dsh-plugin-subscriptions 0.1.0 → 0.1.2

package/lib/index.js

@@ -1,9 +1,10 @@
 import z from "@deepseek-ai/schemastery";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError } from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, createUserMessage, errorChain, isContextWindowExceededError, isQuotaExceededError } from "@deepseek-ai/dsh-llm";
 import { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { AttachmentId } from "@deepseek-ai/dsh-attachment";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { dshHomePath } from "@deepseek-ai/dsh-home-paths";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 
@@ -363,6 +364,13 @@ async function deleteSession(provider, path = authFilePath()) {
 //#region src/auth/rpc.ts
 /** The RPC channel this plugin registers on the host connection. */
 const SUBSCRIPTIONS_AUTH_CHANNEL = "/subscriptions-auth";
+/** Media types the attachment store accepts (ImageMediaType). */
+const IMAGE_MEDIA_TYPES = [
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif"
+];
 /** Payload carried no usable provider id — an RPC client bug, not a server failure. */
 var BadRequest = class extends Error {};
 function ok(value) {
@@ -401,7 +409,34 @@ function readString(payload, field) {
 	if (typeof value !== "string" || value.length === 0) throw new BadRequest(`payload.${field} must be a non-empty string`);
 	return value;
 }
-async function dispatch(controller, endpoint, payload) {
+/** Validate the `image` endpoint's payload into a full attachment reference. */
+function readImageRef(payload) {
+	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
+	const record = payload;
+	const attachmentId = record.attachmentId;
+	if (typeof attachmentId !== "string" || attachmentId.length === 0) throw new BadRequest("payload.attachmentId must be a non-empty string");
+	const mediaType = record.mediaType;
+	if (typeof mediaType !== "string" || !IMAGE_MEDIA_TYPES.includes(mediaType)) throw new BadRequest(`payload.mediaType must be one of ${IMAGE_MEDIA_TYPES.join(", ")}`);
+	for (const field of [
+		"bytes",
+		"width",
+		"height"
+	]) {
+		const value = record[field];
+		if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) throw new BadRequest(`payload.${field} must be a positive integer`);
+	}
+	const name$1 = record.name;
+	if (name$1 !== void 0 && typeof name$1 !== "string") throw new BadRequest("payload.name must be a string when present");
+	return {
+		attachmentId: AttachmentId(attachmentId),
+		mediaType,
+		bytes: record.bytes,
+		width: record.width,
+		height: record.height,
+		...name$1 === void 0 ? {} : { name: name$1 }
+	};
+}
+async function dispatch(controller, endpoint, payload, signal) {
 	switch (endpoint) {
 		case "status": {
 			const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
@@ -419,6 +454,7 @@ async function dispatch(controller, endpoint, payload) {
 		case "logout":
 			await controller.logout(readProvider(payload));
 			return ok({ ok: true });
+		case "image": return ok(await controller.readImage(readImageRef(payload), signal));
 		default: throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
 	}
 }
@@ -430,9 +466,9 @@ async function dispatch(controller, endpoint, payload) {
 function registerAuthRpc(ctx, controller) {
 	ctx.inject(["connection"], (ctx$1) => {
 		const connection = ctx$1.get("connection");
-		ctx$1.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload) => {
+		ctx$1.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
 			try {
-				return await dispatch(controller, endpoint, payload);
+				return await dispatch(controller, endpoint, payload, signal);
 			} catch (error) {
 				return failure(error);
 			}
@@ -1364,11 +1400,10 @@ var CodexAdapter = class extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		const session = await this.options.tokens.peek();
-		if (session === void 0) return [];
+		if (await this.options.tokens.peek() === void 0) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
 		try {
-			return (await this.catalog.get(() => fetchCodexModels(session, this.options.fetchFn))).map((model) => ({
+			return (await this.catalog.get(async () => fetchCodexModels(await this.options.tokens.session(), this.options.fetchFn))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
@@ -1376,6 +1411,7 @@ var CodexAdapter = class extends LlmAdapter {
 				inputModalities: CODEX_MODALITIES
 			}));
 		} catch (error) {
+			if (error instanceof LlmError && (error.code === "MISSING_CREDENTIAL" || error.code === "INVALID_CREDENTIAL")) return [];
 			if (error instanceof OAuthEndpointError && error.status === 401) this.catalog.invalidate();
 			this.options.onWarn?.(`codex model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -2245,17 +2281,17 @@ var GrokAdapter = class extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		const session = await this.options.tokens.peek();
-		if (session === void 0) return [];
+		if (await this.options.tokens.peek() === void 0) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
 		try {
-			return (await this.catalog.get(() => fetchGrokModels(session, this.options.fetchFn))).map((model) => ({
+			return (await this.catalog.get(async () => fetchGrokModels(await this.options.tokens.session(), this.options.fetchFn))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
 				inputModalities: grokModalities(model.id)
 			}));
 		} catch (error) {
+			if (error instanceof LlmError && (error.code === "MISSING_CREDENTIAL" || error.code === "INVALID_CREDENTIAL")) return [];
 			if (error instanceof OAuthEndpointError && error.status === 401) this.catalog.invalidate();
 			this.options.onWarn?.(`grok model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -2557,6 +2593,50 @@ function truncate(text, max = 60) {
 	return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
 }
 /**
+* Non-throwing image-capability check for the calling route (read_image's
+* gate, softened: a generated image that cannot enter history degrades to the
+* text-only result instead of failing the call). Resolves the session's
+* latest routed provider/model and answers whether the exact route declares
+* image input; any resolution failure means "no".
+*/
+async function routeDeclaresImageInput(resolveLlm, exec) {
+	const llm = resolveLlm?.();
+	const routed = exec.agent?.session.requestHeader()?.config;
+	const provider = routed?.provider ?? exec.agent?.options.provider;
+	const model = routed?.model ?? exec.agent?.options.model;
+	if (llm === void 0 || provider === void 0 || model === void 0) return false;
+	try {
+		return (await llm.resolveModelInfo(provider, model, exec.signal)).inputModalities?.includes("image") === true;
+	} catch {
+		return false;
+	}
+}
+/** Re-brand one canonical image entry into the attachment reference an ImageBlock carries. */
+function imageRefFromValue(image) {
+	return {
+		attachmentId: AttachmentId(image.attachmentId),
+		mediaType: image.mediaType,
+		bytes: image.bytes,
+		width: image.width,
+		height: image.height,
+		...image.name === void 0 ? {} : { name: image.name }
+	};
+}
+/** Project the canonical value into the model-facing text + image blocks. */
+function imageGenerateContent(value) {
+	return [imageGenerateText(value), ...(value.images ?? []).map((image) => ({
+		type: "image",
+		attachment: imageRefFromValue(image)
+	}))];
+}
+/** The text summary of one generation, shared by the model content and the UI card. */
+function imageGenerateText(value) {
+	return {
+		type: "text",
+		text: `Saved ${value.paths.length} image(s):\n${value.paths.map((path) => `- ${path}`).join("\n")}` + (value.revisedPrompt === void 0 ? "" : `\n\nRevised prompt: ${value.revisedPrompt}`)
+	};
+}
+/**
 * Build the `image_generate` tool definition.
 * @param options - codex session source, fetch implementation, and image directory.
 * @returns the tool to register on `ctx.tools`.
@@ -2564,7 +2644,7 @@ function truncate(text, max = 60) {
 function createImageGenerateTool(options) {
 	return defineTool({
 		name: "image_generate",
-		description: "Generate an image with the ChatGPT subscription (gpt-image-2) and save it as a PNG file. Returns the saved file paths.",
+		description: "Generate an image with the ChatGPT subscription (gpt-image-2) and save it as a PNG file. Returns the saved file paths; on image-capable models the image itself is attached.",
 		parameters: {
 			prompt: {
 				type: "string",
@@ -2601,19 +2681,56 @@ function createImageGenerateTool(options) {
 						items: { type: "string" },
 						required: true
 					},
+					images: {
+						type: "array",
+						items: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								attachmentId: {
+									type: "string",
+									required: true
+								},
+								mediaType: {
+									type: "string",
+									enum: [
+										"image/png",
+										"image/jpeg",
+										"image/webp",
+										"image/gif"
+									],
+									required: true
+								},
+								bytes: {
+									type: "integer",
+									required: true
+								},
+								width: {
+									type: "integer",
+									required: true
+								},
+								height: {
+									type: "integer",
+									required: true
+								},
+								name: { type: "string" }
+							}
+						}
+					},
 					revisedPrompt: { type: "string" }
 				},
 				additionalProperties: false
 			},
-			render: (_args, value) => [{
-				type: "text",
-				text: `Saved ${value.paths.length} image(s):\n${value.paths.map((path) => `- ${path}`).join("\n")}` + (value.revisedPrompt === void 0 ? "" : `\n\nRevised prompt: ${value.revisedPrompt}`)
-			}]
+			render: (_args, value) => imageGenerateContent(value)
 		},
 		presentCall: (args) => ({
 			card: "generic",
 			title: `image_generate: ${truncate(args.prompt)}`
 		}),
+		presentResult: (_args, result) => ({
+			card: "generic",
+			content: result.content.filter((block) => block.type === "text")
+		}),
 		async execute(args, exec) {
 			const body = buildImageGenerateBody(args);
 			const session = await options.tokens.session();
@@ -2639,11 +2756,38 @@ function createImageGenerateTool(options) {
 				await writeFile(path, image.data);
 				paths.push(path);
 			}
+			const attachments = options.resolveAttachments?.();
+			const imageCapable = attachments !== void 0 && await routeDeclaresImageInput(options.resolveLlm, exec);
+			const refs = [];
+			if (attachments !== void 0 && imageCapable) for (const [index, image] of images.entries()) {
+				const ref = await attachments.saveImage({
+					data: image.data,
+					mediaType: "image/png",
+					name: basename(paths[index])
+				});
+				refs.push({
+					attachmentId: ref.attachmentId,
+					mediaType: ref.mediaType,
+					bytes: ref.bytes,
+					width: ref.width,
+					height: ref.height,
+					...ref.name === void 0 ? {} : { name: ref.name }
+				});
+			}
 			const revisedPrompt = images.find((image) => image.revisedPrompt !== void 0)?.revisedPrompt;
-			return {
+			const value = {
 				paths,
+				...refs.length > 0 ? { images: refs } : {},
 				...revisedPrompt === void 0 ? {} : { revisedPrompt }
 			};
+			if (exec.parent !== void 0 && refs.length > 0) exec.deferContext(createUserMessage({
+				content: imageGenerateContent(value),
+				source: {
+					kind: "plugin",
+					plugin: "dsh-plugin-subscriptions"
+				}
+			}));
+			return value;
 		}
 	});
 }
@@ -2768,9 +2912,19 @@ function planOf(provider, session) {
 var SubscriptionsAuthController = class {
 	/** Last login failure per provider, surfaced as `detail` until the next success. */
 	lastError = /* @__PURE__ */ new Map();
-	constructor(flows, onAuthChanged) {
+	constructor(flows, onAuthChanged, resolveAttachments) {
 		this.flows = flows;
 		this.onAuthChanged = onAuthChanged;
+		this.resolveAttachments = resolveAttachments;
+	}
+	async readImage(ref, signal) {
+		const attachments = this.resolveAttachments();
+		if (attachments === void 0) throw new Error("no attachment service is mounted; generated-image bytes are unavailable");
+		const stored = await attachments.readImage(ref, signal);
+		return {
+			mediaType: stored.ref.mediaType,
+			dataBase64: Buffer.from(stored.data).toString("base64")
+		};
 	}
 	async status(provider) {
 		const session = await getSession(provider);
@@ -2921,10 +3075,14 @@ function apply(ctx, config) {
 			break;
 		}
 	}
-	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, authChanged));
+	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, authChanged, resolveAttachments));
 	ctx.inject(["tools"], (toolsCtx) => {
 		if (grokTokens !== void 0) toolsCtx.tools.register(createXSearchTool({ tokens: grokTokens }));
-		if (codexTokens !== void 0) toolsCtx.tools.register(createImageGenerateTool({ tokens: codexTokens }));
+		if (codexTokens !== void 0) toolsCtx.tools.register(createImageGenerateTool({
+			tokens: codexTokens,
+			resolveAttachments,
+			resolveLlm: () => ctx.get("llm")
+		}));
 	});
 }
 

package/lib/providers/codex.js

@@ -295,7 +295,10 @@ export class CodexAdapter extends LlmAdapter {
         if (!this.options.discovery)
             return this.staticModels(provider);
         try {
-            const discovered = await this.catalog.get(() => fetchCodexModels(session, this.options.fetchFn));
+            // The fetcher runs only on a cache miss, and resolves the session
+            // through the refresh-aware path so an expired access token renews here
+            // instead of failing discovery into the static fallback.
+            const discovered = await this.catalog.get(async () => fetchCodexModels(await this.options.tokens.session(), this.options.fetchFn));
             return discovered.map(model => ({
                 provider,
                 id: model.id,
@@ -305,6 +308,11 @@ export class CodexAdapter extends LlmAdapter {
             }));
         }
         catch (error) {
+            // A permanent refresh failure deletes the stored session: the provider
+            // is logged out, so hide it instead of showing a stale static catalog.
+            if (error instanceof LlmError
+                && (error.code === 'MISSING_CREDENTIAL' || error.code === 'INVALID_CREDENTIAL'))
+                return [];
             if (error instanceof OAuthEndpointError && error.status === 401)
                 this.catalog.invalidate();
             this.options.onWarn?.(`codex model discovery failed; using the built-in catalog (${errorChain(error)})`);

package/lib/providers/grok.js

@@ -252,7 +252,10 @@ export class GrokAdapter extends LlmAdapter {
         if (!this.options.discovery)
             return this.staticModels(provider);
         try {
-            const discovered = await this.catalog.get(() => fetchGrokModels(session, this.options.fetchFn));
+            // The fetcher runs only on a cache miss, and resolves the session
+            // through the refresh-aware path so an expired access token renews here
+            // instead of failing discovery into the static fallback.
+            const discovered = await this.catalog.get(async () => fetchGrokModels(await this.options.tokens.session(), this.options.fetchFn));
             return discovered.map(model => ({
                 provider,
                 id: model.id,
@@ -261,6 +264,11 @@ export class GrokAdapter extends LlmAdapter {
             }));
         }
         catch (error) {
+            // A permanent refresh failure deletes the stored session: the provider
+            // is logged out, so hide it instead of showing a stale static catalog.
+            if (error instanceof LlmError
+                && (error.code === 'MISSING_CREDENTIAL' || error.code === 'INVALID_CREDENTIAL'))
+                return [];
             if (error instanceof OAuthEndpointError && error.status === 401)
                 this.catalog.invalidate();
             this.options.onWarn?.(`grok model discovery failed; using the built-in catalog (${errorChain(error)})`);

package/lib/tools/image-generate.d.ts

@@ -1,10 +1,15 @@
 /**
  * `image_generate` tool: generate images through the ChatGPT/Codex
- * subscription's image endpoint and save them as PNG files under the harness
- * home. Mirrors codex-rs `codex-api/src/images.rs`: POST
+ * subscription's image endpoint, save them as PNG files under the harness
+ * home, and — when the deployment mounts an attachment store and the calling
+ * route declares image input — also commit the bytes as durable attachments
+ * so the images render inline and enter model context (the same path
+ * `read_image` uses). Mirrors codex-rs `codex-api/src/images.rs`: POST
  * `/backend-api/codex/images/generations` with the responses call's auth
  * headers; the response carries base64 PNG data.
  */
+import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import type { LlmRuntime } from '@deepseek-ai/dsh-llm';
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
 import type { CodexSession } from '../auth/store.js';
 import { TokenManager } from '../providers/common.js';
@@ -21,6 +26,10 @@ export interface ImageGenerateToolOptions {
     fetchFn?: FetchFn;
     /** Directory override for saved images (defaults under the harness home). */
     imagesDir?: string;
+    /** Lazy attachment-store lookup; absent or unmounted store keeps the text-only result. */
+    resolveAttachments?: () => AttachmentStore | undefined;
+    /** Lazy llm-service lookup for the image-capability route check. */
+    resolveLlm?: () => LlmRuntime | undefined;
 }
 /** The wire request body for one generation call. */
 export interface ImageGenerateRequestBody {

package/lib/tools/image-generate.js

@@ -1,13 +1,18 @@
 /**
  * `image_generate` tool: generate images through the ChatGPT/Codex
- * subscription's image endpoint and save them as PNG files under the harness
- * home. Mirrors codex-rs `codex-api/src/images.rs`: POST
+ * subscription's image endpoint, save them as PNG files under the harness
+ * home, and — when the deployment mounts an attachment store and the calling
+ * route declares image input — also commit the bytes as durable attachments
+ * so the images render inline and enter model context (the same path
+ * `read_image` uses). Mirrors codex-rs `codex-api/src/images.rs`: POST
  * `/backend-api/codex/images/generations` with the responses call's auth
  * headers; the response carries base64 PNG data.
  */
 import { mkdir, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
+import { AttachmentId } from '@deepseek-ai/dsh-attachment';
+import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { httpLlmError, TokenManager } from '../providers/common.js';
 /** Endpoint the generation request is posted to. */
@@ -67,6 +72,53 @@ function imageFileName(index) {
 function truncate(text, max = 60) {
     return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
 }
+/**
+ * Non-throwing image-capability check for the calling route (read_image's
+ * gate, softened: a generated image that cannot enter history degrades to the
+ * text-only result instead of failing the call). Resolves the session's
+ * latest routed provider/model and answers whether the exact route declares
+ * image input; any resolution failure means "no".
+ */
+async function routeDeclaresImageInput(resolveLlm, exec) {
+    const llm = resolveLlm?.();
+    const routed = exec.agent?.session.requestHeader()?.config;
+    const provider = routed?.provider ?? exec.agent?.options.provider;
+    const model = routed?.model ?? exec.agent?.options.model;
+    if (llm === undefined || provider === undefined || model === undefined)
+        return false;
+    try {
+        const active = await llm.resolveModelInfo(provider, model, exec.signal);
+        return active.inputModalities?.includes('image') === true;
+    }
+    catch {
+        // An unresolvable route cannot be proven image-capable: degrade to text.
+        return false;
+    }
+}
+/** Re-brand one canonical image entry into the attachment reference an ImageBlock carries. */
+function imageRefFromValue(image) {
+    return {
+        attachmentId: AttachmentId(image.attachmentId),
+        mediaType: image.mediaType,
+        bytes: image.bytes,
+        width: image.width,
+        height: image.height,
+        ...image.name === undefined ? {} : { name: image.name },
+    };
+}
+/** Project the canonical value into the model-facing text + image blocks. */
+function imageGenerateContent(value) {
+    return [
+        imageGenerateText(value),
+        ...(value.images ?? []).map(image => ({ type: 'image', attachment: imageRefFromValue(image) })),
+    ];
+}
+/** The text summary of one generation, shared by the model content and the UI card. */
+function imageGenerateText(value) {
+    const text = `Saved ${value.paths.length} image(s):\n${value.paths.map(path => `- ${path}`).join('\n')}`
+        + (value.revisedPrompt === undefined ? '' : `\n\nRevised prompt: ${value.revisedPrompt}`);
+    return { type: 'text', text };
+}
 /**
  * Build the `image_generate` tool definition.
  * @param options - codex session source, fetch implementation, and image directory.
@@ -76,7 +128,7 @@ export function createImageGenerateTool(options) {
     return defineTool({
         name: 'image_generate',
         description: 'Generate an image with the ChatGPT subscription (gpt-image-2) and save it as a PNG file. '
-            + 'Returns the saved file paths.',
+            + 'Returns the saved file paths; on image-capable models the image itself is attached.',
         parameters: {
             prompt: { type: 'string', required: true, description: 'What the image should show.' },
             size: {
@@ -95,20 +147,38 @@ export function createImageGenerateTool(options) {
                 type: 'object',
                 properties: {
                     paths: { type: 'array', items: { type: 'string' }, required: true },
+                    images: {
+                        type: 'array',
+                        items: {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                attachmentId: { type: 'string', required: true },
+                                mediaType: { type: 'string', enum: ['image/png', 'image/jpeg', 'image/webp', 'image/gif'], required: true },
+                                bytes: { type: 'integer', required: true },
+                                width: { type: 'integer', required: true },
+                                height: { type: 'integer', required: true },
+                                name: { type: 'string' },
+                            },
+                        },
+                    },
                     revisedPrompt: { type: 'string' },
                 },
                 additionalProperties: false,
             },
-            render: (_args, value) => [{
-                    type: 'text',
-                    text: `Saved ${value.paths.length} image(s):\n${value.paths.map(path => `- ${path}`).join('\n')}`
-                        + (value.revisedPrompt === undefined ? '' : `\n\nRevised prompt: ${value.revisedPrompt}`),
-                }],
+            render: (_args, value) => imageGenerateContent(value),
         },
         presentCall: args => ({
             card: 'generic',
             title: `image_generate: ${truncate(args.prompt)}`,
         }),
+        // The web UI has no image surface on tool cards and flattens result blocks
+        // to text/JSON, so the completed card shows the text summary only; the
+        // image block stays model-facing in the render output.
+        presentResult: (_args, result) => ({
+            card: 'generic',
+            content: result.content.filter(block => block.type === 'text'),
+        }),
         async execute(args, exec) {
             const body = buildImageGenerateBody(args);
             const session = await options.tokens.session();
@@ -135,8 +205,46 @@ export function createImageGenerateTool(options) {
                 await writeFile(path, image.data);
                 paths.push(path);
             }
+            // Inline display requires durable attachment references, and those may
+            // only enter session history on a route that declares image input.
+            // Either condition failing degrades to the text-only result.
+            const attachments = options.resolveAttachments?.();
+            const imageCapable = attachments !== undefined
+                && await routeDeclaresImageInput(options.resolveLlm, exec);
+            const refs = [];
+            if (attachments !== undefined && imageCapable) {
+                for (const [index, image] of images.entries()) {
+                    const ref = await attachments.saveImage({
+                        data: image.data,
+                        mediaType: 'image/png',
+                        name: basename(paths[index]),
+                    });
+                    refs.push({
+                        attachmentId: ref.attachmentId,
+                        mediaType: ref.mediaType,
+                        bytes: ref.bytes,
+                        width: ref.width,
+                        height: ref.height,
+                        ...ref.name === undefined ? {} : { name: ref.name },
+                    });
+                }
+            }
             const revisedPrompt = images.find(image => image.revisedPrompt !== undefined)?.revisedPrompt;
-            return { paths, ...revisedPrompt === undefined ? {} : { revisedPrompt } };
+            const value = {
+                paths,
+                ...refs.length > 0 ? { images: refs } : {},
+                ...revisedPrompt === undefined ? {} : { revisedPrompt },
+            };
+            // Nested (Code Mode) dispatches have no card: defer the image content as
+            // a user message so the next model request still sees it (read_image's
+            // pattern).
+            if (exec.parent !== undefined && refs.length > 0) {
+                exec.deferContext(createUserMessage({
+                    content: imageGenerateContent(value),
+                    source: { kind: 'plugin', plugin: 'dsh-plugin-subscriptions' },
+                }));
+            }
+            return value;
         },
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscriptions",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Use ChatGPT (Codex), Claude, and Grok (X Premium) subscriptions as DeepSeek Harness LLM providers, with OAuth login from the web Settings page",
   "license": "MIT",
   "repository": {