dsh-image-gen 0.10.0 → 0.10.2

package/lib/client.js

@@ -122983,7 +122983,6 @@ img.ProseMirror-separator {
 				};
 			}, []);
 			const [previewLoading, setPreviewLoading] = (0, react.useState)(false);
-			const blobCache = (0, react.useMemo)(() => /* @__PURE__ */ new Map(), []);
 			const abortControllerRef = (0, react.useRef)(null);
 			const filteredItems = (0, react.useMemo)(() => {
 				return items.filter((item) => {
@@ -123039,7 +123038,6 @@ img.ProseMirror-separator {
 				}
 				setPreviewItem(item);
 				if (blob) {
-					blobCache.set(item.id, blob);
 					const url = URL.createObjectURL(blob);
 					previewUrlRef.current = url;
 					setPreviewBlob(blob);
@@ -123047,15 +123045,6 @@ img.ProseMirror-separator {
 					setPreviewLoading(false);
 					return;
 				}
-				const cached = blobCache.get(item.id);
-				if (cached) {
-					const url = URL.createObjectURL(cached);
-					previewUrlRef.current = url;
-					setPreviewBlob(cached);
-					setPreviewUrl(url);
-					setPreviewLoading(false);
-					return;
-				}
 				setPreviewLoading(true);
 				setPreviewBlob(null);
 				setPreviewUrl(null);
@@ -123063,7 +123052,6 @@ img.ProseMirror-separator {
 				abortControllerRef.current = controller;
 				fetchAttachmentBlob(item.attachment).then((fetchedBlob) => {
 					if (controller.signal.aborted) return;
-					blobCache.set(item.id, fetchedBlob);
 					const url = URL.createObjectURL(fetchedBlob);
 					previewUrlRef.current = url;
 					setPreviewBlob(fetchedBlob);
@@ -123327,11 +123315,7 @@ img.ProseMirror-separator {
 					if (itemsToDownload.length === 1) {
 						const single = itemsToDownload[0];
 						if (!single) return;
-						let blob = blobCache.get(single.id);
-						if (!blob) {
-							blob = await fetchAttachmentBlob(single.attachment);
-							blobCache.set(single.id, blob);
-						}
+						const blob = await fetchAttachmentBlob(single.attachment);
 						const objectUrl = URL.createObjectURL(blob);
 						downloadBlobUrl(objectUrl, `dsh-${single.provider}-${single.id}.png`);
 						URL.revokeObjectURL(objectUrl);
@@ -123344,11 +123328,7 @@ img.ProseMirror-separator {
 						const it = itemsToDownload[i];
 						if (!it) continue;
 						setBatchDownloadProgress(`${i + 1}/${itemsToDownload.length}`);
-						let blob = blobCache.get(it.id);
-						if (!blob) {
-							blob = await fetchAttachmentBlob(it.attachment);
-							blobCache.set(it.id, blob);
-						}
+						const blob = await fetchAttachmentBlob(it.attachment);
 						const arrayBuffer = await blob.arrayBuffer();
 						const ext = blob.type === "image/jpeg" ? "jpg" : blob.type === "image/webp" ? "webp" : "png";
 						let baseName = `dsh-${it.provider}-${it.id.slice(0, 8)}.${ext}`;
@@ -123752,7 +123732,6 @@ img.ProseMirror-separator {
 								onToggleSelect: (e) => handleToggleSelect(item.id, idx, e),
 								onRequestDelete: () => requestSingleDelete(item),
 								onPreview: (blob) => openPreviewItem(item, blob),
-								onBlobLoaded: (b) => blobCache.set(item.id, b),
 								onToast: showToast
 							}, item.id))
 						}) : activeTab === "inspiration" ? (0, react_jsx_runtime.jsx)(InspirationView, {
@@ -124127,39 +124106,37 @@ img.ProseMirror-separator {
 				]
 			});
 		};
-		const GalleryCard = ({ lang, item, index: _index, isManageMode, isSelected, t, onClick, onToggleSelect, onRequestDelete, onPreview: _onPreview, onBlobLoaded, onToast }) => {
+		const GalleryCard = ({ lang, item, index: _index, isManageMode, isSelected, t, onClick, onToggleSelect, onRequestDelete, onPreview: _onPreview, onToast }) => {
+			const [setCardRef, inView] = useInView();
 			const [url, setUrl] = (0, react.useState)();
 			const [blob, setBlob] = (0, react.useState)();
 			const [loading, setLoading] = (0, react.useState)(true);
 			const [error, setError] = (0, react.useState)();
 			(0, react.useEffect)(() => {
-				const controller = new AbortController();
+				if (!inView) return;
+				let active = true;
 				let objectUrl;
-				fetch(IMAGE_ROUTE, {
-					method: "POST",
-					signal: controller.signal,
-					headers: { "content-type": "application/json" },
-					body: JSON.stringify({ attachment: item.attachment })
-				}).then(async (response) => {
-					if (!response.ok) throw new Error(`HTTP ${response.status}`);
-					const resBlob = await response.blob();
-					if (controller.signal.aborted) return;
+				setUrl(void 0);
+				setBlob(void 0);
+				setError(void 0);
+				setLoading(true);
+				fetchAttachmentBlob(item.attachment).then((resBlob) => {
+					if (!active) return;
 					setBlob(resBlob);
-					onBlobLoaded?.(resBlob);
 					objectUrl = URL.createObjectURL(resBlob);
 					setUrl(objectUrl);
 					setLoading(false);
 				}).catch((err) => {
-					if (!controller.signal.aborted) {
+					if (active) {
 						setError(err instanceof Error ? err.message : String(err));
 						setLoading(false);
 					}
 				});
 				return () => {
-					controller.abort();
+					active = false;
 					if (objectUrl) URL.revokeObjectURL(objectUrl);
 				};
-			}, [item.attachment]);
+			}, [item.attachment.attachmentId, inView]);
 			const copyPrompt = async (e) => {
 				e.stopPropagation();
 				try {
@@ -124190,6 +124167,7 @@ img.ProseMirror-separator {
 			};
 			const badgeLabel = item.model || item.provider;
 			return (0, react_jsx_runtime.jsxs)("div", {
+				ref: setCardRef,
 				className: `dsh-ig-gallery-card ${isSelected ? "is-selected" : ""} ${isManageMode ? "is-manage-mode" : ""}`,
 				onClick: (e) => onClick(e, blob),
 				children: [(0, react_jsx_runtime.jsxs)("div", {
@@ -125642,7 +125620,7 @@ body[data-ds-dark-theme] .dsh-ig-workbench{--ig-danger:#f08c8c;--ig-warn:#e5b76a
 `;
 		//#endregion
 		//#region lib/types/client/index.js
-		console.info(`[dsh-image-gen] canvas bundle 2026-10-28T11:56:09.512Z`);
+		console.info(`[dsh-image-gen] canvas bundle 2026-11-02T02:55:48.656Z`);
 		/** Right-sidebar tab-type registration id (DSH 0.1.5 `sidebarRightTabs`). */
 		const SIDEBAR_STUDIO_TAB_ID = "dsh-image-gen/studio";
 		/** The tab kind: a page type opened by kind, recognizing no resource address. */
@@ -126062,23 +126040,26 @@ body[data-ds-dark-theme] .dsh-ig-workbench{--ig-danger:#f08c8c;--ig-warn:#e5b76a
 .dsh-ig-save:disabled{opacity:.4;cursor:default}
 
 /* Provider list: one expandable row per provider, each saving independently. */
-.dsh-ig-providers{display:flex;flex-direction:column;margin-top:6px}
-.dsh-ig-provider-row{border:0;background:none;padding:14px 0}
-.dsh-ig-provider-row + .dsh-ig-provider-row{border-top:0.5px solid var(--dsw-alias-border-l2,#e8ebf0)}
-.dsh-ig-provider-head-row{display:flex;align-items:center;gap:10px}
-.dsh-ig-provider-head{flex:1;min-width:0;width:100%;appearance:none;border:0;background:none;font:inherit;color:inherit;text-align:left;cursor:pointer;display:flex;align-items:center;gap:10px;padding:0}
-.dsh-ig-channel-add{flex:none;width:30px;padding:4px 0;font-size:16px;line-height:20px}
+.dsh-ig-providers{display:flex;flex-direction:column;margin-top:12px;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#e8ebf0);border-radius:10px;background:var(--dsw-alias-bg-layer-3,transparent)}
+.dsh-ig-provider-row{border:0;background:none;padding:0 14px}
+.dsh-ig-provider-row + .dsh-ig-provider-row{border-top:1px solid var(--dsw-alias-border-l2,#e8ebf0)}
+.dsh-ig-provider-head-row{display:flex;align-items:center;gap:8px;min-height:48px}
+.dsh-ig-provider-head{flex:1;min-width:0;width:100%;min-height:48px;appearance:none;border:0;background:none;font:inherit;color:inherit;text-align:left;cursor:pointer;display:flex;align-items:center;gap:10px;padding:0}
+.dsh-ig-channel-add.dsh-ig-btn-secondary{display:inline-flex;align-items:center;justify-content:center;flex:none;box-sizing:border-box;width:26px;height:26px;padding:0;border:0;border-radius:7px;background:var(--dsw-alias-bg-layer-2,#f3f4f6);color:var(--dsw-alias-label-tertiary,#7b818b);line-height:1;transition:background .15s,color .15s}
+.dsh-ig-channel-add.dsh-ig-btn-secondary:hover:not(:disabled){border:0;background:var(--dsw-alias-bg-layer-1,#e5e7eb);color:var(--dsw-alias-label-primary,inherit)}
+.dsh-ig-channel-add svg{width:14px;height:14px}
 .dsh-ig-provider-head:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,#4c78ff);outline-offset:2px;border-radius:var(--dsw-radius-sm,4px)}
-.dsh-ig-provider-head:hover .dsh-ig-provider-name{color:var(--dsw-alias-label-secondary,inherit)}
-.dsh-ig-provider-name{flex:1;min-width:0;font-size:13.5px;font-weight:550;color:var(--dsw-alias-label-primary,inherit)}
-.dsh-ig-provider-chevron{flex:none;color:var(--dsw-alias-label-tertiary,#7b818b);transition:transform .16s;display:inline-flex;align-items:center}
+.dsh-ig-provider-head:hover .dsh-ig-provider-name{color:var(--dsw-alias-label-primary,inherit)}
+.dsh-ig-provider-head:hover .dsh-ig-provider-chevron{color:var(--dsw-alias-label-primary,inherit)}
+.dsh-ig-provider-name{flex:1;min-width:0;font-size:13px;font-weight:550;line-height:20px;color:var(--dsw-alias-label-primary,inherit);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsh-ig-provider-chevron{display:inline-flex;align-items:center;justify-content:center;flex:none;width:20px;height:20px;color:var(--dsw-alias-label-tertiary,#7b818b);transition:transform .16s,color .15s}
 .dsh-ig-provider-chevron-open{transform:rotate(180deg)}
-.dsh-ig-provider-body{border-top:0;padding:8px 0 2px}
-.dsh-ig-badge{flex:none;display:inline-flex;align-items:center;gap:5px;font-size:11.5px;line-height:1.6;padding:2px 9px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2,#d7dbe0);color:var(--dsw-alias-label-secondary,inherit);white-space:nowrap;max-width:60%;overflow:hidden;text-overflow:ellipsis}
-.dsh-ig-badge-dot{width:6px;height:6px;border-radius:50%;background:currentColor;flex:none}
-.dsh-ig-badge-ok{border-color:rgba(34,197,94,.45);color:#15803d;background:rgba(34,197,94,.08)}
-.dsh-ig-badge-missing{border-color:rgba(239,68,68,.4);color:#b91c1c;background:rgba(239,68,68,.06)}
-.dsh-ig-badge-neutral{color:var(--dsw-alias-label-tertiary,#7b818b)}
+.dsh-ig-provider-body{border-top:0;padding:0 0 14px}
+.dsh-ig-badge{flex:none;display:inline-flex;align-items:center;gap:5px;box-sizing:border-box;min-height:22px;padding:1px 8px;border:1px solid transparent;border-radius:6px;font-size:11px;font-weight:500;line-height:18px;color:var(--dsw-alias-label-secondary,inherit);white-space:nowrap;max-width:60%;overflow:hidden;text-overflow:ellipsis}
+.dsh-ig-badge-dot{width:5px;height:5px;border-radius:50%;background:currentColor;flex:none}
+.dsh-ig-badge-ok{border-color:rgba(34,197,94,.2);color:#15803d;background:rgba(34,197,94,.08)}
+.dsh-ig-badge-missing{border-color:rgba(239,68,68,.18);color:#b91c1c;background:rgba(239,68,68,.06)}
+.dsh-ig-badge-neutral{border-color:var(--dsw-alias-border-l2,#e8ebf0);color:var(--dsw-alias-label-tertiary,#7b818b);background:var(--dsw-alias-bg-layer-2,transparent)}
 .dsh-ig-badge-checking .dsh-ig-badge-dot{animation:dsh-ig-pulse 1s ease-in-out infinite}
 @keyframes dsh-ig-pulse{50%{opacity:.25}}
 
@@ -128414,15 +128395,7 @@ body[data-ds-dark-theme] .dsh-ig-workbench{--ig-danger:#f08c8c;--ig-warn:#e5b76a
 					className: "dsh-ig-provider-row",
 					children: [(0, react_jsx_runtime.jsxs)("div", {
 						className: "dsh-ig-provider-head-row",
-						children: [provider === "openai-compat" ? (0, react_jsx_runtime.jsx)("button", {
-							type: "button",
-							className: "dsh-ig-btn-secondary dsh-ig-channel-add",
-							title: t("addCompatChannel"),
-							"aria-label": t("addCompatChannel"),
-							onClick: addCompatChannel,
-							disabled: !settingsWritable,
-							children: "+"
-						}) : null, (0, react_jsx_runtime.jsxs)("button", {
+						children: [(0, react_jsx_runtime.jsxs)("button", {
 							type: "button",
 							className: "dsh-ig-provider-head",
 							"aria-expanded": row.expanded,
@@ -128458,7 +128431,23 @@ body[data-ds-dark-theme] .dsh-ig-workbench{--ig-danger:#f08c8c;--ig-warn:#e5b76a
 									})
 								})
 							]
-						})]
+						}), provider === "openai-compat" ? (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsh-ig-btn-secondary dsh-ig-channel-add",
+							title: t("addCompatChannel"),
+							"aria-label": t("addCompatChannel"),
+							onClick: addCompatChannel,
+							disabled: !settingsWritable,
+							children: (0, react_jsx_runtime.jsx)("svg", {
+								viewBox: "0 0 16 16",
+								fill: "none",
+								stroke: "currentColor",
+								strokeWidth: "1.6",
+								strokeLinecap: "round",
+								"aria-hidden": "true",
+								children: (0, react_jsx_runtime.jsx)("path", { d: "M8 3v10M3 8h10" })
+							})
+						}) : null]
 					}), row.expanded ? provider === "comfyui" ? renderComfyUIBody() : isSubscriptionProvider(provider) ? renderSubscriptionBody(provider) : renderCloudBody(provider) : null]
 				}, provider);
 			};

package/lib/index.js

@@ -8614,12 +8614,13 @@ async function downloadImage$1(url, provider, input) {
 			mediaType: detectImageMediaType(data) ?? imageMediaType$2(parsed.mediaType) ?? "image/png"
 		};
 	}
+	const sameOrigin = new URL(url).origin === new URL(input.baseURL).origin;
 	let response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
 		redirect: "follow",
 		signal: input.signal,
-		...input.apiKey === void 0 ? {} : { headers: { authorization: `Bearer ${input.apiKey}` } }
+		...input.apiKey === void 0 || !sameOrigin ? {} : { headers: { authorization: `Bearer ${input.apiKey}` } }
 	}), input.apiKey);
-	if (!response.ok && input.apiKey !== void 0) response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
+	if (!response.ok && input.apiKey !== void 0 && sameOrigin) response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
 		redirect: "follow",
 		signal: input.signal
 	}), input.apiKey);
@@ -8875,6 +8876,7 @@ function emailFromToken(token) {
 async function formTokenRequest(url, params, fetchImpl) {
 	const response = await fetchImpl(url, {
 		method: "POST",
+		redirect: "error",
 		headers: {
 			"Content-Type": "application/x-www-form-urlencoded",
 			Accept: "application/json"
@@ -8883,8 +8885,15 @@ async function formTokenRequest(url, params, fetchImpl) {
 		signal: AbortSignal.timeout(25e3)
 	});
 	if (!response.ok) {
-		const text = await response.text().catch(() => "");
-		throw new Error(`token endpoint HTTP ${String(response.status)}${text.length > 0 ? `: ${text.slice(0, 200)}` : ""}`);
+		const detail = redactSecrets(await response.text().catch(() => ""), ...Object.entries(params).flatMap(([key, value]) => [
+			"access_token",
+			"refresh_token",
+			"id_token",
+			"code",
+			"code_verifier",
+			"client_secret"
+		].includes(key) ? [value] : [])).slice(0, 200);
+		throw new Error(`token endpoint HTTP ${String(response.status)}${detail.length > 0 ? `: ${detail}` : ""}`);
 	}
 	try {
 		const parsed = await response.json();
@@ -9928,7 +9937,8 @@ var SubscriptionManager = class {
 		const payload = await response.json().catch(() => ({}));
 		if (!response.ok) {
 			const detail = extractErrorMessage(payload);
-			throw new Error(`${vendor} HTTP ${String(response.status)}${detail !== void 0 ? `: ${detail.slice(0, 200)}` : ""}`);
+			const safeDetail = detail === void 0 ? void 0 : redactSecrets(detail, session.accessToken, session.refreshToken, session.accountId, session.email).slice(0, 200);
+			throw new Error(`${vendor} HTTP ${String(response.status)}${safeDetail !== void 0 ? `: ${safeDetail}` : ""}`);
 		}
 		return parseImages(payload);
 	}
@@ -10244,6 +10254,19 @@ const SUBSCRIPTION_CAPABILITIES = {
 	}], "auto", "standard")
 };
 //#endregion
+//#region lib/types/web-route.js
+function withWebAdmission(route, admission) {
+	return {
+		...route,
+		handler: (req, res) => {
+			const rejection = admission()?.(req);
+			if (rejection === void 0) return route.handler(req, res);
+			res.writeHead(rejection, { "content-type": "application/json; charset=utf-8" });
+			res.end(JSON.stringify({ error: rejection === 401 ? "unauthorized" : "forbidden" }));
+		}
+	};
+}
+//#endregion
 //#region lib/types/subscription/subscription-route.js
 const MAX_BODY_BYTES$1 = 16384;
 /** The vendor each subscription provider logs in as. */
@@ -10253,21 +10276,21 @@ function vendorOfProvider(provider) {
 	return "grok";
 }
 /** Register the login/status routes on the plugin's web server. */
-function registerSubscriptionRoutes(ctx, manager) {
-	ctx.effect(() => ctx.webServer.register({
+function registerSubscriptionRoutes(ctx, manager, admission = () => void 0) {
+	ctx.effect(() => ctx.webServer.register(withWebAdmission({
 		kind: "exact",
 		path: SUBSCRIPTION_LOGIN_ROUTE,
 		handler: (req, res) => {
 			serveLogin(req, res, manager);
 		}
-	}), "dsh-image-gen: subscription login route");
-	ctx.effect(() => ctx.webServer.register({
+	}, admission)), "dsh-image-gen: subscription login route");
+	ctx.effect(() => ctx.webServer.register(withWebAdmission({
 		kind: "exact",
 		path: SUBSCRIPTION_STATUS_ROUTE,
 		handler: (req, res) => {
 			serveStatus(req, res, manager);
 		}
-	}), "dsh-image-gen: subscription status route");
+	}, admission)), "dsh-image-gen: subscription status route");
 }
 async function serveLogin(req, res, manager) {
 	if (!sameOrigin$3(req)) return jsonError$3(res, 403, "origin-rejected");
@@ -28787,7 +28810,7 @@ async function fetchClassifiedJson(url, headers, apiKey, signal) {
 		method: "GET",
 		headers,
 		signal: signal ?? AbortSignal.timeout(PROBE_TIMEOUT_MS),
-		redirect: "follow"
+		redirect: "error"
 	}).catch((error) => {
 		throw new Error(error instanceof Error ? error.message : String(error));
 	});
@@ -29021,8 +29044,10 @@ function serveSettingsHealth(req, res, health) {
 //#endregion
 //#region lib/types/image-tool-context.js
 /** Live, credential-free instructions for the conversation model's image tools. */
-function imageToolContext(config) {
+function imageToolContext(config, configuredProviders) {
 	const provider = config.provider ?? "google";
+	const configured = configuredProviders === void 0 ? void 0 : [...configuredProviders];
+	if (configured !== void 0 && !configured.includes("comfyui") && resolveComfyUIWorkflows(config).length > 0) configured.push("comfyui");
 	let model = "not configured";
 	let editModel = model;
 	try {
@@ -29033,6 +29058,7 @@ function imageToolContext(config) {
 	} catch {}
 	return [
 		`Image tools current default provider: ${provider}; generation model: ${JSON.stringify(model)}; editing model: ${JSON.stringify(editModel)}.`,
+		...configured === void 0 ? [] : [`Configured image providers (credential saved, subscription logged in, or ComfyUI workflow present): ${configured.length > 0 ? configured.join(", ") : "none"}. Do not select unlisted providers; configuration presence does not guarantee service reachability.`],
 		"Unless the user explicitly requests a different image provider or model, OMIT provider and model from generate_image, generate_images and edit_image. Do not guess a channel or switch channels after an error.",
 		"Omit unused optional arguments entirely; never fill them with empty strings. size and aspect_ratio are alternatives: provide at most one.",
 		"Subscription parameters: chatgpt-sub accepts size OR aspect_ratio, but NOT image_size. grok-sub image_size: 1K or 2K. google-sub image_size: 1K or 4K. Do not copy parameters from another provider.",
@@ -29088,25 +29114,42 @@ function apply(ctx, config = {}) {
 	const knownWorkspaceRoots = /* @__PURE__ */ new Set();
 	const canvasMirror = new CanvasMirror();
 	const subscriptionManager = new SubscriptionManager(ctx);
+	let configuredImageProviders;
+	let imageContextRevision = 0;
+	const refreshImageToolContext = async () => {
+		const revision = ++imageContextRevision;
+		const config = current();
+		try {
+			const providers = (await describeStudio(ctx, config, subscriptionManager)).providers.filter((profile) => profile.configured).map((profile) => profile.provider === "openai-compat" && profile.channel !== void 0 ? `${profile.provider} (channel: ${profile.channel})` : profile.provider);
+			if (revision === imageContextRevision) configuredImageProviders = providers;
+		} catch {}
+	};
 	const settingsHealth = installImageSettings(ctx, current(), {
 		setSource: (source) => {
 			current = () => migrateOpenAICompatConfig(plainConfig(source()));
 		},
-		onChange: () => {}
+		onChange: () => {
+			refreshImageToolContext();
+		}
+	});
+	let webAdmission;
+	ctx.inject(["connection"], (connectionCtx) => {
+		webAdmission = (request) => connectionCtx.connection.requestRejection(request);
 	});
 	ctx.inject(["webServer"], (webCtx) => {
-		registerSubscriptionRoutes(webCtx, subscriptionManager);
-		webCtx.effect(() => webCtx.webServer.register({
+		const register = (route) => webCtx.webServer.register(withWebAdmission(route, () => webAdmission));
+		registerSubscriptionRoutes(webCtx, subscriptionManager, () => webAdmission);
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: SETTINGS_HEALTH_ROUTE,
 			handler: (req, res) => serveSettingsHealth(req, res, settingsHealth())
 		}), "dsh-image-gen: settings health");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: IMAGE_ROUTE,
 			handler: (req, res) => serveImage(req, res, { readImage: (ref) => ctx.attachments.readImage(ref) })
 		}), "dsh-image-gen: image route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: IMPORT_ROUTE,
 			handler: (req, res) => serveImport(req, res, {
@@ -29115,7 +29158,7 @@ function apply(ctx, config = {}) {
 				mediaTypes: ctx.attachments.imageLimits.mediaTypes
 			})
 		}), "dsh-image-gen: import route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: DELETE_ROUTE,
 			handler: (req, res) => serveDelete(req, res, { deleteWorkspaceImage: async (filePath) => {
@@ -29127,7 +29170,7 @@ function apply(ctx, config = {}) {
 				]));
 			} })
 		}), "dsh-image-gen: delete route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: SAVE_WORKSPACE_ROUTE,
 			handler: (req, res) => serveSaveWorkspace(req, res, {
@@ -29154,7 +29197,7 @@ function apply(ctx, config = {}) {
 				isSaveEnabled: () => current().saveToWorkspace !== false
 			})
 		}), "dsh-image-gen: save workspace route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: TEST_CONNECTION_ROUTE,
 			handler: (req, res) => serveTestConnection(req, res, {
@@ -29163,7 +29206,7 @@ function apply(ctx, config = {}) {
 				subscriptionManager
 			})
 		}), "dsh-image-gen: test connection route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: CANVAS_STATE_ROUTE,
 			handler: (req, res) => serveCanvasState(req, res, {
@@ -29172,7 +29215,7 @@ function apply(ctx, config = {}) {
 				maxImageBytes: ctx.attachments.imageLimits.maxImageBytes
 			})
 		}), "dsh-image-gen: canvas state route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: CANVAS_ASSET_ROUTE,
 			handler: (req, res) => serveCanvasAsset(req, res, {
@@ -29182,10 +29225,19 @@ function apply(ctx, config = {}) {
 		}), "dsh-image-gen: canvas asset route");
 	});
 	ctx.inject(["systemPrompt"], (promptCtx) => {
+		refreshImageToolContext();
+		ctx.inject(["credentials"], (credentialCtx) => {
+			credentialCtx.on("credentials/reference-updated", () => {
+				refreshImageToolContext();
+			});
+			credentialCtx.on("credentials/record-updated", () => {
+				refreshImageToolContext();
+			});
+		});
 		promptCtx.effect(() => promptCtx.systemPrompt.context({
 			name: "dsh-image-gen:image-defaults",
 			order: 59,
-			text: () => imageToolContext(current())
+			text: () => imageToolContext(current(), configuredImageProviders)
 		}), "dsh-image-gen: image tool context");
 		promptCtx.effect(() => promptCtx.systemPrompt.context({
 			name: "dsh-image-gen:canvas",
@@ -29199,7 +29251,8 @@ function apply(ctx, config = {}) {
 		name: "canvas-selection"
 	}) });
 	ctx.inject(["webServer"], (webCtx) => {
-		webCtx.effect(() => webCtx.webServer.register({
+		const register = (route) => webCtx.webServer.register(withWebAdmission(route, () => webAdmission));
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: STUDIO_ROUTE,
 			handler: (req, res) => serveStudio(req, res, {
@@ -29222,7 +29275,7 @@ function apply(ctx, config = {}) {
 			})
 		}), "dsh-image-gen: studio route");
 		const serveInspiration = createInspirationRoute();
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "prefix",
 			path: INSPIRATION_ROUTE,
 			handler: (req, res) => {
@@ -29360,7 +29413,7 @@ function apply(ctx, config = {}) {
 			},
 			model: {
 				type: "string",
-				description: "Optional model name for this call only, overriding the configured model. Not used by ComfyUI (use workflow instead) nor by the subscription providers (model fixed by the subscription)."
+				description: "OMIT unless the user explicitly requests a specific model; omission uses the configured model. Optional override for this call only. Not used by ComfyUI (use workflow instead) nor by the subscription providers (model fixed by the subscription)."
 			},
 			channel: {
 				type: "string",
@@ -29439,7 +29492,7 @@ function apply(ctx, config = {}) {
 			},
 			model: {
 				type: "string",
-				description: "Optional model name for this call only, applied to every item."
+				description: "OMIT unless the user explicitly requests a specific model for every item; omission uses the configured model."
 			},
 			channel: {
 				type: "string",
@@ -29667,7 +29720,7 @@ function apply(ctx, config = {}) {
 			},
 			model: {
 				type: "string",
-				description: "Optional model name for this call only, overriding the configured model. Not used by ComfyUI (use workflow instead) nor by the subscription providers (model fixed by the subscription)."
+				description: "OMIT unless the user explicitly requests a specific model; omission uses the configured model. Optional override for this call only. Not used by ComfyUI (use workflow instead) nor by the subscription providers (model fixed by the subscription)."
 			},
 			channel: {
 				type: "string",

package/lib/types/client/studio-view.d.ts

@@ -40,6 +40,7 @@ export declare const StudioView: FC<{
     onInitialReferenceApplied?(): void;
     onOpenInspiration?(): void;
 }>;
+export declare function useInView<T extends HTMLElement>(): [(node: T | null) => void, boolean];
 export declare function useAttachmentImage(attachment: ImageAttachmentRef | undefined, shouldLoad?: boolean): {
     url: string | null;
     blob: Blob | null;

package/lib/types/client/tl/tl-trace-bridge.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Delivery of a drawing plan to the workbench canvases.
+ *
+ * The `draw_reference` tool cannot put path data inline: the plan is tens of
+ * kilobytes and the conversation is persisted, so the tool result carries only
+ * a `traceId` (see presentationMeta) and this bridge hands that id to whichever
+ * canvas is mounted. The canvas then fetches the plan from the trace-plan route
+ * and plays it.
+ *
+ * A trace that arrives while no canvas is mounted is held, not dropped: the
+ * canvas surfaces are tab-scoped and unmount when the user looks elsewhere, so
+ * dropping on absence would mean the drawing only ever plays if the user
+ * happened to be staring at the infinite canvas at that exact second. The
+ * queue holds the newest trace only — a drawing is a one-shot show, and an
+ * older plan is stale by the time a newer one exists.
+ */
+/** The identifying part of a trace result, as it arrives on a tool event. */
+export interface TlTraceItem {
+    traceId: string;
+    /** Source pixel size, for the overlay's initial aspect box. */
+    sourceWidth: number;
+    sourceHeight: number;
+    /** Region count, for the "N blocks" caption. */
+    steps: number;
+}
+type TlTraceConsumer = (item: TlTraceItem) => void;
+/** Whether any canvas is mounted to play a plan. */
+export declare function hasTlTraceConsumer(): boolean;
+/** The trace waiting for a canvas, if any. */
+export declare function pendingTlTrace(): TlTraceItem | null;
+/**
+ * Register a canvas surface; returns its disposer. A trace that arrived while
+ * nothing was mounted plays immediately, so opening the canvas after asking
+ * for a drawing still shows it.
+ */
+export declare function registerTlTraceConsumer(consumer: TlTraceConsumer): () => void;
+/** Hand a plan to every mounted canvas, or hold the newest one until one is. */
+export declare function pushTlTrace(item: TlTraceItem): void;
+/** Test seam: clear every consumer and the pending slot. */
+export declare function resetTlTraceBridge(): void;
+/**
+ * Parse the plugin-owned trace metadata off a Tool result. Returns undefined
+ * for anything that is not a draw_reference result, so callers can share one
+ * event subscription with the image landings.
+ */
+export declare function traceResultFromMeta(value: unknown): TlTraceItem | undefined;
+/**
+ * Recover a trace from a `tool/ptc-dispatch` event, when the model called
+ * draw_reference through run_code instead of directly.
+ */
+export declare function traceResultFromPtcDispatch(event: {
+    readonly type: string;
+    readonly data: Record<string, unknown>;
+}): TlTraceItem | undefined;
+export {};