@gentbajko/slopify 2.3.1 → 2.5.0

package/dist/edge/docker-projects/install.js

@@ -4,6 +4,7 @@ import { dirname, join } from "node:path";
 import { readVersion } from "../../kernel/version.js";
 import { assertVolumeClaims } from "./claims.js";
 import { readCommittedJournal } from "./committed.js";
+import { pruneRecoveryVolumes } from "./prune.js";
 import { assertSourceIdentity, recoverInstallation } from "./recover.js";
 import { journalSchema, privateDirectory, readState, receiptSchema, selectProjects, writeState, } from "./state.js";
 import { assertIdentity, assertWritableTree, identity, isMissing, privateTree, safePath, syncDirectory, treeDigest, } from "./tree.js";
@@ -91,7 +92,12 @@ export async function installProjects(c, e, recovery) {
         if (!old.running)
             await e.command(["start", old.id]);
         await e.health(old.id, j.token, expectedVersion);
-        return { url: `http://${old.port}`, projects, recovery: j.backup };
+        return {
+            url: `http://${old.port}`,
+            projects,
+            recovery: j.backup,
+            pruned: { removed: [], problems: [] },
+        };
     }
     const id = randomUUID();
     const directory = join(c.directory, id);
@@ -229,7 +235,9 @@ export async function installProjects(c, e, recovery) {
         const ready = await e.inspect(candidate);
         if (!ready?.port)
             throw new Error("Slopify started but Docker did not report which port it is on. Run the same command again to finish.");
-        return { url: `http://${ready.port}`, projects, recovery: j.backup };
+        // Only now, with the new container committed and healthy, are older snapshots redundant.
+        const pruned = await pruneRecoveryVolumes(c, e, j);
+        return { url: `http://${ready.port}`, projects, recovery: j.backup, pruned };
     }
     catch (cause) {
         const current = await readState(receiptPath, receiptSchema, c.uid);

package/dist/edge/docker-projects/prune.js

@@ -0,0 +1,66 @@
+import { join } from "node:path";
+import { recoveryId } from "./engine.js";
+import { journalSchema, readState } from "./state.js";
+// Phases an update's record is left in once it is over, one way or the other. Anything else
+// is an update that never finished, and its volume may be the only copy of the data.
+const settled = new Set(["healthy", "committed", "restored", "rolled-back"]);
+// After an update is committed and healthy, keep only its own recovery volume. An older one is
+// removed only when all of these hold, so a volume some other installation, container or person
+// made is never touched:
+// - its name is exactly `<this data volume>-recovery-<uuid>`, never the data volume itself;
+// - its io.slopify.transaction label is that same uuid (every launcher has set it);
+// - the container label, which this launcher adds, names this container (earlier launchers
+//   set none, and for those the next check decides alone);
+// - the update's own record, <install dir>/<uuid>/journal.json in this container's private
+//   folder, exists and names this container, data volume and Docker, the installation the
+//   volume's label names, and exactly this volume as its backup, and says that update is
+//   over. A first install that was rolled back has an installation id of its own, so the
+//   id is matched against the volume's label rather than the current update's.
+// Docker refuses to remove a volume a container still uses; that refusal is reported, not
+// forced. Nothing here can fail the update, which has already finished.
+export async function pruneRecoveryVolumes(c, e, j) {
+    const removed = [];
+    const problems = [];
+    let volumes;
+    try {
+        volumes = await e.recoveryVolumes(c.volume);
+    }
+    catch (error) {
+        return {
+            removed,
+            problems: [
+                `Couldn't list older recovery volumes to tidy up, so all of them are kept. See them with docker volume ls --filter label=io.slopify.transaction and remove the ones you no longer need with docker volume rm <name>. ${reason(error)}`,
+            ],
+        };
+    }
+    for (const volume of volumes) {
+        const id = recoveryId(c.volume, volume.name);
+        if (id === null || id === j.id || volume.name === j.backup || volume.name === c.volume)
+            continue;
+        if (volume.transaction !== id)
+            continue;
+        if (volume.container !== null && volume.container !== c.name)
+            continue;
+        const record = await readState(join(c.directory, id, "journal.json"), journalSchema, c.uid).catch(() => null);
+        if (record === null ||
+            record.id !== id ||
+            record.name !== c.name ||
+            record.volume !== c.volume ||
+            record.daemon !== j.daemon ||
+            (volume.installation !== null && volume.installation !== record.installation) ||
+            record.backup !== volume.name ||
+            !settled.has(record.phase))
+            continue;
+        try {
+            await e.removeVolume(volume.name);
+            removed.push(volume.name);
+        }
+        catch (error) {
+            problems.push(`Couldn't remove the older recovery volume ${volume.name}, so it is kept. Once nothing uses it, remove it with docker volume rm ${volume.name}. ${reason(error)}`);
+        }
+    }
+    return { removed, problems };
+}
+function reason(error) {
+    return error instanceof Error ? `Why: ${error.message}` : "";
+}

package/dist/edge/events/hub.js

@@ -87,6 +87,17 @@ export function createHub(deps) {
         },
     };
 }
+// Every project event also goes to `observe` (the run notifier), after the open pages have
+// it, whether or not a page is open to receive it.
+export function observedHub(hub, observe) {
+    return {
+        ...hub,
+        emit: (projectId, event) => {
+            hub.emit(projectId, event);
+            observe(event);
+        },
+    };
+}
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/edge/http/app.js

@@ -4,6 +4,7 @@ import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { actionRoutes } from "./actions.js";
 import { audioPreviewRoutes } from "./audio-preview.js";
+import { backupRoutes } from "./backups.js";
 import { checkpointRoutes } from "./checkpoints.js";
 import { diagnosticsRoutes } from "./diagnostics.js";
 import { documentThemeRoutes } from "./document-themes.js";
@@ -41,6 +42,7 @@ function apiRoutes(deps, startedAt) {
     }))
         .route("/staging", stagingRoutes(deps))
         .route("/storage", storageRoutes(deps))
+        .route("/backups", backupRoutes(deps.backups))
         .route("/drafts", draftRoutes(deps.drafts))
         .route("/diagnostics", diagnosticsRoutes(deps))
         .route("/project-templates", projectTemplateRoutes(deps.drafts))

package/dist/edge/http/backups.js

@@ -0,0 +1,40 @@
+import { zValidator } from "@hono/zod-validator";
+import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { backupConfigInputSchema } from "../../slices/backups/model.js";
+import { onInvalid, problem, titleOf } from "./problem.js";
+// Settings → Backups: the schedule, the folder, the last result and Back up now. Writing an
+// archive takes minutes, so Back up now answers at once and the screen polls this view.
+export function backupRoutes(service) {
+    const backups = () => {
+        if (service === undefined)
+            throw new HTTPException(404);
+        return service;
+    };
+    return new Hono()
+        .get("/", async (c) => {
+        c.header("Cache-Control", "no-store");
+        return c.json(await backups().view());
+    })
+        .put("/", zValidator("json", backupConfigInputSchema, onInvalid), async (c) => {
+        const saved = backups().save(c.req.valid("json"));
+        if (!saved.ok)
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: saved.detail,
+                extensions: { field: "folder" },
+            });
+        return c.json(await backups().view());
+    })
+        .post("/run", async (c) => {
+        const started = backups().runNow();
+        if (!started.ok)
+            return problem(c, {
+                status: started.status,
+                title: titleOf(started.status),
+                detail: started.detail,
+            });
+        return c.json(await backups().view(), 202);
+    });
+}

package/dist/edge/http/host-cli.js

@@ -6,6 +6,7 @@ import { z } from "zod";
 import { sniffImage } from "../../adapters/image/bytes.js";
 import { redact } from "../../kernel/log.js";
 import { bridgeLimits, HostFolderRefused, hostCliIds, hostCliProtocol, hostFrameSchema, hostImageSchema, hostLlmIds, hostLlmSchema, hostModelsSchema, hostOpenFolderSchema, hostStatusSchema, } from "../../kernel/ports/host-cli.js";
+import { agentImageTimeoutMs } from "../../kernel/ports/image.js";
 import { isProviderError, providerError } from "../../kernel/ports/model.js";
 export function hostGate() {
     let accepting = true;
@@ -226,9 +227,23 @@ export function hostCliRoutes(options) {
         const job = c.get("job");
         const controller = new AbortController();
         const signal = AbortSignal.any([job.signal, controller.signal]);
-        const timer = setTimeout(() => controller.abort(), 300_000);
+        const timer = setTimeout(() => controller.abort(), agentImageTimeoutMs);
         try {
-            const result = await ports.image.generate({ ...body.data, signal });
+            const { reference, thinking, ...rest } = body.data;
+            const image = reference === undefined
+                ? undefined
+                : {
+                    bytes: new Uint8Array(Buffer.from(reference.base64, "base64")),
+                    mime: reference.mime,
+                };
+            if (image !== undefined && sniffImage(image.bytes) !== image.mime)
+                return invalid(c);
+            const result = await ports.image.generate({
+                ...rest,
+                ...(thinking === undefined ? {} : { thinking }),
+                ...(image === undefined ? {} : { reference: image }),
+                signal,
+            });
             if (signal.aborted)
                 throw providerError({ kind: "unavailable", message: unavailable });
             if (result.bytes.byteLength > bridgeLimits.image || sniffImage(result.bytes) !== result.mime)

package/dist/edge/http/problem.js

@@ -4,6 +4,7 @@ const titles = {
     404: "Not Found",
     409: "Conflict",
     415: "Unsupported Media Type",
+    502: "Bad Gateway",
     500: "Internal Server Error",
 };
 export function problem(c, init) {

package/dist/edge/http/providers.js

@@ -1,6 +1,7 @@
 import { zValidator } from "@hono/zod-validator";
 import { Hono } from "hono";
 import { z } from "zod";
+import { videoModelsOf } from "../../catalog/schema.js";
 import { cliPathMaxLength, saveCliPath } from "../../slices/settings/cli-paths.js";
 import { keyStatus, removeProviderKey, saveProviderKey } from "../../slices/settings/keys.js";
 import { isLocalCliProvider, providerById, providerIds } from "../../slices/settings/model.js";
@@ -56,6 +57,13 @@ export function providerRoutes(deps) {
         .get("/", async (c) => c.json({ providers: await providerStatuses(readiness) }))
         .get("/:id/models", zValidator("param", providerParam, onInvalid), async (c) => {
         const { id } = c.req.valid("param");
+        // Animate images lists the provider's image-to-video models, which only the catalogue
+        // names.
+        if (c.req.query("video") === "1")
+            return c.json({
+                models: deps.catalogue === undefined ? [] : videoModelsOf(deps.catalogue.read(), id),
+                allowsCustom: false,
+            });
         if (deps.catalogue && !isLocalCliProvider(id))
             return c.json({
                 models: deps.catalogue.models(id, providerById(id).family).map((m) => ({

package/dist/edge/http/schedules.js

@@ -18,7 +18,7 @@ function refused(c, result) {
         conflict: "This schedule changed while you were editing, possibly because a run just started. Reload the page to see the latest, then make your change again.",
         "cancel-required": "This schedule is still active. Cancel it first, then delete it. Completed schedules can be deleted straight away.",
         "missing-template": "The template you picked was deleted or changed. Choose a template again, then save.",
-        "unsupported-media": "This template uses audio, images or a thumbnail you supplied, so it cannot run on a schedule. Pick a template that generates these instead.",
+        "unsupported-media": "This template uses audio, images, a thumbnail or shorts background music you supplied, so it cannot run on a schedule: a scheduled run has no one to attach the file again. Pick a template that generates these instead, or remove the music under Outputs → Export → More shorts options on Play and save the template again.",
         "not-due": "This one-off time has already passed. Choose a time in the future.",
         "spend-limit": "The estimated cost is above this schedule's spend limit, or some prices are unknown. Raise the spend limit or choose models with known prices.",
         readiness: "A provider this template needs is not ready, for example a missing API key, model or voice. Check Settings → Providers, then try again.",

package/dist/edge/http/settings.js

@@ -1,6 +1,9 @@
 import { zValidator } from "@hono/zod-validator";
 import { Hono } from "hono";
 import { z } from "zod";
+import { notificationUrlMax, notificationUrlProblem, testNotice, webhookBody, } from "../../slices/notifications/rules.js";
+import { createNotificationSender, sendFailureText } from "../../slices/notifications/send.js";
+import { readNotificationUrl, saveNotificationUrl } from "../../slices/notifications/settings.js";
 import { appearances, providerIds } from "../../slices/settings/model.js";
 import { readSettings, saveSettings } from "../../slices/settings/playback.js";
 import { addVoice, removeVoice, voiceIdMax, voiceNameMax, voices, } from "../../slices/settings/voices.js";
@@ -13,6 +16,9 @@ const voiceBody = z.object({
     name: z.string(),
     voiceId: z.string(),
 });
+// Length and scheme are the slice's rules, so their sentences reach the field; this bound only
+// keeps a pasted novel off the parser.
+const notificationBody = z.object({ url: z.string().max(notificationUrlMax * 2) });
 const playbackBody = z.object({
     silenceGapSeconds: z.number(),
     appearance: z.enum(appearances),
@@ -22,6 +28,7 @@ const playbackBody = z.object({
 export function settingsRoutes(deps) {
     const playback = { db: deps.db, log: deps.log };
     const voiceDeps = { db: deps.db, ids: deps.ids };
+    const send = deps.sendNotification ?? createNotificationSender(globalThis.fetch);
     return new Hono()
         .get("/", (c) => c.json(readSettings(playback)))
         .put("/", zValidator("json", playbackBody, onInvalid), (c) => {
@@ -35,6 +42,43 @@ export function settingsRoutes(deps) {
             });
         }
         return c.json(result.settings);
+    })
+        .get("/notifications", (c) => c.json({ url: readNotificationUrl(deps.db) }))
+        .put("/notifications", zValidator("json", notificationBody, onInvalid), (c) => {
+        const result = saveNotificationUrl(deps.db, c.req.valid("json").url);
+        if (!result.ok) {
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: `The Notification URL wasn't saved: ${result.message} Fix it in Settings → Notifications → Notification URL, then press Save.`,
+                extensions: { fields: [{ field: "url", message: result.message }] },
+            });
+        }
+        return c.json({ url: result.url });
+    })
+        .post("/notifications/test", zValidator("json", notificationBody, onInvalid), async (c) => {
+        const url = c.req.valid("json").url.trim();
+        const invalid = url === ""
+            ? "Enter a Notification URL first, for example https://ntfy.sh/your-topic."
+            : notificationUrlProblem(url);
+        if (invalid !== undefined) {
+            return problem(c, {
+                status: 400,
+                title: titleOf(400),
+                detail: `The test notification wasn't sent: ${invalid}`,
+                extensions: { fields: [{ field: "url", message: invalid }] },
+            });
+        }
+        const result = await send(url, webhookBody(testNotice));
+        if (!result.ok) {
+            deps.log.write("warn", "notification.test", { detail: sendFailureText(result) });
+            return problem(c, {
+                status: 502,
+                title: titleOf(502),
+                detail: `The test notification wasn't delivered: ${sendFailureText(result)}. Check the address in Settings → Notifications → Notification URL (for ntfy, https://ntfy.sh/your-topic), then press Send test notification again.`,
+            });
+        }
+        return c.json({ sent: true });
     })
         .get("/voices", (c) => c.json({ voices: voices(voiceDeps) }))
         .post("/voices", zValidator("json", voiceBody, onInvalid), (c) => {

package/dist/edge/http/timeouts.js

@@ -0,0 +1,38 @@
+export const requestLimits = { requestMs: 300_000, uploadIdleMs: 300_000 };
+// Node's `requestTimeout` (5 minutes) is one limit for the whole server: every
+// `connectionsCheckingInterval` it answers 408 and closes any connection whose current request
+// started longer ago than that and has not fully arrived, however steadily its body is still
+// coming in. A multi-GB backup over a slow link needs longer, so the server's limit is switched
+// off and the same limit is kept here per request, with one exception: Import everything
+// (PUT /api/storage/import) may take as long as it needs, and is only cut off when it sends
+// nothing at all for `uploadIdleMs`. `headersTimeout` (1 minute) is Node's and still applies to
+// every request.
+export function limitRequestTimes(server, limits = requestLimits) {
+    if (!("requestTimeout" in server))
+        return;
+    server.requestTimeout = 0;
+    server.on("request", (request) => {
+        if (isBackupUpload(request)) {
+            // Idle only while the file is arriving; once it is in, the import may take its time.
+            request.setTimeout(limits.uploadIdleMs);
+            request.once("end", () => request.setTimeout(0));
+            return;
+        }
+        const timer = setTimeout(() => {
+            if (request.complete)
+                return;
+            // What Node itself does: a 408 if nothing has been answered on this connection yet.
+            const socket = request.socket;
+            if (socket.writable && socket.bytesWritten === 0)
+                socket.write("HTTP/1.1 408 Request Timeout\r\nConnection: close\r\n\r\n");
+            socket.destroy();
+        }, limits.requestMs);
+        timer.unref();
+        const clear = () => clearTimeout(timer);
+        request.once("end", clear);
+        request.once("close", clear);
+    });
+}
+function isBackupUpload(request) {
+    return request.method === "PUT" && (request.url ?? "").split("?")[0] === "/api/storage/import";
+}

package/dist/host-cli/runtime.js

@@ -1,7 +1,7 @@
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { codexImage } from "../adapters/image/codex.js";
+import { codexImage, codexImageTimeoutMs } from "../adapters/image/codex.js";
 import { claudeCodeLlm } from "../adapters/llm/claude-code.js";
 import { nodeClaudeCodeModels } from "../adapters/llm/claude-code-models.js";
 import { codexLlm } from "../adapters/llm/codex.js";
@@ -75,7 +75,8 @@ export function createHostRuntime(deps) {
         }),
         image: {
             id: "codex-image",
-            models: () => codexImage({ run: deps.run }).models(),
+            timeoutMs: codexImageTimeoutMs,
+            models: () => codexImage({ run: deps.run, readModels: () => models("codex") }).models(),
             generate: async (request) => {
                 const binary = await command("codex-image");
                 return codexImage({ run: deps.run, binary, env: deps.env }).generate(request);

package/dist/kernel/db/migrations/0019-shorts-prompts.sql

@@ -0,0 +1,16 @@
+-- Library prompts of the new "shorts" kind: what the Video stage's Shorts step asks the text
+-- model for when it picks the clips. SQLite cannot change a CHECK in place, so the table is
+-- copied into one whose CHECK lists the new kind, like 0015 did for "description".
+CREATE TABLE prompts_shorts_upgrade (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('article','image','thumbnail','narration','description','shorts')),
+  name TEXT NOT NULL,
+  body TEXT NOT NULL,
+  slots TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+INSERT INTO prompts_shorts_upgrade (id,kind,name,body,slots,updated_at)
+  SELECT id,kind,name,body,slots,updated_at FROM prompts;
+DROP TABLE prompts;
+ALTER TABLE prompts_shorts_upgrade RENAME TO prompts;
+CREATE UNIQUE INDEX prompts_name ON prompts(kind,lower(name));

package/dist/kernel/db/migrations/0022-drop-duplicate-held-work.sql

@@ -0,0 +1,56 @@
+-- Before 2.4.0 every save made while a step waited for Resume minted a new held row for it,
+-- even when the project already had a row for exactly that step (same key and fingerprint).
+-- Save now reserves the existing one instead (existingWork in
+-- slices/rebuild/transition-repo.ts); this removes the copies left behind by older saves.
+--
+-- A row counts for a step the way Save counts it: a finished row (work and piece done), or a
+-- held row nothing ran for (pending, held, unsent, no planning context, no attempt). Per
+-- project, key and fingerprint, the row Save would pick is kept: a finished one first,
+-- otherwise the newest held one. Only held rows that are not that pick are removed, and only
+-- when they carry one piece and no review checkpoint. A revision that reserved a removed
+-- copy is pointed at the kept held row, which is the same unstarted step. A copy some
+-- revision reserved while a finished row exists is left alone: pointing that revision at
+-- the finished result would change what it shows. Finished, running, failed and admitted
+-- work, and assets, are never touched.
+CREATE TEMP TABLE m0022_eligible AS
+SELECT w.id AS work_id, p.id AS piece_id, w.project_id, p.work_key, p.fingerprint,
+  w.rowid AS rid, w.state = 'done' AS done
+FROM revision_work w JOIN revision_work_pieces p ON p.work_id = w.id
+WHERE (w.state = 'done' AND p.state = 'done')
+  OR (w.state = 'pending' AND w.dispatch_state = 'held' AND p.state = 'held'
+    AND p.submitted_at IS NULL AND w.recipe_context IS NULL
+    AND NOT EXISTS (SELECT 1 FROM attempts a WHERE a.work_id = w.id));
+
+CREATE TEMP TABLE m0022_kept AS
+SELECT project_id, work_key, fingerprint, work_id, piece_id, done FROM (
+  SELECT e.*, row_number() OVER (
+    PARTITION BY project_id, work_key, fingerprint ORDER BY done DESC, rid DESC
+  ) AS pick
+  FROM m0022_eligible e
+) WHERE pick = 1;
+
+CREATE TEMP TABLE m0022_copies AS
+SELECT e.work_id, k.work_id AS kept_work_id, k.piece_id AS kept_piece_id
+FROM m0022_eligible e
+JOIN m0022_kept k ON k.project_id = e.project_id AND k.work_key = e.work_key
+  AND k.fingerprint = e.fingerprint
+WHERE e.done = 0 AND e.work_id <> k.work_id
+  AND (SELECT count(*) FROM revision_work_pieces q WHERE q.work_id = e.work_id) = 1
+  AND NOT EXISTS (SELECT 1 FROM review_checkpoints c WHERE c.work_id = e.work_id)
+  AND (k.done = 0
+    OR NOT EXISTS (SELECT 1 FROM revision_work_reservations r WHERE r.work_id = e.work_id));
+
+UPDATE revision_work_reservations
+SET piece_id = CASE WHEN piece_id IS NULL THEN NULL ELSE (
+    SELECT c.kept_piece_id FROM m0022_copies c WHERE c.work_id = revision_work_reservations.work_id
+  ) END,
+  work_id = (
+    SELECT c.kept_work_id FROM m0022_copies c WHERE c.work_id = revision_work_reservations.work_id
+  )
+WHERE work_id IN (SELECT work_id FROM m0022_copies);
+
+DELETE FROM revision_work WHERE id IN (SELECT work_id FROM m0022_copies);
+
+DROP TABLE m0022_eligible;
+DROP TABLE m0022_kept;
+DROP TABLE m0022_copies;

package/dist/kernel/db/migrations/0024-reference-attachments.sql

@@ -0,0 +1,18 @@
+-- A Play draft can carry an uploaded establishing image (the Images stage's reference). SQLite
+-- cannot widen a CHECK constraint in place, so the attachments table is rebuilt with the new
+-- kind. Nothing references it, so enforcement stays on.
+CREATE TABLE play_draft_attachments_reference_upgrade (
+ id TEXT PRIMARY KEY,
+ draft_id TEXT NOT NULL REFERENCES play_drafts(id) ON DELETE CASCADE,
+ staged_file_id TEXT REFERENCES staged_files(id) ON DELETE SET NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('audio','images','thumbnail','reference')),
+ original_filename TEXT NOT NULL,
+ status TEXT NOT NULL CHECK(status IN ('pending','ready','reattach')),
+ error TEXT
+);
+INSERT INTO play_draft_attachments_reference_upgrade (id,draft_id,staged_file_id,kind,original_filename,status,error)
+  SELECT id,draft_id,staged_file_id,kind,original_filename,status,error FROM play_draft_attachments ORDER BY rowid;
+DROP TABLE play_draft_attachments;
+ALTER TABLE play_draft_attachments_reference_upgrade RENAME TO play_draft_attachments;
+CREATE INDEX play_draft_attachment_file ON play_draft_attachments(staged_file_id);
+CREATE INDEX play_draft_attachment_owner ON play_draft_attachments(draft_id);

package/dist/kernel/ports/host-cli.js

@@ -13,6 +13,8 @@ export const bridgeLimits = {
     frame: 4 * 1024 * 1024,
     stream: 64 * 1024 * 1024,
     image: 32 * 1024 * 1024,
+    // An establishing image sent along with an image request; base64 keeps it inside `request`.
+    reference: 10 * 1024 * 1024,
     text: 2 * 1024 * 1024,
     generation: 5,
     metadata: 8,
@@ -39,9 +41,22 @@ export const hostLlmSchema = z
     .strict();
 export const hostImageSchema = z
     .object({
-    model: z.literal("codex-imagegen"),
+    // "codex-imagegen" is the Codex default; any other is one of the Codex CLI's models.
+    model: short.refine((v) => !v.startsWith("-") && !/\s/.test(v)),
     prompt: z.string().min(1).max(bridgeLimits.text),
     aspect: z.enum(["16:9", "9:16"]),
+    thinking: z.enum(thinkingModes).optional(),
+    // The establishing image, as base64 (at most `bridgeLimits.reference` bytes decoded).
+    reference: z
+        .object({
+        mime: z.enum(["image/png", "image/jpeg"]),
+        base64: z
+            .string()
+            .max(Math.ceil(bridgeLimits.reference / 3) * 4)
+            .regex(/^[A-Za-z0-9+/]*={0,2}$/),
+    })
+        .strict()
+        .optional(),
 })
     .strict();
 export const hostOpenFolderSchema = z
@@ -73,7 +88,7 @@ export const hostModelsSchema = z
         id: short,
         name: short,
         group: short.optional(),
-        thinkingModes: z.array(z.enum(thinkingModes)).max(5).optional(),
+        thinkingModes: z.array(z.enum(thinkingModes)).max(thinkingModes.length).optional(),
     })
         .strict())
         .max(1000),

package/dist/kernel/ports/image.js

@@ -1 +1,3 @@
-export {};
+// How long an agent-driven image job (the Codex CLI reviewing and redrawing its image) may
+// run, on this machine or through the host helper.
+export const agentImageTimeoutMs = 30 * 60_000;

package/dist/kernel/ports/llm.js

@@ -1,2 +1,4 @@
 export const messageRoles = ["system", "user", "assistant"];
-export const thinkingModes = ["off", "low", "medium", "high", "xhigh"];
+// "max" and "ultra" are the Codex CLI's two highest reasoning efforts (its model list reports
+// them per model); the catalogue's models never offer them.
+export const thinkingModes = ["off", "low", "medium", "high", "xhigh", "max", "ultra"];

package/dist/kernel/runner/attempt.js

@@ -5,11 +5,13 @@ import { isProviderError, providerError } from "../ports/model.js";
 // Four attempts - the first plus 3 retries - waiting 2 s, 8 s, 30 s.
 export const attemptLimit = 4;
 export const backoffMs = [2000, 8000, 30_000];
-// Each attempt times out at 120 s, image calls at 300 s.
+// Each attempt times out at 120 s, image calls at 300 s, and an image animated into a clip at
+// 900 s: image-to-video models queue and take one to five minutes when they run.
 export const timeoutMs = {
     llm: 120_000,
     tts: 120_000,
     image: 300_000,
+    video: 900_000,
 };
 // A refusal and an unsupported capability are the provider's final answer; retrying only
 // spends the user's money again. The third is a key removed mid-run, which leaves nothing
@@ -23,7 +25,7 @@ const terminalKinds = [
 ];
 export async function attempt(ctx, call, opts) {
     ctx.signal.throwIfAborted();
-    const limit = timeoutMs[opts.kind];
+    const limit = opts.timeoutMs ?? timeoutMs[opts.kind];
     for (let n = 1;; n += 1) {
         ctx.signal.throwIfAborted();
         const retrieving = ctx.continuation?.read() !== undefined;
@@ -131,6 +133,7 @@ const callee = {
     llm: "AI model",
     tts: "narration provider",
     image: "image provider",
+    video: "image-to-video model",
 };
 // Node's `fetch` rejects a request that never reached the server with this TypeError.
 function unreachable(error) {

package/dist/kernel/runner/providers.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { providerError } from "../ports/model.js";
 import { attempt } from "./attempt.js";
 export function stageProviders(deps, context, pieceId) {
     const ctx = {
@@ -140,14 +141,53 @@ export function stageProviders(deps, context, pieceId) {
         },
         image: (call) => {
             const port = deps.registry.image(call.provider);
+            const callId = randomUUID();
+            // A long job (the Codex CLI reviewing and redrawing its image) says how far it has got
+            // on the stage's live panel; the other providers report nothing and show no panel.
+            const onProgress = (text) => context.emit({
+                type: "llm.preview",
+                ...(pieceId === undefined ? {} : { workPieceId: pieceId }),
+                projectId: context.stage.projectId,
+                stage: context.stage.kind,
+                callId,
+                label: call.previewLabel ?? "Image",
+                text,
+                reset: true,
+            });
             return schedule(call.provider, () => attempt(ctx, (signal) => port.generate({
                 model: call.model,
                 prompt: call.prompt,
                 aspect: call.aspect,
+                ...(call.thinking === undefined ? {} : { thinking: call.thinking }),
+                ...(call.reference === undefined ? {} : { reference: call.reference }),
+                onProgress,
+                signal,
+            }), 
+            // One request, one answer: the limit runs over the whole call - 300 s, or the
+            // provider's own when it needs longer.
+            {
+                kind: "image",
+                ...(port.timeoutMs === undefined ? {} : { timeoutMs: port.timeoutMs }),
+            }));
+        },
+        animate: (call) => {
+            const port = deps.registry.image(call.provider);
+            const animate = port.animate;
+            if (animate === undefined)
+                return Promise.reject(providerError({
+                    kind: "unsupported",
+                    message: `${call.provider} can't turn images into video clips. Choose fal.ai or Replicate as the image provider in Edit project → Providers, or turn Animate images off in Edit project → Inputs → Look.`,
+                }));
+            return schedule(call.provider, () => attempt(ctx, (signal) => animate({
+                model: call.model,
+                prompt: call.prompt,
+                image: call.image,
+                aspect: call.aspect,
+                seconds: call.seconds,
                 signal,
             }), 
-            // One request, one answer: the 300 s runs over the whole call.
-            { kind: "image" }));
+            // Queued and slow: the 900 s runs over the whole call, polling included.
+            { kind: "video" }));
         },
         forPiece: (piece) => stageProviders(deps, context, piece),
     };