@goodandready/dsh-image-gen 0.11.6 → 0.11.8

package/README.md

@@ -167,6 +167,12 @@
 * **Cache & History Consistency**: Ensured content-addressed disk cache hits synchronize seamlessly with generation history and sidecar metadata.
 * **Test Suite Expansion**: Added `test/batch4-hardening.test.mjs`, expanding test coverage to **128 automated unit tests (100% pass)**.
 
+### 🚀 What's New in v0.11.8
+* **Bounded Config Payloads (#313)**: `PUT /dsh-image-gen/config` now uses bounded request streaming (`readBoundedRequestBody`) with a 64 KB cap, returning HTTP 413 `Payload Too Large` on oversized bodies to prevent memory exhaustion DoS.
+* **Build Parity Gate (#316)**: `scripts/build-client.mjs` supports `--check` mode, enforcing client distribution parity in `npm test`.
+* **Architecture Decomposition (#317)**: `lib/index.js` simplified into a lightweight facade (<400 lines) with dedicated `lib/config-schema.js` and `lib/resolve-source.js`.
+* **Runtime & Permissions Polish (#318, #319)**: Idempotent startup permissions repair and removal of legacy `loc.get` fallback in favor of standard Cordis translation runtime.
+
 ### 🚀 What's New in v0.10.15
 * **Loop Guard Zero-Limit Bypass (#212)**: Fixed an edge case where setting `loopGuardLimit: 0` (configured to disable protection) enforced a limit of 1 due to `Math.max(1, limit)`. Setting limit to 0 now properly bypasses loop checks.
 * **Security Hardening (Token Masking)**: Added automatic pattern masking for Replicate API tokens (`r8_...`) and Google Gemini API keys (`AIza...`) in `sanitizeErrorAndLogs`.

package/README.ru.md

@@ -34,6 +34,12 @@
 </div>
 
 ---
+## 🚀 Обновления v0.11.8: Защита конфигурационных маршрутов, паритет сборки и модульная архитектура
+* **Ограничение размера тела настроек (#313)**: Маршрут `PUT /dsh-image-gen/config` защищён лимитом 64 КБ с возвратом HTTP 413 `Payload Too Large` при превышении, исключая DoS ядра через исчерпание кучи.
+* **Контроль паритета сборки клиента (#316)**: В `scripts/build-client.mjs` добавлен режим `--check`, встроенный в `npm test` для предотвращения рассинхронизации `lib/client.js` с фрагментами `src/client/*`.
+* **Декомпозиция архитектуры (#317)**: `lib/index.js` сокращён до тонкого фасада (<400 строк); схема конфигурации вынесена в `lib/config-schema.js`, а резолвер источников — в `lib/resolve-source.js`.
+* **Оптимизация инициализации и клиента (#318, #319)**: Устранено дублирование проверки прав истории при старте плагина; удалён устаревший fallback `loc.get` в пользу штатного API Cordis.
+
 ## 🚀 Обновления v0.10.26: Архитектурная декомпозиция и чистота репозитория (#235, #238, #239)
 * **Архитектурная декомпозиция модулей (#239)**: Все серверные модули в `lib/` приведены к проектному стандарту <= 600 строк: генерация пакетов вынесена в `lib/tools/generation-pack.js` (74 строки, `generation.js` снижен до 547 строк), кэш и история — в `lib/history.js` (93 строки), вложения и сайдкары — в `lib/attachment-helper.js` (82 строки, `index.js` снижен до 557 строк). Клиентский код полностью разбит на 15 модулей в `src/client/*` (каждый <= 337 строк).
 * **Чистота репозитория (#235)**: Служебные файлы агентов (`AGENTS.md`, `index.md`) сняты с git-отслеживания и защищены правилами в `.gitignore` и `.gitattributes`.

package/README.zh.md

@@ -122,3 +122,9 @@ MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
 * **`generate_style_matrix` (#286)**: 2x2 风格矩阵探索与双盲对比，并发生成 4 种美学预设切片并支持一键应用。
 * **`对话内局部重绘画布` (#285)**: 在消息卡片上直接唤起交互式笔刷画布，支持选区涂抹与即时 Inpainting 局部重绘。
 * **`智能服务商自动故障转移链` (#282)**: 主服务商 429、5xx、超时或额度耗尽时自动无缝切换备选渠道。
+
+## 🛡️ 安全性
+* **配置请求大小限制 (#313)**：`PUT /dsh-image-gen/config` 限制请求体最大 64 KB，超出返回 HTTP 413，防止内存耗尽 DoS。
+* **客户端构建校验 (#316)**：`scripts/build-client.mjs` 支持 `--check` 模式，确保构建一致性。
+* **架构解耦优化 (#317)**：`lib/index.js` 精简为轻量级门面（<400 行），拆分 `config-schema.js` 与 `resolve-source.js`。
+* **启动与运行时清理 (#318, #319)**：优化历史记录权限修复，移除废弃的 `loc.get` 调用。

package/lib/client.js

@@ -56,7 +56,6 @@ window.__ModuleLoader__.load({
       const loc = ctx?.locale || props?.ctx?.locale
       if (loc) {
         if (typeof loc.t === 'function') return (k, def) => loc.t(NS + '.' + k) || loc.t(k) || def || k
-        if (typeof loc.get === 'function') return (k, def) => loc.get(NS + '.' + k) || loc.get(k) || def || k
       }
       return (k, def) => def || k
     }

package/lib/commands.js

@@ -1,6 +1,6 @@
 // commands.js — Top-level slash command /image for direct generation without LLM reasoning (#152)
 
-import { makeProviders, resolveStylePreset } from './providers.js'
+import { makeProviders, resolveStylePreset, applyStylePreset } from './providers.js'
 import { ASPECT_RATIOS } from './providers/shared-helpers.js'
 import { calculateGenerationCost } from './cost-meter.js'
 
@@ -82,7 +82,7 @@ export function registerImageCommand(ctx, deps) {
       const seed = flags.seed ? Number(flags.seed) : Math.floor(Math.random() * 2147483647)
 
       const styleInfo = resolveStylePreset(effectiveStyle, flags.negative_prompt, flags.guidance_scale)
-      const effectivePrompt = styleInfo.promptSuffix ? `${prompt}, ${styleInfo.promptSuffix}` : prompt
+      const effectivePrompt = applyStylePreset(prompt, effectiveStyle)
 
       const job = {
         prompt: effectivePrompt,

package/lib/config-schema.js

@@ -0,0 +1,302 @@
+// lib/config-schema.js — Zod configuration schema and normalization helpers (#317)
+
+import z from '@deepseek-ai/schemastery'
+import { IMAGE_SIZES, OUTPUT_FORMATS, PROVIDER_KEYS } from './providers.js'
+
+// Polyfill for .volatile() schema annotation if runtime schemastery lacks it (#295)
+if (typeof z.prototype?.volatile !== 'function') {
+  z.prototype.volatile = function volatile() {
+    if (this.meta && this.meta.volatile) throw new TypeError('volatile schema is already wrapped')
+    return typeof this.extra === 'function' ? this.extra('volatile', true) : this
+  }
+}
+
+export const Config = z.object({
+  enabled: z
+    .boolean()
+    .description('Master switch for image generation. When false, tools refuse to execute.')
+    .default(true)
+    .volatile(),
+  provider: z
+    .string()
+    .description(`Which provider generates the image. One of: ${PROVIDER_KEYS.join(', ')}. `
+      + '"fal" uses the FAL queue below; "custom" uses the OpenAI-compatible API configured under it.')
+    .default('fal')
+    .volatile(),
+  model: z
+    .string()
+    .description('FAL model id, called as {baseURL}/{model}.')
+    .default('fal-ai/flux-2/klein/9b')
+    .volatile(),
+  apiKeyEnv: z
+    .string()
+    .role('credential-ref')
+    .description('Credential reference / env var holding the FAL API key (the "Key " auth prefix is added automatically when missing).')
+    .default('FAL_API_KEY')
+    .volatile(),
+  baseURL: z
+    .string()
+    .description('FAL queue base URL.')
+    .default('https://queue.fal.run')
+    .volatile(),
+  defaultSize: z
+    .string()
+    .description(`Default image size when the tool call omits image_size. One of: ${IMAGE_SIZES.join(', ')}.`)
+    .default('landscape_4_3')
+    .volatile(),
+  defaultFormat: z
+    .string()
+    .description(`Default image format when the tool call omits output_format. One of: ${OUTPUT_FORMATS.join(', ')}.`)
+    .default('png')
+    .volatile(),
+  defaultAspectRatio: z
+    .string()
+    .description('Default aspect ratio (square, landscape_16_9, portrait_9_16, etc.) used when prompt does not specify dimensions.')
+    .default('square')
+    .volatile(),
+  deliverAs: z
+    .string()
+    .description('How generated images are returned: "link" keeps them on disk and embeds an inline preview link; "attachment" embeds full image bytes directly in the chat.')
+    .default('link')
+    .volatile(),
+  outputDir: z
+    .string()
+    .description('Directory relative to workspace where generated images are saved.')
+    .default('generated-images')
+    .volatile(),
+  pollIntervalMs: z
+    .number()
+    .description('Polling interval for FAL queue status in milliseconds.')
+    .default(500)
+    .volatile(),
+  timeoutMs: z
+    .number()
+    .description('Hard timeout for image generation in milliseconds.')
+    .default(180000)
+    .volatile(),
+  customBaseURL: z
+    .string()
+    .description('Base URL for OpenAI-compatible images API (provider=custom), e.g. https://api.openai.com/v1.')
+    .default('https://api.openai.com/v1')
+    .volatile(),
+  customModel: z
+    .string()
+    .description('Model name for OpenAI-compatible images API, e.g. dall-e-3 or flux-schnell.')
+    .default('dall-e-3')
+    .volatile(),
+  customKeyEnv: z
+    .string()
+    .role('credential-ref')
+    .description('Credential reference / env var holding the custom provider API key.')
+    .default('CUSTOM_IMAGE_API_KEY')
+    .volatile(),
+  customSize: z
+    .string()
+    .description('Image size sent to custom API, e.g. 1024x1024.')
+    .default('1024x1024')
+    .volatile(),
+  replicateModel: z
+    .string()
+    .description('Replicate model identifier in format owner/model or owner/model:version.')
+    .default('black-forest-labs/flux-schnell')
+    .volatile(),
+  replicateKeyEnv: z
+    .string()
+    .role('credential-ref')
+    .description('Credential reference / env var holding the Replicate API token.')
+    .default('REPLICATE_API_TOKEN')
+    .volatile(),
+  grokKeyEnv: z
+    .string()
+    .role('credential-ref')
+    .description('Credential reference / env var holding the xAI Grok API key.')
+    .default('XAI_API_KEY')
+    .volatile(),
+  chatgptKeyEnv: z
+    .string()
+    .role('credential-ref')
+    .description('Credential reference / env var holding the OpenAI ChatGPT API key.')
+    .default('OPENAI_API_KEY')
+    .volatile(),
+  seedreamModel: z
+    .string()
+    .description('Volcengine SeaDream model deployment endpoint/ID.')
+    .default('doubao-seedream-3.0-t2i')
+    .volatile(),
+  seedreamKeyEnv: z
+    .string()
+    .role('credential-ref')
+    .description('Credential reference / env var holding the Volcengine SeaDream API key.')
+    .default('SEEDREAM_API_KEY')
+    .volatile(),
+  seedreamBaseURL: z
+    .string()
+    .description('Base URL for Volcengine SeaDream API.')
+    .default('https://ark.cn-beijing.volces.com/api/v3')
+    .volatile(),
+  geminiModel: z
+    .string()
+    .description('Google Gemini Imagen model identifier.')
+    .default('imagen-3.0-generate-002')
+    .volatile(),
+  geminiKeyEnv: z
+    .string()
+    .role('credential-ref')
+    .description('Credential reference / env var holding the Google Gemini API key.')
+    .default('GEMINI_API_KEY')
+    .volatile(),
+  localKind: z
+    .string()
+    .description('Local generation backend kind: "automatic1111" (WebUI) or "comfyui".')
+    .default('automatic1111')
+    .volatile(),
+  localBaseURL: z
+    .string()
+    .description('Base URL for local backend (e.g., http://127.0.0.1:7860 or http://127.0.0.1:8188).')
+    .default('http://127.0.0.1:7860')
+    .volatile(),
+  localModel: z
+    .string()
+    .description('Model checkpoint name for local generation.')
+    .default('v1-5-pruned-emaonly.safetensors')
+    .volatile(),
+  localSteps: z
+    .number()
+    .description('Sampling steps for local generation.')
+    .default(20)
+    .volatile(),
+  localCfg: z
+    .number()
+    .description('CFG scale for local generation.')
+    .default(7.0)
+    .volatile(),
+  subscriptionQuality: z
+    .string()
+    .description('Image quality tier for subscription accounts: "standard" or "hd".')
+    .default('standard')
+    .volatile(),
+  autoEnhancePrompt: z
+    .boolean()
+    .description('Automatically enhance short prompts using LLM before generation.')
+    .default(false)
+    .volatile(),
+  defaultStylePreset: z
+    .string()
+    .description('Default visual style applied to generated images (e.g. photo, anime, digital-art, cinematic).')
+    .default('none')
+    .volatile(),
+  enhancePrompt: z
+    .boolean()
+    .description('When true, short or vague prompts are expanded by the chat model before image generation.')
+    .default(false)
+    .volatile(),
+  enhanceModel: z
+    .string()
+    .description('Model name to use for prompt enhancement (empty uses active chat model).')
+    .default('')
+    .volatile(),
+  enhanceBelowChars: z
+    .number()
+    .description('Prompts shorter than this character count trigger prompt enhancement.')
+    .default(40)
+    .volatile(),
+  stylePreset: z
+    .string()
+    .description('Default style preset applied to prompts (e.g., "photographic", "anime", "cinematic"). "none" disables.')
+    .default('none')
+    .volatile(),
+  cacheBySeed: z
+    .boolean()
+    .description('When true, identical prompt+seed requests reuse previous generation from disk cache.')
+    .default(true)
+    .volatile(),
+  cacheByPrompt: z
+    .boolean()
+    .description('When true and seed is random, identical prompts return cached result instead of re-generating.')
+    .default(false)
+    .volatile(),
+  historyLimit: z
+    .number()
+    .description('Maximum number of generation history records to retain in ~/.dsh/image-gen-history.json.')
+    .default(500)
+    .volatile(),
+  pruneDays: z
+    .number()
+    .description('Prune history records older than this many days (0 = disable time-based pruning).')
+    .default(30)
+    .volatile(),
+  qualityGate: z
+    .boolean()
+    .description('Automatically inspect generated image sharpness and detect blank/corrupt outputs, retrying once if needed.')
+    .default(true)
+    .volatile(),
+  dailyBudgetUsd: z
+    .number()
+    .description('Daily image generation spending budget in USD. 0 (default) disables limit enforcement.')
+    .default(0)
+    .volatile(),
+  loopGuardLimit: z
+    .number()
+    .description('Maximum consecutive image generations per session without user interaction. 0 disables protection.')
+    .default(3)
+    .volatile(),
+  diskCache: z
+    .boolean()
+    .description('Content-addressed disk caching for identical generations (<50ms retrieval, zero API cost). On by default.')
+    .default(true)
+    .volatile(),
+  fallbackProviders: z
+    .array(z.string())
+    .description('Ordered list of fallback providers to cascade to if the primary encounters 429, 5xx, or quota limits.')
+    .default([])
+    .volatile(),
+})
+
+export function isVolatileRef(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value) && typeof value.get === 'function'
+}
+
+export function plainConfig(cfg) {
+  if (isVolatileRef(cfg)) return plainConfig(cfg.get())
+  if (!cfg || typeof cfg !== 'object') return cfg
+  const out = {}
+  for (const key of Object.keys(cfg)) {
+    const value = cfg[key]
+    out[key] = isVolatileRef(value) ? value.get() : value
+  }
+  return out
+}
+
+export function volatileConfig(cfg) {
+  const plain = plainConfig(cfg)
+  if (!plain || typeof plain !== 'object') return plain
+  const out = {}
+  for (const [key, field] of Object.entries(Config.dict || {})) {
+    if (field?.meta?.volatile && Object.hasOwn(plain, key)) {
+      out[key] = plain[key]
+    }
+  }
+  return out
+}
+
+export function publicConfig(cfg) {
+  return plainConfig(cfg)
+}
+
+export function sanitizeRaw(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {}
+  const cleaned = {}
+  for (const [k, v] of Object.entries(raw)) {
+    if (v && typeof v === 'object' && !Array.isArray(v) && typeof v.get !== 'function' && Object.keys(v).length === 0) {
+      continue
+    }
+    cleaned[k] = v
+  }
+  return cleaned
+}
+
+export function ensureConfig(raw) {
+  const cleaned = sanitizeRaw(raw)
+  const plain = plainConfig(cleaned)
+  return Config(plain)
+}

package/lib/index.js

@@ -12,9 +12,7 @@
 // Credentials, or $DSH_HOME/.credentials.yaml) under the configured reference,
 // falling back to the process environment.
 
-import z from '@deepseek-ai/schemastery'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
-import { readFile, stat } from 'node:fs/promises'
 import { isTrustedLocalRequest } from './security.js'
 import { saveAndAttachResult } from './attachment-helper.js'
 import {
@@ -41,7 +39,7 @@ import {
   testProviderConnection,
 } from './providers.js'
 
-import { resolveConversationImage, analyzeImageWithVision } from './resolve-image.js'
+import { resolveConversationImage, analyzeImageWithVision, validateImageSignature } from './resolve-image.js'
 import { registerImageCommand } from './commands.js'
 import { registerAllTools } from './register-tools.js'
 import { registerPluginUpdater } from './updater.js'
@@ -49,6 +47,8 @@ import { registerVaultRoutes } from './vault.js'
 import { registerSettingsRoutes } from './settings-route.js'
 import { clearAllAnchors } from './anchor-helpers.js'
 import { resetLoopGuard, getLoopGuardState } from './loop-guard.js'
+import { Config, plainConfig, volatileConfig, publicConfig, ensureConfig } from './config-schema.js'
+import { resolveSource } from './resolve-source.js'
 
 export { IMAGE_SIZES, OUTPUT_FORMATS, PROVIDER_KEYS, buildSidecar, normalizeMediaType, resolveConversationImage, analyzeImageWithVision }
 export { saveAndAttachResult }
@@ -65,6 +65,9 @@ export {
   repairHistoryPermissions,
 }
 
+export { Config, plainConfig, volatileConfig, publicConfig, ensureConfig }
+export { resolveSource }
+
 export const name = '@goodandready/dsh-image-gen'
 
 /** Settings namespace the Web card edits. */
@@ -75,346 +78,10 @@ const NS = 'dsh-image-gen'
 const LEGACY_NS = 'dsh-fal-image-gen'
 export const inject = ['tools', 'attachments', 'credentials', 'webServer', 'settings', 'llm', 'systemPrompt']
 
-// Polyfill for .volatile() schema annotation if runtime schemastery lacks it (#295)
-if (typeof z.prototype?.volatile !== 'function') {
-  z.prototype.volatile = function volatile() {
-    if (this.meta && this.meta.volatile) throw new TypeError('volatile schema is already wrapped')
-    return typeof this.extra === 'function' ? this.extra('volatile', true) : this
-  }
-}
-
-export const Config = z.object({
-  enabled: z
-    .boolean()
-    .description('Master switch for image generation. When false, tools refuse to execute.')
-    .default(true)
-    .volatile(),
-  provider: z
-    .string()
-    .description(`Which provider generates the image. One of: ${PROVIDER_KEYS.join(', ')}. `
-      + '"fal" uses the FAL queue below; "custom" uses the OpenAI-compatible API configured under it.')
-    .default('fal')
-    .volatile(),
-  model: z
-    .string()
-    .description('FAL model id, called as {baseURL}/{model}.')
-    .default('fal-ai/flux-2/klein/9b')
-    .volatile(),
-  apiKeyEnv: z
-    .string()
-    .role('credential-ref')
-    .description('Credential reference / env var holding the FAL API key (the "Key " auth prefix is added automatically when missing).')
-    .default('FAL_API_KEY')
-    .volatile(),
-  baseURL: z
-    .string()
-    .description('FAL queue base URL.')
-    .default('https://queue.fal.run')
-    .volatile(),
-  defaultSize: z
-    .string()
-    .description(`Default image size when the tool call omits image_size. One of: ${IMAGE_SIZES.join(', ')}.`)
-    .default('landscape_4_3')
-    .volatile(),
-  defaultFormat: z
-    .string()
-    .description(`Default output format. One of: ${OUTPUT_FORMATS.join(', ')}.`)
-    .default('png')
-    .volatile(),
-  pollIntervalMs: z
-    .number()
-    .description('Status polling interval in milliseconds.')
-    .default(2000)
-    .volatile(),
-  timeoutMs: z
-    .number()
-    .description('Total generation timeout in milliseconds (submit + poll + download).')
-    .default(180000)
-    .volatile(),
-  deliverAs: z
-    .string()
-    .description(
-      'How the finished image reaches the conversation. '
-      + '"link": the tool returns a link and the card renders the picture from it — the chat model only ever sees text, so this works with any model. '
-      + '"image": the tool returns the image itself — the picture is part of the result, which a text-only chat model cannot read, so this mode needs dsh-vision-bridge (or a vision-capable chat model).'
-    )
-    .default('link')
-    .volatile(),
-  customBaseURL: z
-    .string()
-    .description('provider=custom: API root without a trailing slash, e.g. https://api.openai.com/v1. '
-      + 'The request goes to {customBaseURL}/images/generations.')
-    .default('')
-    .volatile(),
-  customModel: z
-    .string()
-    .description('provider=custom: model id, e.g. gpt-image-1.')
-    .default('')
-    .volatile(),
-  customKeyEnv: z
-    .string()
-    .role('credential-ref')
-    .description('provider=custom: credential reference / env var holding the API key. '
-      + 'Empty means no authorization header, for gateways that need none.')
-    .default('OPENAI_API_KEY')
-    .volatile(),
-
-  replicateModel: z
-    .string()
-    .description('provider=replicate: model identifier on Replicate.')
-    .default('black-forest-labs/flux-schnell')
-    .volatile(),
-  replicateKeyEnv: z
-    .string()
-    .role('credential-ref')
-    .description('provider=replicate: credential reference / env var holding API token.')
-    .default('REPLICATE_API_TOKEN')
-    .volatile(),
-
-  subscriptionQuality: z
-    .string()
-    .description('provider=codex or grok: quality asked of the subscription — low, medium, high or empty '
-      + 'for the provider default.')
-    .default('')
-    .volatile(),
-  customSize: z
-    .string()
-    .description('provider=custom: fixed size sent to the API, e.g. 1024x1024. '
-      + 'Empty means the named size is translated automatically — set this only for an API picky about sizes.')
-    .default('')
-    .volatile(),
-  localKind: z
-    .string()
-    .description('provider=local: which local API to use — "comfyui" or "a1111".')
-    .default('comfyui')
-    .volatile(),
-  localBaseURL: z
-    .string()
-    .description('provider=local: server address, e.g. http://127.0.0.1:8188 (ComfyUI) or http://127.0.0.1:7860 (A1111).')
-    .default('')
-    .volatile(),
-  localModel: z
-    .string()
-    .description('provider=local: model id (A1111) or workflow/schema name (ComfyUI). Empty means the server default.')
-    .default('')
-    .volatile(),
-  localSteps: z
-    .number()
-    .description('provider=local: sampling steps.')
-    .default(20)
-    .volatile(),
-  localCfg: z
-    .number()
-    .description('provider=local: CFG scale.')
-    .default(7)
-    .volatile(),
-  seedreamBaseURL: z
-    .string()
-    .description('provider=seedream: base URL, e.g. https://api.bytedanceapi.com/v1 or Volcengine Ark.')
-    .default('https://api.bytedanceapi.com/v1')
-    .volatile(),
-  seedreamKeyEnv: z
-    .string()
-    .role('credential-ref')
-    .description('provider=seedream: credential reference / env var holding the API key.')
-    .default('SEEDREAM_API_KEY')
-    .volatile(),
-  seedreamModel: z
-    .string()
-    .description('provider=seedream: model id, e.g. seedream-4.0.')
-    .default('seedream-4.0')
-    .volatile(),
-  geminiKeyEnv: z
-    .string()
-    .role('credential-ref')
-    .description('provider=gemini: credential reference / env var holding the Google API key.')
-    .default('GEMINI_API_KEY')
-    .volatile(),
-  geminiModel: z
-    .string()
-    .description('provider=gemini: model id, e.g. gemini-2.0-flash-exp-image-generation.')
-    .default('gemini-2.0-flash-exp-image-generation')
-    .volatile(),
-  outputDir: z
-    .string()
-    .description('Where generated images are saved. A relative path resolves against the session working directory; an absolute path is used as given.')
-    .default('generated/images')
-    .volatile(),
-  historyLimit: z
-    .number()
-    .description('How many recent generations to keep in the in-memory history list.')
-    .default(50)
-    .volatile(),
-  pruneDays: z
-    .number()
-    .description('Delete generated files and history entries older than this many days. 0 (default) disables pruning.')
-    .default(0)
-    .volatile(),
-  enhancePrompt: z
-    .boolean()
-    .description('Expand a short prompt into a detailed one through the chat model before generating. Off by default.')
-    .default(false)
-    .volatile(),
-  enhanceModel: z
-    .string()
-    .description('Model used to enhance the prompt. Empty means the same model that leads the conversation.')
-    .default('')
-    .volatile(),
-  autoEnhancePrompt: z
-    .boolean()
-    .description('Enrich prompts with photography, lighting, and composition quality tokens.')
-    .default(false)
-    .volatile(),
-  defaultStylePreset: z
-    .string()
-    .description('Default style preset applied to generations (e.g. cinematic, anime, photorealistic).')
-    .default('none')
-    .volatile(),
-  enhanceBelowChars: z
-    .number()
-    .description('Only enhance prompts shorter than this many characters.')
-    .default(200)
-    .volatile(),
-  stylePreset: z
-    .string()
-    .description('Optional style suffix appended to the prompt before generation. Empty (default) means no style is applied and the prompt is used as-is.')
-    .default('')
-    .volatile(),
-  cacheBySeed: z
-    .boolean()
-    .description('If the same seed+prompt was already generated (present in history), return the cached result instead of generating again. Off by default.')
-    .default(false)
-    .volatile(),
-  cacheByPrompt: z
-    .boolean()
-    .description('If the same prompt was already generated (present in history), return the cached result instead of generating again. Off by default.')
-    .default(false)
-    .volatile(),
-  qualityGate: z
-    .boolean()
-    .description('Automatic quality gate with silent re-roll for blank or defective frames. On by default.')
-    .default(true)
-    .volatile(),
-  dailyBudgetUsd: z
-    .number()
-    .description('Daily image generation spending budget in USD. 0 (default) disables limit enforcement.')
-    .default(0)
-    .volatile(),
-  loopGuardLimit: z
-    .number()
-    .description('Maximum consecutive image generations per session without user interaction. 0 disables protection.')
-    .default(3)
-    .volatile(),
-  diskCache: z
-    .boolean()
-    .description('Content-addressed disk caching for identical generations (<50ms retrieval, zero API cost). On by default.')
-    .default(true)
-    .volatile(),
-  fallbackProviders: z
-    .array(z.string())
-    .description('Ordered list of fallback providers to cascade to if the primary encounters 429, 5xx, or quota limits.')
-    .default([])
-    .volatile(),
-})
-
-function isVolatileRef(value) {
-  return !!value && typeof value === 'object' && !Array.isArray(value) && typeof value.get === 'function'
-}
-
-export function plainConfig(cfg) {
-  if (isVolatileRef(cfg)) return plainConfig(cfg.get())
-  if (!cfg || typeof cfg !== 'object') return cfg
-  const out = {}
-  for (const key of Object.keys(cfg)) {
-    const value = cfg[key]
-    out[key] = isVolatileRef(value) ? value.get() : value
-  }
-  return out
-}
-
-export function volatileConfig(cfg) {
-  const plain = plainConfig(cfg)
-  if (!plain || typeof plain !== 'object') return plain
-  const out = {}
-  for (const [key, field] of Object.entries(Config.dict || {})) {
-    if (field?.meta?.volatile && Object.hasOwn(plain, key)) {
-      out[key] = plain[key]
-    }
-  }
-  return out
-}
-
-export function publicConfig(cfg) {
-  return plainConfig(cfg)
-}
-
-/** Keep a file stem safe for the filesystem. */
-/** Read source image for editing: filesystem path or attachment id. */
-export async function resolveSource(ctx, exec, ref) {
-  if (!ref) return undefined
-  const sessionCwd = exec?.agent?.session?.header?.cwd || process.cwd()
-  if (ref.startsWith('sha256:')) {
-    const stored = await ctx.attachments.readImage({ attachmentId: ref, mediaType: 'image/png', bytes: 0, width: 0, height: 0 })
-    const bytes = Buffer.from(stored.data || stored.bytes || [])
-    validateImageSignature(bytes, ref)
-    return { bytes, mediaType: stored.ref?.mediaType || 'image/png' }
-  }
-  if (ref.startsWith('data:')) {
-    const commaIndex = ref.indexOf(',')
-    if (commaIndex > 0) {
-      const meta = ref.slice(0, commaIndex)
-      const data = ref.slice(commaIndex + 1).trim()
-      const approxBytes = Math.ceil((data.length * 3) / 4)
-      if (approxBytes > 50 * 1024 * 1024) {
-        throw new Error('Data URI payload too large. Maximum allowed size is 50 MB.')
-      }
-      const bytes = Buffer.from(data, 'base64')
-      if (bytes.length > 50 * 1024 * 1024) {
-        throw new Error('Decoded image data too large. Maximum allowed size is 50 MB.')
-      }
-      validateImageSignature(bytes, 'inline data URI')
-      const mediaMatch = meta.match(/data:([^;]+)/)
-      return { bytes, mediaType: mediaMatch ? mediaMatch[1] : 'image/png' }
-    }
-    throw new Error('Malformed data URI')
-  }
-
-  const root = path.resolve(sessionCwd)
-  const target = path.resolve(root, ref)
-  const rel = path.relative(root, target)
-  if (rel.startsWith('..') || path.isAbsolute(rel)) {
-    throw new Error(`Access denied: path "${ref}" is outside allowed workspace directory "${root}"`)
-  }
-
-  const fileStat = await stat(target).catch(() => null)
-  if (!fileStat) {
-    throw new Error(`Source image not found: ${ref}`)
-  }
-  if (!fileStat.isFile()) {
-    throw new Error(`Target is not a regular file: ${ref}`)
-  }
-  if (fileStat.size === 0) {
-    throw new Error(`Image file is empty (0 bytes): ${ref}`)
-  }
-  if (fileStat.size > 50 * 1024 * 1024) {
-    throw new Error(`Source image too large (${(fileStat.size / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
-  }
-
-  const bytes = await readFile(target)
-  validateImageSignature(bytes, ref)
-  const ext = path.extname(target).toLowerCase()
-  const mediaType = ext === '.jpg' || ext === '.jpeg' ? 'image/jpeg'
-    : ext === '.webp' ? 'image/webp'
-    : ext === '.gif' ? 'image/gif'
-    : ext === '.svg' ? 'image/svg+xml'
-    : 'image/png'
-  return { bytes, mediaType }
-}
-
 export function slugify(input) {
   const stem = String(input ?? '')
     .toLowerCase()
-    .replace(/[^a-z0-9\u0400-\u04ff]+/gi, '-')
+    .replace(/[^a-z0-9Ѐ-ӿ]+/gi, '-')
     .replace(/^-+|-+$/g, '')
     .slice(0, 48)
   return stem || 'image'
@@ -460,36 +127,14 @@ function migrateLegacySettings(sctx, scope) {
  *  Canonical implementation lives in prompt-enhancer.js; re-exported for backwards compat. */
 export { collectText } from './prompt-enhancer.js'
 
-
 /** Expand short prompt via chat model; return original prompt on error.
  *  Canonical implementation lives in prompt-enhancer.js; re-exported for backwards compat. */
 export { buildEnhancePromptSystemMessage } from './prompt-enhancer.js'
 
-
 /** Expand short prompt via chat model; return original prompt on error.
  *  Canonical implementation lives in prompt-enhancer.js; re-exported for backwards compat. */
 export { enhancePrompt } from './prompt-enhancer.js'
 
-
-function sanitizeRaw(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {}
-  const cleaned = {}
-  for (const [k, v] of Object.entries(raw)) {
-    if (v && typeof v === "object" && !Array.isArray(v) && typeof v.get !== "function" && Object.keys(v).length === 0) {
-      continue
-    }
-    cleaned[k] = v
-  }
-  return cleaned
-}
-
-export function ensureConfig(raw) {
-  const cleaned = sanitizeRaw(raw)
-  const plain = plainConfig(cleaned)
-  return Config(plain)
-}
-
-
 export function apply(ctx, rawConfig) {
   const config = ensureConfig(rawConfig)
   const baseConfig = plainConfig(config)
@@ -577,61 +222,59 @@ export function apply(ctx, rawConfig) {
   })
 
   // Serve the stored image so the tool card can show it inline.
-  const imageHandler = (() => {
-    return async (req, res) => {
-      if (req.method !== 'GET' && req.method !== 'HEAD') {
-        res.writeHead(405, { 'Content-Type': 'application/json' })
-        res.end(JSON.stringify({ error: 'GET only' }))
-        return
-      }
-      if (!isTrustedLocalRequest(req)) {
-        res.writeHead(403, { 'Content-Type': 'application/json' })
-        res.end(JSON.stringify({ error: 'forbidden' }))
-        return
-      }
-      const query = new URL(req.url ?? '/', 'http://x').searchParams
-      const id = query.get('id') ?? ''
-      if (!/^sha256:[0-9a-f]{64}$/.test(id)) {
-        res.writeHead(400, { 'Content-Type': 'application/json' })
-        res.end(JSON.stringify({ error: 'bad attachment id' }))
-        return
-      }
+  const imageHandler = async (req, res) => {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.writeHead(405, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: 'GET only' }))
+      return
+    }
+    if (!isTrustedLocalRequest(req)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: 'forbidden' }))
+      return
+    }
+    const query = new URL(req.url ?? '/', 'http://x').searchParams
+    const id = query.get('id') ?? ''
+    if (!/^sha256:[0-9a-f]{64}$/.test(id)) {
+      res.writeHead(400, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: 'bad attachment id' }))
+      return
+    }
 
-      const mediaType = query.get('mediaType') ?? 'image/png'
-      const bytes = Number(query.get('bytes') ?? 0)
-      const width = Number(query.get('width') ?? 0)
-      const height = Number(query.get('height') ?? 0)
+    const mediaType = query.get('mediaType') ?? 'image/png'
+    const bytes = Number(query.get('bytes') ?? 0)
+    const width = Number(query.get('width') ?? 0)
+    const height = Number(query.get('height') ?? 0)
 
-      try {
-        const stored = await ctx.attachments.readImage({
-          attachmentId: id,
-          mediaType,
-          bytes,
-          width,
-          height,
-        })
-        res.writeHead(200, {
-          'Content-Type': stored.ref?.mediaType || mediaType,
-          'Content-Length': stored.data.byteLength,
-          'Cache-Control': 'public, max-age=31536000, immutable',
-        })
-        if (req.method === 'HEAD') {
-          res.end()
-          return
-        }
-        res.end(Buffer.isBuffer(stored.data) ? stored.data : Buffer.from(stored.data))
-      } catch (_) {
-        res.writeHead(404, { 'Content-Type': 'application/json' })
-        res.end(JSON.stringify({ error: 'attachment not found' }))
+    try {
+      const stored = await ctx.attachments.readImage({
+        attachmentId: id,
+        mediaType,
+        bytes,
+        width,
+        height,
+      })
+      res.writeHead(200, {
+        'Content-Type': stored.ref?.mediaType || mediaType,
+        'Content-Length': stored.data.byteLength,
+        'Cache-Control': 'public, max-age=31536000, immutable',
+      })
+      if (req.method === 'HEAD') {
+        res.end()
+        return
       }
+      res.end(Buffer.isBuffer(stored.data) ? stored.data : Buffer.from(stored.data))
+    } catch (_) {
+      res.writeHead(404, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: 'attachment not found' }))
     }
-  })()
+  }
 
-  for (const path of ['/dsh-image-gen/image', '/dsh-fal-image-gen/image']) {
-      // Repair history file & directory permissions on startup (#307)
+  // Repair history file & directory permissions once on startup (#307, #318)
   repairHistoryPermissions()
 
-  ctx.effect(() => ctx.webServer.register({
+  for (const path of ['/dsh-image-gen/image', '/dsh-fal-image-gen/image']) {
+    ctx.effect(() => ctx.webServer.register({
       kind: 'exact',
       path,
       handler: imageHandler,

package/lib/providers.js

@@ -347,7 +347,7 @@ export function resolveStylePreset(styleKeyOrText, existingNegative, existingGui
 export function applyStylePreset(prompt, styleKeyOrText) {
   if (!styleKeyOrText) return prompt
   const res = resolveStylePreset(styleKeyOrText)
-  return `${prompt}, ${res.promptSuffix}`
+  return res.promptSuffix ? `${prompt}, ${res.promptSuffix}` : prompt
 }
 
 export async function blendImagesFal({ fetchImpl, resolveKey, cfg }, { images, weights, prompt, model = 'fal-ai/flux/dev/image-to-image', signal }) {

package/lib/resolve-source.js

@@ -0,0 +1,67 @@
+// lib/resolve-source.js — Safe image source resolution for image tools (#317)
+
+import path from 'node:path'
+import { readFile, stat } from 'node:fs/promises'
+import { validateImageSignature } from './resolve-image.js'
+
+/** Read source image for editing: filesystem path or attachment id. */
+export async function resolveSource(ctx, exec, ref) {
+  if (!ref) return undefined
+  const sessionCwd = exec?.agent?.session?.header?.cwd || process.cwd()
+  if (ref.startsWith('sha256:')) {
+    const stored = await ctx.attachments.readImage({ attachmentId: ref, mediaType: 'image/png', bytes: 0, width: 0, height: 0 })
+    const bytes = Buffer.from(stored.data || stored.bytes || [])
+    validateImageSignature(bytes, ref)
+    return { bytes, mediaType: stored.ref?.mediaType || 'image/png' }
+  }
+  if (ref.startsWith('data:')) {
+    const commaIndex = ref.indexOf(',')
+    if (commaIndex > 0) {
+      const meta = ref.slice(0, commaIndex)
+      const data = ref.slice(commaIndex + 1).trim()
+      const approxBytes = Math.ceil((data.length * 3) / 4)
+      if (approxBytes > 50 * 1024 * 1024) {
+        throw new Error('Data URI payload too large. Maximum allowed size is 50 MB.')
+      }
+      const bytes = Buffer.from(data, 'base64')
+      if (bytes.length > 50 * 1024 * 1024) {
+        throw new Error('Decoded image data too large. Maximum allowed size is 50 MB.')
+      }
+      validateImageSignature(bytes, 'inline data URI')
+      const mediaMatch = meta.match(/data:([^;]+)/)
+      return { bytes, mediaType: mediaMatch ? mediaMatch[1] : 'image/png' }
+    }
+    throw new Error('Malformed data URI')
+  }
+
+  const root = path.resolve(sessionCwd)
+  const target = path.resolve(root, ref)
+  const rel = path.relative(root, target)
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`Access denied: path "${ref}" is outside allowed workspace directory "${root}"`)
+  }
+
+  const fileStat = await stat(target).catch(() => null)
+  if (!fileStat) {
+    throw new Error(`Source image not found: ${ref}`)
+  }
+  if (!fileStat.isFile()) {
+    throw new Error(`Target is not a regular file: ${ref}`)
+  }
+  if (fileStat.size === 0) {
+    throw new Error(`Image file is empty (0 bytes): ${ref}`)
+  }
+  if (fileStat.size > 50 * 1024 * 1024) {
+    throw new Error(`Source image too large (${(fileStat.size / (1024 * 1024)).toFixed(1)} MB). Maximum allowed size is 50 MB.`)
+  }
+
+  const bytes = await readFile(target)
+  validateImageSignature(bytes, ref)
+  const ext = path.extname(target).toLowerCase()
+  const mediaType = ext === '.jpg' || ext === '.jpeg' ? 'image/jpeg'
+    : ext === '.webp' ? 'image/webp'
+    : ext === '.gif' ? 'image/gif'
+    : ext === '.svg' ? 'image/svg+xml'
+    : 'image/png'
+  return { bytes, mediaType }
+}

package/lib/settings-route.js

@@ -3,6 +3,7 @@
 // Provides HTTP read/write fallback when DSH core is accessed over network.
 
 import { isTrustedLocalRequest } from './security.js'
+import { readBoundedRequestBody } from './vault.js'
 import { publicConfig, plainConfig, Config } from './index.js'
 
 export function registerSettingsRoutes(ctx, { live, getSettingsApi, setLiveConfig }) {
@@ -61,52 +62,62 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, setLiveConfi
         return
       }
 
-      const chunks = []
-      req.on('data', (c) => chunks.push(c))
-      req.on('end', async () => {
-        let payload
-        try {
-          payload = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}')
-        } catch {
-          res.writeHead(400, { 'Content-Type': 'application/json' })
-          res.end(JSON.stringify({ ok: false, error: 'invalid JSON' }))
+      let buf
+      try {
+        buf = await readBoundedRequestBody(req, 64 * 1024)
+      } catch (err) {
+        if (err?.statusCode === 413) {
+          res.writeHead(413, { 'Content-Type': 'application/json' })
+          res.end(JSON.stringify({ ok: false, error: err.message }))
           return
         }
+        res.writeHead(400, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ ok: false, error: err?.message || 'body read failed' }))
+        return
+      }
+
+      let payload
+      try {
+        payload = JSON.parse(buf.toString('utf8') || '{}')
+      } catch {
+        res.writeHead(400, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ ok: false, error: 'invalid JSON' }))
+        return
+      }
 
-        const raw = payload && typeof payload.config === 'object' && payload.config !== null ? payload.config : payload
-        if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+      const raw = payload && typeof payload.config === 'object' && payload.config !== null ? payload.config : payload
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ ok: false, error: 'body must be a JSON object' }))
+        return
+      }
+
+      const allowedKeys = new Set(Object.keys(Config.dict || {}))
+      for (const k of Object.keys(raw)) {
+        if (!allowedKeys.has(k)) {
           res.writeHead(400, { 'Content-Type': 'application/json' })
-          res.end(JSON.stringify({ ok: false, error: 'body must be a JSON object' }))
+          res.end(JSON.stringify({ ok: false, error: `unknown config field: ${k}` }))
           return
         }
+      }
 
-        const allowedKeys = new Set(Object.keys(Config.dict || {}))
-        for (const k of Object.keys(raw)) {
-          if (!allowedKeys.has(k)) {
-            res.writeHead(400, { 'Content-Type': 'application/json' })
-            res.end(JSON.stringify({ ok: false, error: `unknown config field: ${k}` }))
-            return
-          }
+      try {
+        const base = plainConfig(live()) || {}
+        const merged = Config({ ...base, ...raw })
+        const settingsApi = getSettingsApi ? getSettingsApi() : null
+        if (settingsApi && typeof settingsApi.replace === 'function') {
+          await settingsApi.replace(merged)
+        } else if (settingsApi && typeof settingsApi.update === 'function') {
+          await settingsApi.update(raw)
+        } else if (typeof setLiveConfig === 'function') {
+          setLiveConfig(merged)
         }
-
-        try {
-          const base = plainConfig(live()) || {}
-          const merged = Config({ ...base, ...raw })
-          const settingsApi = getSettingsApi ? getSettingsApi() : null
-          if (settingsApi && typeof settingsApi.replace === 'function') {
-            await settingsApi.replace(merged)
-          } else if (settingsApi && typeof settingsApi.update === 'function') {
-            await settingsApi.update(raw)
-          } else if (typeof setLiveConfig === 'function') {
-            setLiveConfig(merged)
-          }
-          res.writeHead(200, { 'Content-Type': 'application/json' })
-          res.end(JSON.stringify({ ok: true, config: publicConfig(merged) }))
-        } catch (err) {
-          res.writeHead(400, { 'Content-Type': 'application/json' })
-          res.end(JSON.stringify({ ok: false, error: String(err?.message || err) }))
-        }
-      })
+        res.writeHead(200, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ ok: true, config: publicConfig(merged) }))
+      } catch (err) {
+        res.writeHead(400, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ ok: false, error: String(err?.message || err) }))
+      }
     },
   }), 'dsh-image-gen: config route')
 }

package/lib/tools/frontend.js

@@ -10,6 +10,7 @@ import {
   checkWcagContrast,
   optimizeSvgContent,
   generatePwaIconSuite,
+  extractSampleColorsFromBuffer,
 } from '../frontend-assets.js'
 
 export function registerFrontendTools(ctx, deps) {

package/lib/tools/generation.js

@@ -43,6 +43,15 @@ import { getCachedGeneration, setCachedGeneration } from '../generation-cache.js
 import { resolveFallbackChain, executeWithFallback } from '../fallback-router.js'
 import { getSessionAnchor, applyAnchorPromptHints } from '../anchor-helpers.js'
 import { enhancePrompt } from '../prompt-enhancer.js'
+import {
+  readHistory,
+  writeHistory,
+  pruneHistory,
+  findCachedGeneration,
+  findCached,
+  findCachedByPrompt,
+  cachedResult,
+} from '../history.js'
 
 
 export function registerGenerationTools(ctx, deps) {
@@ -286,7 +295,7 @@ export function registerGenerationTools(ctx, deps) {
         assertBudgetAvailable(estimatedCost, cfg.dailyBudgetUsd)
         const providers = makeProviders(
           { fetchImpl: fetch, resolveKey: (ref) => resolveApiKey(ctx, ref), cfg, subscriptionImages },
-          { prompt: effectivePrompt, size, format, seed: args.seed, signal: exec.signal, negativePrompt: effectivePolishedNegative, guidanceScale: effectiveGuidance, source, mask, strength: args.strength, quality: args.quality, style: args.style, aspectPixels, aspectRatio: args.aspect_ratio },
+          { prompt: effectivePrompt, size, format, seed: args.seed, signal: exec.signal, negativePrompt: effectiveNegative, guidanceScale: effectiveGuidance, source, mask, strength: args.strength, quality: args.quality, style: args.style, aspectPixels, aspectRatio: args.aspect_ratio },
         )
       // Subscription providers return {ok:false, reason} instead of throwing:
       // rejection reaches the model as text. Without this guard,

package/lib/tools/processing-advanced.js

@@ -11,6 +11,7 @@ import {
   saveAttachmentSafe,
 } from '../providers.js'
 import { sanitizeErrorAndLogs } from '../security.js'
+import { resolveConversationImage } from '../resolve-image.js'
 
 export function registerProcessingAdvancedTools(ctx, deps) {
   const {

package/lib/vault.js

@@ -118,14 +118,15 @@ export async function readBoundedRequestBody(req, maxBytes = MAX_VAULT_BODY_BYTE
   let received = 0
   const chunks = []
   for await (const chunk of req) {
-    received += chunk.length
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    received += buf.length
     if (received > maxBytes) {
       if (typeof req.destroy === 'function') req.destroy()
       const err = new Error(`Payload Too Large: request body exceeded maximum allowed size of ${maxBytes} bytes`)
       err.statusCode = 413
       throw err
     }
-    chunks.push(chunk)
+    chunks.push(buf)
   }
   return Buffer.concat(chunks)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-image-gen",
-  "version": "0.11.6",
+  "version": "0.11.8",
   "description": "Image generation for DeepSeek Harness: a generate_image tool with pluggable providers — the FAL queue, any OpenAI-compatible images API, or a ChatGPT/Grok subscription with no API key at all. The picture is shown inline in the conversation; the model receives either a link (works with any chat model) or the image itself (needs dsh-vision-bridge or a vision-capable model).",
   "keywords": [
     "deepseek-harness",
@@ -69,9 +69,10 @@
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "scripts": {
-    "test": "node scripts/build-client.mjs && node --check lib/client.js && node --test test/*.test.mjs",
+    "test": "node scripts/build-client.mjs --check && node --check lib/client.js && node --test test/*.test.mjs",
     "build:client": "node scripts/build-client.mjs",
-    "publish:github": "bash scripts/publish-github.sh"
+    "publish:github": "bash scripts/publish-github.sh",
+    "build:client:check": "node scripts/build-client.mjs --check"
   },
   "publishConfig": {
     "access": "public"