@hienlh/ppm 0.19.4 → 0.19.5

package/src/server/routes/proxy.ts

@@ -1,6 +1,8 @@
 import { Hono } from "hono";
 import type { Context } from "hono";
 import { proxyService } from "../../services/proxy.service.ts";
+import { listProviderModels } from "../../services/proxy-agent-turn.ts";
+import { forwardImageGeneration, forwardImageEdit } from "../../services/proxy-image-bridge.ts";
 import { getProxyStats } from "../../services/db.service.ts";
 import { ok, err } from "../../types/api.ts";
 
@@ -105,6 +107,64 @@ proxyRoutes.post("/v1/messages/count_tokens", async (c) => {
   return proxyService.forward("/v1/messages/count_tokens", "POST", headers, body, getCallerMeta(c));
 });
 
+// ── Provider-scoped agent endpoints ──
+//
+// Both API dialects hang off the same `/proxy/<provider>` prefix, so a client
+// only swaps its base URL and keeps the vendor path its SDK already appends:
+//   ANTHROPIC_BASE_URL=<host>/proxy/codex     → POST /proxy/codex/v1/messages
+//   OPENAI_BASE_URL=<host>/proxy/codex/v1     → POST /proxy/codex/v1/chat/completions
+// Registered after the static routes above, which keep serving Claude unscoped.
+
+/** Shared gate: proxy must be on and the caller must present the proxy key. */
+function agentGate(c: Context, dialect: "anthropic" | "openai"): Response | null {
+  const authHeader = c.req.header("authorization") || c.req.header("x-api-key");
+  const fail = (status: 503 | 401, message: string) =>
+    dialect === "anthropic"
+      ? c.json({ type: "error", error: { type: status === 401 ? "authentication_error" : "api_error", message } }, status)
+      : c.json({ error: { message, type: status === 401 ? "authentication_error" : "server_error" } }, status);
+
+  if (!proxyService.isEnabled()) return fail(503, "Proxy is disabled");
+  if (!validateProxyAuth(authHeader)) return fail(401, "Invalid proxy auth key");
+  return null;
+}
+
+/** POST /proxy/:provider/v1/messages — provider's agent in Anthropic format. */
+proxyRoutes.post("/:provider/v1/messages", async (c) => {
+  const blocked = agentGate(c, "anthropic");
+  if (blocked) return blocked;
+  return proxyService.forwardAgentMessages(c.req.param("provider"), await c.req.text(), getCallerMeta(c));
+});
+
+/** POST /proxy/:provider/v1/chat/completions — provider's agent in OpenAI format. */
+proxyRoutes.post("/:provider/v1/chat/completions", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return proxyService.forwardAgentChat(c.req.param("provider"), await c.req.text(), getCallerMeta(c));
+});
+
+/** POST /proxy/:provider/v1/images/generations — text to image, OpenAI shape. */
+proxyRoutes.post("/:provider/v1/images/generations", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return forwardImageGeneration(c.req.param("provider"), await c.req.json().catch(() => ({})));
+});
+
+/** POST /proxy/:provider/v1/images/edits — image to image, OpenAI shape.
+ *  JSON only: the agent needs the source on disk, so a base64 payload is what
+ *  the bridge can actually act on. */
+proxyRoutes.post("/:provider/v1/images/edits", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return forwardImageEdit(c.req.param("provider"), await c.req.json().catch(() => ({})));
+});
+
+/** GET /proxy/:provider/v1/models — models that provider offers, OpenAI list shape. */
+proxyRoutes.get("/:provider/v1/models", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return listProviderModels(c.req.param("provider"));
+});
+
 /** GET /proxy/stats — proxy request stats (behind proxy auth) */
 proxyRoutes.get("/stats", (c) => {
   const authHeader = c.req.header("authorization") || c.req.header("x-api-key");

package/src/services/codex-account.service.ts

@@ -167,8 +167,10 @@ export function peekCodexAccount(): CodexAccount | null {
 }
 
 /** Sticky account for a session → else strategy pick → else null (default ~/.codex). */
-export async function resolveCodexAccountForSession(sessionId: string): Promise<CodexAccount | null> {
-  const sticky = getSessionCodexAccount(sessionId);
+export async function resolveCodexAccountForSession(sessionId?: string): Promise<CodexAccount | null> {
+  // Session-less callers (the model list) have nothing sticky to honour and fall
+  // straight through to the configured strategy.
+  const sticky = sessionId ? getSessionCodexAccount(sessionId) : null;
   if (sticky) { const a = getCodexAccount(sticky); if (a) return a; }
   if (getCodexStrategy() === "lowest-usage" && listCodexAccounts().length > 1) {
     const usages = await getAllCodexUsages();

package/src/services/prod-db-guard.ts

@@ -0,0 +1,98 @@
+/**
+ * Gatekeeper for the real (non-isolated) PPM database.
+ *
+ * `getDb()` opens `~/.ppm/ppm.db` lazily for whoever asks first, which put every
+ * throwaway script, spike and agent worktree one import away from production
+ * state: a proxy probe that booted the provider registry without loading config
+ * once reset the whole `config` table and emptied `projects`, locking the user
+ * out of their own instance.
+ *
+ * The rule enforced here: only a genuine PPM entrypoint may touch the real
+ * database. Anything else must either point `PPM_HOME` at a scratch directory --
+ * the isolation contract the test suite already uses -- or opt in loudly through
+ * `PPM_ALLOW_PROD_DB=1`.
+ */
+import { sep } from "node:path";
+
+/**
+ * Entry scripts cleared to open the real database, matched as path suffixes so
+ * they hold for a git checkout, a global npm install and a worktree alike.
+ */
+const ALLOWED_ENTRYPOINTS = [
+  "src/index.ts", // ppm CLI -- package.json "bin"
+  "src/server/index.ts", // HTTP server, and the __serve__ daemon child
+  "src/services/supervisor.ts", // __supervise__
+  "src/services/edge-forwarder.ts", // __edge__
+];
+
+/** Escape hatch for a deliberate one-off against production state. */
+export const PROD_DB_OVERRIDE_ENV = "PPM_ALLOW_PROD_DB";
+
+/**
+ * Everything the decision depends on, gathered in one place so the rule can be
+ * exercised without mutating process-wide state (tests that unset PPM_HOME leak
+ * the real ~/.ppm into whatever runs next).
+ */
+export interface ProdDbGuardContext {
+  ppmHome: string | undefined;
+  override: string | undefined;
+  execPath: string;
+  /** Raw process.argv[1], separators not yet normalised. */
+  entry: string;
+}
+
+/** Snapshot the live process into a guard context. */
+export function currentProdDbGuardContext(): ProdDbGuardContext {
+  return {
+    ppmHome: process.env.PPM_HOME,
+    override: process.env[PROD_DB_OVERRIDE_ENV],
+    execPath: process.execPath,
+    entry: process.argv[1] ?? "",
+  };
+}
+
+/** Entry path with separators normalised, so Windows paths match the suffixes. */
+function normaliseEntry(entry: string): string {
+  return entry.split(sep).join("/");
+}
+
+/**
+ * Whether the described process may open the real database.
+ *
+ * A set `PPM_HOME` already redirects the whole PPM directory elsewhere, so the
+ * caller has isolated itself and there is nothing left to protect.
+ */
+export function isAllowedProdDbEntrypoint(
+  ctx: ProdDbGuardContext = currentProdDbGuardContext(),
+): boolean {
+  if (ctx.ppmHome) return true;
+  if (ctx.override === "1") return true;
+  // A compiled binary carries its entry inside the executable, so argv[1] is not
+  // a source path there. Same signal autostart-generator uses.
+  if (!ctx.execPath.includes("bun")) return true;
+  const entry = normaliseEntry(ctx.entry);
+  // Anchored on a path boundary, so a stray ".../vendor-src/index.ts" cannot pose
+  // as the CLI just by ending in the same characters.
+  return ALLOWED_ENTRYPOINTS.some(
+    (suffix) => entry === suffix || entry.endsWith("/" + suffix),
+  );
+}
+
+/**
+ * Throw unless the current process is allowed to open `dbPath`.
+ * The message is written for whoever -- or whatever -- is driving the script.
+ */
+export function assertProdDbAccessAllowed(dbPath: string): void {
+  const ctx = currentProdDbGuardContext();
+  if (isAllowedProdDbEntrypoint(ctx)) return;
+  const entry = normaliseEntry(ctx.entry) || "<unknown entry>";
+  throw new Error(
+    [
+      `Refusing to open the real PPM database at ${dbPath} from "${entry}".`,
+      "Only the ppm CLI, server, supervisor and edge forwarder may touch production state.",
+      "Run this against a scratch database instead -- set PPM_HOME to a temp directory",
+      `(the same isolation the test suite uses) -- or set ${PROD_DB_OVERRIDE_ENV}=1 if you`,
+      "genuinely intend to write to ~/.ppm.",
+    ].join(" "),
+  );
+}

package/src/services/proxy-agent-anthropic-bridge.ts

@@ -10,7 +10,7 @@ import {
   startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
 } from "./proxy-agent-turn.ts";
 import {
-  buildPromptFromAnthropicMessages, messageResponse, anthropicError,
+  buildPromptFromAnthropicMessages, hasUnsupportedAnthropicBlocks, messageResponse, anthropicError,
   MessageStreamWriter, ANTHROPIC_SSE_HEADERS, type AnthropicMessagesBody,
 } from "./proxy-anthropic-format.ts";
 
@@ -29,7 +29,10 @@ async function runNonStreaming(providerId: string, body: AnthropicMessagesBody):
     for await (const ev of events) {
       if (ev.type === "text") text += ev.content;
       else if (ev.type === "error") throw new Error(ev.message);
-      else if (ev.type === "done") usage = usageOf(ev);
+      // `done` ends the turn, but a provider's event stream stays open for the
+      // session's next turn and never returns. Without this break the request
+      // hangs on a completed answer until the idle timeout fires.
+      else if (ev.type === "done") { usage = usageOf(ev); break; }
     }
     return messageResponse(text, body.model || providerId, usage);
   } finally {
@@ -53,7 +56,9 @@ async function runStreaming(providerId: string, body: AnthropicMessagesBody): Pr
         for await (const ev of events) {
           if (ev.type === "text") stream.text(ev.content);
           else if (ev.type === "error") throw new Error(ev.message);
-          else if (ev.type === "done") usage = usageOf(ev);
+          // See runNonStreaming: the stream outlives the turn, so `done` is the
+          // only signal that the answer is complete.
+          else if (ev.type === "done") { usage = usageOf(ev); break; }
         }
         stream.close(usage);
       } catch (e) {
@@ -83,6 +88,12 @@ export async function forwardAgentMessages(
   if (!resolveProvider(providerId)) {
     return anthropicError(404, `Unknown provider "${providerId}". Available: ${proxyableProviderIds().join(", ") || "none"}`);
   }
+  // Silently dropping an image would answer the prompt as if the picture had
+  // been seen — worse than refusing, because the caller cannot tell. Images in
+  // this dialect are not staged yet; the OpenAI endpoint is the one to use.
+  if (hasUnsupportedAnthropicBlocks(body)) {
+    return anthropicError(400, "This endpoint accepts text content blocks only; send images to /v1/chat/completions or /v1/images/edits");
+  }
   try {
     return body.stream
       ? await runStreaming(providerId, body)

package/src/services/proxy-agent-bridge.ts

@@ -11,18 +11,51 @@
  * before answering. Tool traffic has no place in the OpenAI wire format, so only
  * assistant text reaches the caller.
  */
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import {
   startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
 } from "./proxy-agent-turn.ts";
+import { decodeImagePayload } from "./proxy-image-bridge.ts";
 import {
-  buildPromptFromOpenAiMessages, completionResponse, openAiError,
+  buildPromptFromOpenAiMessages, hasUnsupportedBlocks, extractImagePayloads,
+  completionResponse, openAiError,
   ChunkWriter, SSE_HEADERS, type OpenAiChatBody,
 } from "./proxy-openai-format.ts";
 
+/**
+ * Inline images written to a scratch directory, since a provider may take an
+ * image only as a path. Returns the paths plus the cleanup that removes them.
+ */
+function stageImages(body: OpenAiChatBody): { paths: string[]; discard: () => void } {
+  const { dataUrls } = extractImagePayloads(body);
+  if (dataUrls.length === 0) return { paths: [], discard: () => {} };
+  const dir = mkdtempSync(join(tmpdir(), "ppm-chat-img-"));
+  const paths = dataUrls.map((url, i) => {
+    const { bytes, ext } = decodeImagePayload(url);
+    const path = join(dir, `image-${i}${ext}`);
+    writeFileSync(path, bytes);
+    return path;
+  });
+  return { paths, discard: () => { try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ } } };
+}
+
 /** Open the turn described by an OpenAI-format body. */
-function startTurn(providerId: string, body: OpenAiChatBody) {
+async function startTurn(providerId: string, body: OpenAiChatBody) {
   const { prompt, systemPrompt } = buildPromptFromOpenAiMessages(body);
-  return startAgentTurn(providerId, { prompt, systemPrompt, model: body.model });
+  const staged = stageImages(body);
+  try {
+    const run = await startAgentTurn(providerId, {
+      prompt, systemPrompt, model: body.model, imagePaths: staged.paths,
+    });
+    // The agent reads the files during the turn, so they outlive startTurn and
+    // are dropped alongside the session.
+    return { ...run, cleanup: async () => { await run.cleanup(); staged.discard(); } };
+  } catch (e) {
+    staged.discard();
+    throw e;
+  }
 }
 
 /** Non-streaming: drain the turn, return one `chat.completion`. */
@@ -34,7 +67,10 @@ async function runNonStreaming(providerId: string, body: OpenAiChatBody): Promis
     for await (const ev of events) {
       if (ev.type === "text") content += ev.content;
       else if (ev.type === "error") throw new Error(ev.message);
-      else if (ev.type === "done") usage = usageOf(ev);
+      // `done` ends the turn, but a provider's event stream stays open for the
+      // session's next turn and never returns. Without this break the request
+      // hangs on a completed answer until the idle timeout fires.
+      else if (ev.type === "done") { usage = usageOf(ev); break; }
     }
     return completionResponse(content, body.model || providerId, usage && {
       promptTokens: usage.inputTokens, completionTokens: usage.outputTokens,
@@ -59,6 +95,9 @@ async function runStreaming(providerId: string, body: OpenAiChatBody): Promise<R
         for await (const ev of events) {
           if (ev.type === "text") chunks.text(ev.content);
           else if (ev.type === "error") throw new Error(ev.message);
+          // See runNonStreaming: the stream outlives the turn, so `done` is the
+          // only signal that the answer is complete.
+          else if (ev.type === "done") break;
         }
         chunks.close();
       } catch (e) {
@@ -88,6 +127,14 @@ export async function forwardAgentChatCompletions(
   if (!resolveProvider(providerId)) {
     return openAiError(404, `Unknown provider "${providerId}". Available: ${proxyableProviderIds().join(", ") || "none"}`);
   }
+  // Silently dropping a block would answer the prompt as if it had been seen —
+  // worse than refusing, because the caller cannot tell.
+  if (hasUnsupportedBlocks(body)) {
+    return openAiError(400, "Only text and image_url content blocks are supported");
+  }
+  if (extractImagePayloads(body).remoteUrls > 0) {
+    return openAiError(400, "image_url must be a data: URL; remote URLs are not fetched");
+  }
   try {
     return body.stream
       ? await runStreaming(providerId, body)

package/src/services/proxy-agent-turn.ts

@@ -8,7 +8,9 @@
  * here once rather than twice.
  *
  * Sessions are ephemeral: one per request, deleted afterwards. An API call must
- * not leave a conversation behind in the sidebar.
+ * not leave a conversation behind in the sidebar, and an OpenAI or Anthropic
+ * client replays its whole conversation on every call, so a reused session would
+ * stack that history on itself.
  */
 import { mkdirSync } from "node:fs";
 import { resolve } from "node:path";
@@ -104,6 +106,12 @@ export interface TurnRequest {
   systemPrompt?: string;
   /** Model name passed straight to the provider. */
   model?: string;
+  /**
+   * Local files holding the request's images. Codex takes an image as a path
+   * and has no base64 form, so an inline attachment reaches the agent only
+   * after the caller has written it to disk.
+   */
+  imagePaths?: string[];
 }
 
 export interface TurnRun {
@@ -133,11 +141,14 @@ export async function startAgentTurn(providerId: string, req: TurnRequest): Prom
   const events = provider.sendMessage(session.id, message, {
     permissionMode: PROXY_PERMISSION_MODE,
     ...(req.model ? { model: req.model } : {}),
+    ...(req.imagePaths?.length ? { imagePaths: req.imagePaths } : {}),
   });
 
   return {
     events: withTimeout(events),
     cleanup: async () => {
+      // abortQuery is what kills the runtime; deleteSession alone may only drop
+      // the record, depending on the provider.
       try { provider.abortQuery?.(session.id, "proxy"); } catch { /* best effort */ }
       try { await provider.deleteSession(session.id); } catch { /* best effort */ }
     },

package/src/services/proxy-image-bridge.ts

@@ -0,0 +1,186 @@
+/**
+ * OpenAI Images API over a PPM provider's agent.
+ *
+ *   POST /proxy/<provider>/v1/images/generations   text → image
+ *   POST /proxy/<provider>/v1/images/edits         image → image
+ *
+ * Only codex is wired up, and that is the honest shape of it rather than a
+ * shortcut: codex owns a built-in image tool, while Claude cannot generate
+ * images at all. Other providers get a clear refusal instead of a hang.
+ *
+ * Getting the bytes back is the awkward part. The agent's sandbox stays
+ * read-only — a proxy reachable with an API key must not gain write access to
+ * the host — so it cannot drop the file somewhere of our choosing. It does
+ * write into codex's own `generated_images` directory even under that sandbox,
+ * so the bridge snapshots that directory around the turn and takes whatever is
+ * new. Widening the sandbox to control the path was tried and rejected: codex
+ * reports the workspace as read-only regardless, and the elevation would buy
+ * nothing.
+ */
+import { mkdtempSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, extname } from "node:path";
+import { resolveCodexAccountForSession } from "./codex-account.service.ts";
+import { startAgentTurn, resolveProvider } from "./proxy-agent-turn.ts";
+import { openAiError } from "./proxy-openai-format.ts";
+
+/** Providers whose agent can actually produce an image. */
+const IMAGE_CAPABLE = new Set(["codex"]);
+
+const IMAGE_EXTENSIONS = new Set([".png", ".jpg", ".jpeg", ".webp", ".gif"]);
+
+export interface ImageGenerationBody {
+  prompt?: string;
+  n?: number;
+  size?: string;
+  model?: string;
+}
+
+export interface ImageEditBody extends ImageGenerationBody {
+  /** Data URL or bare base64 of the image to edit. */
+  image?: string;
+}
+
+/** Decode a data URL (or bare base64) into bytes plus a file extension. */
+export function decodeImagePayload(payload: string): { bytes: Buffer; ext: string } {
+  const match = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(payload.trim());
+  const mime = match?.[1] ?? "image/png";
+  const data = match ? match[3]! : payload.trim();
+  const ext = mime === "image/jpeg" ? ".jpg" : mime === "image/webp" ? ".webp" : ".png";
+  return { bytes: Buffer.from(data, "base64"), ext };
+}
+
+/** Every image file under a directory tree, with its modified time. */
+function listImages(root: string): Map<string, number> {
+  const found = new Map<string, number>();
+  const walk = (dir: string) => {
+    let entries: string[];
+    try { entries = readdirSync(dir); } catch { return; }
+    for (const name of entries) {
+      const full = join(dir, name);
+      let stat;
+      try { stat = statSync(full); } catch { continue; }
+      if (stat.isDirectory()) walk(full);
+      else if (IMAGE_EXTENSIONS.has(extname(name).toLowerCase())) found.set(full, stat.mtimeMs);
+    }
+  };
+  walk(root);
+  return found;
+}
+
+/** Where the provider drops generated images. Codex writes under its CODEX_HOME. */
+async function imageOutputRoot(): Promise<string> {
+  const account = await resolveCodexAccountForSession();
+  const home = account?.home ?? join(process.env.USERPROFILE ?? process.env.HOME ?? ".", ".codex");
+  return join(home, "generated_images");
+}
+
+/** Run one turn and return the image files it produced, newest first. */
+async function runImageTurn(
+  providerId: string, prompt: string, model: string | undefined, imagePaths: string[],
+): Promise<string[]> {
+  const root = await imageOutputRoot();
+  mkdirSync(root, { recursive: true });
+  const before = listImages(root);
+
+  const { events, cleanup } = await startAgentTurn(providerId, { prompt, model, imagePaths });
+  let said = "";
+  try {
+    for await (const ev of events) {
+      if (ev.type === "text") said += ev.content;
+      else if (ev.type === "error") throw new Error(ev.message);
+      else if (ev.type === "done") break;
+    }
+  } finally {
+    await cleanup();
+  }
+
+  const produced = [...listImages(root)]
+    .filter(([path, mtime]) => !before.has(path) || before.get(path) !== mtime)
+    .sort((a, b) => b[1] - a[1])
+    .map(([path]) => path);
+
+  if (produced.length === 0) {
+    // The agent answers in prose when it declines, and that reason is far more
+    // useful to the caller than a bare "no image".
+    throw new Error(`The agent produced no image. It replied: ${said.trim().slice(0, 400) || "(nothing)"}`);
+  }
+  return produced;
+}
+
+/** OpenAI's images response. Always base64 — PPM has nowhere to host a URL. */
+function imagesResponse(paths: string[]): Response {
+  return new Response(JSON.stringify({
+    created: Math.floor(Date.now() / 1000),
+    data: paths.map((p) => ({ b64_json: readFileSync(p).toString("base64") })),
+  }), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" },
+  });
+}
+
+/** Shared guard: provider must exist and be able to make images. */
+function refuse(providerId: string): Response | null {
+  if (!resolveProvider(providerId)) return openAiError(404, `Unknown provider "${providerId}"`);
+  if (!IMAGE_CAPABLE.has(providerId)) {
+    return openAiError(400, `Provider "${providerId}" cannot generate images. Supported: ${[...IMAGE_CAPABLE].join(", ")}`);
+  }
+  return null;
+}
+
+/** Ask for exactly the files we intend to read back. */
+function generationPrompt(body: ImageGenerationBody): string {
+  const count = Math.min(Math.max(body.n ?? 1, 1), 4);
+  return [
+    `Generate ${count} image${count > 1 ? "s" : ""} using your built-in image generation tool.`,
+    body.size ? `Target size: ${body.size}.` : "",
+    `Subject: ${body.prompt}`,
+    "Do not write any files yourself and do not run shell commands. Reply with only the word DONE.",
+  ].filter(Boolean).join("\n");
+}
+
+/** POST /v1/images/generations */
+export async function forwardImageGeneration(providerId: string, body: ImageGenerationBody): Promise<Response> {
+  const blocked = refuse(providerId);
+  if (blocked) return blocked;
+  if (!body.prompt?.trim()) return openAiError(400, "prompt is required");
+
+  try {
+    const produced = await runImageTurn(providerId, generationPrompt(body), body.model, []);
+    return imagesResponse(produced.slice(0, Math.min(Math.max(body.n ?? 1, 1), 4)));
+  } catch (e) {
+    return openAiError(502, (e as Error).message);
+  }
+}
+
+/** POST /v1/images/edits */
+export async function forwardImageEdit(providerId: string, body: ImageEditBody): Promise<Response> {
+  const blocked = refuse(providerId);
+  if (blocked) return blocked;
+  if (!body.image) return openAiError(400, "image is required");
+  if (!body.prompt?.trim()) return openAiError(400, "prompt is required");
+
+  // The agent reads the source off disk, so the payload has to land somewhere
+  // first; the directory is this request's alone and goes away with it.
+  const dir = mkdtempSync(join(tmpdir(), "ppm-img-in-"));
+  try {
+    const { bytes, ext } = decodeImagePayload(body.image);
+    if (bytes.length === 0) return openAiError(400, "image is not valid base64");
+    const path = join(dir, `input${ext}`);
+    writeFileSync(path, bytes);
+
+    const prompt = [
+      "Edit the attached image using your built-in image generation tool.",
+      `Requested change: ${body.prompt}`,
+      "Preserve everything the request does not ask you to change.",
+      "Do not write any files yourself and do not run shell commands. Reply with only the word DONE.",
+    ].join("\n");
+
+    const produced = await runImageTurn(providerId, prompt, body.model, [path]);
+    return imagesResponse(produced.slice(0, Math.min(Math.max(body.n ?? 1, 1), 4)));
+  } catch (e) {
+    return openAiError(502, (e as Error).message);
+  } finally {
+    try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+}

package/src/services/proxy-openai-bridge.ts

@@ -7,6 +7,9 @@
  */
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import { accountSelector } from "./account-selector.service.ts";
+import {
+  buildPromptFromOpenAiMessages, openAiError, SSE_HEADERS,
+} from "./proxy-openai-format.ts";
 
 // ── Helpers ──────────────────────────────────────────────────────────
 
@@ -26,36 +29,6 @@ function buildSdkEnv(accessToken: string): Record<string, string | undefined> {
   };
 }
 
-/** Extract system prompt and build text prompt from OpenAI messages format */
-function buildPromptFromOpenAiMessages(body: any): { prompt: string; systemPrompt?: string } {
-  const messages: any[] = body.messages ?? [];
-  let systemPrompt: string | undefined;
-  const conversationParts: string[] = [];
-
-  for (const m of messages) {
-    const text = typeof m.content === "string"
-      ? m.content
-      : Array.isArray(m.content)
-        ? m.content.filter((b: any) => b.type === "text").map((b: any) => b.text).join("\n")
-        : String(m.content ?? "");
-
-    if (m.role === "system") {
-      systemPrompt = systemPrompt ? `${systemPrompt}\n${text}` : text;
-    } else {
-      const role = m.role === "assistant" ? "Assistant" : "Human";
-      conversationParts.push(`${role}: ${text}`);
-    }
-  }
-
-  return { prompt: conversationParts.join("\n\n"), systemPrompt };
-}
-
-function openAiError(status: number, message: string): Response {
-  return new Response(JSON.stringify({
-    error: { message, type: "server_error", code: String(status) },
-  }), { status, headers: { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" } });
-}
-
 // ── Public API ───────────────────────────────────────────────────────
 
 interface SdkAccount {
@@ -230,12 +203,5 @@ async function handleStreaming(
     },
   });
 
-  return new Response(readable, {
-    headers: {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      "Connection": "keep-alive",
-      "Access-Control-Allow-Origin": "*",
-    },
-  });
+  return new Response(readable, { headers: SSE_HEADERS });
 }

package/src/services/proxy-openai-format.ts

@@ -11,7 +11,11 @@
 /** One entry of the OpenAI `messages` array (content is string or block array). */
 export interface OpenAiMessage {
   role?: string;
-  content?: string | Array<{ type?: string; text?: string }> | null;
+  content?: string | Array<{
+    type?: string;
+    text?: string;
+    image_url?: { url?: string };
+  }> | null;
 }
 
 export interface OpenAiChatBody {
@@ -52,10 +56,32 @@ export function buildPromptFromOpenAiMessages(
   return { prompt: conversationParts.join("\n\n"), systemPrompt };
 }
 
-/** True when any message carries a content block this format cannot forward. */
+/**
+ * Inline image payloads, in request order.
+ *
+ * Only `data:` URLs are accepted. Fetching an arbitrary `http(s)` URL would let
+ * a caller aim the server at hosts it can reach and the caller cannot, so a
+ * remote URL is refused rather than followed.
+ */
+export function extractImagePayloads(body: OpenAiChatBody): { dataUrls: string[]; remoteUrls: number } {
+  const dataUrls: string[] = [];
+  let remoteUrls = 0;
+  for (const m of body.messages ?? []) {
+    if (!Array.isArray(m.content)) continue;
+    for (const block of m.content) {
+      if (block.type !== "image_url") continue;
+      const url = block.image_url?.url ?? "";
+      if (url.startsWith("data:")) dataUrls.push(url);
+      else remoteUrls++;
+    }
+  }
+  return { dataUrls, remoteUrls };
+}
+
+/** True when a message carries a block this format can neither send nor name. */
 export function hasUnsupportedBlocks(body: OpenAiChatBody): boolean {
   return (body.messages ?? []).some((m) =>
-    Array.isArray(m.content) && m.content.some((b) => b.type && b.type !== "text"),
+    Array.isArray(m.content) && m.content.some((b) => b.type && b.type !== "text" && b.type !== "image_url"),
   );
 }