[iamwavecut]

When a non-VIP user requests an image while replying to or attaching a picture, draw_image currently selects VIP editing and refuses the request. The executor now describes the selected sources through Vision, queues an explanation of the editing restriction, and schedules a new text-to-image job in the regular queue using the user request and reference descriptions.

VIP editing stays unchanged. The fallback preserves captions and generation options, respects chat permissions and generation limits, and reports Vision or notice failures without scheduling an unreferenced image. The notice describes an attempt rather than promising a result before admission or provider success. Tool instructions explain the new behavior.

The existing transitive ctutils lockfile entry is updated from 0.4.2 to 0.4.4 to fix RUSTSEC-2026-0385, which blocked CI. No advisory exception was added.

Validation: cargo fmt --all -- --check; cargo clippy --locked --workspace --all-targets --all-features -- -D warnings; cargo test --locked --workspace (2665 passed, 0 failed, 10 ignored); cargo audit --ignore RUSTSEC-2023-0071 (existing optional-MySQL exception, three existing allowed warnings); cargo machete. Regression coverage includes attached, quoted and history references, multiple sources, permissions, limits, Vision errors and notice ordering.

[github-actions]

	Warnings
⚠️	Prompt files are cache-sensitive contracts; confirm prompt shape and role markers were preserved intentionally.

	Messages
📖	Danger checked 6 changed file(s).

Generated by 🚫 dangerJS against a961b17

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🔒 Security concerns Possible prompt injection: Vision captions derived from user-controlled images are interpolated into the image generation prompt. The template does include an explicit instruction to treat references as data, not instructions, which mitigates this, but the model-side protection is advisory only.

⚡ Recommended focus areas for review Notice sent before limit check The fallback explanation is sent to the user (send_image_fallback_notice) before the regular generation path runs its rate-limit check inside schedule_image. For a rate-limited non-VIP user, the notice promises "я нарисую новое изображение", but the request is then rejected with generation_rate_limited and nothing is queued — the user receives a misleading explanation with no image. The permission check (direct_draw_image_rejection) is correctly done before the notice, but the rate-limit check happens only later; it should also be evaluated before sending the fallback notice. let Some(sender) = self.image_fallback_notice.as_deref() else { return Err(Box::new(ToolResult::failed( "draw_image_notice_failed", "Не удалось отправить пояснение о переходе от VIP-редактирования к новой генерации. Задача не поставлена в очередь.", ))); }; sender.send_image_fallback_notice(request).await.map_err(|_| { Box::new(ToolResult::failed("draw_image_notice_failed", "Не удалось отправить пояснение о переходе от VIP-редактирования к новой генерации. Задача не поставлена в очередь.")) })?;

[iamwavecut]

Danger prompt-contract warning checked: the change only extends the text inside the existing image_references block. Handlebars conditions, partial names, role markers and template data shape are unchanged. The prompt-rendering tests passed in the local workspace suite.

The dependency gate also found today's RUSTSEC-2026-0385 in the existing ctutils 0.4.2 lockfile entry. I am updating only that transitive dependency to the fixed 0.4.4 release and rerunning validation.

[iamwavecut]

Reviewed the guide at 7db1308. The notice-before-limits concern is valid for the unconditional wording. I changed the notice to say “попробую нарисовать” (will try to draw), so it does not promise a queued or delivered image before admission. The regular scheduling path still returns generation_rate_limited or another concrete failure to the dialog for explanation. Keeping the notice before scheduling preserves the requested explanation-before-generation behavior and also covers provider failures that admission checks cannot predict.

The Vision text is intentionally reference data, needed for this feature. It only reaches image prompt refinement/generation, with an explicit data-only instruction. Existing content classification and generation safety handling remain in that path. It does not become a tool instruction or executable code.

[iamwavecut]

Final review verification at a961b17: CI, dependency and SAST checks passed. PR-Agent run 39954980068 explicitly logged no actionable review findings and no actionable code suggestions for this head. The earlier guide's notice wording and prompt-data concerns are addressed above. Current inline comments, review threads and submitted reviews are empty. Local workspace validation passed 2665 tests with 10 ignored.