dsh-shengtu

Multi-engine image generation for DeepSeek Harness — 生图 / AI image generation, inside the conversation.

It does two things:

1. Registers an agent tool generate_image — say "draw a picture of…" in a conversation and the generated image appears right in the transcript.
2. Adds an Image generation button below the composer. It opens a panel with Generate and Config tabs plus an on/off switch.

Install

From the plugin market once it is listed there, or straight from this repository:

dsh plugin add github:xuhairui-dzz/dsh-shengtu

Then reload the page (Ctrl+R). The package declares dsh.bundle, so it activates as a normal bundle in your profile.

To pin a revision instead of tracking main, append the commit:

dsh plugin add github:xuhairui-dzz/dsh-shengtu#<40-char-sha>

Engines (panel → Config → Engine)

Engine	Credential variable	Default endpoint / model
Doubao · Volcengine Ark	ARK_API_KEY	https://ark.cn-beijing.volces.com/api/v3 / doubao-seedream-5-0-flash-260915
SiliconFlow	GUIJI_API_KEY	https://api.siliconflow.cn/v1 / Kwai-Kolors/Kolors
OpenAI	OPENAI_API_KEY	https://api.openai.com/v1 / gpt-image-1 (template)
Custom	any	anything exposing POST {baseURL}/images/generations

Switching engines takes effect immediately; the panel and the agent tool share one configuration and one credential.

Configuration

Key	Meaning
engine	Preset: ark / siliconflow / openai / custom
baseURL, model	Endpoint and model name
credentialRef	Credential variable name, defaulted per engine
size, watermark, timeoutMs	Size, watermark, timeout
outDir	Output directory; empty = generated/ under the session working directory
pricePerImage	Unit price (CNY per image) for local spend tracking; 0 counts images only

Secrets are never written into the config file: they are read through the Harness credential service (settings credential store, shell environment, or .env). The panel's API Key field stores straight into the credential store.

Spend tracking

The panel header shows N today · M total (money only when a unit price is set). This is a local tally, not a provider bill — the real charge is whatever your console says.

Safety boundaries

• Keys are read on the Host side only and are never sent to the browser; the client sees only "ready / missing".
• Downloaded images are validated against a byte cap and format signature (PNG/JPEG/WebP) before being written.
• The panel's image route only serves image files inside outDir and rejects path traversal.

Development

node test/toggle-test.mjs   # offline behavioural test of the on/off switch

License

MIT