@arthovlabs/liber 0.6.0 → 0.7.0

package/README.md

@@ -419,6 +419,34 @@ The only thing it unlocks is `GET /shared/<id>`, once per request, while
 `expires_at` is in the future and `revoked` is false.
 
 
+---
+
+## 🖼️ Images and video
+
+Two tools turn text into media. Neither model runs on your machine: the call goes
+to the provider whose key you configured, and LiBER keeps the part that matters —
+the file is written into the workspace, its path and size come back as a receipt, so
+a turn cannot claim "the image is ready" without a file behind it.
+
+| tool | provider | key |
+|---|---|---|
+| `image_generate` | OpenAI Images (or any endpoint that speaks `POST {base}/images/generations`) | `OPENAI_API_KEY` |
+| `video_generate` | Replicate (`/v1/predictions`, polled to completion) | `REPLICATE_API_TOKEN` |
+
+Results land in `artifacts/media/<timestamp>-<slug>.png|mp4`. Video asks for a model
+version (`LIBER_VIDEO_MODEL=owner/model:version`, or the `model` argument), and when
+`ffmpeg` is available it also extracts a thumbnail; when it is not, the reply says so
+instead of pretending.
+
+**Cost is capped before the call, not after.** `LIBER_MEDIA_MAX_USD` (default `$2`)
+refuses a single call above the ceiling, `LIBER_MEDIA_DAILY_USD` adds a daily media
+budget, and every successful call is recorded in `.liber/budget.json` so
+`limits.max_cost_per_day` covers media alongside tokens.
+
+`GET /media` reports what this machine can actually do right now — which provider is
+configured, whether ffmpeg was found — and **Settings → Images & Video** shows the
+same, plus a prompt box to try it.
+
 ---
 
 ## 🔑 Clients and tokens

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arthovlabs/liber",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "LiBER — autonomous agent orchestrator with a machine-enforced grounding gate and a skill library",
   "bin": {
     "liber": "bin/liber",

package/src/daemon/core/budget.js

@@ -138,8 +138,24 @@ function record(usage, engineConfig = {}) {
   return s;
 }
 
+/**
+ * Media calls are priced per call, not per token. They land in the same daily cost
+ * counter so limits.max_cost_per_day covers them too.
+ */
+function recordSpend(costUsd, label = 'media') {
+  const amount = Number(costUsd);
+  if (!Number.isFinite(amount) || amount <= 0) return load();
+  const s = load();
+  s.cost_usd += amount;
+  s.calls += 1;
+  s.by_kind = { ...(s.by_kind || {}) };
+  s.by_kind[label] = Number(s.by_kind[label] || 0) + amount;
+  save();
+  return s;
+}
+
 function snapshot() {
   return { ...load() };
 }
 
-module.exports = { check, summary, record, reset, reload, snapshot, costOf, priceOf, today };
+module.exports = { check, summary, record, recordSpend, reset, reload, snapshot, costOf, priceOf, today };

package/src/daemon/core/engine.js

@@ -418,6 +418,8 @@ class LiberEngine {
     const memKey = memoryKey || agentId;
     const cfg = { ...DEFAULT_GROUNDING, ...(agentConfig.grounding || {}) };
     const ledger = resumed ? EvidenceLedger.fromJSON(resumeState.ledger) : new EvidenceLedger(agentId);
+    // One id per turn, so a terminal line can be tied to the turn that caused it.
+    const turnId = `${agentId}:${Date.now().toString(36)}`;
     const skillCtx = skills.buildContext(String(userMessage || ''), cfg.doctrine_budget_chars);
     // Standing facts are injected every turn, not fetched on demand: a new
     // session should open already knowing the user and this workspace.
@@ -867,7 +869,7 @@ class LiberEngine {
             seq: ++subSeq
           });
         } else {
-          result = await registry.execute(call.name, call.args, { agentId, client: client || null, turnId: ledger.turnId || null });
+          result = await registry.execute(call.name, call.args, { agentId, client: client || null, turnId });
         }
 
         // A tool can refuse for policy reasons and report that a human may
@@ -881,7 +883,7 @@ class LiberEngine {
           const approved = await waitForHitl(agentId, call.name, call.args);
           if (approved) {
             onEvent('hitl_approved', { tool: call.name, retried: true });
-            result = await registry.execute(call.name, call.args, { approved: true, agentId, client: client || null, turnId: ledger.turnId || null });
+            result = await registry.execute(call.name, call.args, { approved: true, agentId, client: client || null, turnId });
           } else {
             result = { error: `DENIED: approval was not granted. Tool '${call.name}' did not execute.`, policy_denied: true };
           }

package/src/daemon/core/providers.js

@@ -51,6 +51,8 @@ function envValue(name) {
 const CATALOG = [
   // — OpenAI-compatible cloud APIs
   { id: 'openai', label: 'OpenAI', adapter: 'openai', base: 'https://api.openai.com/v1', env: 'OPENAI_API_KEY', docs: 'platform.openai.com/api-keys', kind: 'api' },
+  { id: 'replicate', label: 'Replicate', adapter: 'openai', base: 'https://api.replicate.com/v1', env: 'REPLICATE_API_TOKEN', docs: 'replicate.com/account/api-tokens', kind: 'api' },
+  { id: 'stability', label: 'Stability AI', adapter: 'openai', base: 'https://api.stability.ai', env: 'STABILITY_API_KEY', docs: 'platform.stability.ai', kind: 'api' },
   { id: 'anthropic', label: 'Anthropic', adapter: 'anthropic', base: 'https://api.anthropic.com', env: 'ANTHROPIC_API_KEY', docs: 'console.anthropic.com', kind: 'api' },
   { id: 'google', label: 'Google Gemini', adapter: 'gemini', base: 'https://generativelanguage.googleapis.com', env: 'GEMINI_API_KEY', docs: 'aistudio.google.com/apikey', kind: 'api' },
   { id: 'xai', label: 'xAI Grok', adapter: 'openai', base: 'https://api.x.ai/v1', env: 'XAI_API_KEY', docs: 'console.x.ai', kind: 'api' },

package/src/daemon/core/registry.js

@@ -263,12 +263,53 @@ class ToolRegistry {
       },
       handler: searchWeb
     });
+
+    // images and video are opt-in by key: the tool explains itself when missing
+    this.registerMedia();
   }
 
   register(def) {
     this.tools.set(def.name, def);
   }
 
+  /** Text to image/video: provider-backed, written into the workspace, spent from
+   *  the same daily budget. Registered apart because it is opt-in by key. */
+  registerMedia() {
+    const media = require('./tools/media-tool');
+
+    this.register({
+      name: 'image_generate',
+      description: 'Generate an image from a text prompt and save it into the workspace under artifacts/media/. Requires an image provider key (OpenAI by default, or any endpoint that speaks POST /images/generations). Returns the file path and size so the result can be cited.',
+      parameters: {
+        type: 'object',
+        properties: {
+          prompt: { type: 'string', description: 'What the image should show' },
+          size: { type: 'string', description: 'e.g. 1024x1024, 1536x1024, 1024x1536' },
+          model: { type: 'string', description: 'Provider model id (default gpt-image-1)' },
+          endpoint: { type: 'string', description: 'Override the provider base URL' },
+          n: { type: 'integer', description: 'How many images (1-4)' }
+        },
+        required: ['prompt']
+      },
+      handler: media.imageGenerate
+    });
+
+    this.register({
+      name: 'video_generate',
+      description: 'Generate a short video from a text prompt through Replicate, save the mp4 under artifacts/media/, and extract a thumbnail when ffmpeg is available. Requires REPLICATE_API_TOKEN and a model version (LIBER_VIDEO_MODEL or the model argument).',
+      parameters: {
+        type: 'object',
+        properties: {
+          prompt: { type: 'string', description: 'What the video should show' },
+          model: { type: 'string', description: 'owner/model:version (falls back to LIBER_VIDEO_MODEL)' },
+          seconds: { type: 'integer', description: 'Clip length in seconds if the model supports it' }
+        },
+        required: ['prompt']
+      },
+      handler: media.videoGenerate
+    });
+  }
+
   get(name) {
     if (name === 'shell_execute' || name === 'exec') return this.tools.get('terminal');
     return this.tools.get(name);

package/src/daemon/core/tools/media-tool.js

@@ -0,0 +1,247 @@
+// src/daemon/core/tools/media-tool.js — images and video from text, with receipts.
+//
+// Nothing is generated locally: there is no model on this machine, so every call
+// goes to a provider the operator configured. What LiBER adds is the part that
+// makes the result trustworthy: the file is written into the workspace, its path
+// and size come back as a tool result (so the grounding gate can cite it), the
+// spend is recorded, and a missing capability is reported instead of pretended.
+const fs = require('fs');
+const path = require('path');
+const providers = require('../providers');
+const budget = require('../budget');
+
+const DEFAULT_IMAGE_MODEL = 'gpt-image-1';
+
+function artifactsDir() {
+  const dir = path.resolve(process.cwd(), 'artifacts', 'media');
+  fs.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function slug(text, max = 40) {
+  return String(text || 'media')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, max) || 'media';
+}
+
+function stamp() {
+  return new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
+}
+
+/** Which key and base URL an image/video call would use right now. */
+function policy() {
+  const key = providers.resolve('openai', 'https://api.openai.com/v1');
+  const replicate = providers.resolve('replicate', 'https://api.replicate.com/v1');
+  let ffmpeg = null;
+  try {
+    const { sandboxEnv } = require('./terminal-tool');
+    const candidates = [
+      process.env.LIBER_FFMPEG,
+      path.resolve(process.cwd(), 'runtime', 'ffmpeg.exe'),
+      path.resolve(process.cwd(), 'runtime', 'ffmpeg')
+    ].filter(Boolean);
+    for (const c of candidates) {
+      if (fs.existsSync(c)) { ffmpeg = c; break; }
+    }
+    if (!ffmpeg) {
+      const which = require('child_process').execFileSync(process.platform === 'win32' ? 'where' : 'which',
+        ['ffmpeg'], { stdio: ['ignore', 'pipe', 'ignore'], env: sandboxEnv() }).toString().trim().split(/\r?\n/)[0];
+      if (which) ffmpeg = which;
+    }
+  } catch { /* not installed: reported honestly below */ }
+
+  return {
+    images: { configured: !!key, provider: key ? 'openai' : null, model: DEFAULT_IMAGE_MODEL },
+    video: { configured: !!replicate, provider: replicate ? 'replicate' : null },
+    ffmpeg,
+    max_usd_per_call: Number(process.env.LIBER_MEDIA_MAX_USD) || 2
+  };
+}
+
+function ensureSpend(cost) {
+  const snap = budget.snapshot();
+  const cap = Number(process.env.LIBER_MEDIA_MAX_USD) || 2;
+  const perCall = Number(cost) || 0;
+  if (perCall > cap) {
+    return { ok: false, error: `This call is estimated at $${perCall.toFixed(2)}, above the $${cap.toFixed(2)} per-call ceiling (LIBER_MEDIA_MAX_USD).` };
+  }
+  const daily = Number(process.env.LIBER_MEDIA_DAILY_USD) || 0;
+  if (daily > 0 && snap.cost_usd + perCall > daily) {
+    return { ok: false, error: `Daily media ceiling reached ($${snap.cost_usd.toFixed(2)} spent, $${daily.toFixed(2)} allowed).` };
+  }
+  return { ok: true };
+}
+
+async function postJson(url, body, headers, timeout = 120000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeout);
+  try {
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...headers },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    const text = await res.text();
+    let data = null;
+    try { data = JSON.parse(text); } catch { data = { raw: text.slice(0, 400) }; }
+    return { ok: res.ok, status: res.status, data };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Text to image. OpenAI-compatible by default; any endpoint that speaks
+ * POST {base}/images/generations works (including a self-hosted gateway).
+ */
+async function imageGenerate({ prompt, size = '1024x1024', model = DEFAULT_IMAGE_MODEL, endpoint = null, n = 1 } = {}, meta = {}) {
+  const text = String(prompt || '').trim();
+  if (!text) return { error: 'A prompt is required.' };
+
+  const key = providers.resolve('openai', endpoint || 'https://api.openai.com/v1');
+  if (!key) {
+    return {
+      error: 'No image provider is configured. Add an OpenAI key in Settings → Providers (or a custom endpoint that speaks /images/generations).',
+      needs_provider: 'openai'
+    };
+  }
+  const base = String(endpoint || 'https://api.openai.com/v1').replace(/\/+$/, '');
+
+  const spend = ensureSpend(0.08);
+  if (!spend.ok) return { error: spend.error, budget_blocked: true };
+
+  const res = await postJson(`${base}/images/generations`,
+    { model, prompt: text, size, n: Math.max(1, Math.min(Number(n) || 1, 4)) },
+    { Authorization: `Bearer ${key}` });
+
+  if (!res.ok) {
+    const detail = res.data?.error?.message || res.data?.error || res.data?.raw || `HTTP ${res.status}`;
+    return { error: `Image provider refused the request: ${String(detail).slice(0, 300)}` };
+  }
+
+  const items = Array.isArray(res.data?.data) ? res.data.data : [];
+  if (!items.length) return { error: 'The provider answered without an image.' };
+
+  const dir = artifactsDir();
+  const files = [];
+  items.forEach((item, i) => {
+    if (!item?.b64_json) return;
+    const bytes = Buffer.from(item.b64_json, 'base64');
+    const file = path.join(dir, `${stamp()}-${slug(text)}${items.length > 1 ? '-' + (i + 1) : ''}.png`);
+    fs.writeFileSync(file, bytes);
+    files.push({ path: file, bytes: bytes.length });
+  });
+  if (!files.length) return { error: 'The provider returned no base64 image data (response_format may be unsupported).' };
+
+  budget.recordSpend(0.08, 'media');
+  return {
+    kind: 'image',
+    provider: 'openai',
+    model,
+    prompt: text,
+    files,
+    cost_usd: 0.08,
+    revised_prompt: items[0]?.revised_prompt || null,
+    note: files.length > 1 ? `${files.length} images written.` : 'Image written to the workspace.'
+  };
+}
+
+async function pollPrediction(url, key, timeoutMs = 600000) {
+  const started = Date.now();
+  for (;;) {
+    if (Date.now() - started > timeoutMs) return { ok: false, error: 'The provider did not finish in 10 minutes.' };
+    const res = await fetch(url, { headers: { Authorization: `Bearer ${key}` } });
+    const data = await res.json().catch(() => ({}));
+    const status = String(data.status || '');
+    if (status === 'succeeded') return { ok: true, data };
+    if (status === 'failed' || status === 'canceled') {
+      return { ok: false, error: `Generation ${status}: ${data.error || 'no detail'}` };
+    }
+    await new Promise(r => setTimeout(r, 3000));
+  }
+}
+
+/**
+ * Text to video through Replicate. Model versions change, so the caller passes one
+ * (owner/model:version) or the operator sets LIBER_VIDEO_MODEL.
+ */
+async function videoGenerate({ prompt, model = null, seconds = 4 } = {}, meta = {}) {
+  const text = String(prompt || '').trim();
+  if (!text) return { error: 'A prompt is required.' };
+
+  const key = providers.resolve('replicate', 'https://api.replicate.com/v1');
+  if (!key) {
+    return {
+      error: 'No video provider is configured. Add a Replicate token in Settings → Providers.',
+      needs_provider: 'replicate'
+    };
+  }
+  const version = String(model || process.env.LIBER_VIDEO_MODEL || '').trim();
+  if (!version) {
+    return {
+      error: 'A model version is required for video. Set LIBER_VIDEO_MODEL (owner/model:version) or pass model.',
+      needs_model: true
+    };
+  }
+
+  const spend = ensureSpend(Number(process.env.LIBER_VIDEO_COST_USD) || 0.5);
+  if (!spend.ok) return { error: spend.error, budget_blocked: true };
+
+  const create = await postJson('https://api.replicate.com/v1/predictions',
+    { version, input: { prompt: text, seconds: Number(seconds) || 4 } },
+    { Authorization: `Bearer ${key}` });
+  if (!create.ok) {
+    return { error: `Video provider refused the request: ${JSON.stringify(create.data).slice(0, 300)}` };
+  }
+
+  const pollUrl = create.data?.urls?.get;
+  if (!pollUrl) return { error: 'The provider did not return a polling URL.' };
+
+  const done = await pollPrediction(pollUrl, key);
+  if (!done.ok) return { error: done.error };
+
+  const output = done.data.output;
+  const url = Array.isArray(output) ? output[output.length - 1] : (typeof output === 'string' ? output : null);
+  if (!url) return { error: 'The provider finished without a video URL.' };
+
+  const bin = await fetch(url);
+  if (!bin.ok) return { error: `Could not download the result (HTTP ${bin.status}).` };
+  const bytes = Buffer.from(await bin.arrayBuffer());
+
+  const dir = artifactsDir();
+  const file = path.join(dir, `${stamp()}-${slug(text)}.mp4`);
+  fs.writeFileSync(file, bytes);
+
+  const cost = Number(process.env.LIBER_VIDEO_COST_USD) || 0.5;
+  budget.recordSpend(cost, 'media');
+
+  const out = {
+    kind: 'video',
+    provider: 'replicate',
+    model: version,
+    prompt: text,
+    files: [{ path: file, bytes: bytes.length }],
+    cost_usd: cost
+  };
+
+  // A thumbnail is the cheapest way to prove the file is a real video, and it is
+  // what a chat surface needs. Only claimed when ffmpeg is actually present.
+  const p = policy();
+  if (p.ffmpeg) {
+    try {
+      const thumb = file.replace(/\.mp4$/, '-thumb.png');
+      require('child_process').execFileSync(p.ffmpeg, ['-y', '-i', file, '-frames:v', '1', thumb],
+        { stdio: 'ignore', timeout: 60000 });
+      if (fs.existsSync(thumb)) out.files.push({ path: thumb, bytes: fs.statSync(thumb).size, kind: 'thumbnail' });
+    } catch { out.thumbnail_error = 'ffmpeg could not extract a frame.'; }
+  } else {
+    out.note = 'No ffmpeg on this machine: no thumbnail was produced.';
+  }
+
+  return out;
+}
+
+module.exports = { imageGenerate, videoGenerate, policy, artifactsDir };

package/src/daemon/liberd.js

@@ -979,6 +979,13 @@ class LiberDaemon {
         }));
         return;
       }
+      else if (endpoint === '/media') {
+        // What this machine can actually do today: which provider answered, and
+        // whether ffmpeg exists for video post-processing. No capability is claimed
+        // without a key behind it.
+        const media = require('./core/tools/media-tool');
+        res.end(JSON.stringify({ success: true, ...media.policy() }));
+      }
       else if (endpoint === '/voice' || endpoint === '/voice/speak') {
         if (endpoint === '/voice' && req.method === 'GET') {
           const voices = await voice.voices();