dsh-image-gen 0.10.1 → 0.10.2

package/lib/client.js

@@ -125620,7 +125620,7 @@ body[data-ds-dark-theme] .dsh-ig-workbench{--ig-danger:#f08c8c;--ig-warn:#e5b76a
 `;
 		//#endregion
 		//#region lib/types/client/index.js
-		console.info(`[dsh-image-gen] canvas bundle 2026-11-01T16:40:54.993Z`);
+		console.info(`[dsh-image-gen] canvas bundle 2026-11-02T02:55:48.656Z`);
 		/** Right-sidebar tab-type registration id (DSH 0.1.5 `sidebarRightTabs`). */
 		const SIDEBAR_STUDIO_TAB_ID = "dsh-image-gen/studio";
 		/** The tab kind: a page type opened by kind, recognizing no resource address. */

package/lib/index.js

@@ -8614,12 +8614,13 @@ async function downloadImage$1(url, provider, input) {
 			mediaType: detectImageMediaType(data) ?? imageMediaType$2(parsed.mediaType) ?? "image/png"
 		};
 	}
+	const sameOrigin = new URL(url).origin === new URL(input.baseURL).origin;
 	let response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
 		redirect: "follow",
 		signal: input.signal,
-		...input.apiKey === void 0 ? {} : { headers: { authorization: `Bearer ${input.apiKey}` } }
+		...input.apiKey === void 0 || !sameOrigin ? {} : { headers: { authorization: `Bearer ${input.apiKey}` } }
 	}), input.apiKey);
-	if (!response.ok && input.apiKey !== void 0) response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
+	if (!response.ok && input.apiKey !== void 0 && sameOrigin) response = await guardedFetch(`${provider} image download`, input.signal, () => fetch(url, {
 		redirect: "follow",
 		signal: input.signal
 	}), input.apiKey);
@@ -8875,6 +8876,7 @@ function emailFromToken(token) {
 async function formTokenRequest(url, params, fetchImpl) {
 	const response = await fetchImpl(url, {
 		method: "POST",
+		redirect: "error",
 		headers: {
 			"Content-Type": "application/x-www-form-urlencoded",
 			Accept: "application/json"
@@ -8883,8 +8885,15 @@ async function formTokenRequest(url, params, fetchImpl) {
 		signal: AbortSignal.timeout(25e3)
 	});
 	if (!response.ok) {
-		const text = await response.text().catch(() => "");
-		throw new Error(`token endpoint HTTP ${String(response.status)}${text.length > 0 ? `: ${text.slice(0, 200)}` : ""}`);
+		const detail = redactSecrets(await response.text().catch(() => ""), ...Object.entries(params).flatMap(([key, value]) => [
+			"access_token",
+			"refresh_token",
+			"id_token",
+			"code",
+			"code_verifier",
+			"client_secret"
+		].includes(key) ? [value] : [])).slice(0, 200);
+		throw new Error(`token endpoint HTTP ${String(response.status)}${detail.length > 0 ? `: ${detail}` : ""}`);
 	}
 	try {
 		const parsed = await response.json();
@@ -9928,7 +9937,8 @@ var SubscriptionManager = class {
 		const payload = await response.json().catch(() => ({}));
 		if (!response.ok) {
 			const detail = extractErrorMessage(payload);
-			throw new Error(`${vendor} HTTP ${String(response.status)}${detail !== void 0 ? `: ${detail.slice(0, 200)}` : ""}`);
+			const safeDetail = detail === void 0 ? void 0 : redactSecrets(detail, session.accessToken, session.refreshToken, session.accountId, session.email).slice(0, 200);
+			throw new Error(`${vendor} HTTP ${String(response.status)}${safeDetail !== void 0 ? `: ${safeDetail}` : ""}`);
 		}
 		return parseImages(payload);
 	}
@@ -10244,6 +10254,19 @@ const SUBSCRIPTION_CAPABILITIES = {
 	}], "auto", "standard")
 };
 //#endregion
+//#region lib/types/web-route.js
+function withWebAdmission(route, admission) {
+	return {
+		...route,
+		handler: (req, res) => {
+			const rejection = admission()?.(req);
+			if (rejection === void 0) return route.handler(req, res);
+			res.writeHead(rejection, { "content-type": "application/json; charset=utf-8" });
+			res.end(JSON.stringify({ error: rejection === 401 ? "unauthorized" : "forbidden" }));
+		}
+	};
+}
+//#endregion
 //#region lib/types/subscription/subscription-route.js
 const MAX_BODY_BYTES$1 = 16384;
 /** The vendor each subscription provider logs in as. */
@@ -10253,21 +10276,21 @@ function vendorOfProvider(provider) {
 	return "grok";
 }
 /** Register the login/status routes on the plugin's web server. */
-function registerSubscriptionRoutes(ctx, manager) {
-	ctx.effect(() => ctx.webServer.register({
+function registerSubscriptionRoutes(ctx, manager, admission = () => void 0) {
+	ctx.effect(() => ctx.webServer.register(withWebAdmission({
 		kind: "exact",
 		path: SUBSCRIPTION_LOGIN_ROUTE,
 		handler: (req, res) => {
 			serveLogin(req, res, manager);
 		}
-	}), "dsh-image-gen: subscription login route");
-	ctx.effect(() => ctx.webServer.register({
+	}, admission)), "dsh-image-gen: subscription login route");
+	ctx.effect(() => ctx.webServer.register(withWebAdmission({
 		kind: "exact",
 		path: SUBSCRIPTION_STATUS_ROUTE,
 		handler: (req, res) => {
 			serveStatus(req, res, manager);
 		}
-	}), "dsh-image-gen: subscription status route");
+	}, admission)), "dsh-image-gen: subscription status route");
 }
 async function serveLogin(req, res, manager) {
 	if (!sameOrigin$3(req)) return jsonError$3(res, 403, "origin-rejected");
@@ -28787,7 +28810,7 @@ async function fetchClassifiedJson(url, headers, apiKey, signal) {
 		method: "GET",
 		headers,
 		signal: signal ?? AbortSignal.timeout(PROBE_TIMEOUT_MS),
-		redirect: "follow"
+		redirect: "error"
 	}).catch((error) => {
 		throw new Error(error instanceof Error ? error.message : String(error));
 	});
@@ -29109,19 +29132,24 @@ function apply(ctx, config = {}) {
 			refreshImageToolContext();
 		}
 	});
+	let webAdmission;
+	ctx.inject(["connection"], (connectionCtx) => {
+		webAdmission = (request) => connectionCtx.connection.requestRejection(request);
+	});
 	ctx.inject(["webServer"], (webCtx) => {
-		registerSubscriptionRoutes(webCtx, subscriptionManager);
-		webCtx.effect(() => webCtx.webServer.register({
+		const register = (route) => webCtx.webServer.register(withWebAdmission(route, () => webAdmission));
+		registerSubscriptionRoutes(webCtx, subscriptionManager, () => webAdmission);
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: SETTINGS_HEALTH_ROUTE,
 			handler: (req, res) => serveSettingsHealth(req, res, settingsHealth())
 		}), "dsh-image-gen: settings health");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: IMAGE_ROUTE,
 			handler: (req, res) => serveImage(req, res, { readImage: (ref) => ctx.attachments.readImage(ref) })
 		}), "dsh-image-gen: image route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: IMPORT_ROUTE,
 			handler: (req, res) => serveImport(req, res, {
@@ -29130,7 +29158,7 @@ function apply(ctx, config = {}) {
 				mediaTypes: ctx.attachments.imageLimits.mediaTypes
 			})
 		}), "dsh-image-gen: import route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: DELETE_ROUTE,
 			handler: (req, res) => serveDelete(req, res, { deleteWorkspaceImage: async (filePath) => {
@@ -29142,7 +29170,7 @@ function apply(ctx, config = {}) {
 				]));
 			} })
 		}), "dsh-image-gen: delete route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: SAVE_WORKSPACE_ROUTE,
 			handler: (req, res) => serveSaveWorkspace(req, res, {
@@ -29169,7 +29197,7 @@ function apply(ctx, config = {}) {
 				isSaveEnabled: () => current().saveToWorkspace !== false
 			})
 		}), "dsh-image-gen: save workspace route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: TEST_CONNECTION_ROUTE,
 			handler: (req, res) => serveTestConnection(req, res, {
@@ -29178,7 +29206,7 @@ function apply(ctx, config = {}) {
 				subscriptionManager
 			})
 		}), "dsh-image-gen: test connection route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: CANVAS_STATE_ROUTE,
 			handler: (req, res) => serveCanvasState(req, res, {
@@ -29187,7 +29215,7 @@ function apply(ctx, config = {}) {
 				maxImageBytes: ctx.attachments.imageLimits.maxImageBytes
 			})
 		}), "dsh-image-gen: canvas state route");
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: CANVAS_ASSET_ROUTE,
 			handler: (req, res) => serveCanvasAsset(req, res, {
@@ -29223,7 +29251,8 @@ function apply(ctx, config = {}) {
 		name: "canvas-selection"
 	}) });
 	ctx.inject(["webServer"], (webCtx) => {
-		webCtx.effect(() => webCtx.webServer.register({
+		const register = (route) => webCtx.webServer.register(withWebAdmission(route, () => webAdmission));
+		webCtx.effect(() => register({
 			kind: "exact",
 			path: STUDIO_ROUTE,
 			handler: (req, res) => serveStudio(req, res, {
@@ -29246,7 +29275,7 @@ function apply(ctx, config = {}) {
 			})
 		}), "dsh-image-gen: studio route");
 		const serveInspiration = createInspirationRoute();
-		webCtx.effect(() => webCtx.webServer.register({
+		webCtx.effect(() => register({
 			kind: "prefix",
 			path: INSPIRATION_ROUTE,
 			handler: (req, res) => {

package/lib/types/subscription/subscription-route.d.ts

@@ -1,5 +1,6 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { SubscriptionManager } from './manager.js';
+import { type WebAdmission } from '../web-route.js';
 export { SUBSCRIPTION_LOGIN_ROUTE, SUBSCRIPTION_STATUS_ROUTE } from '../shared.js';
 /** Register the login/status routes on the plugin's web server. */
-export declare function registerSubscriptionRoutes(ctx: Context, manager: SubscriptionManager): void;
+export declare function registerSubscriptionRoutes(ctx: Context, manager: SubscriptionManager, admission?: () => WebAdmission | undefined): void;

package/lib/types/web-route.d.ts

@@ -0,0 +1,4 @@
+import type { ConnectionRequestRejection, ConnectionTrustRequest } from '@deepseek-ai/dsh-client-connection';
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+export type WebAdmission = (request: ConnectionTrustRequest) => ConnectionRequestRejection;
+export declare function withWebAdmission(route: WebRoute, admission: () => WebAdmission | undefined): WebRoute;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-image-gen",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Bring ChatGPT-like image generation to DeepSeek Harness — Gemini, OpenAI, Seedream, DashScope, local ComfyUI & more.",
   "type": "module",
   "author": "shanliuling",