Kepos Image Generation

Native image generation and editing adapters for the Kepos bridge. The bridge uses its managed OAuth and always selects gpt-image-2; neither adapter asks for, stores, or forwards an API key, cookie, token, or other credential.

Install for DSH

dsh plugin --profile <profile> add @lamplitisles/dsh-imagegen

The DSH package targets the exact 0.1.2-rc.1 API contract.

Open DSH Settings and select Kepos Image Generation to view or change the bridge address. The default is http://codex-bridge.localhost:17480; the adapter appends /codex/images itself.

Install for Pi

pi install npm:@lamplitisles/pi-imagegen

Run /kepos-image-settings in Pi to view or change the global bridge address. Interactive TUI and RPC modes can change it; noninteractive mode reports the current address and explains that interactive UI is required. Pi stores only bridgeUrl in its global kepos-imagegen.json agent configuration file.

Image edits

Both adapters expose kepos_image_generate. Omit images to generate a PNG. For an edit, pass one through five PNG, JPEG, GIF, or WebP paths relative to the active DSH workspace or Pi current working directory. Paths outside that directory, including symlink escapes, are rejected. DSH also saves each result as a PNG under .dsh/kepos-imagegen/ and returns that relative path alongside its native attachment. Pi returns an image content block and does not write an output file.

Maintainer release setup

The GitHub workflow publishes a matching tagged release of the two public packages. Before the first beta publication, a maintainer must:

1. Create the @lamplitisles npm scope and manually publish the initial beta for both @lamplitisles/dsh-imagegen and @lamplitisles/pi-imagegen.
2. Configure npm Trusted Publishing for each package identity, this repository, the .github/workflows/release.yml workflow, and the protected npm environment.
3. Create the protected GitHub npm environment with the required release policy.

Then push a v<semver> tag. Stable tags publish with npm's latest tag and prerelease tags publish with beta. The workflow uses OIDC provenance; no npm token is stored in this repository.

Development

pnpm install --frozen-lockfile
pnpm format:check
pnpm typecheck
pnpm test
pnpm build
GITHUB_REF_NAME=v0.1.0 pnpm release:check
pnpm test:pack

These checks use fakes and test-owned temporary directories. They never call a live Kepos bridge or publish packages.

To verify the local rc.1 DSH integration before release, build first and run the linked-source smoke against the official 0.1.2-rc.1 CLI. It creates and removes its own DSH_HOME; it does not start DSH Web or modify the web profile.

DSH_CLI=/absolute/path/to/dsh pnpm test:dsh-link