dsh-image-generation-responses

简体中文

A DeepSeek Harness Cordis plugin that exposes a generate_image tool backed by the Responses API image_generation tool. Generated bytes are validated and stored as durable DSH attachments, then rendered directly in the conversation by the included web client view.

Supported provider contract

This plugin intentionally supports a specific OpenAI-style contract rather than every API described as "OpenAI compatible":

• POST {baseURL}/responses
• Authorization: Bearer <credential>
• Responses API image_generation tool calls
• non-streaming JSON responses containing base64 image data

Azure-style api-version queries, api-key headers, arbitrary custom headers, remote image URLs, and the legacy /images/generations endpoint are not supported.

Requirements

• Node.js 20.3 or newer
• DeepSeek Harness packages compatible with 0.1.0-rc.6
• A provider/model combination that supports the Responses image-generation tool
• DSH services: tools, credentials, and attachments
• The standard DSH web client packages for inline rendering

Installation

Install the package in the DSH web profile that owns your cordis.patch.yml:

npm install dsh-image-generation-responses

Mount it in the profile patch:

- insert:
    - id: image-generation-responses
      name: dsh-image-generation-responses
      config:
        baseURL: https://api.openai.com/v1
        apiKeyEnv: OPENAI_API_KEY
        responseModel: gpt-5.6-sol
        imageModel: gpt-image-2
        size: 1024x1024
        quality: medium
        background: opaque
        format: png
        timeoutMs: 120000
        maxResponseBytes: 33554432

Provide the API key through DSH's credentials service or the environment. Never put a real key in cordis.patch.yml or commit it to Git.

After first installing this package, restart the running DSH process and refresh the web page. DSH discovers a package's Client half at process startup. Later edits to an already-discovered lib/client.js may use the normal client-plugin HMR flow when its watcher is available.

Configuration

Option	Default	Description
baseURL	https://api.openai.com/v1	Trusted deployment API base. /responses is appended; query and fragment are removed.
apiKeyEnv	OPENAI_API_KEY	Credential reference resolved for every call.
responseModel	gpt-5.6-sol	Top-level Responses model. Override for compatible providers.
imageModel	gpt-image-2	Model field on the image_generation tool.
size	1024x1024	1024x1024, 1024x1536, 1536x1024, or auto.
quality	medium	low, medium, high, or auto.
background	opaque	opaque, transparent, or auto.
format	png	png, jpeg, or webp. Transparent JPEG is rejected.
timeoutMs	120000	Cooperative request and tool timeout.
maxResponseBytes	33554432	Limit for the JSON response body and decoded image.

baseURL is administrator-controlled configuration. Never derive it from user or model input. Plain HTTP is accepted for trusted local development endpoints; production deployments should use HTTPS.

Tool

generate_image(prompt, size?, quality?, background?, format?)

The tool returns canonical JSON metadata including the durable attachment reference, model names, generation options, and provider IDs when present. Its model-facing rendering contains a text summary and an image ContentBlock.

Storage and conversation rendering

The Host half strictly decodes base64 and calls attachments.saveImage(). DSH validates and stores the image in its attachment backend; it is not written to the workspace as a normal .png file.

The Client half registers a keyed generate_image view in tool.call.toolview. It resolves a session-authorized attachment URL through the conversation service and renders DSH's ImageGallery, including loading, retry, and original-image preview behavior.

Errors and limits

Failures use stable ImageGenerationError.code values such as MISSING_CREDENTIAL, HTTP_ERROR, TIMEOUT, BAD_BASE64, OVERSIZED, REFUSED, and MISSING_OUTPUT. Responses and decoded images are bounded. Remote image URLs and HTTP redirects are rejected.

Prompts and generated images are processed by the configured provider. Review that provider's data and content policies before use.

Development

npm install
npm test
npm run check
npm pack --dry-run

Tests use mocked transport and tiny fixtures. They require no credentials and make no paid generation calls.

lib/client.js is authored directly in DSH's distributable browser module-loader format. There is intentionally no generated client artifact or hidden transform step; changes must preserve the window.__ModuleLoader__.load({ id, factory }) contract and platform seed-module boundary.

React and @deepseek-ai/dsh-client-ui-attachment are optional npm peers because the supported DSH web shell supplies them as platform seed modules. Materializing this Client half outside that shell is unsupported.

See SECURITY.md for private vulnerability reporting, CONTRIBUTING.md for contribution guidelines, and RELEASING.md for the maintainer release checklist.

License

MIT © Poepon and contributors.