dsh-image-gen

LIMITATIONS

Known limitations

- Reference edits use a DSH filesystem path plus one-time external-upload approval. A dedicated attachment-picker UI remains future work; headless or `approval: never` sessions reject such uploads. - The Codex subscription endpoint is a private compatibility surface. Live requests confirmed it accepts both GPT Image 2.5 aliases and the `xhigh` / `max` tiers, but it ignores the literal requested `size` and `quality` and serves its own (2026-09-11 runs: `1774x887` / 1030 tokens at `high`, `1536x1024` / 1372 tokens at `max`). It is still not documented as an Image API edit endpoint, so subscription reference edits and public-API-only output options stay disabled. - Subscription `size` and `quality` shape the provider's own budget rather than a literal request, so the same tier can deliver a different size and cost than the API-key contract documents. - A card reads its image over the loopback RPC, and the Host authorizes that read from the session store, which is written asynchronously. A read can therefore arrive before the completed result is durable. `0.4.1` treats that case as recoverable rather than terminal: the Host keeps the just-generated reference for `servedResultTtlMs` (default 5 minutes; never a long-term authorization path), answers with a distinct `pending` reason, and the card retries with bounded backoff before showing an actionable message. Set `servedResultTtlMs: 0` to make the session store the sole authority at every moment. - Final previews are intentionally loopback-only. Remote Web clients receive a clear unavailable state rather than image bytes. - Current DSH credential resolution and attachment saving do not accept cancellation signals. The plugin checks cancellation before and after those stages and waits for them during teardown, but cannot interrupt a provider implementation that stalls inside either service. - OpenAI may evolve arbitrary-size limits or event fields. The plugin fails closed on incompatible responses instead of guessing. - GPT Image 2.5 API-key generation is verified against deterministic mocked provider responses, not against a billed live account. The Codex subscription path is verified live for `gpt-image-2.5-flare` and `gpt-image-2.5-sunburst`; a real API-key call and `gpt-image-2` on the subscription endpoint remain unverified.