@chibitek/chibi 0.1.158 → 0.1.161

package/dist-server/server/attachment-mimes.js

@@ -0,0 +1,58 @@
+/** Accepted upload mimes and the extensions stored on disk for them. */
+/** Mimes the endpoint accepts, mapped to the extension stored on disk.
+ * Sniffing is not attempted — a lie here only changes the filename. */
+export const IMAGE_MIMES = {
+    "image/png": ".png",
+    "image/jpeg": ".jpg",
+    "image/gif": ".gif",
+    "image/webp": ".webp",
+};
+/** Useful document and audio formats accepted by the upload endpoint.
+ * Generic archives, binaries, HTML, SVG, and executable/script mimes stay
+ * out. Office/OpenDocument packages are allowed because they are documents,
+ * despite using ZIP internally. The claimed mime determines the extension;
+ * an attacker-controlled filename never does. */
+export const FILE_MIMES = {
+    "audio/opus": ".opus",
+    "audio/ogg": ".ogg",
+    "audio/mpeg": ".mp3",
+    "audio/mp4": ".m4a",
+    "audio/x-m4a": ".m4a",
+    "audio/aac": ".aac",
+    "audio/wav": ".wav",
+    "audio/x-wav": ".wav",
+    "audio/wave": ".wav",
+    "audio/flac": ".flac",
+    "audio/x-flac": ".flac",
+    "audio/webm": ".webm",
+    "text/plain": ".txt",
+    "text/markdown": ".md",
+    "text/csv": ".csv",
+    "text/tab-separated-values": ".tsv",
+    "application/json": ".json",
+    "application/pdf": ".pdf",
+    "application/rtf": ".rtf",
+    "text/rtf": ".rtf",
+    "application/msword": ".doc",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": ".docx",
+    "application/vnd.ms-excel": ".xls",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": ".xlsx",
+    "application/vnd.ms-powerpoint": ".ppt",
+    "application/vnd.openxmlformats-officedocument.presentationml.presentation": ".pptx",
+    "application/vnd.oasis.opendocument.text": ".odt",
+    "application/vnd.oasis.opendocument.spreadsheet": ".ods",
+    "application/vnd.oasis.opendocument.presentation": ".odp",
+};
+export function extensionForMime(mime) {
+    if (!mime)
+        return null;
+    return IMAGE_MIMES[mime.split(";")[0].trim().toLowerCase()] ?? null;
+}
+export function normalizedMime(mime) {
+    const value = mime?.split(";")[0]?.trim().toLowerCase();
+    return value || null;
+}
+export function extensionForFileMime(mime) {
+    const value = normalizedMime(mime);
+    return value ? FILE_MIMES[value] ?? null : null;
+}

package/dist-server/server/attachments.js

@@ -2,10 +2,12 @@
 // ~/.openmausbot/attachments so every CLI engine can open them by path —
 // the app never ships image bytes through the prompt itself.
 import { createHash, randomUUID } from "node:crypto";
-import { createReadStream, linkSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { createReadStream, linkSync, mkdirSync, readFileSync, readdirSync, statSync, statfsSync, unlinkSync, writeFileSync, } from "node:fs";
 import { link, open, unlink } from "node:fs/promises";
 import { join, extname } from "node:path";
 import { DATA_DIR } from "./config.js";
+import { FILE_MIMES, IMAGE_MIMES, extensionForFileMime, extensionForMime, normalizedMime } from "./attachment-mimes.js";
+export { extensionForFileMime, extensionForMime };
 export const ATTACHMENTS_DIR = join(DATA_DIR, "attachments");
 /** The spec's ceiling: a screenshot bigger than this is rejected before it
  * is ever buffered, matching the composer's existing size discipline. */
@@ -14,9 +16,14 @@ export const IMAGE_MAX_BYTES = 10 * 1024 * 1024;
  * ceiling. This is a local inbox, not unbounded remote storage. */
 export const FILE_MAX_BYTES = 25 * 1024 * 1024;
 /** Attachments are durable because prompts refer to their paths. Never
- * silently evict them: once this ceiling is reached, a new upload gets an
- * explicit 507 and the person can decide what to remove. */
-export const ATTACHMENTS_MAX_BYTES = 512 * 1024 * 1024;
+ * silently evict them. There is no fixed quota by default: the store grows
+ * until the disk itself runs low (see ATTACHMENTS_DISK_RESERVE_BYTES), then a
+ * new upload gets an explicit 507 and the person can decide what to remove.
+ * OMB_ATTACHMENTS_MAX_BYTES sets an optional hard ceiling (tests use it). */
+export const ATTACHMENTS_MAX_BYTES = Number(process.env.OMB_ATTACHMENTS_MAX_BYTES) || Number.POSITIVE_INFINITY;
+/** Free space always left on the attachments volume, so uploads can never
+ * fill the disk the app, its database and the OS depend on. */
+export const ATTACHMENTS_DISK_RESERVE_BYTES = 2 * 1024 * 1024 * 1024;
 /** Interrupted streamed uploads use private partial files. A crash can leave
  * one behind, so future uploads remove only our stale partials — never a
  * committed attachment that a transcript may still reference. */
@@ -47,55 +54,6 @@ function invalidateAttachmentAccounting() {
     committedAttachmentBytes = null;
     attachmentAccountingVersion += 1;
 }
-/** Mimes the endpoint accepts, mapped to the extension stored on disk.
- * Sniffing is not attempted — a lie here only changes the filename. */
-const IMAGE_MIMES = {
-    "image/png": ".png",
-    "image/jpeg": ".jpg",
-    "image/gif": ".gif",
-    "image/webp": ".webp",
-};
-/** Useful document and audio formats accepted by the upload endpoint.
- * Generic archives, binaries, HTML, SVG, and executable/script mimes stay
- * out. Office/OpenDocument packages are allowed because they are documents,
- * despite using ZIP internally. The claimed mime determines the extension;
- * an attacker-controlled filename never does. */
-const FILE_MIMES = {
-    "audio/opus": ".opus",
-    "audio/ogg": ".ogg",
-    "audio/mpeg": ".mp3",
-    "audio/mp4": ".m4a",
-    "audio/x-m4a": ".m4a",
-    "audio/aac": ".aac",
-    "audio/wav": ".wav",
-    "audio/x-wav": ".wav",
-    "audio/wave": ".wav",
-    "audio/flac": ".flac",
-    "audio/x-flac": ".flac",
-    "audio/webm": ".webm",
-    "text/plain": ".txt",
-    "text/markdown": ".md",
-    "text/csv": ".csv",
-    "text/tab-separated-values": ".tsv",
-    "application/json": ".json",
-    "application/pdf": ".pdf",
-    "application/rtf": ".rtf",
-    "text/rtf": ".rtf",
-    "application/msword": ".doc",
-    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": ".docx",
-    "application/vnd.ms-excel": ".xls",
-    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": ".xlsx",
-    "application/vnd.ms-powerpoint": ".ppt",
-    "application/vnd.openxmlformats-officedocument.presentationml.presentation": ".pptx",
-    "application/vnd.oasis.opendocument.text": ".odt",
-    "application/vnd.oasis.opendocument.spreadsheet": ".ods",
-    "application/vnd.oasis.opendocument.presentation": ".odp",
-};
-export function extensionForMime(mime) {
-    if (!mime)
-        return null;
-    return IMAGE_MIMES[mime.split(";")[0].trim().toLowerCase()] ?? null;
-}
 export function ensureAttachmentsDir() {
     mkdirSync(ATTACHMENTS_DIR, { recursive: true, mode: 0o700 });
 }
@@ -160,11 +118,23 @@ function addCommittedBytes(delta, version = attachmentAccountingVersion) {
     }
     committedAttachmentBytes += delta;
 }
-/** Bytes that count against ATTACHMENTS_MAX_BYTES right now, for callers
- * that plan a batch (the Grok Bot history import) before saving any of it. */
-export function attachmentBytesUsed() {
+/** Bytes that count against ATTACHMENTS_MAX_BYTES right now. */
+function attachmentBytesUsed() {
     return committedBytes() + reservedAttachmentBytes;
 }
+/** Bytes the disk can still take before dropping to the reserve. Committed
+ * files are already off the free count; reservations are not written yet. */
+function diskHeadroomBytes() {
+    ensureAttachmentsDir();
+    const { bavail, bsize } = statfsSync(ATTACHMENTS_DIR);
+    return Number(bavail) * Number(bsize) - ATTACHMENTS_DISK_RESERVE_BYTES - reservedAttachmentBytes;
+}
+/** How many more bytes uploads may add right now: the smaller of the
+ * optional ceiling and the disk headroom. Callers that plan a batch (the
+ * Grok Bot history import) read this before saving any of it. */
+export function attachmentBytesAvailable() {
+    return Math.max(0, Math.min(ATTACHMENTS_MAX_BYTES - attachmentBytesUsed(), diskHeadroomBytes()));
+}
 /** Remove only abandoned temporary uploads, and refresh the cached usage
  * total from the same fresh scan. Outside accounting recovery, this is the
  * only full directory walk after start-up; nothing on the upload path calls it
@@ -239,10 +209,9 @@ class AttachmentReservation {
         this.reserveAtLeast(bytes, bytes);
     }
     reserveAtLeast(required, preferred) {
-        const used = committedBytes();
-        const available = ATTACHMENTS_MAX_BYTES - used - reservedAttachmentBytes;
+        const available = attachmentBytesAvailable();
         if (available < required) {
-            throw statusError(507, `attachments storage is full (limit ${ATTACHMENTS_MAX_BYTES} bytes)`);
+            throw statusError(507, "attachments storage is full (the disk is nearly out of free space)");
         }
         // Unknown-length HTTP bodies reserve in bounded chunks. Taking whatever
         // remains below the preferred increment avoids falsely rejecting a small
@@ -328,14 +297,6 @@ async function digestFile(path) {
 function statusError(status, message) {
     return Object.assign(new Error(message), { status });
 }
-function normalizedMime(mime) {
-    const value = mime?.split(";")[0]?.trim().toLowerCase();
-    return value || null;
-}
-export function extensionForFileMime(mime) {
-    const value = normalizedMime(mime);
-    return value ? FILE_MIMES[value] ?? null : null;
-}
 /** Strip platform-reserved characters and replace any sender-provided
  * extension with the canonical one for the accepted mime. Separators and
  * encoded separators are rejected rather than massaged so traversal attempts

package/dist-server/server/avatar-image.js

@@ -6,6 +6,7 @@ export const AVATAR_IMAGE_TIMEOUT_MS = 120_000;
 const MAX_UPSTREAM_RESPONSE_BYTES = 15 * 1024 * 1024;
 export const avatarGenerationRequestSchema = z.object({
     prompt: z.string().trim().max(AVATAR_DIRECTION_MAX_CHARS).default(""),
+    source: z.enum(["auto", "subscription", "api"]).default("auto"),
 });
 const generatedImageResponseSchema = z.object({
     data: z.array(z.object({ b64_json: z.string().min(1).optional(), url: z.string().optional() })).min(1),

package/dist-server/server/avatar-subscription.js

@@ -1,5 +1,28 @@
 import { decodeGeneratedImage } from "./generated-image.js";
-import { avatarGenerationPrompt, AVATAR_IMAGE_TIMEOUT_MS } from "./avatar-image.js";
+import { avatarGenerationPrompt, generateAvatarImage, AVATAR_IMAGE_TIMEOUT_MS } from "./avatar-image.js";
+import { PASS, ROUTES } from "./routes/table.js";
+export async function generateRoutedAvatar(cfg, instances, bot, direction, source = "auto") {
+    if (source !== "api") {
+        const subscription = await avatarSubscription(instances);
+        if (subscription)
+            return generateSubscriptionAvatar(subscription, bot, direction);
+        if (source === "subscription" || instances.some(instance => instance.enabled && instance.generateImage)) {
+            throw Object.assign(new Error("Sign in to an image-capable subscription in Settings, or explicitly choose an image API connection."), { status: 409 });
+        }
+    }
+    return generateAvatarImage(cfg, bot, direction);
+}
+export function installAvatarSubscriptionRoute(instances) {
+    ROUTES.push(async (context) => {
+        if (context.path !== "/api/avatar-subscription" || context.method !== "GET")
+            return PASS;
+        const available = instances();
+        const subscription = await avatarSubscription(available);
+        context.res.setHeader("Cache-Control", "no-store");
+        context.json(context.res, 200, { offered: available.some(instance => instance.enabled && instance.generateImage),
+            available: Boolean(subscription), label: subscription?.displayName ?? "Signed-in subscription" });
+    });
+}
 /** Capability and current billing are both required. An authenticated text
  * engine is not evidence that its subscription can generate images. */
 export async function avatarSubscription(instances) {

package/dist-server/server/checkpoint-recovery.js

@@ -0,0 +1,18 @@
+/** This identifies an unusable saved session, never permission to replay a
+ * submitted prompt. Only a subsequent explicit turn may rebuild the context. */
+export function isBrokenAntigravityCheckpoint(driverKind, message) {
+    return driverKind === "antigravityAgent" && message.includes("could not find doneCh for checkpoint");
+}
+export function invalidateBrokenCheckpoint(store, botId, driverKind, event) {
+    if (event.providerInstanceId && isBrokenAntigravityCheckpoint(driverKind, event.message)) {
+        // Undefined is absent on disk and engineIsFresh rebuilds from Atomic's
+        // transcript on the next send, including after an application restart.
+        store.setResumeCursor(botId, event.providerInstanceId, undefined, event.threadId);
+    }
+}
+/** Antigravity also sends its execution failure as a chunked assistant reply
+ * followed by end_turn. A quoted error inside a normal answer is not failure. */
+export function isAntigravityCheckpointReply(driverKind, text) {
+    return driverKind === "antigravityAgent"
+        && /^Agent execution error: could not find doneCh for checkpoint\s*$/.test(text.trim());
+}

package/dist-server/server/drivers/acp/core.js

@@ -48,6 +48,7 @@ import { commandSummary, toolDetailPreview } from "../../tool-summary.js";
 import { extractMcpImages } from "../../mcp-tool-images.js";
 import { mcpToolRefFromLabel } from "../../../shared/mcp-tool-ref.js";
 import { redactSecretsInText } from "../../redact.js";
+import { isBrokenAntigravityCheckpoint, isAntigravityCheckpointReply } from "../../checkpoint-recovery.js";
 import { recoveryPromptFor } from "../../resume-recovery.js";
 import { isModelRejection } from "../retry.js";
 import { engineFailureFromCode, isCredentialDead, isOpaqueRequestRejection, logAuthFailure, parseResetAt, resetHintFromData } from "../../engine-failure.js";
@@ -464,14 +465,15 @@ export function createAcpDriver(support) {
                 // turn synchronously must find this session free
                 session.current = null;
                 active.delete(threadId);
+                if (isAntigravityCheckpointReply(DRIVER_KIND, current.state.text)) {
+                    ok = false;
+                    stopReason = "invalid_checkpoint";
+                    emit({ ...base(threadId, current.turnId), type: "runtime.error", message: current.state.text.trim() });
+                    closeSession(threadId, "invalid-checkpoint");
+                }
                 current.flushAssistantText();
-                // `end_turn` with nothing to show for it — no reply, no image, no
-                // tool result — is a lost turn, not a success. An engine can report
-                // exactly that (a provider may cut a reasoning-only stream and
-                // still answer end_turn), and ok:true would end the thread quietly
-                // while the person's message went unanswered. Keep the completion,
-                // but report it as a failure so terminal chips, incidents and
-                // follow-ups see what happened.
+                // A successful end_turn without a reply or tool result is a lost
+                // turn. Report failure so terminal chips and follow-ups reflect it.
                 let finalOk = ok;
                 let finalStopReason = stopReason;
                 if (finalOk && finalStopReason === null && !current.state.producedItem) {
@@ -1467,7 +1469,9 @@ export function createAcpDriver(support) {
                                 type: "runtime.error",
                                 message: errorMessage,
                             });
-                            settle(threadId, session, false, reason ?? "failed");
+                            if (isBrokenAntigravityCheckpoint(DRIVER_KIND, errorMessage))
+                                closeSession(threadId, "invalid-checkpoint");
+                            settle(threadId, session, false, isBrokenAntigravityCheckpoint(DRIVER_KIND, errorMessage) ? "invalid_checkpoint" : reason ?? "failed");
                         }
                     }
                     catch (e) {
@@ -1492,18 +1496,14 @@ export function createAcpDriver(support) {
                                 ...(needsAuth ? { setup: true } : {}),
                                 ...(failure ? { failure } : {}),
                             });
-                            // Internal RPC failures can leave a live child poisoned just
-                            // like a silent prompt. Evict before completion listeners can
-                            // start the next turn. Never replay this accepted prompt: it
-                            // may already have executed tools. The next explicit turn can
-                            // resume the recorded session on a fresh process.
-                            // An agent refused by its provider mid-prompt is still running
-                            // (retrying on its own): it goes too.
-                            if ((logAuth || (!needsAuth && (stalled || e?.acpSessionFailure === true
+                            // Evict unusable sessions without replaying accepted prompts.
+                            // The harness invalidates broken checkpoints durably so the
+                            // next explicit turn rebuilds from the retained transcript.
+                            if ((logAuth || (!needsAuth && (stalled || isBrokenAntigravityCheckpoint(DRIVER_KIND, message) || e?.acpSessionFailure === true
                                 || code === "upstream_outage"))) && session.child.exitCode === null && !session.closing) {
                                 closeSession(threadId, logAuth ? "provider-auth" : stalled ? "prompt-stall" : "rpc-failure");
                             }
-                            settle(threadId, session, false, needsAuth ? "auth_required" : "rpc_error");
+                            settle(threadId, session, false, needsAuth ? "auth_required" : isBrokenAntigravityCheckpoint(DRIVER_KIND, message) ? "invalid_checkpoint" : "rpc_error");
                         }
                     }
                 })();

package/dist-server/server/drivers/claude-message.js

@@ -0,0 +1,12 @@
+// Extract text from the native Claude response before transcript normalization.
+export function firstText(content) {
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .filter((b) => b?.type === "text" && b.text)
+            .map((b) => b.text)
+            .join("");
+    }
+    return "";
+}

package/dist-server/server/drivers/claude.js

@@ -1,3 +1,4 @@
+import { firstText } from "./claude-message.js";
 // Claude driver — upstream ClaudeDriver skeleton over agentcal's
 // drivers/claude.js runtime (stream-json both directions, prompt over
 // stdin, completion from a real `result` event — verified against
@@ -811,17 +812,6 @@ function decodeConfig(raw) {
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
     };
 }
-function firstText(content) {
-    if (typeof content === "string")
-        return content;
-    if (Array.isArray(content)) {
-        return content
-            .filter((b) => b?.type === "text" && b.text)
-            .map((b) => b.text)
-            .join("");
-    }
-    return "";
-}
 /** Claude's stream-json input accepts the same image source blocks as the
  * Anthropic Messages API. Keep the old string form for text-only turns so a
  * CLI update cannot disturb the overwhelmingly common path. */
@@ -1739,7 +1729,7 @@ export const ClaudeDriver = {
                                     delivered.sessionId = o.session_id;
                                 session.sessionId = o.session_id;
                             }
-                            emit({ ...base(threadId, currentTurnId()), type: "session.started", sessionId: o.session_id, model: o.model, ...(retry.rebuilt ? { rebuilt: true } : {}) });
+                            emit({ ...base(threadId, currentTurnId()), type: "session.started", sessionId: o.session_id, model: o.model, modelEvidenceLevel: "session-reported", ...(retry.rebuilt ? { rebuilt: true } : {}) });
                         }
                         else if (o.subtype === "compact_boundary") {
                             // The CLI summarized the history, notes included: the next
@@ -1773,6 +1763,13 @@ export const ClaudeDriver = {
                     }
                     case "assistant": {
                         const msg = o.message ?? {};
+                        if (o.is_api_error_message !== true && typeof o.error !== "string") {
+                            emit({ ...base(threadId, currentTurnId()), type: "model.evidence",
+                                callId: typeof msg.id === "string" ? msg.id : newId(),
+                                responseId: typeof msg.id === "string" ? msg.id : undefined,
+                                model: typeof msg.model === "string" ? msg.model : null,
+                                level: typeof msg.model === "string" ? "response-reported" : "unknown" });
+                        }
                         const text = firstText(msg.content);
                         // CLI auth diagnostics enter the shared fallback path, never assistant text.
                         if (claudeAuthFailure(o, text)) {

package/dist-server/server/drivers/codex-image.js

@@ -0,0 +1,141 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { killCliTree, spawnCli } from "../procs.js";
+import { codexConfigMcpServers, codexUserMcpOffArgs } from "./codex-mcp-names.js";
+import { codexPersonalSetupOffArgs } from "./codex-personal.js";
+import { codexToolSurfaceArgs } from "./codex-tool-surface.js";
+/** A separate ephemeral app-server: no chat bus, history, mounted integrations,
+ * API billing fallback or provider-supplied file reads. Prompt travels on stdin. */
+export async function codexImage(cli, env, prompt, signal, diagnostic, model) {
+    signal.throwIfAborted();
+    const cwd = await mkdtemp(join(tmpdir(), "atomic-avatar-"));
+    const args = ["app-server", ...codexToolSurfaceArgs(),
+        ...codexUserMcpOffArgs(codexConfigMcpServers(env, cwd)), ...codexPersonalSetupOffArgs(env, cwd),
+        ...["shell_tool", "unified_exec", "view_image", "apps", "multi_agent", "multi_agent_v2", "code_mode"]
+            .flatMap(name => ["-c", `features.${name}=false`]),
+        "-c", "features.image_generation=true", "-c", 'web_search="disabled"',
+        "-c", 'model_provider="openai"', "-c", 'forced_login_method="chatgpt"',
+        "-c", "project_doc_max_bytes=0",
+    ];
+    let child;
+    try {
+        child = spawnCli(cli, args, { cwd, env, stdio: ["pipe", "pipe", "pipe"] });
+    }
+    catch {
+        await rm(cwd, { recursive: true, force: true });
+        throw new Error("Could not start image generation.");
+    }
+    const pending = new Map();
+    let nextId = 0, buffer = "", image, done = false;
+    let resolveImage;
+    let rejectImage;
+    const result = new Promise((resolve, reject) => { resolveImage = resolve; rejectImage = reject; });
+    // The handshake may still be awaiting an RPC when an abort/exit occurs.
+    void result.catch(() => { });
+    const fail = () => {
+        const error = new Error("Codex image generation did not complete.");
+        for (const waiter of pending.values())
+            waiter.reject(error);
+        pending.clear();
+        if (!done)
+            rejectImage(error);
+        done = true;
+    };
+    const send = (message) => { child.stdin.write(JSON.stringify(message) + "\n", error => { if (error)
+        fail(); }); };
+    const request = (method, params) => new Promise((resolve, reject) => {
+        if (done) {
+            reject(new Error("Image session ended."));
+            return;
+        }
+        const id = ++nextId;
+        pending.set(id, { resolve, reject });
+        send({ id, method, params });
+    });
+    child.on("error", fail);
+    child.on("exit", fail);
+    child.stdin.on("error", fail);
+    child.stderr.resume();
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+        buffer += chunk;
+        if (Buffer.byteLength(buffer) > 32 * 1024 * 1024) {
+            fail();
+            return;
+        }
+        for (;;) {
+            const newline = buffer.indexOf("\n");
+            if (newline < 0)
+                break;
+            const line = buffer.slice(0, newline);
+            buffer = buffer.slice(newline + 1);
+            try {
+                const message = JSON.parse(line);
+                if (message.method === "item/completed" || message.method === "turn/completed")
+                    diagnostic?.({ method: message.method,
+                        itemType: message.params?.item?.type, status: message.params?.turn?.status ?? message.params?.item?.status,
+                        imageBytes: message.params?.item?.type === "imageGeneration" ? message.params.item.result?.length ?? 0 : undefined,
+                        errorTerms: message.params?.turn?.error?.message?.match(/\b(?:usage|limit|quota|expired|auth|model|configuration|tools?|sandbox|rate|429|401|403|400|unsupported|invalid|image_generation|reasoning|summary|does not exist|not supported|not available|gpt-[\w.-]+)\b/gi) ?? undefined });
+                if (message.method && message.id !== undefined) {
+                    // No permission, tool or user-input request can widen this session.
+                    send({ id: message.id, error: { code: -32601, message: "Not available in avatar generation." } });
+                    fail();
+                    return;
+                }
+                if (message.id !== undefined) {
+                    const waiter = pending.get(message.id);
+                    pending.delete(message.id);
+                    if (message.error)
+                        waiter?.reject(new Error("Codex image request failed."));
+                    else
+                        waiter?.resolve(message.result);
+                }
+                else if (message.method === "item/completed" && message.params?.item?.type === "imageGeneration") {
+                    const item = message.params.item;
+                    if (item.status !== "failed" && typeof item.result === "string")
+                        image = item.result;
+                }
+                else if (message.method === "turn/completed") {
+                    if (message.params?.turn?.status !== "completed" || !image) {
+                        fail();
+                        return;
+                    }
+                    done = true;
+                    resolveImage(image);
+                }
+            }
+            catch {
+                fail();
+                return;
+            }
+        }
+    });
+    signal.addEventListener("abort", fail, { once: true });
+    try {
+        if (signal.aborted)
+            fail();
+        await request("initialize", { clientInfo: { name: "atomic_avatar", version: "1" }, capabilities: { experimentalApi: true } });
+        send({ method: "initialized", params: {} });
+        const catalog = await request("model/list", { limit: 100 });
+        const choices = Array.isArray(catalog.data) ? catalog.data.filter(item => item && item.hidden !== true &&
+            (typeof item.model === "string" || typeof item.id === "string")) : [];
+        const choice = choices.find(item => item.id === model || item.model === model) ?? choices.find(item => item.isDefault) ?? choices[0];
+        if (!choice)
+            throw new Error("No subscription image model is available.");
+        const started = await request("thread/start", { cwd, model: choice.model ?? choice.id, modelProvider: "openai", ephemeral: true, approvalPolicy: "never", sandbox: "read-only",
+            developerInstructions: "Generate exactly one image with the native image generation tool. Do not run commands, read files, use other tools or ask for credentials." });
+        if (typeof started.thread?.id !== "string")
+            throw new Error("Missing image session.");
+        await request("turn/start", { threadId: started.thread.id, input: [{ type: "text", text: prompt }],
+            approvalPolicy: "never", sandboxPolicy: { type: "readOnly" } });
+        return await result;
+    }
+    finally {
+        signal.removeEventListener("abort", fail);
+        fail();
+        const stopped = await killCliTree(child);
+        if (stopped)
+            await rm(cwd, { recursive: true, force: true });
+    }
+}

package/dist-server/server/drivers/codex.js

@@ -1,12 +1,8 @@
 import { codexToolSurfaceArgs } from "./codex-tool-surface.js";
-// Codex driver — upstream CodexDriver skeleton over agentcal's
-// drivers/codex.js runtime: the official `codex` CLI headless over its
-// app-server JSON-RPC protocol (newline-delimited JSON on stdio).
-// Completion is a real `turn/completed` notification; approval requests
-// arrive as in-process server→client JSON-RPC requests and surface as
-// canonical request.opened events (answered via respondToRequest — no MCP
-// proxy or unix socket needed, unlike claude). Verified against
-// codex-cli 0.144.4 by agentcal.
+import { codexImage } from "./codex-image.js";
+// Official Codex app-server over newline-delimited JSON-RPC on stdio.
+// Completion comes from turn/completed; native approval requests become
+// canonical request.opened events answered through respondToRequest.
 //
 // resumeCursor is the codex thread id; a later turn tries thread/resume
 // and preserves that history or reports a failed resume.
@@ -1557,7 +1553,7 @@ export const CodexDriver = {
                     if (!codexThreadId)
                         throw new Error("Codex did not return a native thread id");
                     await syncCodexInstructions(threadId, codexThreadId, developerInstructions, resumedNativeThread, request);
-                    emit({ ...base(threadId, turnId), type: "session.started", sessionId: codexThreadId, model: startedModel ?? turn.model ?? null, ...(rebuiltFromReplay ? { rebuilt: true } : {}) });
+                    emit({ ...base(threadId, turnId), type: "session.started", sessionId: codexThreadId, model: startedModel ?? turn.model ?? null, modelEvidenceLevel: startedModel ? "session-reported" : "requested-only", ...(rebuiltFromReplay ? { rebuilt: true } : {}) });
                     const note = turn.systemStable !== undefined
                         ? volatileNoteFor(threadId, codexThreadId, !resumedNativeThread || rebuiltFromReplay, turn)
                         : "";
@@ -1700,6 +1696,7 @@ export const CodexDriver = {
             cancelAuthentication: () => authentication.cancel(),
             signOut: () => authentication.signOut(),
             snapshot,
+            ...(!config.managed ? { generateImage: (prompt, options) => codexImage(config.cli, childEnv(), prompt, options.signal, undefined, decodeCodexSelection(models.default).model ?? undefined) } : {}),
             adapter: {
                 provider: DRIVER_KIND,
                 capabilities: {

package/dist-server/server/drivers/openai-chat.js

@@ -42,7 +42,7 @@ export function createOpenAIChatRuntime(options) {
         turnId,
         createdAt: new Date().toISOString(),
     });
-    const complete = async (messages, model, stream, signal, onDelta, tools = []) => {
+    const complete = async (messages, model, stream, signal, onDelta, tools = [], onIdentity) => {
         // Idle timer that is renewed on every received chunk during streaming
         const timeoutController = new AbortController();
         let idleTimer = null;
@@ -77,6 +77,7 @@ export function createOpenAIChatRuntime(options) {
                 const bodyError = providerError(json);
                 if (bodyError)
                     throw new ChatProtocolError(`provider returned a completion error: ${bodyError.slice(0, 200)}`);
+                onIdentity?.(typeof json.model === "string" ? json.model : null, typeof json.id === "string" ? json.id : undefined);
                 const message = json.choices?.[0]?.message;
                 if (!message || !object(message) || !["content", "reasoning_content", "reasoning", "reasoning_details", "tool_calls", "function_call"].some((key) => key in message)) {
                     throw new ChatProtocolError("provider returned no completion message");
@@ -141,6 +142,7 @@ export function createOpenAIChatRuntime(options) {
                 const chunkError = providerError(chunk);
                 if (chunkError)
                     throw new ChatProtocolError(`provider returned a streaming completion error: ${chunkError.slice(0, 200)}`);
+                onIdentity?.(typeof chunk.model === "string" ? chunk.model : null, typeof chunk.id === "string" ? chunk.id : undefined);
                 const choice = chunk.choices?.find((row) => row.index === undefined || row.index === 0);
                 const delta = choice?.delta;
                 if (object(delta))
@@ -329,10 +331,19 @@ export function createOpenAIChatRuntime(options) {
                                 emit({ ...base(turn.threadId, turnId), type: "content.delta", streamKind, delta: visible });
                         };
                         try {
+                            const callId = newId();
+                            emit({ ...base(turn.threadId, turnId), type: "model.call", callId });
+                            let previousIdentity = "";
                             completion = await complete(messages, model, true, abort.signal, (text, streamKind) => {
                                 streamed = true;
                                 delta(text, streamKind);
-                            }, tools.definitions);
+                            }, tools.definitions, (reportedModel, responseId) => {
+                                const identity = JSON.stringify([reportedModel, responseId]);
+                                if (identity === previousIdentity)
+                                    return;
+                                previousIdentity = identity;
+                                emit({ ...base(turn.threadId, turnId), type: "model.evidence", callId, model: reportedModel, responseId, level: reportedModel ? "response-reported" : "unknown" });
+                            });
                             delta("", "assistant_text", true);
                             delta("", "reasoning_text", true);
                             break;