dsh-image-gen 0.3.0 → 0.3.1

package/lib/index.js

@@ -12,6 +12,8 @@ const IMAGE_ROUTE = "/plugins/dsh-image-gen/image";
 const DELETE_ROUTE = "/plugins/dsh-image-gen/delete";
 /** Same-origin route used by the browser image workbench. */
 const STUDIO_ROUTE = "/plugins/dsh-image-gen/studio";
+/** Browser route used for saving generated images to workspace on demand. */
+const SAVE_WORKSPACE_ROUTE = "/plugins/dsh-image-gen/save-workspace";
 /** Namespace persisted through DSH Settings. */
 const IMAGE_GENERATION_NAMESPACE = "image-generation";
 /** Supported providers. */
@@ -964,6 +966,230 @@ function record$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 //#endregion
+//#region lib/types/workspace-save.js
+/** Persist one generated image as a file under the session workspace. */
+/** File extension for each supported image media type. */
+const EXTENSION = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/webp": "webp",
+	"image/gif": "gif"
+};
+/**
+* Build the deterministic file name for a generated image:
+* `image-<digest-prefix>.<ext>`. The digest prefix comes from the
+* content-addressed attachment id, so the same image bytes always map to the
+* same file name regardless of when they were generated, and re-saving simply
+* overwrites the previous copy in place.
+* @param attachmentId - durable attachment id (`sha256:<hex>`).
+* @param mediaType - verified image media type.
+* @returns the file name (no directory).
+*/
+function workspaceImageName(attachmentId, mediaType) {
+	return `image-${(attachmentId.startsWith("sha256:") ? attachmentId.slice(7) : attachmentId).slice(0, 8).padEnd(8, "0")}.${EXTENSION[mediaType]}`;
+}
+/**
+* Resolve the configured image folder inside the session workspace. The
+* folder may nest, but must stay inside the workspace: absolute paths and
+* parent-traversal segments are rejected for both separator styles.
+*
+* This lexical pass is necessary but not sufficient: `saveImageToWorkspace`
+* additionally verifies the on-disk resolution so symlinked folders cannot
+* escape the workspace.
+* @param workspaceRoot - the session workspace directory.
+* @param folder - configured subfolder; empty/blank means the workspace root.
+* @returns the absolute image directory.
+* @throws when the folder would escape the workspace root.
+*/
+function workspaceImageDir(workspaceRoot, folder) {
+	const trimmed = (folder ?? "").trim();
+	const root = resolve(workspaceRoot);
+	const dir = trimmed === "" ? root : resolve(root, trimmed);
+	if (!containsPath(root, dir)) throw new Error(`image workspace folder '${folder}' must stay inside the session workspace`);
+	return dir;
+}
+/** True when `child` equals `parent` or lives underneath it (lexically). */
+function containsPath(parent, child) {
+	const rel = relative(parent, child);
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+* Real path of the closest existing ancestor of `dir` (inclusive). Walking up
+* lets us validate symlinked folder segments before creating anything under
+* them.
+*/
+async function nearestExistingRealPath(dir) {
+	let probe = dir;
+	for (;;) try {
+		return await realpath(probe);
+	} catch (error) {
+		if (error?.code !== "ENOENT") throw error;
+		const parent = dirname(probe);
+		if (parent === probe) throw error;
+		probe = parent;
+	}
+}
+/** Reject a directory whose on-disk resolution lands outside the workspace. */
+function assertInsideWorkspace(realRoot, candidate, folder) {
+	if (containsPath(realRoot, candidate)) return;
+	throw new Error(`image workspace folder '${folder ?? ""}' must stay inside the session workspace (${candidate} resolves outside ${realRoot})`);
+}
+/**
+* Write one generated image durably under the session workspace.
+*
+* Containment is enforced twice: lexically by `workspaceImageDir`, then
+* against real paths, so a configured folder (or any intermediate segment)
+* that is a symlink pointing outside the workspace is rejected before and
+* after anything is created.
+*
+* The bytes are written to a same-directory staging file and renamed onto the
+* target, so a crash never leaves a half-written image under its final name.
+* Re-saving identical bytes rewrites the same file (the name is content-
+* addressed), which keeps repeated generations idempotent. A cancellation is
+* honoured up to and including the final rename: an aborted save never
+* resolves successfully and never leaves the image behind under its final
+* name.
+* @param options - workspace root, configured folder, attachment identity, and image bytes.
+* @returns the absolute path of the written file.
+*/
+async function saveImageToWorkspace(options) {
+	const dir = workspaceImageDir(options.workspaceRoot, options.folder);
+	options.signal?.throwIfAborted();
+	const realRoot = await realpath(resolve(options.workspaceRoot));
+	assertInsideWorkspace(realRoot, await nearestExistingRealPath(dir), options.folder);
+	const name = workspaceImageName(options.attachmentId, options.mediaType);
+	const target = join(dir, name);
+	const staging = join(dir, `.${name}.${process.pid}-${randomUUID()}.tmp`);
+	await mkdir(dir, { recursive: true });
+	assertInsideWorkspace(realRoot, await realpath(dir), options.folder);
+	try {
+		await writeFile(staging, options.data, {
+			flag: "wx",
+			signal: options.signal
+		});
+		options.signal?.throwIfAborted();
+		await rename(staging, target);
+	} catch (error) {
+		await unlink(staging).catch(() => {});
+		throw error;
+	}
+	try {
+		options.signal?.throwIfAborted();
+	} catch (error) {
+		await unlink(target).catch(() => {});
+		throw error;
+	}
+	return target;
+}
+/** Regex pattern strictly matching generated image file names (e.g. image-01234567.png). */
+const GENERATED_IMAGE_NAME_REGEX = /^image-[0-9a-f]{8,}\.(png|jpg|jpeg|webp|gif)$/i;
+/** Discover all DSH workspace paths recorded in local application storage. */
+async function getDshWorkspaceRoots() {
+	const roots = [];
+	try {
+		const home = process.env.USERPROFILE || process.env.HOME || "";
+		if (home) {
+			const workspaceJsonPath = join(home, ".dsh", "storages", "workspace.json");
+			const content = await readFile(workspaceJsonPath, "utf8");
+			const workspaces = JSON.parse(content)?.tables?.workspaces;
+			if (workspaces && typeof workspaces === "object") {
+				for (const ws of Object.values(workspaces)) if (ws && typeof ws === "object" && "path" in ws && typeof ws.path === "string") {
+					const p = ws.path;
+					if (p.trim()) roots.push(p.trim());
+				}
+			}
+		}
+	} catch {}
+	return roots;
+}
+/** Discover detailed workspace records from DSH workspace.json storage. */
+async function getDshWorkspacesFull() {
+	const list = [];
+	try {
+		const home = process.env.USERPROFILE || process.env.HOME || "";
+		if (home) {
+			const workspaceJsonPath = join(home, ".dsh", "storages", "workspace.json");
+			const content = await readFile(workspaceJsonPath, "utf8");
+			const workspaces = JSON.parse(content)?.tables?.workspaces;
+			if (workspaces && typeof workspaces === "object") for (const [id, ws] of Object.entries(workspaces)) {
+				const raw = ws;
+				if (raw && typeof raw.path === "string") {
+					const p = raw.path.trim();
+					if (!p) continue;
+					const title = typeof raw.title === "string" && raw.title.trim() ? raw.title.trim() : basename(p);
+					const rawSessions = raw.sessionIds;
+					const sessionIds = Array.isArray(rawSessions) ? rawSessions.filter((s) => typeof s === "string") : [];
+					list.push({
+						workspaceId: id,
+						path: p,
+						title,
+						sessionIds
+					});
+				}
+			}
+		}
+	} catch {}
+	return list;
+}
+/**
+* Verify whether a candidate path lives within an allowed DSH workspace root.
+* Resolves symlinks via `realpath` to prevent symlink traversal attacks.
+* @returns the canonical realpath of the candidate root.
+* @throws when candidateRoot does not exist or falls outside the allowed roots.
+*/
+async function assertWorkspaceAllowed(candidateRoot, allowedRoots) {
+	const realCandidate = await realpath(resolve(candidateRoot));
+	const rootsToCheck = /* @__PURE__ */ new Set();
+	for (const r of allowedRoots) if (typeof r === "string" && r.trim()) try {
+		rootsToCheck.add(await realpath(resolve(r)));
+	} catch {}
+	for (const allowed of rootsToCheck) if (containsPath(allowed, realCandidate)) return realCandidate;
+	throw new Error(`Directory '${candidateRoot}' is not within an allowed DSH workspace`);
+}
+/**
+* Safely delete a generated image file from workspace disk by its path.
+* Enforces strict safety gates:
+* 1. Base name must match generated image pattern (`image-<hex>.<ext>`) to avoid touching user files.
+* 2. Path must be a regular file and NOT a symbolic link.
+* 3. Real canonical path's basename must also match the pattern.
+* 4. Real canonical path must reside within an allowed workspace root (or process.cwd()).
+*/
+async function deleteImageFromWorkspace(filePath, allowedWorkspaceRoots) {
+	const resolved = resolve(filePath);
+	const base = resolved.split(/[/\\]/).pop() ?? "";
+	if (!GENERATED_IMAGE_NAME_REGEX.test(base)) return false;
+	try {
+		const fileLstat = await lstat(resolved);
+		if (fileLstat.isSymbolicLink() || !fileLstat.isFile()) return false;
+	} catch (err) {
+		if (err?.code === "ENOENT") return true;
+		throw err;
+	}
+	try {
+		const realFile = await realpath(resolved);
+		const realBase = realFile.split(/[/\\]/).pop() ?? "";
+		if (!GENERATED_IMAGE_NAME_REGEX.test(realBase)) return false;
+		const rootsToCheck = /* @__PURE__ */ new Set();
+		if (allowedWorkspaceRoots) {
+			for (const r of allowedWorkspaceRoots) if (typeof r === "string" && r.trim()) rootsToCheck.add(resolve(r));
+		}
+		rootsToCheck.add(resolve(process.cwd()));
+		let withinAllowed = false;
+		for (const root of rootsToCheck) try {
+			if (containsPath(await realpath(root), realFile)) {
+				withinAllowed = true;
+				break;
+			}
+		} catch {}
+		if (!withinAllowed) return false;
+		await unlink(realFile);
+		return true;
+	} catch (err) {
+		if (err?.code === "ENOENT") return true;
+		throw err;
+	}
+}
+//#endregion
 //#region lib/types/image-route.js
 const MAX_BODY_BYTES = 65536;
 /** Serve one verified durable image reference to a same-origin browser request. */
@@ -994,13 +1220,17 @@ async function serveImage(req, res, deps) {
 		jsonError$1(res, 404, "image-unavailable");
 	}
 }
+function sameOrigin$1(req) {
+	const origin = req.headers.origin;
+	const host = req.headers.host;
+	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return false;
+	return true;
+}
 /** Safely delete one or more generated image files from the workspace disk. */
 async function serveDelete(req, res, deps) {
 	if (req.method !== "POST") return jsonError$1(res, 405, "method-not-allowed");
 	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$1(res, 415, "json-required");
-	const origin = req.headers.origin;
-	const host = req.headers.host;
-	if (origin !== void 0 && host !== void 0 && origin !== `http://${host}` && origin !== `https://${host}`) return jsonError$1(res, 403, "origin-rejected");
+	if (!sameOrigin$1(req)) return jsonError$1(res, 403, "origin-rejected");
 	let body;
 	try {
 		body = JSON.parse(await readBody$1(req));
@@ -1033,6 +1263,61 @@ async function serveDelete(req, res, deps) {
 		failedFiles
 	}));
 }
+/** Serve on-demand image persistence into the workspace. */
+async function serveSaveWorkspace(req, res, deps) {
+	if (!sameOrigin$1(req)) return jsonError$1(res, 403, "origin-rejected");
+	if (req.method !== "POST") return jsonError$1(res, 405, "method-not-allowed");
+	if (!(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return jsonError$1(res, 415, "json-required");
+	try {
+		const raw = JSON.parse(await readBody$1(req));
+		const attachment = parseImageAttachmentRef(raw.attachment);
+		if (!attachment) return jsonError$1(res, 400, "invalid-attachment");
+		if (!deps.isSaveEnabled()) {
+			res.writeHead(200, {
+				"content-type": "application/json",
+				"cache-control": "no-store"
+			});
+			res.end(JSON.stringify({
+				ok: true,
+				savedTo: void 0
+			}));
+			return;
+		}
+		const rawTarget = typeof raw.workspaceRoot === "string" && raw.workspaceRoot.trim() ? raw.workspaceRoot.trim() : deps.getActiveWorkspaceRoot();
+		const allowedRoots = await deps.getAllowedWorkspaceRoots();
+		let targetRoot;
+		try {
+			targetRoot = await assertWorkspaceAllowed(rawTarget, allowedRoots);
+		} catch {
+			return jsonError$1(res, 403, "workspace-root-not-allowed");
+		}
+		const stored = await deps.readImage(attachment);
+		if (!stored || !stored.data) return jsonError$1(res, 404, "image-not-found");
+		const savedTo = await deps.saveToWorkspace({
+			workspaceRoot: targetRoot,
+			attachmentId: String(attachment.attachmentId),
+			mediaType: attachment.mediaType,
+			data: stored.data
+		});
+		res.writeHead(200, {
+			"content-type": "application/json",
+			"cache-control": "no-store"
+		});
+		res.end(JSON.stringify({
+			ok: true,
+			savedTo
+		}));
+	} catch (err) {
+		res.writeHead(500, {
+			"content-type": "application/json",
+			"cache-control": "no-store"
+		});
+		res.end(JSON.stringify({
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		}));
+	}
+}
 /** Validate the persisted reference carried by a tool presentation. */
 function imageAttachmentFromMeta(meta) {
 	const value = record$1(meta);
@@ -1337,196 +1622,6 @@ async function readBoundedBytes(response, maxBytes) {
 	return joined;
 }
 //#endregion
-//#region lib/types/workspace-save.js
-/** Persist one generated image as a file under the session workspace. */
-/** File extension for each supported image media type. */
-const EXTENSION = {
-	"image/png": "png",
-	"image/jpeg": "jpg",
-	"image/webp": "webp",
-	"image/gif": "gif"
-};
-/**
-* Build the deterministic file name for a generated image:
-* `image-<digest-prefix>.<ext>`. The digest prefix comes from the
-* content-addressed attachment id, so the same image bytes always map to the
-* same file name regardless of when they were generated, and re-saving simply
-* overwrites the previous copy in place.
-* @param attachmentId - durable attachment id (`sha256:<hex>`).
-* @param mediaType - verified image media type.
-* @returns the file name (no directory).
-*/
-function workspaceImageName(attachmentId, mediaType) {
-	return `image-${(attachmentId.startsWith("sha256:") ? attachmentId.slice(7) : attachmentId).slice(0, 8).padEnd(8, "0")}.${EXTENSION[mediaType]}`;
-}
-/**
-* Resolve the configured image folder inside the session workspace. The
-* folder may nest, but must stay inside the workspace: absolute paths and
-* parent-traversal segments are rejected for both separator styles.
-*
-* This lexical pass is necessary but not sufficient: `saveImageToWorkspace`
-* additionally verifies the on-disk resolution so symlinked folders cannot
-* escape the workspace.
-* @param workspaceRoot - the session workspace directory.
-* @param folder - configured subfolder; empty/blank means the workspace root.
-* @returns the absolute image directory.
-* @throws when the folder would escape the workspace root.
-*/
-function workspaceImageDir(workspaceRoot, folder) {
-	const trimmed = (folder ?? "").trim();
-	const root = resolve(workspaceRoot);
-	const dir = trimmed === "" ? root : resolve(root, trimmed);
-	if (!containsPath(root, dir)) throw new Error(`image workspace folder '${folder}' must stay inside the session workspace`);
-	return dir;
-}
-/** True when `child` equals `parent` or lives underneath it (lexically). */
-function containsPath(parent, child) {
-	const rel = relative(parent, child);
-	return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-}
-/**
-* Real path of the closest existing ancestor of `dir` (inclusive). Walking up
-* lets us validate symlinked folder segments before creating anything under
-* them.
-*/
-async function nearestExistingRealPath(dir) {
-	let probe = dir;
-	for (;;) try {
-		return await realpath(probe);
-	} catch (error) {
-		if (error?.code !== "ENOENT") throw error;
-		const parent = dirname(probe);
-		if (parent === probe) throw error;
-		probe = parent;
-	}
-}
-/** Reject a directory whose on-disk resolution lands outside the workspace. */
-function assertInsideWorkspace(realRoot, candidate, folder) {
-	if (containsPath(realRoot, candidate)) return;
-	throw new Error(`image workspace folder '${folder ?? ""}' must stay inside the session workspace (${candidate} resolves outside ${realRoot})`);
-}
-/**
-* Write one generated image durably under the session workspace.
-*
-* Containment is enforced twice: lexically by `workspaceImageDir`, then
-* against real paths, so a configured folder (or any intermediate segment)
-* that is a symlink pointing outside the workspace is rejected before and
-* after anything is created.
-*
-* The bytes are written to a same-directory staging file and renamed onto the
-* target, so a crash never leaves a half-written image under its final name.
-* Re-saving identical bytes rewrites the same file (the name is content-
-* addressed), which keeps repeated generations idempotent. A cancellation is
-* honoured up to and including the final rename: an aborted save never
-* resolves successfully and never leaves the image behind under its final
-* name.
-* @param options - workspace root, configured folder, attachment identity, and image bytes.
-* @returns the absolute path of the written file.
-*/
-async function saveImageToWorkspace(options) {
-	const dir = workspaceImageDir(options.workspaceRoot, options.folder);
-	options.signal?.throwIfAborted();
-	const realRoot = await realpath(resolve(options.workspaceRoot));
-	assertInsideWorkspace(realRoot, await nearestExistingRealPath(dir), options.folder);
-	const name = workspaceImageName(options.attachmentId, options.mediaType);
-	const target = join(dir, name);
-	const staging = join(dir, `.${name}.${process.pid}-${randomUUID()}.tmp`);
-	await mkdir(dir, { recursive: true });
-	assertInsideWorkspace(realRoot, await realpath(dir), options.folder);
-	try {
-		await writeFile(staging, options.data, {
-			flag: "wx",
-			signal: options.signal
-		});
-		options.signal?.throwIfAborted();
-		await rename(staging, target);
-	} catch (error) {
-		await unlink(staging).catch(() => {});
-		throw error;
-	}
-	try {
-		options.signal?.throwIfAborted();
-	} catch (error) {
-		await unlink(target).catch(() => {});
-		throw error;
-	}
-	return target;
-}
-/** Regex pattern strictly matching generated image file names (e.g. image-01234567.png). */
-const GENERATED_IMAGE_NAME_REGEX = /^image-[0-9a-f]{8,}\.(png|jpg|jpeg|webp|gif)$/i;
-/** Discover detailed workspace records from DSH workspace.json storage. */
-async function getDshWorkspacesFull() {
-	const list = [];
-	try {
-		const home = process.env.USERPROFILE || process.env.HOME || "";
-		if (home) {
-			const workspaceJsonPath = join(home, ".dsh", "storages", "workspace.json");
-			const content = await readFile(workspaceJsonPath, "utf8");
-			const workspaces = JSON.parse(content)?.tables?.workspaces;
-			if (workspaces && typeof workspaces === "object") for (const [id, ws] of Object.entries(workspaces)) {
-				const raw = ws;
-				if (raw && typeof raw.path === "string") {
-					const p = raw.path.trim();
-					if (!p) continue;
-					const title = typeof raw.title === "string" && raw.title.trim() ? raw.title.trim() : basename(p);
-					const rawSessions = raw.sessionIds;
-					const sessionIds = Array.isArray(rawSessions) ? rawSessions.filter((s) => typeof s === "string") : [];
-					list.push({
-						workspaceId: id,
-						path: p,
-						title,
-						sessionIds
-					});
-				}
-			}
-		}
-	} catch {}
-	return list;
-}
-/**
-* Safely delete a generated image file from workspace disk by its path.
-* Enforces strict safety gates:
-* 1. Base name must match generated image pattern (`image-<hex>.<ext>`) to avoid touching user files.
-* 2. Path must be a regular file and NOT a symbolic link.
-* 3. Real canonical path's basename must also match the pattern.
-* 4. Real canonical path must reside within an allowed workspace root (or process.cwd()).
-*/
-async function deleteImageFromWorkspace(filePath, allowedWorkspaceRoots) {
-	const resolved = resolve(filePath);
-	const base = resolved.split(/[/\\]/).pop() ?? "";
-	if (!GENERATED_IMAGE_NAME_REGEX.test(base)) return false;
-	try {
-		const fileLstat = await lstat(resolved);
-		if (fileLstat.isSymbolicLink() || !fileLstat.isFile()) return false;
-	} catch (err) {
-		if (err?.code === "ENOENT") return true;
-		throw err;
-	}
-	try {
-		const realFile = await realpath(resolved);
-		const realBase = realFile.split(/[/\\]/).pop() ?? "";
-		if (!GENERATED_IMAGE_NAME_REGEX.test(realBase)) return false;
-		const rootsToCheck = /* @__PURE__ */ new Set();
-		if (allowedWorkspaceRoots) {
-			for (const r of allowedWorkspaceRoots) if (typeof r === "string" && r.trim()) rootsToCheck.add(resolve(r));
-		}
-		rootsToCheck.add(resolve(process.cwd()));
-		let withinAllowed = false;
-		for (const root of rootsToCheck) try {
-			if (containsPath(await realpath(root), realFile)) {
-				withinAllowed = true;
-				break;
-			}
-		} catch {}
-		if (!withinAllowed) return false;
-		await unlink(realFile);
-		return true;
-	} catch (err) {
-		if (err?.code === "ENOENT") return true;
-		throw err;
-	}
-}
-//#endregion
 //#region lib/types/studio.js
 const PROVIDER_LABELS = {
 	google: "Google",
@@ -1575,130 +1670,183 @@ async function generateFromStudio(ctx, config, input, signal, fallbackWorkspaceR
 	if (input.mode === "edit" && rawRefs.length === 0) throw new Error("图生图需要至少一张参考图");
 	const sourceImages = input.mode === "edit" ? await Promise.all(rawRefs.map((ref) => readStudioReference(ctx, ref, signal))) : [];
 	const startedAt = Date.now();
-	let generated;
-	let output;
-	if (active.provider === "google") {
-		const aspectRatio = input.ratio;
-		const imageSize = input.quality;
-		generated = input.mode === "edit" ? await editGoogleImage({
-			apiKey: credential.value,
-			endpoint: active.endpoint,
-			model: active.model,
-			prompt: input.prompt,
-			sourceImages,
-			aspectRatio,
-			imageSize,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		}) : await generateGoogleImage({
-			apiKey: credential.value,
-			endpoint: active.endpoint,
-			model: active.model,
-			prompt: input.prompt,
-			aspectRatio,
-			imageSize,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		});
-		output = `${aspectRatio}, ${imageSize}`;
-	} else if (active.provider === "openai") {
-		const size = openAISize(input.ratio);
-		generated = input.mode === "edit" ? await editOpenAICompatibleImage({
-			apiKey: credential.value,
-			baseURL: active.baseURL,
-			model: active.model,
-			prompt: input.prompt,
-			sourceImages,
-			size,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		}) : await generateOpenAICompatibleImage({
-			provider: "openai",
-			apiKey: credential.value,
-			baseURL: active.baseURL,
-			model: active.model,
-			prompt: input.prompt,
-			size,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		});
-		output = size;
-	} else if (active.provider === "seedream") {
-		const size = input.quality;
-		generated = input.mode === "edit" ? await editSeedreamImage({
-			apiKey: credential.value,
-			baseURL: active.baseURL,
-			model: active.model,
-			prompt: input.prompt,
-			sourceImages,
-			size,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		}) : await generateOpenAICompatibleImage({
-			provider: "seedream",
-			apiKey: credential.value,
-			baseURL: active.baseURL,
-			model: active.model,
-			prompt: input.prompt,
-			size,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		});
-		output = size;
-	} else {
-		if (input.mode === "edit" && sourceImages.length > 3) throw new Error("DashScope (通义万相) 图生图目前最多支持 3 张参考图，请精简后重试");
-		const size = dashScopeSize(input.ratio);
-		generated = input.mode === "edit" ? await editDashScopeImage({
-			apiKey: credential.value,
-			endpoint: active.endpoint,
-			model: active.model,
-			prompt: input.prompt,
-			sourceImages,
-			size,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		}) : await generateDashScopeImage({
-			apiKey: credential.value,
-			endpoint: active.endpoint,
-			model: active.model,
+	const count = input.count ?? 1;
+	const generateSingle = async (index) => {
+		let generated;
+		let output;
+		if (active.provider === "google") {
+			const aspectRatio = input.ratio;
+			const imageSize = input.quality;
+			generated = input.mode === "edit" ? await editGoogleImage({
+				apiKey: credential.value,
+				endpoint: active.endpoint,
+				model: active.model,
+				prompt: input.prompt,
+				sourceImages,
+				aspectRatio,
+				imageSize,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			}) : await generateGoogleImage({
+				apiKey: credential.value,
+				endpoint: active.endpoint,
+				model: active.model,
+				prompt: input.prompt,
+				aspectRatio,
+				imageSize,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			});
+			output = `${aspectRatio}, ${imageSize}`;
+		} else if (active.provider === "openai") {
+			const size = openAISize(input.ratio);
+			generated = input.mode === "edit" ? await editOpenAICompatibleImage({
+				apiKey: credential.value,
+				baseURL: active.baseURL,
+				model: active.model,
+				prompt: input.prompt,
+				sourceImages,
+				size,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			}) : await generateOpenAICompatibleImage({
+				provider: "openai",
+				apiKey: credential.value,
+				baseURL: active.baseURL,
+				model: active.model,
+				prompt: input.prompt,
+				size,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			});
+			output = size;
+		} else if (active.provider === "seedream") {
+			const size = input.quality;
+			generated = input.mode === "edit" ? await editSeedreamImage({
+				apiKey: credential.value,
+				baseURL: active.baseURL,
+				model: active.model,
+				prompt: input.prompt,
+				sourceImages,
+				size,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			}) : await generateOpenAICompatibleImage({
+				provider: "seedream",
+				apiKey: credential.value,
+				baseURL: active.baseURL,
+				model: active.model,
+				prompt: input.prompt,
+				size,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			});
+			output = size;
+		} else {
+			if (input.mode === "edit" && sourceImages.length > 3) throw new Error("DashScope (通义万相) 图生图目前最多支持 3 张参考图，请精简后重试");
+			const size = dashScopeSize(input.ratio);
+			generated = input.mode === "edit" ? await editDashScopeImage({
+				apiKey: credential.value,
+				endpoint: active.endpoint,
+				model: active.model,
+				prompt: input.prompt,
+				sourceImages,
+				size,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			}) : await generateDashScopeImage({
+				apiKey: credential.value,
+				endpoint: active.endpoint,
+				model: active.model,
+				prompt: input.prompt,
+				size,
+				maxBytes: ctx.attachments.imageLimits.maxImageBytes,
+				signal
+			});
+			output = size;
+		}
+		if (!ctx.attachments.imageLimits.mediaTypes.includes(generated.mediaType)) throw new Error(`当前 DSH 不支持保存 ${generated.mediaType} 图片`);
+		return {
+			attachment: await ctx.attachments.saveImage({
+				data: generated.data,
+				mediaType: generated.mediaType,
+				name: count > 1 ? `studio-image-${index + 1}` : "studio-image"
+			}),
+			output
+		};
+	};
+	if (count === 1) {
+		const single = await generateSingle(0);
+		return {
+			attachment: single.attachment,
+			output: single.output,
+			provider: input.provider,
+			model: input.model,
 			prompt: input.prompt,
-			size,
-			maxBytes: ctx.attachments.imageLimits.maxImageBytes,
-			signal
-		});
-		output = size;
+			createdAt: Date.now(),
+			elapsedMs: Date.now() - startedAt,
+			requestedCount: 1,
+			failedCount: 0,
+			items: [single],
+			...single.savedTo ? { savedTo: single.savedTo } : {}
+		};
 	}
-	if (!ctx.attachments.imageLimits.mediaTypes.includes(generated.mediaType)) throw new Error(`当前 DSH 不支持保存 ${generated.mediaType} 图片`);
-	const attachment = await ctx.attachments.saveImage({
-		data: generated.data,
-		mediaType: generated.mediaType,
-		name: "studio-image"
-	});
-	let savedTo;
-	const targetRoot = input.workspaceRoot || fallbackWorkspaceRoot;
-	if (config.saveToWorkspace !== false && targetRoot) try {
-		savedTo = await saveImageToWorkspace({
-			workspaceRoot: targetRoot,
-			folder: config.workspaceFolder,
-			attachmentId: attachment.attachmentId,
-			mediaType: generated.mediaType,
-			data: generated.data,
-			signal
+	const poolResults = await runPool(Array.from({ length: count }, (_, i) => () => generateSingle(i)), 2);
+	const successes = [];
+	const errors = [];
+	for (let i = 0; i < poolResults.length; i++) {
+		const r = poolResults[i];
+		if (r.status === "fulfilled") successes.push(r.value);
+		else errors.push({
+			index: i,
+			message: r.reason instanceof Error ? r.reason.message : String(r.reason)
 		});
-	} catch (saveError) {
-		ctx.logger.warn(`dsh-image-gen: studio failed to save image to workspace: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 	}
+	if (successes.length === 0) {
+		const firstReason = poolResults[0] && poolResults[0].status === "rejected" ? poolResults[0].reason : /* @__PURE__ */ new Error("批量生图全部失败");
+		throw firstReason instanceof Error ? firstReason : new Error(String(firstReason));
+	}
+	const first = successes[0];
 	return {
-		attachment,
+		attachment: first.attachment,
+		output: first.output,
 		provider: input.provider,
 		model: input.model,
 		prompt: input.prompt,
-		output,
 		createdAt: Date.now(),
 		elapsedMs: Date.now() - startedAt,
-		...savedTo ? { savedTo } : {}
+		requestedCount: count,
+		failedCount: errors.length,
+		items: successes,
+		...errors.length > 0 ? { errors } : {},
+		...first.savedTo ? { savedTo: first.savedTo } : {}
 	};
 }
+async function runPool(tasks, concurrency = 2) {
+	const results = new Array(tasks.length);
+	let nextIndex = 0;
+	async function worker() {
+		while (nextIndex < tasks.length) {
+			const currentIndex = nextIndex++;
+			const task = tasks[currentIndex];
+			try {
+				const val = await task();
+				results[currentIndex] = {
+					status: "fulfilled",
+					value: val
+				};
+			} catch (err) {
+				results[currentIndex] = {
+					status: "rejected",
+					reason: err
+				};
+			}
+		}
+	}
+	const workers = Array.from({ length: Math.min(concurrency, tasks.length) }, () => worker());
+	await Promise.all(workers);
+	return results;
+}
 function studioProfile(config, provider, configured) {
 	const active = resolveProvider(providerConfig(config, provider));
 	if (active.provider === "comfyui") throw new Error("Invalid cloud provider profile");
@@ -1886,6 +2034,11 @@ function parseStudioGenerateRequest(value) {
 	if (input.mode === "edit" && references.length === 0) throw new Error("图生图需要至少一张参考图");
 	if (references.length > 5) throw new Error("最多支持上传 5 张参考图");
 	const workspaceRoot = typeof input.workspaceRoot === "string" && input.workspaceRoot.trim().length > 0 ? input.workspaceRoot.trim() : void 0;
+	let count;
+	if (input.count !== void 0) {
+		if (typeof input.count !== "number" || !Number.isInteger(input.count) || input.count < 1 || input.count > 4) throw new Error("生成数量仅支持 1 到 4 张");
+		count = input.count;
+	}
 	return {
 		mode: input.mode,
 		provider: input.provider,
@@ -1893,6 +2046,7 @@ function parseStudioGenerateRequest(value) {
 		prompt,
 		ratio,
 		quality,
+		...count !== void 0 ? { count } : {},
 		...references.length > 0 ? {
 			references,
 			reference: references[0]
@@ -1991,6 +2145,30 @@ function apply(ctx, config = {}) {
 		path: DELETE_ROUTE,
 		handler: (req, res) => serveDelete(req, res, { deleteWorkspaceImage: (filePath) => deleteImageFromWorkspace(filePath, knownWorkspaceRoots) })
 	}), "dsh-image-gen: delete route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: SAVE_WORKSPACE_ROUTE,
+		handler: (req, res) => serveSaveWorkspace(req, res, {
+			readImage: (ref) => ctx.attachments.readImage(ref),
+			saveToWorkspace: (options) => saveImageToWorkspace({
+				workspaceRoot: options.workspaceRoot,
+				folder: current().workspaceFolder,
+				attachmentId: options.attachmentId,
+				mediaType: options.mediaType,
+				data: options.data
+			}),
+			getActiveWorkspaceRoot: () => Array.from(knownWorkspaceRoots)[0] || process.cwd(),
+			getAllowedWorkspaceRoots: async () => {
+				const discovered = await getDshWorkspaceRoots().catch(() => []);
+				return /* @__PURE__ */ new Set([
+					...knownWorkspaceRoots,
+					...discovered,
+					process.cwd()
+				]);
+			},
+			isSaveEnabled: () => current().saveToWorkspace !== false
+		})
+	}), "dsh-image-gen: save workspace route");
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: STUDIO_ROUTE,
@@ -2310,7 +2488,8 @@ function imageOutput(verb) {
 					required: true
 				},
 				savedTo: { type: "string" },
-				saveError: { type: "string" }
+				saveError: { type: "string" },
+				seed: { type: "integer" }
 			}
 		},
 		render: (_args, value) => {
@@ -2420,4 +2599,4 @@ function installImageSettings(ctx, config, hooks) {
 	ctx.logger.warn("dsh-image-gen: this DSH exposes neither settings API generation; settings UI stays on the composition entry");
 }
 //#endregion
-export { Config, DELETE_ROUTE, IMAGE_ROUTE, STUDIO_ROUTE, apply, imageAttachmentFromMeta, inject, name };
+export { Config, DELETE_ROUTE, IMAGE_ROUTE, SAVE_WORKSPACE_ROUTE, STUDIO_ROUTE, apply, imageAttachmentFromMeta, inject, name };