Images and Self-publishing
Use only your own conversation at deek.loca.zone and an independently approved model within the restrictive onboarding policy; model, image, and publishing actions each retain their separate permission requirements. The native sharing schema and image-choice recovery documented here are release features from rc.2-r9, not provider-use permission; Studio’s phone-correct Direction C workbench requires rc.2-r8 or later. See Releases for owner-specific availability.
Gemini and image commands
The rc.2-r9 release documentation lists Gemini Argon (google-antigravity/gemini-4-argon) in the subscription catalog. This is release/catalog history, not verified current entitlement to that exact model and not a recommendation to select it. Google routes remain outside the approved onboarding guide; Subscription Provider Sign-in owns the restrictive provider policy. Text-model selection and image-provider selection are separate controls, and a release does not replace a saved choice.
The following image-command forms are retained as release references outside approved DeepSeek/Codex/Claude onboarding, not instructions or permission to use xAI or Google. A separate provider-specific authorization and an explicitly requested image are prerequisites:
/image xai <prompt>
/image google-relay <prompt>Each direct command asks the native image tool for one 1024 × 1024 image, without a text-model turn or automatic fallback/retry. The prompt limit is 8,192 UTF-8 bytes. These command forms accept no reference attachments or extra model, URL, or count parameters; use Studio for the workbench’s supported editing flow.
/image-status inspects the current conversation’s image tools and PTC runtime readiness without any model or image request. The direct command requires an existing TypeScript/Python PTC runtime that admits a 240-second image call. The configured command limit is a 120-second cooldown and 50 images per owner per day; the native result remains authoritative. Codex image generation is unavailable; choosing a text Codex model does not enable it.
Successful native image results are saved as conversation attachments and indexed by Gallery. On failure or cancellation an already dispatched call may have consumed quota; inspect its result before another request. Image-choice recovery preserves a newer user choice and does not cancel unrelated conversations. Ordinary image toggles retain their busy-session refusal.
Self-publish with the native tool
Have the agent build the app in an allowed source directory, start its owned loopback listener, and call deploy_service through the normal tool path. No administrator publication, arbitrary shell command, owner field, path, or nginx fragment belongs in the tool input.
| Field | Accepted input |
|---|---|
name | Required; matches ^[a-z][a-z0-9-]{1,30}$ |
port | Required integer; must also be in your broker-granted block |
action | Required: deploy, remove, status, or access |
visibility | Optional for deploy/access: private, link, granted, or public |
granted_users | Optional: at most 32 unique, exact sign-in usernames; no groups |
share | Optional: "rotate" |
enabled | Optional boolean; false hides the app from everyone |
The native wire schema rejects extra properties. Access fields require deploy or access; access requires at least one setting and an existing published app. The port must match the existing app when changing access. The schema does not expose the broker’s operator-only pin or stop_tool_listener flags.
For an app whose assigned port is 47150, for example:
{"name":"my-app","port":47150,"action":"deploy"}{"name":"my-app","port":47150,"action":"access","visibility":"link","share":"rotate"}{"name":"my-app","port":47150,"action":"access","visibility":"granted","granted_users":["otto"]}These are input examples, not executed requests or allocations. Copy the new share link from https://<owner>.deek.loca.zone/_apps/; plaintext share tokens are not returned by the tool. status inspects the broker result; remove unpublishes and stops a broker-managed app while retaining its snapshot.
PENDING after 90 seconds is a queued request, not a successful deployment; retain the UUID and inspect status before repeating. A schema registration is not proof that a particular app published, rendered, or passed an authenticated owner visit. Read the broker result and follow its owner-visit instruction.
Agent listener durability limitation
As shipped through rc.2-r14, an agent-published listener (deploy_service) runs inside the owner’s Deek process and is not pin-durable: it dies with the owner restart. Publishing a route is not a transfer to a durable service. The broker refuses to pin a layout that serves assets only under /<name>/ with REFUSED_PREFIX_ASSET_BROKEN. To be pinnable, the upstream must serve / and /assets at its root; browser-facing URLs still retain the app prefix. Correct the app’s source/base handling, not the proxy, and obtain separate operator approval for a managed pin.
The D-541 proof app has been retired after the listener-lifetime and prefix/asset pin refusals (D-541p-e; backend follow-up D-590). Its earlier successful share render is historical proof, not a currently available demo or durable deployment.
Private Accounts and Service Publishing owns the snapshot, prefix/asset proof, sharing, pruning, and recovery details.