v3.13.0

• Proxy support actually works now (#23). 3.12.0's proxy path was broken on arrival, twice over: the bundled copy of undici had its internal node:http2 references destroyed by bundling (the embedded ProxyAgent threw http2.connect is not a function), and handing any undici 8 dispatcher to the host's built-in fetch (a different undici major) fails with UND_ERR_INVALID_ARG regardless. undici is no longer bundled — it resolves from node_modules, shrinking the CLI bundle from 1.17 MB to 131 KB — and the proxied path now uses undici's own fetch so dispatcher and fetch are same-sourced, with the dispatcher closed after the response so its keep-alive pool cannot pin the process open. A new integration test drives the built CLI through a real local HTTP proxy, the exact coverage whose absence let 3.12.0 ship broken (and whose first draft repeated a classic mistake: spawnSync freezes the test's own fake servers, so the CLI must be spawned async); both the env-var and explicit-setting forms were also verified against a real LAN proxy. Independent review of the fix then caught the same cross-version boundary hiding in the no-proxy remote-image path — the IP-pinned download Agent was still handed to the host's fetch — so that path is now same-sourced too, and the Node floor rises to 22.19 (undici 8's own engine requirement, which externalizing made load-bearing). Thanks to @JooJeen for a diagnosis that had already isolated both layers.
• dsh: images nested inside tool-result content no longer wedge the session (#24). dsh's own native read_image (from dsh-tool-fs, reachable under the (modlens vision) variants since they declare image input) returns its image block nested inside tool-result content. Both conversion paths only scanned top-level message content, while the upstream DeepSeek adapter's rejection check recurses — so one nested image block in the history failed every later turn with UNSUPPORTED_CONTENT, permanently, since the durable log by design keeps the real blocks. Both paths now recurse through tool-result content exactly as the adapter does, converting nested images to evidence text on the wire while the log keeps its native blocks. Thanks to @alex16lai for the precise trace.