@goodandready/dsh-image-gen 0.11.4 → 0.11.5

package/lib/client.js

@@ -50,6 +50,16 @@ window.__ModuleLoader__.load({
           strokeLinecap: 'round', strokeLinejoin: 'round',
         }))
 
+
+    function resolveTranslator(props, ctx) {
+      if (typeof props?.t === 'function') return props.t
+      const loc = ctx?.locale || props?.ctx?.locale
+      if (loc) {
+        if (typeof loc.t === 'function') return (k, def) => loc.t(NS + '.' + k) || loc.t(k) || def || k
+        if (typeof loc.get === 'function') return (k, def) => loc.get(NS + '.' + k) || loc.get(k) || def || k
+      }
+      return (k, def) => def || k
+    }
     // -------------------------------------------------------------- CSS & Design System
     function ensureCss() {
       if (typeof document === 'undefined') return
@@ -2519,6 +2529,23 @@ window.__ModuleLoader__.load({
       'studio.parameters': 'Generation Parameters',
       'studio.generate': 'Generate in Chat',
       'studio.recent': 'Recent Generations',
+      'studio.prompt': 'Prompt:',
+      'studio.promptPlaceholder': 'Describe your vision...',
+      'studio.stylePreset': 'Style Preset:',
+      'studio.aspectRatio': 'Aspect Ratio:',
+      'studio.provider': 'Provider:',
+      'studio.seed': 'Seed (optional):',
+      'studio.random': 'Random',
+      'studio.randomizeSeed': 'Randomize seed',
+      'studio.fullscreen': 'Fullscreen',
+      'studio.exitFullscreen': 'Exit Fullscreen',
+      'studio.copyMarkdown': 'Copy Markdown',
+      'studio.copyHtml': 'Copy HTML',
+      'studio.download': 'Download',
+      'studio.emptyCanvas': 'Select an image from the recent strip below or click Generate.',
+      'studio.copiedCommand': 'Copied generation command to clipboard!',
+      'studio.copiedSnippet': 'Copied snippet to clipboard!',
+
       'vault.title': 'Asset Browser & Vault',
       'vault.search': 'Search prompt or tags...',
       'vault.loadMore': 'Load more assets',
@@ -2528,6 +2555,19 @@ window.__ModuleLoader__.load({
       'vault.insert': 'Insert in Chat',
       'vault.download': 'Download',
       'vault.delete': 'Delete',
+      'vault.allProviders': 'All Providers',
+      'vault.allRatios': 'All Ratios',
+      'vault.newest': 'Newest',
+      'vault.oldest': 'Oldest',
+      'vault.loading': 'Loading...',
+      'vault.confirmDelete': 'Are you sure you want to delete this asset?',
+      'vault.deleted': 'Asset deleted',
+      'vault.deleteFailed': 'Failed to delete asset',
+      'vault.copiedMarkdown': 'Markdown snippet copied to clipboard!',
+      'vault.copiedPrompt': 'Prompt & seed copied to clipboard!',
+      'vault.noPrompt': 'No prompt',
+      'vault.seed': 'Seed',
+      'vault.provider': 'Provider',
     }
 
     const zh = {
@@ -2754,6 +2794,23 @@ window.__ModuleLoader__.load({
       'studio.parameters': '生成参数配置',
       'studio.generate': '在对话中生成',
       'studio.recent': '最近生成历史',
+      'studio.prompt': '提示词:',
+      'studio.promptPlaceholder': '描述你想创作的画面...',
+      'studio.stylePreset': '风格预设:',
+      'studio.aspectRatio': '宽高比:',
+      'studio.provider': '生成引擎:',
+      'studio.seed': '随机种子 (可选):',
+      'studio.random': '随机',
+      'studio.randomizeSeed': '随机生成种子',
+      'studio.fullscreen': '全屏',
+      'studio.exitFullscreen': '退出全屏',
+      'studio.copyMarkdown': '复制 Markdown',
+      'studio.copyHtml': '复制 HTML',
+      'studio.download': '下载图像',
+      'studio.emptyCanvas': '从下方最近生成列表中选择图像，或点击生成。',
+      'studio.copiedCommand': '已将生成指令复制到剪贴板！',
+      'studio.copiedSnippet': '代码片段已复制到剪贴板！',
+
       'vault.title': '图像素材库与浏览器',
       'vault.search': '搜索提示词或标签...',
       'vault.loadMore': '加载更多素材',
@@ -2763,6 +2820,19 @@ window.__ModuleLoader__.load({
       'vault.insert': '插入到当前对话',
       'vault.download': '下载图像',
       'vault.delete': '删除',
+      'vault.allProviders': '所有引擎',
+      'vault.allRatios': '所有比例',
+      'vault.newest': '最新',
+      'vault.oldest': '最早',
+      'vault.loading': '加载中...',
+      'vault.confirmDelete': '确定要删除此素材吗？',
+      'vault.deleted': '素材已删除',
+      'vault.deleteFailed': '删除素材失败',
+      'vault.copiedMarkdown': 'Markdown 片段已复制到剪贴板！',
+      'vault.copiedPrompt': '提示词与种子已复制到剪贴板！',
+      'vault.noPrompt': '无提示词',
+      'vault.seed': '种子',
+      'vault.provider': '引擎',
     }
 
     // -------------------------------------------------------------- Registration & Apply
@@ -2882,7 +2952,20 @@ window.__ModuleLoader__.load({
     }
 
     function apply(ctx) {
-      if (ctx.locale && typeof ctx.locale.define === 'function') {
+      if (ctx.locale && typeof ctx.locale.register === 'function') {
+        try {
+          if (typeof ctx.effect === 'function') {
+            ctx.effect(() => ctx.locale.register(NS, { en, zh }), 'dsh-image-gen: locale')
+          } else {
+            ctx.locale.register(NS, { en, zh })
+          }
+        } catch (_) {
+          try {
+            ctx.locale.register(NS, 'en', en)
+            ctx.locale.register(NS, 'zh', zh)
+          } catch (_) { /* ignore fallback locale register error */ }
+        }
+      } else if (ctx.locale && typeof ctx.locale.define === 'function') {
         ctx.locale.define('en', NS, en)
         ctx.locale.define('zh', NS, zh)
       }
@@ -3068,9 +3151,10 @@ window.__ModuleLoader__.load({
         )
       )
     }
-    // -------------------------------------------------------------- Asset Vault View (#159)
+    // -------------------------------------------------------------- Asset Vault View (#159, #304)
     function AssetVaultView(props) {
       const { ctx, onSelectAsset } = props
+      const t = resolveTranslator(props, ctx)
       const [items, setItems] = react.useState([])
       const [loading, setLoading] = react.useState(false)
       const [q, setQ] = react.useState('')
@@ -3115,7 +3199,7 @@ window.__ModuleLoader__.load({
       }, [q, provider, aspect, sort])
 
       const handleDelete = (id) => {
-        if (!window.confirm('Are you sure you want to delete this asset?')) return
+        if (!window.confirm(t('vault.confirmDelete') || 'Are you sure you want to delete this asset?')) return
         fetch('/dsh-image-gen/vault?id=' + encodeURIComponent(id), { method: 'DELETE' })
           .then((r) => r.json())
           .then((res) => {
@@ -3124,17 +3208,17 @@ window.__ModuleLoader__.load({
               if (selected && (selected.id === id || selected.attachmentId === id)) {
                 setSelected(null)
               }
-              showFeedback('Asset deleted')
+              showFeedback(t('vault.deleted') || 'Asset deleted')
             }
           })
-          .catch(() => showFeedback('Failed to delete asset'))
+          .catch(() => showFeedback(t('vault.deleteFailed') || 'Failed to delete asset'))
       }
 
       const handleInsert = (item) => {
         const link = '![' + (item.prompt || 'Generated Image') + '](' + (item.url || item.thumbnailUrl) + ')'
         if (typeof navigator !== 'undefined' && navigator.clipboard) {
           navigator.clipboard.writeText(link)
-          showFeedback('Markdown snippet copied to clipboard!')
+          showFeedback(t('vault.copiedMarkdown') || 'Markdown snippet copied to clipboard!')
         }
       }
 
@@ -3146,7 +3230,7 @@ window.__ModuleLoader__.load({
         const cmd = '/image ' + (item.prompt || '') + (item.seed !== undefined ? ' --seed ' + item.seed : '')
         if (typeof navigator !== 'undefined' && navigator.clipboard) {
           navigator.clipboard.writeText(cmd)
-          showFeedback('Prompt & seed copied to clipboard!')
+          showFeedback(t('vault.copiedPrompt') || 'Prompt & seed copied to clipboard!')
         }
       }
 
@@ -3160,7 +3244,7 @@ window.__ModuleLoader__.load({
             type: 'text',
             className: 'ig-input',
             style: { flex: '1 1 200px', padding: '6px 12px', borderRadius: '6px', border: '1px solid var(--dsw-alias-border-l2)', background: 'var(--dsw-alias-bg-layer-2)', color: 'var(--dsw-alias-label-primary)' },
-            placeholder: 'Search prompt or tags...',
+            placeholder: t('vault.search') || 'Search prompt or tags...',
             value: q,
             onChange: (e) => setQ(e.target.value),
           }),
@@ -3172,7 +3256,7 @@ window.__ModuleLoader__.load({
               onChange: (e) => setProvider(e.target.value),
               style: { padding: '6px 10px', borderRadius: '6px', border: '1px solid var(--dsw-alias-border-l2)', background: 'var(--dsw-alias-bg-layer-2)', color: 'var(--dsw-alias-label-primary)' },
             },
-            react.createElement('option', { value: 'all' }, 'All Providers'),
+            react.createElement('option', { value: 'all' }, t('vault.allProviders') || 'All Providers'),
             react.createElement('option', { value: 'fal' }, 'FAL.ai'),
             react.createElement('option', { value: 'openai' }, 'OpenAI'),
             react.createElement('option', { value: 'local' }, 'Local (ComfyUI)')
@@ -3185,7 +3269,7 @@ window.__ModuleLoader__.load({
               onChange: (e) => setAspect(e.target.value),
               style: { padding: '6px 10px', borderRadius: '6px', border: '1px solid var(--dsw-alias-border-l2)', background: 'var(--dsw-alias-bg-layer-2)', color: 'var(--dsw-alias-label-primary)' },
             },
-            react.createElement('option', { value: 'all' }, 'All Ratios'),
+            react.createElement('option', { value: 'all' }, t('vault.allRatios') || 'All Ratios'),
             react.createElement('option', { value: '1:1' }, '1:1 Square'),
             react.createElement('option', { value: '16:9' }, '16:9 Landscape'),
             react.createElement('option', { value: '9:16' }, '9:16 Portrait'),
@@ -3200,12 +3284,12 @@ window.__ModuleLoader__.load({
               onClick: () => setSort(sort === 'newest' ? 'oldest' : 'newest'),
               style: { border: '1px solid var(--dsw-alias-border-l2)', padding: '6px 10px', borderRadius: '6px', background: 'var(--dsw-alias-bg-layer-2)', color: 'var(--dsw-alias-label-primary)', cursor: 'pointer' },
             },
-            sort === 'newest' ? '↓ Newest' : '↑ Oldest'
+            sort === 'newest' ? ('↓ ' + (t('vault.newest') || 'Newest')) : ('↑ ' + (t('vault.oldest') || 'Oldest'))
           )
         ),
         feedback && react.createElement('div', { style: { padding: '6px 12px', borderRadius: '6px', background: 'color-mix(in srgb, var(--dsw-alias-state-brand-primary) 15%, transparent)', color: 'var(--dsw-alias-state-brand-primary)', fontSize: '12px' } }, feedback),
         items.length === 0 && !loading
-          ? react.createElement('div', { style: { padding: '32px', textAlign: 'center', color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' } }, 'No assets found in vault.')
+          ? react.createElement('div', { style: { padding: '32px', textAlign: 'center', color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' } }, t('vault.empty') || 'No assets found in vault.')
           : react.createElement(
               'div',
               { className: 'ig-vault-grid' },
@@ -3222,19 +3306,19 @@ window.__ModuleLoader__.load({
                   react.createElement(
                     'div',
                     { className: 'ig-vault-body' },
-                    react.createElement('div', { className: 'ig-vault-prompt', title: item.prompt }, item.prompt || 'Untitled'),
+                    react.createElement('div', { className: 'ig-vault-prompt', title: item.prompt }, item.prompt || (t('vault.noPrompt') || 'Untitled')),
                     react.createElement(
                       'div',
                       { className: 'ig-vault-meta' },
                       react.createElement('span', null, item.provider || 'local'),
-                      item.seed !== undefined && react.createElement('span', null, 'Seed ' + item.seed)
+                      item.seed !== undefined && react.createElement('span', null, (t('vault.seed') || 'Seed') + ' ' + item.seed)
                     ),
                     react.createElement(
                       'div',
                       { style: { display: 'flex', gap: '4px', marginTop: '6px' } },
-                      react.createElement('button', { type: 'button', className: 'ig-rev-btn', style: { flex: 1 }, onClick: () => handleReroll(item), title: 'Re-roll with seed' }, '🎲 Re-roll'),
-                      react.createElement('button', { type: 'button', className: 'ig-rev-btn', style: { flex: 1 }, onClick: () => handleInsert(item), title: 'Insert into chat' }, '💬 Insert'),
-                      react.createElement('button', { type: 'button', className: 'ig-rev-btn', onClick: () => handleDelete(item.id || item.attachmentId), title: 'Delete' }, '🗑️')
+                      react.createElement('button', { type: 'button', className: 'ig-rev-btn', style: { flex: 1 }, onClick: () => handleReroll(item), title: t('vault.reroll') || 'Re-roll with seed' }, '🎲 ' + (t('vault.reroll') || 'Re-roll')),
+                      react.createElement('button', { type: 'button', className: 'ig-rev-btn', style: { flex: 1 }, onClick: () => handleInsert(item), title: t('vault.insert') || 'Insert into chat' }, '💬 ' + (t('vault.insert') || 'Insert')),
+                      react.createElement('button', { type: 'button', className: 'ig-rev-btn', onClick: () => handleDelete(item.id || item.attachmentId), title: t('vault.delete') || 'Delete' }, '🗑️')
                     )
                   )
                 )
@@ -3253,7 +3337,7 @@ window.__ModuleLoader__.load({
                 disabled: loading,
                 style: { padding: '8px 20px', borderRadius: '6px', border: '1px solid var(--dsw-alias-border-l2)', background: 'var(--dsw-alias-bg-layer-2)', color: 'var(--dsw-alias-label-primary)', cursor: 'pointer' },
               },
-              loading ? 'Loading...' : 'Load more assets'
+              loading ? (t('vault.loading') || 'Loading...') : (t('vault.loadMore') || 'Load more assets')
             )
           ),
         selected &&
@@ -3272,7 +3356,7 @@ window.__ModuleLoader__.load({
               react.createElement(
                 'div',
                 { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
-                react.createElement('span', { style: { fontWeight: '700', fontSize: '14px', color: 'var(--dsw-alias-label-primary)' } }, 'Asset Inspector'),
+                react.createElement('span', { style: { fontWeight: '700', fontSize: '14px', color: 'var(--dsw-alias-label-primary)' } }, t('vault.inspector') || 'Asset Inspector'),
                 react.createElement('button', { type: 'button', onClick: () => setSelected(null), style: { background: 'none', border: 'none', cursor: 'pointer', fontSize: '16px', color: 'var(--dsw-alias-label-secondary)' } }, '✕')
               ),
               react.createElement('img', {
@@ -3282,31 +3366,32 @@ window.__ModuleLoader__.load({
               react.createElement(
                 'div',
                 { style: { display: 'flex', flexWrap: 'wrap', gap: '6px', fontSize: '11px' } },
-                selected.seed !== undefined && react.createElement('span', { className: 'ig-badge' }, 'Seed: ' + selected.seed),
-                selected.provider && react.createElement('span', { className: 'ig-badge' }, 'Provider: ' + selected.provider),
+                selected.seed !== undefined && react.createElement('span', { className: 'ig-badge' }, (t('vault.seed') || 'Seed') + ': ' + selected.seed),
+                selected.provider && react.createElement('span', { className: 'ig-badge' }, (t('vault.provider') || 'Provider') + ': ' + selected.provider),
                 selected.width && react.createElement('span', { className: 'ig-badge' }, selected.width + '×' + selected.height),
                 selected.cost ? react.createElement('span', { className: 'ig-badge' }, '$' + Number(selected.cost).toFixed(4)) : null
               ),
-              react.createElement('div', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-primary)', background: 'var(--dsw-alias-bg-layer-2)', padding: '10px', borderRadius: '6px', lineHeight: '1.4' } }, selected.prompt || 'No prompt'),
+              react.createElement('div', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-primary)', background: 'var(--dsw-alias-bg-layer-2)', padding: '10px', borderRadius: '6px', lineHeight: '1.4' } }, selected.prompt || (t('vault.noPrompt') || 'No prompt')),
               react.createElement(
                 'div',
                 { style: { display: 'flex', gap: '8px', justifyContent: 'flex-end', marginTop: '6px' } },
-                react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleReroll(selected) }, '🎲 Re-roll'),
-                react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleInsert(selected) }, '💬 Insert in Chat'),
+                react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleReroll(selected) }, '🎲 ' + (t('vault.reroll') || 'Re-roll')),
+                react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleInsert(selected) }, '💬 ' + (t('vault.insert') || 'Insert in Chat')),
                 react.createElement(
                   'a',
                   { href: selected.url || selected.thumbnailUrl, download: 'vault-asset-' + (selected.id || 'image') + '.png', className: 'ig-tab-btn', style: { textDecoration: 'none', display: 'inline-flex', alignItems: 'center' } },
-                  '⬇ Download'
+                  '⬇ ' + (t('vault.download') || 'Download')
                 ),
-                react.createElement('button', { type: 'button', className: 'ig-tab-btn', style: { color: 'var(--dsw-alias-state-error-primary)' }, onClick: () => handleDelete(selected.id || selected.attachmentId) }, '🗑️ Delete')
+                react.createElement('button', { type: 'button', className: 'ig-tab-btn', style: { color: 'var(--dsw-alias-state-error-primary)' }, onClick: () => handleDelete(selected.id || selected.attachmentId) }, '🗑️ ' + (t('vault.delete') || 'Delete'))
               )
             )
           )
       )
     }
-    // -------------------------------------------------------------- Fullscreen Image Studio (#158)
+    // -------------------------------------------------------------- Fullscreen Image Studio (#158, #304)
     function ImageStudioView(props) {
       const { ctx } = props
+      const t = resolveTranslator(props, ctx)
       const [viewMode, setViewMode] = react.useState('studio') // 'studio' | 'vault'
       const [isFullscreen, setIsFullscreen] = react.useState(false)
       const [layoutGrid, setLayoutGrid] = react.useState('1x1') // '1x1' | '2x2' | '1x4'
@@ -3350,16 +3435,16 @@ window.__ModuleLoader__.load({
 
       const updatePrompt = (val) => {
         setPrompt(val)
-        try { window.localStorage.setItem('dsh_studio_prompt', val) } catch (_) { /* storage unavailable */ }
+        try { window.localStorage.setItem('dsh_studio_prompt', val) } catch (_) { /* ignore storage quota or private mode error */ }
       }
 
-      const handleSelectFromVault = (asset) => {
-        if (!asset) return
-        setActiveImages([asset])
-        if (asset.prompt) updatePrompt(asset.prompt)
-        if (asset.seed !== undefined) setSeed(String(asset.seed))
-        if (asset.provider) setProvider(asset.provider)
+      const handleSelectFromVault = (item) => {
+        if (!item) return
+        setActiveImages([item])
         setViewMode('studio')
+        if (item.prompt) updatePrompt(item.prompt)
+        if (item.provider) setProvider(item.provider)
+        if (item.seed !== undefined) setSeed(String(item.seed))
       }
 
       const handleCopySnippet = (format) => {
@@ -3371,7 +3456,7 @@ window.__ModuleLoader__.load({
         if (format === 'html') snippet = '<img src="' + url + '" alt="' + (first.prompt || 'Artwork') + '" />'
         if (typeof navigator !== 'undefined' && navigator.clipboard) {
           navigator.clipboard.writeText(snippet)
-          setStatus('Copied ' + format.toUpperCase() + ' snippet!')
+          setStatus(t('studio.copiedSnippet') || ('Copied ' + format.toUpperCase() + ' snippet!'))
           setTimeout(() => setStatus(''), 2000)
         }
       }
@@ -3389,7 +3474,7 @@ window.__ModuleLoader__.load({
           react.createElement(
             'div',
             { style: { display: 'flex', gap: '8px', alignItems: 'center' } },
-            react.createElement('span', { style: { fontWeight: '700', fontSize: '15px', color: 'var(--dsw-alias-label-primary)' } }, '🎨 Image Studio'),
+            react.createElement('span', { style: { fontWeight: '700', fontSize: '15px', color: 'var(--dsw-alias-label-primary)' } }, '🎨 ' + (t('studio.title') || 'Image Studio')),
             react.createElement(
               'button',
               {
@@ -3397,7 +3482,7 @@ window.__ModuleLoader__.load({
                 className: 'ig-tab-btn ' + (viewMode === 'studio' ? 'active' : ''),
                 onClick: () => setViewMode('studio'),
               },
-              'Studio Canvas'
+              t('studio.canvas') || 'Studio Canvas'
             ),
             react.createElement(
               'button',
@@ -3406,7 +3491,7 @@ window.__ModuleLoader__.load({
                 className: 'ig-tab-btn ' + (viewMode === 'vault' ? 'active' : ''),
                 onClick: () => setViewMode('vault'),
               },
-              '🗃️ Asset Vault'
+              '🗃️ ' + (t('studio.vault') || 'Asset Vault')
             )
           ),
           react.createElement(
@@ -3438,12 +3523,12 @@ window.__ModuleLoader__.load({
                 onClick: () => setIsFullscreen(!isFullscreen),
                 style: { border: '1px solid var(--dsw-alias-border-l2)' },
               },
-              isFullscreen ? '✕ Exit Fullscreen' : '⛶ Fullscreen'
+              isFullscreen ? ('✕ ' + (t('studio.exitFullscreen') || 'Exit Fullscreen')) : ('⛶ ' + (t('studio.fullscreen') || 'Fullscreen'))
             )
           )
         ),
         viewMode === 'vault'
-          ? react.createElement(AssetVaultView, { ctx, onSelectAsset: handleSelectFromVault })
+          ? react.createElement(AssetVaultView, { ctx, t, onSelectAsset: handleSelectFromVault })
           : react.createElement(
               react.Fragment,
               null,
@@ -3453,16 +3538,16 @@ window.__ModuleLoader__.load({
                 react.createElement(
                   'div',
                   { className: 'ig-studio-sidebar' },
-                  react.createElement('span', { style: { fontWeight: '600', fontSize: '13px', color: 'var(--dsw-alias-label-primary)' } }, 'Generation Parameters'),
+                  react.createElement('span', { style: { fontWeight: '600', fontSize: '13px', color: 'var(--dsw-alias-label-primary)' } }, t('studio.parameters') || 'Generation Parameters'),
                   react.createElement(
                     'div',
                     null,
-                    react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, 'Prompt:'),
+                    react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, t('studio.prompt') || 'Prompt:'),
                     react.createElement('textarea', {
                       className: 'ig-input',
                       rows: 4,
                       style: { width: '100%', resize: 'vertical', borderRadius: '6px', padding: '8px', fontSize: '12px' },
-                      placeholder: 'Describe your vision...',
+                      placeholder: t('studio.promptPlaceholder') || 'Describe your vision...',
                       value: prompt,
                       onChange: (e) => updatePrompt(e.target.value),
                     })
@@ -3470,7 +3555,7 @@ window.__ModuleLoader__.load({
                   react.createElement(
                     'div',
                     null,
-                    react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, 'Style Preset:'),
+                    react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, t('studio.stylePreset') || 'Style Preset:'),
                     react.createElement(
                       'div',
                       { style: { display: 'flex', flexWrap: 'wrap', gap: '4px' } },
@@ -3495,7 +3580,7 @@ window.__ModuleLoader__.load({
                     react.createElement(
                       'div',
                       null,
-                      react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, 'Aspect Ratio:'),
+                      react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, t('studio.aspectRatio') || 'Aspect Ratio:'),
                       react.createElement(
                         'select',
                         {
@@ -3514,7 +3599,7 @@ window.__ModuleLoader__.load({
                     react.createElement(
                       'div',
                       null,
-                      react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, 'Provider:'),
+                      react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, t('studio.provider') || 'Provider:'),
                       react.createElement(
                         'select',
                         {
@@ -3532,7 +3617,7 @@ window.__ModuleLoader__.load({
                   react.createElement(
                     'div',
                     null,
-                    react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, 'Seed (optional):'),
+                    react.createElement('label', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'block', marginBottom: '4px' } }, t('studio.seed') || 'Seed (optional):'),
                     react.createElement(
                       'div',
                       { style: { display: 'flex', gap: '6px' } },
@@ -3540,7 +3625,7 @@ window.__ModuleLoader__.load({
                         type: 'number',
                         className: 'ig-input',
                         style: { flex: 1, padding: '6px', fontSize: '12px' },
-                        placeholder: 'Random',
+                        placeholder: t('studio.random') || 'Random',
                         value: seed,
                         onChange: (e) => setSeed(e.target.value),
                       }),
@@ -3550,7 +3635,7 @@ window.__ModuleLoader__.load({
                           type: 'button',
                           className: 'ig-tab-btn',
                           onClick: () => setSeed(String(Math.floor(Math.random() * 2147483647))),
-                          title: 'Randomize seed',
+                          title: t('studio.randomizeSeed') || 'Randomize seed',
                         },
                         '🎲'
                       )
@@ -3566,12 +3651,12 @@ window.__ModuleLoader__.load({
                         const cmd = '/image ' + (prompt || 'Artwork') + (stylePreset !== 'none' ? ' --style ' + stylePreset : '') + ' --aspect ' + aspectRatio + ' --provider ' + provider + (seed ? ' --seed ' + seed : '')
                         if (typeof navigator !== 'undefined' && navigator.clipboard) {
                           navigator.clipboard.writeText(cmd)
-                          setStatus('Copied generation command to clipboard!')
+                          setStatus(t('studio.copiedCommand') || 'Copied generation command to clipboard!')
                           setTimeout(() => setStatus(''), 2500)
                         }
                       },
                     },
-                    '🎨 Generate in Chat'
+                    '🎨 ' + (t('studio.generate') || 'Generate in Chat')
                   ),
                   status && react.createElement('div', { style: { fontSize: '11px', color: 'var(--dsw-alias-state-brand-primary)', textAlign: 'center' } }, status)
                 ),
@@ -3579,7 +3664,7 @@ window.__ModuleLoader__.load({
                   'div',
                   { className: 'ig-studio-canvas' },
                   activeImages.length === 0
-                    ? react.createElement('div', { style: { color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' } }, 'Select an image from the recent strip below or click Generate.')
+                    ? react.createElement('div', { style: { color: 'var(--dsw-alias-label-secondary)', fontSize: '13px' } }, t('studio.emptyCanvas') || 'Select an image from the recent strip below or click Generate.')
                     : react.createElement(
                         'div',
                         {
@@ -3604,12 +3689,12 @@ window.__ModuleLoader__.load({
                     react.createElement(
                       'div',
                       { style: { display: 'flex', gap: '8px', marginTop: '10px' } },
-                      react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleCopySnippet('markdown') }, 'Copy Markdown'),
-                      react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleCopySnippet('html') }, 'Copy HTML'),
+                      react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleCopySnippet('markdown') }, t('studio.copyMarkdown') || 'Copy Markdown'),
+                      react.createElement('button', { type: 'button', className: 'ig-tab-btn', onClick: () => handleCopySnippet('html') }, t('studio.copyHtml') || 'Copy HTML'),
                       react.createElement(
                         'a',
                         { href: activeImages[0].url || activeImages[0].thumbnailUrl, download: 'studio-image.png', className: 'ig-tab-btn', style: { textDecoration: 'none' } },
-                        '⬇ Download'
+                        '⬇ ' + (t('studio.download') || 'Download')
                       )
                     )
                 )
@@ -3617,7 +3702,7 @@ window.__ModuleLoader__.load({
               react.createElement(
                 'div',
                 { style: { display: 'flex', flexDirection: 'column', gap: '6px', marginTop: '10px' } },
-                react.createElement('span', { style: { fontSize: '12px', fontWeight: '600', color: 'var(--dsw-alias-label-secondary)' } }, 'Recent Generations:'),
+                react.createElement('span', { style: { fontSize: '12px', fontWeight: '600', color: 'var(--dsw-alias-label-secondary)' } }, (t('studio.recent') || 'Recent Generations') + ':'),
                 react.createElement(
                   'div',
                   { className: 'ig-studio-strip', style: { display: 'flex', gap: '8px', overflowX: 'auto', padding: '4px 0' } },

package/lib/commands.js

@@ -0,0 +1,176 @@
+// commands.js — Top-level slash command /image for direct generation without LLM reasoning (#152)
+
+import { makeProviders, resolveStylePreset } from './providers.js'
+import { ASPECT_RATIOS } from './providers/shared-helpers.js'
+import { calculateGenerationCost } from './cost-meter.js'
+
+/**
+ * Parse raw slash command arguments: /image <prompt> [--flags]
+ *
+ * @param {string} rawInput
+ * @returns {{ prompt: string, flags: Record<string, string>, error?: string }}
+ */
+export function parseImageCommandArgs(rawInput) {
+  const str = String(rawInput || '').trim()
+  if (!str) return { prompt: '', flags: {}, error: 'Missing prompt' }
+
+  const tokens = []
+  const re = /[^\s"']+|"([^"]*)"|'([^']*)'/g
+  let match
+  while ((match = re.exec(str)) !== null) {
+    tokens.push(match[1] || match[2] || match[0])
+  }
+
+  const flags = {}
+  const promptWords = []
+
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i]
+    if (t.startsWith('--')) {
+      const eqIdx = t.indexOf('=')
+      if (eqIdx !== -1) {
+        const key = t.slice(2, eqIdx).toLowerCase()
+        const val = t.slice(eqIdx + 1)
+        flags[key] = val
+      } else {
+        const key = t.slice(2).toLowerCase()
+        if (i + 1 < tokens.length && !tokens[i + 1].startsWith('--')) {
+          flags[key] = tokens[i + 1]
+          i++
+        } else {
+          flags[key] = 'true'
+        }
+      }
+    } else {
+      promptWords.push(t)
+    }
+  }
+
+  const prompt = promptWords.join(' ').trim()
+  return { prompt, flags }
+}
+
+/**
+ * Registers the /image slash command via @deepseek-ai/dsh-commands service.
+ *
+ * @param {object} ctx - Cordis context
+ * @param {object} deps - Shared plugin runtime dependencies
+ */
+export function registerImageCommand(ctx, deps) {
+  const { live, saveAndAttachResult, resolveApiKey, slugify } = deps
+
+  ctx.inject(['commands'], (cmdCtx) => {
+    const commands = cmdCtx.commands
+    if (typeof commands?.register !== 'function') return
+
+    const executeCommand = async (rawInput, invocation = {}) => {
+      const { prompt, flags } = parseImageCommandArgs(rawInput)
+      if (!prompt) {
+        return {
+          kind: 'error',
+          text: 'Usage: /image <prompt> [--size=...] [--aspect=...] [--provider=...] [--style=...] [--seed=...]',
+          toString() { return this.text },
+        }
+      }
+
+      const cfg = typeof live === 'function' ? live() : (deps.config || {})
+      const provider = flags.provider || cfg.provider || 'fal'
+      const size = flags.size || cfg.defaultSize || 'square'
+      const format = flags.format || cfg.defaultFormat || 'png'
+      const aspectRatio = flags.aspect || flags.aspect_ratio || cfg.defaultAspectRatio
+      const effectiveStyle = flags.style || cfg.stylePreset
+      const seed = flags.seed ? Number(flags.seed) : Math.floor(Math.random() * 2147483647)
+
+      const styleInfo = resolveStylePreset(effectiveStyle, flags.negative_prompt, flags.guidance_scale)
+      const effectivePrompt = styleInfo.promptSuffix ? `${prompt}, ${styleInfo.promptSuffix}` : prompt
+
+      const job = {
+        prompt: effectivePrompt,
+        size,
+        format,
+        aspectRatio,
+        aspectPixels: aspectRatio ? ASPECT_RATIOS[aspectRatio] : undefined,
+        seed,
+        signal: invocation?.signal,
+      }
+
+      const pdeps = {
+        fetchImpl: fetch,
+        resolveKey: (ref) => resolveApiKey(ctx, ref),
+        cfg,
+        ctx,
+      }
+
+      const providerFactory = deps.makeProviders || makeProviders
+      const providers = providerFactory(pdeps, job)
+      const generateFn = providers[provider] || providers.fal || providers.custom
+      if (typeof generateFn !== 'function') {
+        throw new Error(`Unsupported provider: "${provider}". One of: fal, openai, grok, gemini, replicate, local, seedream`)
+      }
+
+      const result = await generateFn(seed, effectivePrompt)
+      const safeSlug = typeof slugify === 'function' ? slugify(prompt.slice(0, 32)) : 'image'
+      const stem = `${safeSlug}-${Date.now().toString(36)}`
+      const name = `${stem}.${format}`
+
+      const cost = calculateGenerationCost({
+        provider,
+        model: cfg.model || cfg.customModel || 'default',
+        size,
+        count: 1,
+      })
+
+      const attached = await saveAndAttachResult(ctx, invocation, cfg, {
+        bytes: result.bytes,
+        mediaType: result.mediaType || 'image/png',
+        name,
+        stem,
+        prompt,
+        size,
+        format,
+        seed,
+        provider,
+        model: cfg.model || cfg.customModel || 'default',
+        cost,
+        sourceUrl: result.sourceUrl,
+        deliverAs: cfg.deliverAs || 'link',
+        args: { prompt, ...flags },
+        action: 'generated via /image command',
+      })
+
+      return {
+        kind: 'success',
+        text: attached.summary,
+        attachment: attached.attachment,
+        toString() { return attached.summary },
+      }
+    }
+
+    const unregister = commands.register({
+      definitionId: '@goodandready/dsh-image-gen',
+      name: 'image',
+      description: 'Generate an image directly without chat model reasoning (/image <prompt> [--size=...] [--aspect=...] [--provider=...] [--style=...])',
+      input: { hint: '<prompt> [--size=...] [--aspect=...] [--provider=...] [--style=...]' },
+      handler: async (invocation) => {
+        try {
+          const raw = invocation?.rawInput || invocation?.text || (typeof invocation === 'string' ? invocation : '')
+          return await executeCommand(raw, invocation)
+        } catch (err) {
+          return {
+            kind: 'error',
+            text: `Image generation failed: ${err?.message || err}`,
+            toString() { return `Image generation failed: ${err?.message || err}` },
+          }
+        }
+      },
+      execute: async (rawArgs, invocation) => {
+        const res = await executeCommand(rawArgs, invocation)
+        return res.text
+      },
+    })
+
+    if (typeof ctx.effect === 'function') {
+      ctx.effect(() => () => unregister?.(), 'dsh-image-gen: /image slash command')
+    }
+  })
+}

package/lib/history.js

@@ -1,6 +1,6 @@
 import path from 'node:path'
 import os from 'node:os'
-import { existsSync, unlinkSync } from 'node:fs'
+import { existsSync, unlinkSync, chmodSync, readdirSync, statSync } from 'node:fs'
 import { readFile, writeFile, mkdir } from 'node:fs/promises'
 import { enforceSecurePermissions } from './security.js'
 
@@ -68,6 +68,37 @@ export async function pruneHistory(entries, pruneDays) {
   return kept
 }
 
+/**
+ * Repairs permissions on the history directory (0700) and history file (0600),
+ * migrating existing installations created under world-readable umasks (#307).
+ */
+export function repairHistoryPermissions() {
+  try {
+    const file = historyFile()
+    const dir = path.dirname(file)
+    if (existsSync(dir)) {
+      try { chmodSync(dir, 0o700) } catch (_err) { /* non-fatal permission repair */ }
+      try {
+        const files = readdirSync(dir)
+        for (const f of files) {
+          const p = path.join(dir, f)
+          try {
+            const st = statSync(p)
+            if (st.isDirectory()) {
+              chmodSync(p, 0o700)
+            } else {
+              chmodSync(p, 0o600)
+            }
+          } catch (_err) { /* skip unreadable entry */ }
+        }
+      } catch (_err) { /* skip unreadable directory */ }
+    }
+    if (existsSync(file)) {
+      try { chmodSync(file, 0o600) } catch (_err) { /* non-fatal permission repair */ }
+    }
+  } catch (_err) { /* non-fatal permission repair */ }
+}
+
 export async function readHistory() {
   try {
     const raw = await readFile(historyFile(), 'utf-8')
@@ -81,9 +112,12 @@ export async function readHistory() {
 /** Save history to disk file (atomic overwrite). */
 export async function writeHistory(entries) {
   try {
-    await mkdir(path.dirname(historyFile()), { recursive: true })
-    await writeFile(historyFile(), JSON.stringify(entries, null, 2))
-    enforceSecurePermissions(historyFile())
+    const file = historyFile()
+    const dir = path.dirname(file)
+    await mkdir(dir, { recursive: true, mode: 0o700 })
+    try { chmodSync(dir, 0o700) } catch (_err) { /* non-fatal permission repair */ }
+    await writeFile(file, JSON.stringify(entries, null, 2), { mode: 0o600 })
+    enforceSecurePermissions(file)
   } catch (e) { /* history write failure is non-fatal */ }
 }
 

package/lib/index.js

@@ -14,7 +14,7 @@
 
 import z from '@deepseek-ai/schemastery'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
-import { readFile } from 'node:fs/promises'
+import { readFile, stat } from 'node:fs/promises'
 import { isTrustedLocalRequest } from './security.js'
 import { saveAndAttachResult } from './attachment-helper.js'
 import {
@@ -27,6 +27,7 @@ import {
   readHistory,
   writeHistory,
   filterHistory,
+  repairHistoryPermissions,
 } from './history.js'
 import { existsSync } from 'node:fs'
 import path from 'node:path'
@@ -41,6 +42,7 @@ import {
 } from './providers.js'
 
 import { resolveConversationImage, analyzeImageWithVision } from './resolve-image.js'
+import { registerImageCommand } from './commands.js'
 import { registerAllTools } from './register-tools.js'
 import { registerPluginUpdater } from './updater.js'
 import { registerVaultRoutes } from './vault.js'
@@ -60,6 +62,7 @@ export {
   readHistory,
   writeHistory,
   filterHistory,
+  repairHistoryPermissions,
 }
 
 export const name = '@goodandready/dsh-image-gen'
@@ -349,16 +352,60 @@ export function publicConfig(cfg) {
 /** Read source image for editing: filesystem path or attachment id. */
 export async function resolveSource(ctx, exec, ref) {
   if (!ref) return undefined
-  const sessionCwd = exec.agent?.session?.header?.cwd
+  const sessionCwd = exec?.agent?.session?.header?.cwd || process.cwd()
   if (ref.startsWith('sha256:')) {
     const stored = await ctx.attachments.readImage({ attachmentId: ref, mediaType: 'image/png', bytes: 0, width: 0, height: 0 })
-    return { bytes: Buffer.from(stored.data), mediaType: stored.ref?.mediaType || 'image/png' }
+    const bytes = Buffer.from(stored.data || stored.bytes || [])
+    validateImageSignature(bytes, ref)
+    return { bytes, mediaType: stored.ref?.mediaType || 'image/png' }
   }
-  const p = path.resolve(sessionCwd || process.cwd(), ref)
-  const bytes = await readFile(p)
-  const ext = path.extname(p).toLowerCase()
+  if (ref.startsWith('data:')) {
+    const commaIndex = ref.indexOf(',')
+    if (commaIndex > 0) {
+      const meta = ref.slice(0, commaIndex)
+      const data = ref.slice(commaIndex + 1).trim()
+      const approxBytes = Math.ceil((data.length * 3) / 4)
+      if (approxBytes > 50 * 1024 * 1024) {
+        throw new Error('Data URI payload too large. Maximum allowed size is 50 MB.')
+      }
+      const bytes = Buffer.from(data, 'base64')
+      if (bytes.length > 50 * 1024 * 1024) {
+        throw new Error('Decoded image data too large. Maximum allowed size is 50 MB.')
+      }
+      validateImageSignature(bytes, 'inline data URI')
+      const mediaMatch = meta.match(/data:([^;]+)/)
+      return { bytes, mediaType: mediaMatch ? mediaMatch[1] : 'image/png' }
+    }
+    throw new Error('Malformed data URI')
+  }
+
+  const root = path.resolve(sessionCwd)
+  const target = path.resolve(root, ref)
+  const rel = path.relative(root, target)
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`Access denied: path "${ref}" is outside allowed workspace directory "${root}"`)
+  }
+
+  const fileStat = await stat(target).catch(() => null)
+  if (!fileStat) {
+    throw new Error(`Source image not found: ${ref}`)
+  }
+  if (!fileStat.isFile()) {
+    throw new Error(`Target is not a regular file: ${ref}`)
+  }
+  if (fileStat.size === 0) {
+    throw new Error(`Image file is empty (0 bytes): ${ref}`)
+  }
+  if (fileStat.size > 50 * 1024 * 1024) {
+    throw new Error(`Source image too large (${(fileStat.size / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
+  }
+
+  const bytes = await readFile(target)
+  validateImageSignature(bytes, ref)
+  const ext = path.extname(target).toLowerCase()
   const mediaType = ext === '.jpg' || ext === '.jpeg' ? 'image/jpeg'
     : ext === '.webp' ? 'image/webp'
+    : ext === '.gif' ? 'image/gif'
     : ext === '.svg' ? 'image/svg+xml'
     : 'image/png'
   return { bytes, mediaType }
@@ -581,7 +628,10 @@ export function apply(ctx, rawConfig) {
   })()
 
   for (const path of ['/dsh-image-gen/image', '/dsh-fal-image-gen/image']) {
-    ctx.effect(() => ctx.webServer.register({
+      // Repair history file & directory permissions on startup (#307)
+  repairHistoryPermissions()
+
+  ctx.effect(() => ctx.webServer.register({
       kind: 'exact',
       path,
       handler: imageHandler,
@@ -676,6 +726,16 @@ export function apply(ctx, rawConfig) {
   }, 'dsh-image-gen: session cleanup')
 
   // Tool registrations live in register-tools.js; each tool is a labeled ctx.effect (#216).
+    // Top-level /image slash command (#152)
+  registerImageCommand(ctx, {
+    config: baseConfig,
+    live,
+    saveAndAttachResult,
+    resolveSource,
+    slugify,
+    resolveApiKey,
+  })
+
   registerAllTools(ctx, {
     config: baseConfig,
     live,

package/lib/resolve-image.js

@@ -65,6 +65,26 @@ export function findLastConversationImage(exec) {
 /**
  * Determine MIME type by extension or signature.
  */
+/**
+ * Validate that buffer has a recognized image header (PNG, JPEG, WebP, GIF, SVG).
+ */
+export function validateImageSignature(bytes, refName = 'input') {
+  if (!bytes || bytes.length < 4) {
+    throw new Error(`Invalid image data in ${refName}: file is too small to be a valid image`)
+  }
+  const isPng = bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4E && bytes[3] === 0x47
+  const isJpeg = bytes[0] === 0xFF && bytes[1] === 0xD8 && bytes[2] === 0xFF
+  const isWebp = bytes.length >= 12 && bytes[0] === 0x52 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x46 &&
+                 bytes[8] === 0x57 && bytes[9] === 0x45 && bytes[10] === 0x42 && bytes[11] === 0x50
+  const isGif = bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38
+  const head = bytes.slice(0, 128).toString('utf8').toLowerCase()
+  const isSvg = head.includes('<svg') || (head.includes('<?xml') && head.includes('<svg'))
+
+  if (!isPng && !isJpeg && !isWebp && !isGif && !isSvg) {
+    throw new Error(`Invalid image file format in ${refName}: file does not match any recognized image signature (PNG, JPEG, WebP, GIF, SVG)`)
+  }
+}
+
 export function detectMediaType(filePath, buffer) {
   if (buffer && buffer.length >= 8) {
     // PNG signature: 89 50 4E 47 0D 0A 1A 0A
@@ -135,15 +155,26 @@ export async function resolveConversationImage(ctx, exec, targetRef) {
     }
   }
 
-  // 2. Data URI
+  // 2. Data URI (enforce pre-allocation bounded check)
   if (effectiveRef.startsWith('data:')) {
     const commaIndex = effectiveRef.indexOf(',')
     if (commaIndex > 0) {
       const meta = effectiveRef.slice(0, commaIndex)
-      const data = effectiveRef.slice(commaIndex + 1)
+      const b64Data = effectiveRef.slice(commaIndex + 1).trim()
+      const approxBytes = Math.ceil((b64Data.length * 3) / 4)
+      const MAX_IMAGE_BYTES = 50 * 1024 * 1024
+      if (approxBytes > MAX_IMAGE_BYTES) {
+        throw new Error(`Data URI payload too large (~${(approxBytes / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
+      }
+
       const mediaMatch = meta.match(/data:([^;]+)/)
       const mediaType = mediaMatch ? mediaMatch[1] : 'image/png'
-      const bytes = Buffer.from(data, 'base64')
+      const bytes = Buffer.from(b64Data, 'base64')
+      if (bytes.length > MAX_IMAGE_BYTES) {
+        throw new Error(`Decoded image data too large (${(bytes.length / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
+      }
+      validateImageSignature(bytes, 'inline data URI')
+
       return {
         bytes,
         mediaType,
@@ -151,25 +182,34 @@ export async function resolveConversationImage(ctx, exec, targetRef) {
         name: 'inline-image',
       }
     }
+    throw new Error('Malformed data URI: missing comma separator')
   }
 
-  // 3. Local filesystem resolution
-  const absPath = path.isAbsolute(effectiveRef)
-    ? effectiveRef
-    : path.resolve(sessionCwd, effectiveRef)
+  // 3. Local filesystem resolution with strict workspace containment check
+  const root = sessionCwd ? path.resolve(sessionCwd) : process.cwd()
+  const absPath = path.resolve(root, effectiveRef)
+  const rel = path.relative(root, absPath)
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`Access denied: path "${effectiveRef}" is outside allowed workspace directory "${root}"`)
+  }
 
   const fileStat = await stat(absPath).catch(() => null)
   if (!fileStat) {
     throw new Error(`Image file not found: ${effectiveRef}`)
   }
+  if (!fileStat.isFile()) {
+    throw new Error(`Target is not a regular file: ${effectiveRef}`)
+  }
   if (fileStat.size === 0) {
     throw new Error(`Image file is empty (0 bytes): ${effectiveRef}`)
   }
-  if (fileStat.size > 50 * 1024 * 1024) {
+  const MAX_IMAGE_BYTES = 50 * 1024 * 1024
+  if (fileStat.size > MAX_IMAGE_BYTES) {
     throw new Error(`Image file too large (${(fileStat.size / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
   }
 
   const bytes = await readFile(absPath)
+  validateImageSignature(bytes, effectiveRef)
   const mediaType = detectMediaType(absPath, bytes)
   return {
     bytes,

package/lib/vault.js

@@ -99,6 +99,37 @@ export function filterVaultEntries(entries, options = {}, existsFn = existsSync)
 /**
  * Delete entry and associated disk files (image + sidecar json).
  */
+export const MAX_VAULT_BODY_BYTES = 64 * 1024 // 64 KiB bounded limit (#306)
+
+/**
+ * Reads request body with a hard byte ceiling, aborting early with 413 if exceeded.
+ */
+export async function readBoundedRequestBody(req, maxBytes = MAX_VAULT_BODY_BYTES) {
+  const clHeader = req?.headers && (req.headers['content-length'] || req.headers['Content-Length'])
+  if (clHeader !== undefined) {
+    const cl = Number(clHeader)
+    if (Number.isFinite(cl) && cl > maxBytes) {
+      const err = new Error(`Payload Too Large: Content-Length ${cl} exceeds maximum allowed size of ${maxBytes} bytes`)
+      err.statusCode = 413
+      throw err
+    }
+  }
+
+  let received = 0
+  const chunks = []
+  for await (const chunk of req) {
+    received += chunk.length
+    if (received > maxBytes) {
+      if (typeof req.destroy === 'function') req.destroy()
+      const err = new Error(`Payload Too Large: request body exceeded maximum allowed size of ${maxBytes} bytes`)
+      err.statusCode = 413
+      throw err
+    }
+    chunks.push(chunk)
+  }
+  return Buffer.concat(chunks)
+}
+
 export async function deleteVaultEntry(id) {
   if (!id) return { success: false, error: 'Missing entry id' }
   const entries = await readHistory()
@@ -157,11 +188,19 @@ export function registerVaultRoutes(ctx) {
 
         if (!id) {
           try {
-            const chunks = []
-            for await (const chunk of req) chunks.push(chunk)
-            const body = JSON.parse(Buffer.concat(chunks).toString('utf-8'))
-            id = body.id
-          } catch { /* body parse error */ }
+            const buf = await readBoundedRequestBody(req, MAX_VAULT_BODY_BYTES)
+            if (buf && buf.length > 0) {
+              const body = JSON.parse(buf.toString('utf-8'))
+              id = body?.id
+            }
+          } catch (err) {
+            if (err?.statusCode === 413) {
+              res.writeHead(413, { 'Content-Type': 'application/json' })
+              res.end(JSON.stringify({ ok: false, error: err.message }))
+              return
+            }
+            /* body parse error falls through to missing id check */
+          }
         }
 
         if (!id) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",
@@ -70,7 +70,8 @@
   },
   "scripts": {
     "test": "node scripts/build-client.mjs && node --check lib/client.js && node --test test/*.test.mjs",
-    "build:client": "node scripts/build-client.mjs"
+    "build:client": "node scripts/build-client.mjs",
+    "publish:github": "bash scripts/publish-github.sh"
   },
   "publishConfig": {
     "access": "public"