dsh-codex-subscription 1.13.1 → 1.14.1

package/lib/index.js

@@ -1303,7 +1303,7 @@ function openaiCodexSubscriptionProvider({ resolveSpeedMode = () => void 0, reso
 }
 //#endregion
 //#region src/version.js
-const PACKAGE_VERSION = "1.13.1";
+const PACKAGE_VERSION = "1.14.1";
 const USER_AGENT = `dsh-codex-subscription/${PACKAGE_VERSION}`;
 //#endregion
 //#region src/model-catalog.js
@@ -1637,6 +1637,10 @@ const PNG_SIGNATURE = Buffer.from([
 	26,
 	10
 ]);
+const FULL_ATTACHMENT_ID = /^sha256:[0-9a-f]{64}$/u;
+const BARE_ATTACHMENT_DIGEST = /^[0-9a-f]{64}$/iu;
+const PATH_LIKE_ATTACHMENT_ID = /[\\/]/u;
+const FILE_NAME_ATTACHMENT_ID = /\.[A-Za-z0-9]{1,16}$/u;
 const record$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const nonEmpty = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
 function normalizeImageOptions(args) {
@@ -1706,22 +1710,63 @@ function decodeCodexPng(value, maximumBytes) {
 	return new Uint8Array(data);
 }
 function imageReference(value) {
+	const originalDimensions = record$2(value.originalDimensions) ? {
+		width: value.originalDimensions.width,
+		height: value.originalDimensions.height
+	} : void 0;
 	return {
 		attachmentId: value.attachmentId,
 		mediaType: value.mediaType,
 		bytes: value.bytes,
 		width: value.width,
 		height: value.height,
-		...value.name === void 0 ? {} : { name: value.name }
+		...value.name === void 0 ? {} : { name: value.name },
+		...originalDimensions === void 0 ? {} : { originalDimensions }
 	};
 }
+function normalizeAttachmentId(value) {
+	if (typeof value !== "string") return void 0;
+	if (FULL_ATTACHMENT_ID.test(value)) return value;
+	const bare = BARE_ATTACHMENT_DIGEST.exec(value);
+	return bare === null ? void 0 : `sha256:${bare[0].toLowerCase()}`;
+}
+function invalidAttachmentId(value) {
+	const attachmentId = value?.attachmentId;
+	if (typeof attachmentId === "string" && (PATH_LIKE_ATTACHMENT_ID.test(attachmentId) || FILE_NAME_ATTACHMENT_ID.test(attachmentId))) throw new Error("referenceImages attachmentId is a file path or filename; call read_image on that file and retry with its complete sha256:<64 lowercase hex> attachment reference. Do not omit referenceImages or fall back to new image generation.");
+	throw new Error("referenceImages attachmentId must be sha256:<64 lowercase hex> copied from an image block or read_image result. Do not omit referenceImages or fall back to new image generation.");
+}
 function referenceOf(value, attachments) {
-	if (!record$2(value) || typeof value.attachmentId !== "string" || value.attachmentId.length === 0 || value.attachmentId.length > 256 || !attachments.imageLimits.mediaTypes.includes(value.mediaType) || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || !Number.isSafeInteger(value.width) || value.width <= 0 || !Number.isSafeInteger(value.height) || value.height <= 0 || value.name !== void 0 && (typeof value.name !== "string" || value.name.length > 256)) throw new Error("referenceImages contains an invalid image reference");
-	return imageReference(value);
+	const attachmentId = normalizeAttachmentId(value?.attachmentId);
+	if (attachmentId === void 0) invalidAttachmentId(value);
+	if (!record$2(value) || !attachments.imageLimits.mediaTypes.includes(value.mediaType) || !Number.isSafeInteger(value.bytes) || value.bytes <= 0 || !Number.isSafeInteger(value.width) || value.width <= 0 || !Number.isSafeInteger(value.height) || value.height <= 0 || value.name !== void 0 && (typeof value.name !== "string" || value.name.length > 256) || value.originalDimensions !== void 0 && (!record$2(value.originalDimensions) || !Number.isSafeInteger(value.originalDimensions.width) || value.originalDimensions.width <= 0 || !Number.isSafeInteger(value.originalDimensions.height) || value.originalDimensions.height <= 0)) throw new Error("referenceImages contains an invalid image reference");
+	return imageReference({
+		...value,
+		attachmentId
+	});
 }
-async function editImages(values, attachments, signal) {
+function sessionImageReferences(messages) {
+	const references = /* @__PURE__ */ new Map();
+	const visit = (content) => {
+		if (!Array.isArray(content)) return;
+		for (const block of content) if (block?.type === "image" && record$2(block.attachment)) {
+			const id = normalizeAttachmentId(block.attachment.attachmentId);
+			if (id !== void 0) references.set(id, block.attachment);
+		} else if (block?.type === "tool-result") visit(block.content);
+	};
+	for (const message of messages ?? []) visit(message?.content);
+	return references;
+}
+async function editImages(values, attachments, signal, messages) {
 	if (!Array.isArray(values) || values.length === 0 || values.length > MAX_REFERENCE_IMAGES) throw new Error(`referenceImages must contain between 1 and ${MAX_REFERENCE_IMAGES} images`);
-	const references = values.map((value) => referenceOf(value, attachments));
+	const available = messages === void 0 ? void 0 : sessionImageReferences(messages);
+	const references = values.map((value) => {
+		const id = normalizeAttachmentId(value?.attachmentId);
+		if (id === void 0) invalidAttachmentId(value);
+		if (available === void 0) return referenceOf(value, attachments);
+		const selected = available.get(id);
+		if (selected === void 0) throw new Error("The selected image attachment cannot be found in the current session. Call read_image on the intended image and retry with its returned reference. Do not omit referenceImages or substitute another image.");
+		return referenceOf(selected, attachments);
+	});
 	if (new Set(references.map((value) => value.attachmentId)).size !== references.length) throw new Error("referenceImages must not contain duplicates");
 	const images = [];
 	let totalBytes = 0;
@@ -1734,9 +1779,10 @@ async function editImages(values, attachments, signal) {
 	return images;
 }
 function imageContent(value) {
+	const label = typeof value.size === "string" && value.size.length > 0 ? `Generated a ${value.size} image.` : "Generated an image.";
 	return [{
 		type: "text",
-		text: typeof value.size === "string" && value.size.length > 0 ? `Generated a ${value.size} image.` : "Generated an image."
+		text: value.localPath === void 0 ? label : `${label}\nOriginal PNG saved on the DSH host at: ${JSON.stringify(value.localPath)}. Read this file or copy it to the workspace with a .png extension; this host path is not a browser URL.`
 	}, {
 		type: "image",
 		attachment: imageReference(value.image)
@@ -1773,7 +1819,21 @@ function imageOutputSchema() {
 						type: "integer",
 						required: true
 					},
-					name: { type: "string" }
+					name: { type: "string" },
+					originalDimensions: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							width: {
+								type: "integer",
+								required: true
+							},
+							height: {
+								type: "integer",
+								required: true
+							}
+						}
+					}
 				}
 			},
 			original: {
@@ -1813,6 +1873,11 @@ function imageOutputSchema() {
 				}
 			},
 			background: { type: "string" },
+			localPath: {
+				type: "string",
+				required: true,
+				description: "Absolute path to the original PNG on the DSH host."
+			},
 			quality: { type: "string" },
 			size: { type: "string" }
 		}
@@ -1835,7 +1900,7 @@ function createCodexImageTool(options) {
 	const attachments = options.attachments;
 	return defineTool({
 		name: CODEX_IMAGE_TOOL_NAME,
-		description: "Create a new image or explicitly edit selected prior images using the signed-in Codex subscription. Omit referenceImages for a completely new image. Include only the exact prior image references the user asked to edit; never assume every image in the conversation is a reference.",
+		description: "Create a new image or explicitly edit selected prior images using the signed-in Codex subscription. Omit referenceImages only for a completely new image. For an edit, copy each complete image reference from the session image block or read_image result, including attachmentId in the exact form sha256:<64 lowercase hex>; never use a workspace path, absolute path, or filename, and do not omit the references to turn an edit into text-to-image generation. A bare 64-character hex digest is accepted and normalized to sha256:<64 lowercase hex>. If a reference is unavailable, call read_image and retry with its returned reference. Include only the exact prior image references the user asked to edit; never assume every image in the conversation is a reference. For annotation-guided edits, include both the named clean source and its numbered location reference, and preserve the numbered coordinates and requested changes in the prompt. The location-reference markers are guidance only and must not appear in the result. If those references cannot be identified, do not substitute unrelated images or silently ignore the annotations.",
 		parameters: {
 			prompt: {
 				type: "string",
@@ -1867,14 +1932,15 @@ function createCodexImageTool(options) {
 			},
 			referenceImages: {
 				type: "array",
-				description: "Optional explicit references to 1-5 prior images to edit. Omit for a new image.",
+				description: "Optional explicit references to 1-5 prior images to edit. Copy each complete reference from the session image block or read_image result. Omit only for a new image; an invalid reference must be fixed and retried rather than omitted.",
 				items: {
 					type: "object",
 					additionalProperties: false,
 					properties: {
 						attachmentId: {
 							type: "string",
-							required: true
+							required: true,
+							description: "Copy the complete attachmentId from the image block or read_image result: sha256:<64 lowercase hex>. Never pass a workspace path, absolute path, or filename. A bare 64-character hex digest is accepted and normalized to sha256:<64 lowercase hex>."
 						},
 						mediaType: {
 							type: "string",
@@ -1892,7 +1958,21 @@ function createCodexImageTool(options) {
 							type: "integer",
 							required: true
 						},
-						name: { type: "string" }
+						name: { type: "string" },
+						originalDimensions: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								width: {
+									type: "integer",
+									required: true
+								},
+								height: {
+									type: "integer",
+									required: true
+								}
+							}
+						}
 					}
 				}
 			}
@@ -1920,7 +2000,8 @@ function createCodexImageTool(options) {
 			if (!attachments.imageLimits.mediaTypes.includes("image/png")) throw new Error("This DSH installation does not accept PNG image attachments");
 			const maximumBytes = Math.min(attachments.imageLimits.maxImageBytes, attachments.imageLimits.maxMessageImageBytes);
 			const editing = args.referenceImages !== void 0;
-			const images = editing ? await editImages(args.referenceImages, attachments, exec.signal) : void 0;
+			const sessionMessages = editing && typeof options.getSessionMessages === "function" ? await options.getSessionMessages(exec.agent?.id) : void 0;
+			const images = editing ? await editImages(args.referenceImages, attachments, exec.signal, sessionMessages ?? (options.getSessionMessages ? [] : void 0)) : void 0;
 			let response;
 			try {
 				response = await fetchImage(editing ? CODEX_IMAGE_EDIT_URL : CODEX_IMAGE_GENERATION_URL, {
@@ -1973,6 +2054,7 @@ function createCodexImageTool(options) {
 			const result = {
 				image: imageReference(ref),
 				original,
+				localPath: options.originalImages.originalPath(original.assetId),
 				...metadata.background === void 0 ? {} : { background: metadata.background },
 				...metadata.quality === void 0 ? {} : { quality: metadata.quality },
 				...metadata.size === void 0 ? {} : { size: metadata.size }
@@ -2045,6 +2127,9 @@ var OriginalImageStore = class {
 		if (!ORIGINAL_IMAGE_ID_PATTERN.test(assetId)) throw new TypeError("invalid original image asset id");
 		return join(this.root, assetId.slice(4, 6), assetId);
 	}
+	originalPath(assetId) {
+		return join(this.directory(assetId), "original");
+	}
 	async save(sessionId, data, name = "codex-generated-original.png") {
 		if (!validSessionId(sessionId) || !(data instanceof Uint8Array) || data.byteLength === 0 || data.byteLength > 48 * 1024 * 1024) throw new TypeError("invalid original image input");
 		const { width, height } = pngDimensions(data);
@@ -3294,6 +3379,7 @@ function apply(ctx) {
 		getAuth: resolveAuth,
 		readCredential: (options) => store.read(PROVIDER, options),
 		attachments: ctx.attachments,
+		getSessionMessages: (sessionId) => ctx.get?.("sessions")?.get?.(sessionId)?.deriveMessages?.() ?? [],
 		originalImages,
 		fetch: (input, init) => network.fetch("image", input, init)
 	}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-subscription",
-  "version": "1.13.1",
+  "version": "1.14.1",
   "description": "Use ChatGPT and Codex subscriptions in DeepSeek Harness with OAuth, quota, safe resets, web search, images, and Fast mode",
   "type": "module",
   "main": "./lib/index.js",
@@ -17,7 +17,6 @@
     "README.en.md",
     "README.zh-CN.md",
     "DIRECTORY.md",
-    "AGENTS.md",
     "compatibility.json",
     "LICENSE",
     "SECURITY.md",

package/AGENTS.md

@@ -1,93 +0,0 @@
-# Agent installation guide
-
-Use this guide when a user asks an Agent to install, update, verify, or remove
-`dsh-codex-subscription` in a selected DeepSeek Harness profile.
-
-## Safety
-
-- Confirm the target DSH installation and profile. Use `web` only when it is the user's target.
-- Use the exact `1.13.1` package below; do not install a moving branch.
-- Never print OAuth credentials, account IDs, authorization callbacks, or credential-store contents.
-- Preserve the DSH profile, unrelated plugins, sessions, and saved sign-in.
-- Do not start, stop, or restart DSH without explicit permission.
-- If more than one DSH installation exists, ask which one is the target before changing it.
-
-## Locate DSH
-
-On Windows, check the standard DSH and official npm entry points without recursively scanning disks:
-
-```powershell
-Get-Command dsh -ErrorAction SilentlyContinue
-Get-Command npx -ErrorAction SilentlyContinue
-Get-CimInstance Win32_Process -Filter "Name = 'node.exe'" |
-  Where-Object { $_.CommandLine -match '@deepseek-ai[\\/]dsh[\\/]lib[\\/]bin\.js' } |
-  Select-Object ExecutablePath, CommandLine
-```
-
-DSH-Portable exposes the same standard `dsh plugin` contract. Missing system pnpm is normal; do not
-install it globally for this plugin. If several targets remain possible, stop and ask the user which one
-to change.
-
-## Install or update
-
-For an official DSH installation run through npm, keep the complete `npx` prefix because the official
-run command does not create a global `dsh` command:
-
-```sh
-npx -y @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web add dsh-codex-subscription@1.13.1
-```
-
-With an existing global `dsh` command:
-
-```sh
-dsh plugin --profile web add dsh-codex-subscription@1.13.1
-```
-
-Use the same `add` command to update or repair. This is the complete package-changing operation.
-Do not download pnpm, create a second package store, save profile snapshots, add a resident manager,
-or restart DSH automatically. The DSH CLI owns package resolution, locking, and profile composition.
-
-## Verify
-
-Use the same executable selected above:
-
-```sh
-dsh plugin --profile web list dsh-codex-subscription --depth 0
-dsh --profile web --dump-config
-```
-
-For the official npm route, run the same checks with `npx -y @deepseek-ai/dsh@0.1.2-rc.1` in place of `dsh`.
-
-1. `dsh-codex-subscription` version `1.13.1` appears exactly once.
-2. `codex-subscription` appears exactly once in the composed config.
-3. No unrelated plugin or profile was changed and DSH was not restarted.
-
-With permission to restart DSH, open **Settings -> Codex** and verify the settings page loads. Confirm
-that search offers **Auto**, **DSH default**, and **Codex subscription**, the composer quota switch defaults
-to off, and `codex_image_generate` is available. Do not consume quota merely to test installation unless
-the user explicitly asks for a live model, search, or image-generation check.
-
-## Uninstall
-
-```sh
-dsh plugin --profile web remove dsh-codex-subscription
-```
-
-For the official npm route:
-
-```sh
-npx -y @deepseek-ai/dsh@0.1.2-rc.1 plugin --profile web remove dsh-codex-subscription
-```
-
-Uninstall removes only this plugin. It must preserve the profile, sessions, other plugins, and saved
-ChatGPT sign-in. Signing out is a separate action and requires explicit permission.
-
-## Failure handling
-
-Distinguish command discovery, network, HTTP/TLS, package-manager, profile-lock, version, and peer
-dependency failures. Do not disable TLS validation, delete a lock owned by a live process, install a
-second package manager, wipe a profile, expose credentials, or switch to another paid route.
-
-On failure, report the sanitized command error, DSH version, selected profile, requested plugin version,
-installation mode, what changed, and what remains unverified. A successful CLI exit is not live UI
-acceptance.