
+    local: createLocalGenerator(safeDeps, job),
+    seedream: createSeedreamGenerator(safeDeps, job),
+    gemini: createGeminiGenerator(safeDeps, job),
+    replicate: createReplicateGenerator(safeDeps, job),
   }
 }
 
@@ -279,7 +281,8 @@ export function embedPngMetadata(pngBytes, metadata = {}) {
   return Buffer.concat([buf.subarray(0, insertPos), chunk, buf.subarray(insertPos)])
 }
 
-export async function removeBackgroundFal({ fetchImpl, resolveKey, cfg }, { imageBytes, mediaType = 'image/png', model = 'fal-ai/birefnet', signal }) {
+export async function removeBackgroundFal({ fetchImpl, resolveKey, cfg: rawCfg }, { imageBytes, mediaType = 'image/png', model = 'fal-ai/birefnet', signal }) {
+  const cfg = plainConfig(rawCfg)
   const key = await resolveKey(cfg.apiKeyEnv)
   const base64 = Buffer.isBuffer(imageBytes) ? imageBytes.toString('base64') : Buffer.from(imageBytes).toString('base64')
   const dataUrl = `data:${mediaType};base64,${base64}`
@@ -297,7 +300,8 @@ export async function removeBackgroundFal({ fetchImpl, resolveKey, cfg }, { imag
   return { bytes, mediaType: 'image/png', width: img.width || 0, height: img.height || 0, sourceUrl: img.url }
 }
 
-export async function upscaleImageFal({ fetchImpl, resolveKey, cfg }, { imageBytes, mediaType = 'image/png', scale = 2, creativity, prompt, model = 'fal-ai/clarity-upscaler', signal }) {
+export async function upscaleImageFal({ fetchImpl, resolveKey, cfg: rawCfg }, { imageBytes, mediaType = 'image/png', scale = 2, creativity, prompt, model = 'fal-ai/clarity-upscaler', signal }) {
+  const cfg = plainConfig(rawCfg)
   const key = await resolveKey(cfg.apiKeyEnv)
   const base64 = Buffer.isBuffer(imageBytes) ? imageBytes.toString('base64') : Buffer.from(imageBytes).toString('base64')
   const dataUrl = `data:${mediaType};base64,${base64}`
@@ -579,8 +583,9 @@ export async function blendImagesFal({ fetchImpl, resolveKey, cfg }, { images, w
 /** Direct image editing (inpainting / img2img) via selected provider. */
 /** @internal — direct provider call path for integration tests */
 export async function editImageDirect(deps, job) {
-  const providers = makeProviders(deps, job)
-  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof deps?.cfg?.provider === 'string' && deps.cfg.provider.trim()) || (typeof deps?.cfg?.defaultProvider === 'string' && deps.cfg.defaultProvider.trim()) || 'fal'
+  const safeDeps = deps?.cfg ? { ...deps, cfg: plainConfig(deps.cfg) } : deps
+  const providers = makeProviders(safeDeps, job)
+  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof safeDeps?.cfg?.provider === 'string' && safeDeps.cfg.provider.trim()) || (typeof safeDeps?.cfg?.defaultProvider === 'string' && safeDeps.cfg.defaultProvider.trim()) || 'fal'
   const fn = providers[providerKey] || providers.fal || providers.custom
   if (!fn) throw new Error(`Provider "${providerKey}" does not support image editing`)
   return fn(job.seed, job.prompt)
@@ -589,11 +594,12 @@ export async function editImageDirect(deps, job) {
 /** Direct image variation via selected provider. */
 /** @internal — direct provider call path for integration tests */
 export async function varyImageDirect(deps, job) {
-  const providers = makeProviders(deps, {
+  const safeDeps = deps?.cfg ? { ...deps, cfg: plainConfig(deps.cfg) } : deps
+  const providers = makeProviders(safeDeps, {
     ...job,
     strength: job.variationStrength ?? job.strength ?? 0.35,
   })
-  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof deps?.cfg?.provider === 'string' && deps.cfg.provider.trim()) || (typeof deps?.cfg?.defaultProvider === 'string' && deps.cfg.defaultProvider.trim()) || 'fal'
+  const providerKey = (typeof job?.provider === 'string' && job.provider.trim()) || (typeof safeDeps?.cfg?.provider === 'string' && safeDeps.cfg.provider.trim()) || (typeof safeDeps?.cfg?.defaultProvider === 'string' && safeDeps.cfg.defaultProvider.trim()) || 'fal'
   const fn = providers[providerKey] || providers.fal || providers.custom
   if (!fn) throw new Error(`Provider "${providerKey}" does not support image variations`)
   return fn(job.seed, job.prompt)
@@ -628,7 +634,8 @@ export function toLosslessJson(val) {
  * Returns { ok: boolean, latencyMs: number, message: string }.
  */
 export async function testProviderConnection(deps, providerId) {
-  const { fetchImpl = fetch, resolveKey, cfg } = deps || {}
+  const { fetchImpl = fetch, resolveKey } = deps || {}
+  const cfg = plainConfig(deps?.cfg)
   const start = Date.now()
   const rawProvider = (typeof providerId === 'string' && providerId.trim())
     || (typeof cfg?.provider === 'string' && cfg.provider.trim())

package/lib/security.js

@@ -294,3 +294,49 @@ export function resolveInside(baseDir, candidatePath) {
 
   return resolved
 }
+
+const SAFE_HEX_COLOR = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/
+const SAFE_RGB_COLOR = /^rgba?\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}(?:\s*,\s*(?:0|1|0?\.\d+)\s*)?\)$/i
+const SAFE_HSL_COLOR = /^hsla?\(\s*\d{1,3}(?:deg)?\s*,\s*\d{1,3}%\s*,\s*\d{1,3}%(?:\s*,\s*(?:0|1|0?\.\d+)\s*)?\)$/i
+const SAFE_NAMED_COLOR = /^(?:transparent|currentColor|none|[a-zA-Z]{3,20})$/i
+
+/**
+ * Escapes characters for safe inclusion in XML/SVG documents and attributes (#414).
+ * Replaces &, <, >, ", ' with their corresponding XML entities.
+ *
+ * @param {string|unknown} val
+ * @returns {string} XML-safe string
+ */
+export function escapeXml(val) {
+  if (val === null || val === undefined) return ''
+  return String(val)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;')
+}
+
+/**
+ * Sanitizes a color value for safe inclusion in SVG attributes (fill, stroke, stop-color) (#414).
+ * If the input is not a recognized safe color (hex, rgb/rgba, hsl/hsla, or safe named color),
+ * returns the provided fallback color.
+ *
+ * @param {string|unknown} color
+ * @param {string} [fallback='#000000']
+ * @returns {string} Sanitized color string
+ */
+export function sanitizeSvgColor(color, fallback = '#000000') {
+  if (typeof color !== 'string') return fallback
+  const trimmed = color.trim()
+  if (
+    SAFE_HEX_COLOR.test(trimmed) ||
+    SAFE_RGB_COLOR.test(trimmed) ||
+    SAFE_HSL_COLOR.test(trimmed) ||
+    SAFE_NAMED_COLOR.test(trimmed)
+  ) {
+    return trimmed
+  }
+  return fallback
+}
+

package/lib/tools/processing-advanced.js

@@ -10,7 +10,7 @@ import {
   toLosslessJson,
   saveAttachmentSafe,
 } from '../providers.js'
-import { sanitizeErrorAndLogs, resolveInside } from '../security.js'
+import { sanitizeErrorAndLogs, resolveInside, escapeXml, sanitizeSvgColor } from '../security.js'
 import { resolveConversationImage } from '../resolve-image.js'
 
 export function registerProcessingAdvancedTools(ctx, deps) {
@@ -126,6 +126,7 @@ export function registerProcessingAdvancedTools(ctx, deps) {
               const mime = src.mediaType || 'image/png'
               const dataUri = `data:${mime};base64,${b64}`
               const label = labels[idx] || String(idx + 1)
+              const escapedLabel = escapeXml(label)
 
               tilesSvg += `
   <g transform="translate(${x}, ${y})">
@@ -133,14 +134,11 @@ export function registerProcessingAdvancedTools(ctx, deps) {
     <rect width="${tileW}" height="${tileH}" rx="8" fill="#18191c" stroke="#2c2e33" stroke-width="1"/>
     <image href="${dataUri}" width="${tileW}" height="${tileH}" preserveAspectRatio="xMidYMid slice" clip-path="url(#clip-${idx})"/>
     <rect x="12" y="12" width="28" height="24" rx="4" fill="rgba(0,0,0,0.65)"/>
-    <text x="26" y="29" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="13" font-weight="700" text-anchor="middle">${label}</text>
+    <text x="26" y="29" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="13" font-weight="700" text-anchor="middle">${escapedLabel}</text>
   </g>`
             })
 
-            const escapedTitle = title
-              .replace(/&/g, '&amp;')
-              .replace(/</g, '&lt;')
-              .replace(/>/g, '&gt;')
+            const escapedTitle = escapeXml(title || '')
 
             const svgContent = `<?xml version="1.0" encoding="UTF-8"?>
 <svg xmlns="http://www.w3.org/2000/svg" width="${totalW}" height="${totalH}" viewBox="0 0 ${totalW} ${totalH}">
@@ -247,7 +245,7 @@ export function registerProcessingAdvancedTools(ctx, deps) {
             const source = await resolveConversationImage(ctx, exec, args.image)
             const targetRatioKey = args.aspect_ratio || '1:1'
             const mode = args.mode || 'auto_focus'
-            const bgColor = args.background || '#0b0c0e'
+            const bgColor = sanitizeSvgColor(args.background || '#0b0c0e', '#0b0c0e')
 
             const ratioMap = {
               '1:1': 1.0,
@@ -413,8 +411,11 @@ export function registerProcessingAdvancedTools(ctx, deps) {
 
             const projectName = args.project_name || 'Project Brand'
             const tagline = args.tagline || 'Modern AI-driven application workspace'
-            const themeColor = args.theme_color || '#4f46e5'
+            const themeColor = sanitizeSvgColor(args.theme_color || '#4f46e5', '#4f46e5')
             const initial = projectName.charAt(0).toUpperCase()
+            const escapedInitial = escapeXml(initial)
+            const escapedProject = escapeXml(projectName)
+            const escapedTagline = escapeXml(tagline)
 
             let logoDataUri = null
             if (args.logo_image) {
@@ -439,7 +440,7 @@ export function registerProcessingAdvancedTools(ctx, deps) {
             const faviconSvg = `<?xml version="1.0" encoding="UTF-8"?>
 <svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64">
   <rect width="64" height="64" rx="16" fill="${themeColor}"/>
-  ${logoDataUri ? `<image href="${logoDataUri}" x="8" y="8" width="48" height="48" preserveAspectRatio="xMidYMid meet"/>` : `<text x="32" y="44" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="34" font-weight="900" text-anchor="middle">${initial}</text>`}
+  ${logoDataUri ? `<image href="${logoDataUri}" x="8" y="8" width="48" height="48" preserveAspectRatio="xMidYMid meet"/>` : `<text x="32" y="44" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="34" font-weight="900" text-anchor="middle">${escapedInitial}</text>`}
 </svg>`
             const faviconPath = path.join(targetDir, 'favicon.svg')
             await writeFile(faviconPath, faviconSvg, 'utf8')
@@ -459,7 +460,7 @@ export function registerProcessingAdvancedTools(ctx, deps) {
     </linearGradient>
   </defs>
   <rect width="${size}" height="${size}" rx="${rx}" fill="url(#brandGrad-${size})"/>
-  ${logoDataUri ? `<image href="${logoDataUri}" x="${size * 0.15}" y="${size * 0.15}" width="${size * 0.7}" height="${size * 0.7}" preserveAspectRatio="xMidYMid meet"/>` : `<text x="${size / 2}" y="${yOffset}" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="${fontSize}" font-weight="900" text-anchor="middle">${initial}</text>`}
+  ${logoDataUri ? `<image href="${logoDataUri}" x="${size * 0.15}" y="${size * 0.15}" width="${size * 0.7}" height="${size * 0.7}" preserveAspectRatio="xMidYMid meet"/>` : `<text x="${size / 2}" y="${yOffset}" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="${fontSize}" font-weight="900" text-anchor="middle">${escapedInitial}</text>`}
 </svg>`
               const iconPath = path.join(targetDir, `icon-${size}.svg`)
               await writeFile(iconPath, iconSvg, 'utf8')
@@ -486,8 +487,6 @@ export function registerProcessingAdvancedTools(ctx, deps) {
             exportedFiles.push(manifestPath)
 
             // 4. OpenGraph Social Card (1200x630)
-            const escapedProject = projectName.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-            const escapedTagline = tagline.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
             const ogCardSvg = `<?xml version="1.0" encoding="UTF-8"?>
 <svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630">
   <defs>
@@ -511,7 +510,7 @@ export function registerProcessingAdvancedTools(ctx, deps) {
   
   <g transform="translate(860, 200)">
     <rect width="180" height="180" rx="36" fill="${themeColor}" fill-opacity="0.15" stroke="${themeColor}" stroke-width="2"/>
-    ${logoDataUri ? `<image href="${logoDataUri}" x="20" y="20" width="140" height="140" preserveAspectRatio="xMidYMid meet"/>` : `<text x="90" y="125" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="96" font-weight="900" text-anchor="middle">${initial}</text>`}
+    ${logoDataUri ? `<image href="${logoDataUri}" x="20" y="20" width="140" height="140" preserveAspectRatio="xMidYMid meet"/>` : `<text x="90" y="125" fill="#ffffff" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="96" font-weight="900" text-anchor="middle">${escapedInitial}</text>`}
   </g>
   
   <text x="130" y="480" fill="#64748b" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif" font-size="14" font-weight="500">Auto-generated by @goodandready/dsh-image-gen</text>

package/lib/vision-ocr-helpers.js

@@ -1,4 +1,5 @@
 // vision-ocr-helpers.js — OCR text localization and seamless replacement (#180).
+import { escapeXml, sanitizeSvgColor } from './security.js'
 
 /**
  * Parses bounding box representations into normalized [x1, y1, x2, y2] (0-1000 scale).
@@ -87,6 +88,7 @@ export function buildTextInpaintMaskSvg(width, height, bboxes, paddingPx = 8) {
 export function buildTextOverlaySvg(width, height, items, fontFamily = 'sans-serif') {
   const w = Math.max(1, width || 1024)
   const h = Math.max(1, height || 1024)
+  const safeFont = escapeXml(fontFamily)
 
   const textNodes = (items || []).map((item) => {
     const norm = normalizeBbox(item.bbox, w, h)
@@ -98,18 +100,14 @@ export function buildTextOverlaySvg(width, height, items, fontFamily = 'sans-ser
     const boxH = Math.max(1, Math.round(((y2n - y1n) / 1000) * h))
 
     const computedFontSize = item.fontSize || Math.max(12, Math.round(boxH * 0.72))
-    const color = item.color || '#FFFFFF'
+    const color = sanitizeSvgColor(item.color || '#FFFFFF', '#FFFFFF')
     const centerX = pxX1 + Math.round(boxW / 2)
     const baselineY = pxY1 + Math.round(boxH * 0.75)
 
     // Escape XML entities
-    const safeText = String(item.text)
-      .replace(/&/g, '&')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
+    const safeText = escapeXml(item.text)
 
-    return `<text x="${centerX}" y="${baselineY}" text-anchor="middle" font-family="${fontFamily}" font-size="${computedFontSize}" font-weight="700" fill="${color}" filter="drop-shadow(0 2px 4px rgba(0,0,0,0.6))">${safeText}</text>`
+    return `<text x="${centerX}" y="${baselineY}" text-anchor="middle" font-family="${safeFont}" font-size="${computedFontSize}" font-weight="700" fill="${color}" filter="drop-shadow(0 2px 4px rgba(0,0,0,0.6))">${safeText}</text>`
   }).filter(Boolean).join('\n  ')
 
   return `<?xml version="1.0" encoding="UTF-8"?>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.11.34",
+  "version": "0.11.36",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",