@hienlh/ppm 0.19.4 → 0.19.6

package/src/server/routes/proxy.ts

@@ -1,15 +1,19 @@
 import { Hono } from "hono";
 import type { Context } from "hono";
 import { proxyService } from "../../services/proxy.service.ts";
+import { listProviderModels } from "../../services/proxy-agent-turn.ts";
+import { forwardImageGeneration, forwardImageEdit } from "../../services/proxy-image-bridge.ts";
 import { getProxyStats } from "../../services/db.service.ts";
 import { ok, err } from "../../types/api.ts";
 
 /**
- * Proxy routes — Anthropic-compatible API proxy.
- * External tools (opencode, cursor, etc.) send requests here
- * and PPM forwards them to Anthropic using account rotation.
+ * Proxy routes — PPM's accounts behind the Anthropic and OpenAI API formats.
+ *
+ * Mounted at /proxy, so /proxy/v1/messages maps to Anthropic's POST /v1/messages
+ * and external tools (opencode, cursor, etc.) reach Claude through account
+ * rotation exactly as before. A provider segment — /proxy/<provider>/v1/… —
+ * routes to that provider's agent instead, and adds the images endpoints.
  *
- * Mounted at /proxy — so /proxy/v1/messages maps to Anthropic's POST /v1/messages.
  * Uses its own auth (proxy auth key), NOT PPM's auth middleware.
  */
 export const proxyRoutes = new Hono();
@@ -105,6 +109,64 @@ proxyRoutes.post("/v1/messages/count_tokens", async (c) => {
   return proxyService.forward("/v1/messages/count_tokens", "POST", headers, body, getCallerMeta(c));
 });
 
+// ── Provider-scoped agent endpoints ──
+//
+// Both API dialects hang off the same `/proxy/<provider>` prefix, so a client
+// only swaps its base URL and keeps the vendor path its SDK already appends:
+//   ANTHROPIC_BASE_URL=<host>/proxy/codex     → POST /proxy/codex/v1/messages
+//   OPENAI_BASE_URL=<host>/proxy/codex/v1     → POST /proxy/codex/v1/chat/completions
+// Registered after the static routes above, which keep serving Claude unscoped.
+
+/** Shared gate: proxy must be on and the caller must present the proxy key. */
+function agentGate(c: Context, dialect: "anthropic" | "openai"): Response | null {
+  const authHeader = c.req.header("authorization") || c.req.header("x-api-key");
+  const fail = (status: 503 | 401, message: string) =>
+    dialect === "anthropic"
+      ? c.json({ type: "error", error: { type: status === 401 ? "authentication_error" : "api_error", message } }, status)
+      : c.json({ error: { message, type: status === 401 ? "authentication_error" : "server_error" } }, status);
+
+  if (!proxyService.isEnabled()) return fail(503, "Proxy is disabled");
+  if (!validateProxyAuth(authHeader)) return fail(401, "Invalid proxy auth key");
+  return null;
+}
+
+/** POST /proxy/:provider/v1/messages — provider's agent in Anthropic format. */
+proxyRoutes.post("/:provider/v1/messages", async (c) => {
+  const blocked = agentGate(c, "anthropic");
+  if (blocked) return blocked;
+  return proxyService.forwardAgentMessages(c.req.param("provider"), await c.req.text(), getCallerMeta(c));
+});
+
+/** POST /proxy/:provider/v1/chat/completions — provider's agent in OpenAI format. */
+proxyRoutes.post("/:provider/v1/chat/completions", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return proxyService.forwardAgentChat(c.req.param("provider"), await c.req.text(), getCallerMeta(c));
+});
+
+/** POST /proxy/:provider/v1/images/generations — text to image, OpenAI shape. */
+proxyRoutes.post("/:provider/v1/images/generations", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return forwardImageGeneration(c.req.param("provider"), await c.req.json().catch(() => ({})));
+});
+
+/** POST /proxy/:provider/v1/images/edits — image to image, OpenAI shape.
+ *  JSON only: the agent needs the source on disk, so a base64 payload is what
+ *  the bridge can actually act on. */
+proxyRoutes.post("/:provider/v1/images/edits", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return forwardImageEdit(c.req.param("provider"), await c.req.json().catch(() => ({})));
+});
+
+/** GET /proxy/:provider/v1/models — models that provider offers, OpenAI list shape. */
+proxyRoutes.get("/:provider/v1/models", async (c) => {
+  const blocked = agentGate(c, "openai");
+  if (blocked) return blocked;
+  return listProviderModels(c.req.param("provider"));
+});
+
 /** GET /proxy/stats — proxy request stats (behind proxy auth) */
 proxyRoutes.get("/stats", (c) => {
   const authHeader = c.req.header("authorization") || c.req.header("x-api-key");

package/src/services/codex-account.service.ts

@@ -167,8 +167,10 @@ export function peekCodexAccount(): CodexAccount | null {
 }
 
 /** Sticky account for a session → else strategy pick → else null (default ~/.codex). */
-export async function resolveCodexAccountForSession(sessionId: string): Promise<CodexAccount | null> {
-  const sticky = getSessionCodexAccount(sessionId);
+export async function resolveCodexAccountForSession(sessionId?: string): Promise<CodexAccount | null> {
+  // Session-less callers (the model list) have nothing sticky to honour and fall
+  // straight through to the configured strategy.
+  const sticky = sessionId ? getSessionCodexAccount(sessionId) : null;
   if (sticky) { const a = getCodexAccount(sticky); if (a) return a; }
   if (getCodexStrategy() === "lowest-usage" && listCodexAccounts().length > 1) {
     const usages = await getAllCodexUsages();

package/src/services/edge-forwarder.ts

@@ -1,191 +1,191 @@
-/**
- * Edge forwarder — owns the public port and pipes raw TCP to the server's
- * current loopback port.
- *
- * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
- *
- * On Windows a child spawned with fd stdio inherits every inheritable handle,
- * including a listening socket. When such a descendant is orphaned it keeps the
- * socket open, so the port stays in LISTEN under a dead PID and can never be
- * rebound — a "zombie port". The server hits this constantly because it spawns
- * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
- *
- * The edge exists precisely because it spawns nothing, so its socket cannot be
- * inherited and its port cannot zombie. cloudflared can therefore stay pinned
- * to it forever and the public URL stops rotating. Adding any child-process
- * call to this file reintroduces the exact bug the edge was built to remove.
- *
- * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
- * untouched, and forwarded requests keep the headers cloudflared set.
- */
-import net from "node:net";
-import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
-
-/** Delay between attempts while waiting for the server to come back. */
-const CONNECT_RETRY_MS = 250;
-/**
- * How long a client connection waits for a reachable server before giving up.
- * During an upgrade the server is briefly absent; refusing instantly would
- * surface as a broken page rather than a slow one.
- */
-const CONNECT_WINDOW_MS = 5000;
-
-const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
-
-/** Resolve once the socket is connected; reject on the first connect error. */
-function connectUpstream(port: number): Promise<net.Socket> {
-  return new Promise((resolvePromise, reject) => {
-    const upstream = net.connect({
-      port,
-      host: "127.0.0.1", // never taken from status.json — loopback only
-      allowHalfOpen: true,
-    });
-    const onError = (err: Error) => {
-      upstream.destroy();
-      reject(err);
-    };
-    upstream.once("error", onError);
-    upstream.once("connect", () => {
-      upstream.removeListener("error", onError);
-      resolvePromise(upstream);
-    });
-  });
-}
-
-/**
- * Largest amount of client data held while waiting for the server. Bounds the
- * memory a slow upload can pin during an upgrade window.
- */
-const MAX_PENDING_BYTES = 8 * 1024 * 1024;
-
-/**
- * Pipe one client connection to the server.
- *
- * Resolving the upstream is async, so the first bytes usually arrive before
- * there is anywhere to send them. They must be captured by a `data` listener
- * attached synchronously on this very tick and replayed once the upstream
- * exists.
- *
- * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
- * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
- * bring them back. A socket with no `data` listener drops them outright too.
- * Both variants silently swallowed the first request in testing.
- */
-async function handleConnection(
-  client: net.Socket,
-  connectWindowMs: number,
-): Promise<void> {
-  const pending: Buffer[] = [];
-  let pendingBytes = 0;
-  let clientEnded = false;
-  const onEarlyData = (chunk: Buffer) => {
-    pendingBytes += chunk.length;
-    if (pendingBytes > MAX_PENDING_BYTES) {
-      client.destroy();
-      return;
-    }
-    pending.push(chunk);
-  };
-  client.on("data", onEarlyData);
-  client.once("end", () => { clientEnded = true; });
-
-  let upstream: net.Socket | null = null;
-  let clientGone = false;
-
-  // A socket error with no listener is an unhandled 'error' event, which would
-  // take the whole edge process — and the public port — down with it.
-  const teardown = () => {
-    upstream?.destroy();
-    client.destroy();
-  };
-  client.on("error", teardown);
-  client.once("close", () => { clientGone = true; });
-
-  const deadline = Date.now() + connectWindowMs;
-  while (!clientGone && Date.now() < deadline) {
-    const port = resolveTargetPort();
-    if (port !== null) {
-      try {
-        upstream = await connectUpstream(port);
-        break;
-      } catch {
-        // Server not up yet (or moved mid-restart) — re-resolve and retry.
-        _resetTargetCache();
-      }
-    }
-    await sleep(CONNECT_RETRY_MS);
-  }
-
-  if (clientGone) return;
-  if (!upstream) {
-    client.destroy();
-    return;
-  }
-
-  upstream.on("error", teardown);
-
-  // Replay what arrived during the connect, then hand both directions to the
-  // stream machinery. Removing the listener and piping happen in the same tick,
-  // so no chunk can slip through the gap.
-  client.off("data", onEarlyData);
-  for (const chunk of pending) upstream.write(chunk);
-  pending.length = 0;
-
-  client.pipe(upstream);
-  upstream.pipe(client);
-
-  // The client may have half-closed while we were still connecting.
-  if (clientEnded) upstream.end();
-}
-
-export interface EdgeForwarderOptions {
-  publicPort: number;
-  host?: string;
-  /** How long a client waits for a reachable server. Defaults to 5s. */
-  connectWindowMs?: number;
-}
-
-/**
- * Bind the public port and start forwarding. Resolves once listening so the
- * caller can fail fast when the port is unavailable.
- */
-export function startEdgeForwarder(
-  opts: EdgeForwarderOptions,
-): Promise<net.Server> {
-  const host = opts.host ?? "0.0.0.0";
-  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
-  return new Promise((resolvePromise, reject) => {
-    // allowHalfOpen keeps the other direction alive when one side sends FIN —
-    // long-lived chat WS and SSE streams depend on it.
-    const server = net.createServer({ allowHalfOpen: true }, (client) => {
-      void handleConnection(client, connectWindowMs);
-    });
-    server.once("error", reject);
-    server.listen(opts.publicPort, host, () => {
-      server.removeListener("error", reject);
-      resolvePromise(server);
-    });
-  });
-}
-
-// ─── Process entry ─────────────────────────────────────────────────────
-// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
-// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
-if (process.argv.includes("__edge__")) {
-  const idx = process.argv.indexOf("__edge__");
-  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
-  const host = process.argv[idx + 2] ?? "0.0.0.0";
-
-  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
-    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
-    process.exit(2);
-  }
-
-  try {
-    await startEdgeForwarder({ publicPort, host });
-    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
-  } catch (err) {
-    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
-    process.exit(1);
-  }
-}
+/**
+ * Edge forwarder — owns the public port and pipes raw TCP to the server's
+ * current loopback port.
+ *
+ * ─── CRITICAL INVARIANT: THIS PROCESS MUST NEVER SPAWN A CHILD ───
+ *
+ * On Windows a child spawned with fd stdio inherits every inheritable handle,
+ * including a listening socket. When such a descendant is orphaned it keeps the
+ * socket open, so the port stays in LISTEN under a dead PID and can never be
+ * rebound — a "zombie port". The server hits this constantly because it spawns
+ * chat/tool/MCP subprocesses; those inherit its listener and wedge its port.
+ *
+ * The edge exists precisely because it spawns nothing, so its socket cannot be
+ * inherited and its port cannot zombie. cloudflared can therefore stay pinned
+ * to it forever and the public URL stops rotating. Adding any child-process
+ * call to this file reintroduces the exact bug the edge was built to remove.
+ *
+ * Raw TCP, never HTTP: WebSocket upgrades and SSE streams pass through
+ * untouched, and forwarded requests keep the headers cloudflared set.
+ */
+import net from "node:net";
+import { resolveTargetPort, _resetTargetCache } from "./edge-target-resolver.ts";
+
+/** Delay between attempts while waiting for the server to come back. */
+const CONNECT_RETRY_MS = 250;
+/**
+ * How long a client connection waits for a reachable server before giving up.
+ * During an upgrade the server is briefly absent; refusing instantly would
+ * surface as a broken page rather than a slow one.
+ */
+const CONNECT_WINDOW_MS = 5000;
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+/** Resolve once the socket is connected; reject on the first connect error. */
+function connectUpstream(port: number): Promise<net.Socket> {
+  return new Promise((resolvePromise, reject) => {
+    const upstream = net.connect({
+      port,
+      host: "127.0.0.1", // never taken from status.json — loopback only
+      allowHalfOpen: true,
+    });
+    const onError = (err: Error) => {
+      upstream.destroy();
+      reject(err);
+    };
+    upstream.once("error", onError);
+    upstream.once("connect", () => {
+      upstream.removeListener("error", onError);
+      resolvePromise(upstream);
+    });
+  });
+}
+
+/**
+ * Largest amount of client data held while waiting for the server. Bounds the
+ * memory a slow upload can pin during an upgrade window.
+ */
+const MAX_PENDING_BYTES = 8 * 1024 * 1024;
+
+/**
+ * Pipe one client connection to the server.
+ *
+ * Resolving the upstream is async, so the first bytes usually arrive before
+ * there is anywhere to send them. They must be captured by a `data` listener
+ * attached synchronously on this very tick and replayed once the upstream
+ * exists.
+ *
+ * `socket.pause()` is NOT a substitute — verified against Bun 1.3.13: bytes
+ * that arrive while paused are lost, and a later `pipe()`/`resume()` does not
+ * bring them back. A socket with no `data` listener drops them outright too.
+ * Both variants silently swallowed the first request in testing.
+ */
+async function handleConnection(
+  client: net.Socket,
+  connectWindowMs: number,
+): Promise<void> {
+  const pending: Buffer[] = [];
+  let pendingBytes = 0;
+  let clientEnded = false;
+  const onEarlyData = (chunk: Buffer) => {
+    pendingBytes += chunk.length;
+    if (pendingBytes > MAX_PENDING_BYTES) {
+      client.destroy();
+      return;
+    }
+    pending.push(chunk);
+  };
+  client.on("data", onEarlyData);
+  client.once("end", () => { clientEnded = true; });
+
+  let upstream: net.Socket | null = null;
+  let clientGone = false;
+
+  // A socket error with no listener is an unhandled 'error' event, which would
+  // take the whole edge process — and the public port — down with it.
+  const teardown = () => {
+    upstream?.destroy();
+    client.destroy();
+  };
+  client.on("error", teardown);
+  client.once("close", () => { clientGone = true; });
+
+  const deadline = Date.now() + connectWindowMs;
+  while (!clientGone && Date.now() < deadline) {
+    const port = resolveTargetPort();
+    if (port !== null) {
+      try {
+        upstream = await connectUpstream(port);
+        break;
+      } catch {
+        // Server not up yet (or moved mid-restart) — re-resolve and retry.
+        _resetTargetCache();
+      }
+    }
+    await sleep(CONNECT_RETRY_MS);
+  }
+
+  if (clientGone) return;
+  if (!upstream) {
+    client.destroy();
+    return;
+  }
+
+  upstream.on("error", teardown);
+
+  // Replay what arrived during the connect, then hand both directions to the
+  // stream machinery. Removing the listener and piping happen in the same tick,
+  // so no chunk can slip through the gap.
+  client.off("data", onEarlyData);
+  for (const chunk of pending) upstream.write(chunk);
+  pending.length = 0;
+
+  client.pipe(upstream);
+  upstream.pipe(client);
+
+  // The client may have half-closed while we were still connecting.
+  if (clientEnded) upstream.end();
+}
+
+export interface EdgeForwarderOptions {
+  publicPort: number;
+  host?: string;
+  /** How long a client waits for a reachable server. Defaults to 5s. */
+  connectWindowMs?: number;
+}
+
+/**
+ * Bind the public port and start forwarding. Resolves once listening so the
+ * caller can fail fast when the port is unavailable.
+ */
+export function startEdgeForwarder(
+  opts: EdgeForwarderOptions,
+): Promise<net.Server> {
+  const host = opts.host ?? "0.0.0.0";
+  const connectWindowMs = opts.connectWindowMs ?? CONNECT_WINDOW_MS;
+  return new Promise((resolvePromise, reject) => {
+    // allowHalfOpen keeps the other direction alive when one side sends FIN —
+    // long-lived chat WS and SSE streams depend on it.
+    const server = net.createServer({ allowHalfOpen: true }, (client) => {
+      void handleConnection(client, connectWindowMs);
+    });
+    server.once("error", reject);
+    server.listen(opts.publicPort, host, () => {
+      server.removeListener("error", reject);
+      resolvePromise(server);
+    });
+  });
+}
+
+// ─── Process entry ─────────────────────────────────────────────────────
+// Mirrors the `__serve__` guard in src/server/index.ts: the supervisor
+// re-invokes the binary as `<bin> __edge__ <publicPort> <host>`.
+if (process.argv.includes("__edge__")) {
+  const idx = process.argv.indexOf("__edge__");
+  const publicPort = parseInt(process.argv[idx + 1] ?? "", 10);
+  const host = process.argv[idx + 2] ?? "0.0.0.0";
+
+  if (!Number.isInteger(publicPort) || publicPort <= 0 || publicPort > 65535) {
+    process.stderr.write(`[edge] Invalid public port: ${process.argv[idx + 1]}\n`);
+    process.exit(2);
+  }
+
+  try {
+    await startEdgeForwarder({ publicPort, host });
+    process.stderr.write(`[edge] Listening on ${host}:${publicPort}\n`);
+  } catch (err) {
+    process.stderr.write(`[edge] Failed to bind ${host}:${publicPort}: ${err}\n`);
+    process.exit(1);
+  }
+}

package/src/services/proxy-agent-anthropic-bridge.ts

@@ -10,7 +10,7 @@ import {
   startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
 } from "./proxy-agent-turn.ts";
 import {
-  buildPromptFromAnthropicMessages, messageResponse, anthropicError,
+  buildPromptFromAnthropicMessages, hasUnsupportedAnthropicBlocks, messageResponse, anthropicError,
   MessageStreamWriter, ANTHROPIC_SSE_HEADERS, type AnthropicMessagesBody,
 } from "./proxy-anthropic-format.ts";
 
@@ -29,7 +29,10 @@ async function runNonStreaming(providerId: string, body: AnthropicMessagesBody):
     for await (const ev of events) {
       if (ev.type === "text") text += ev.content;
       else if (ev.type === "error") throw new Error(ev.message);
-      else if (ev.type === "done") usage = usageOf(ev);
+      // `done` ends the turn, but a provider's event stream stays open for the
+      // session's next turn and never returns. Without this break the request
+      // hangs on a completed answer until the idle timeout fires.
+      else if (ev.type === "done") { usage = usageOf(ev); break; }
     }
     return messageResponse(text, body.model || providerId, usage);
   } finally {
@@ -53,7 +56,9 @@ async function runStreaming(providerId: string, body: AnthropicMessagesBody): Pr
         for await (const ev of events) {
           if (ev.type === "text") stream.text(ev.content);
           else if (ev.type === "error") throw new Error(ev.message);
-          else if (ev.type === "done") usage = usageOf(ev);
+          // See runNonStreaming: the stream outlives the turn, so `done` is the
+          // only signal that the answer is complete.
+          else if (ev.type === "done") { usage = usageOf(ev); break; }
         }
         stream.close(usage);
       } catch (e) {
@@ -83,6 +88,12 @@ export async function forwardAgentMessages(
   if (!resolveProvider(providerId)) {
     return anthropicError(404, `Unknown provider "${providerId}". Available: ${proxyableProviderIds().join(", ") || "none"}`);
   }
+  // Silently dropping an image would answer the prompt as if the picture had
+  // been seen — worse than refusing, because the caller cannot tell. Images in
+  // this dialect are not staged yet; the OpenAI endpoint is the one to use.
+  if (hasUnsupportedAnthropicBlocks(body)) {
+    return anthropicError(400, "This endpoint accepts text content blocks only; send images to /v1/chat/completions or /v1/images/edits");
+  }
   try {
     return body.stream
       ? await runStreaming(providerId, body)

package/src/services/proxy-agent-bridge.ts

@@ -11,18 +11,51 @@
  * before answering. Tool traffic has no place in the OpenAI wire format, so only
  * assistant text reaches the caller.
  */
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import {
   startAgentTurn, usageOf, resolveProvider, proxyableProviderIds,
 } from "./proxy-agent-turn.ts";
+import { decodeImagePayload } from "./proxy-image-bridge.ts";
 import {
-  buildPromptFromOpenAiMessages, completionResponse, openAiError,
+  buildPromptFromOpenAiMessages, hasUnsupportedBlocks, extractImagePayloads,
+  completionResponse, openAiError,
   ChunkWriter, SSE_HEADERS, type OpenAiChatBody,
 } from "./proxy-openai-format.ts";
 
+/**
+ * Inline images written to a scratch directory, since a provider may take an
+ * image only as a path. Returns the paths plus the cleanup that removes them.
+ */
+function stageImages(body: OpenAiChatBody): { paths: string[]; discard: () => void } {
+  const { dataUrls } = extractImagePayloads(body);
+  if (dataUrls.length === 0) return { paths: [], discard: () => {} };
+  const dir = mkdtempSync(join(tmpdir(), "ppm-chat-img-"));
+  const paths = dataUrls.map((url, i) => {
+    const { bytes, ext } = decodeImagePayload(url);
+    const path = join(dir, `image-${i}${ext}`);
+    writeFileSync(path, bytes);
+    return path;
+  });
+  return { paths, discard: () => { try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ } } };
+}
+
 /** Open the turn described by an OpenAI-format body. */
-function startTurn(providerId: string, body: OpenAiChatBody) {
+async function startTurn(providerId: string, body: OpenAiChatBody) {
   const { prompt, systemPrompt } = buildPromptFromOpenAiMessages(body);
-  return startAgentTurn(providerId, { prompt, systemPrompt, model: body.model });
+  const staged = stageImages(body);
+  try {
+    const run = await startAgentTurn(providerId, {
+      prompt, systemPrompt, model: body.model, imagePaths: staged.paths,
+    });
+    // The agent reads the files during the turn, so they outlive startTurn and
+    // are dropped alongside the session.
+    return { ...run, cleanup: async () => { await run.cleanup(); staged.discard(); } };
+  } catch (e) {
+    staged.discard();
+    throw e;
+  }
 }
 
 /** Non-streaming: drain the turn, return one `chat.completion`. */
@@ -34,7 +67,10 @@ async function runNonStreaming(providerId: string, body: OpenAiChatBody): Promis
     for await (const ev of events) {
       if (ev.type === "text") content += ev.content;
       else if (ev.type === "error") throw new Error(ev.message);
-      else if (ev.type === "done") usage = usageOf(ev);
+      // `done` ends the turn, but a provider's event stream stays open for the
+      // session's next turn and never returns. Without this break the request
+      // hangs on a completed answer until the idle timeout fires.
+      else if (ev.type === "done") { usage = usageOf(ev); break; }
     }
     return completionResponse(content, body.model || providerId, usage && {
       promptTokens: usage.inputTokens, completionTokens: usage.outputTokens,
@@ -59,6 +95,9 @@ async function runStreaming(providerId: string, body: OpenAiChatBody): Promise<R
         for await (const ev of events) {
           if (ev.type === "text") chunks.text(ev.content);
           else if (ev.type === "error") throw new Error(ev.message);
+          // See runNonStreaming: the stream outlives the turn, so `done` is the
+          // only signal that the answer is complete.
+          else if (ev.type === "done") break;
         }
         chunks.close();
       } catch (e) {
@@ -88,6 +127,14 @@ export async function forwardAgentChatCompletions(
   if (!resolveProvider(providerId)) {
     return openAiError(404, `Unknown provider "${providerId}". Available: ${proxyableProviderIds().join(", ") || "none"}`);
   }
+  // Silently dropping a block would answer the prompt as if it had been seen —
+  // worse than refusing, because the caller cannot tell.
+  if (hasUnsupportedBlocks(body)) {
+    return openAiError(400, "Only text and image_url content blocks are supported");
+  }
+  if (extractImagePayloads(body).remoteUrls > 0) {
+    return openAiError(400, "image_url must be a data: URL; remote URLs are not fetched");
+  }
   try {
     return body.stream
       ? await runStreaming(providerId, body)

package/src/services/proxy-agent-turn.ts

@@ -8,7 +8,9 @@
  * here once rather than twice.
  *
  * Sessions are ephemeral: one per request, deleted afterwards. An API call must
- * not leave a conversation behind in the sidebar.
+ * not leave a conversation behind in the sidebar, and an OpenAI or Anthropic
+ * client replays its whole conversation on every call, so a reused session would
+ * stack that history on itself.
  */
 import { mkdirSync } from "node:fs";
 import { resolve } from "node:path";
@@ -104,6 +106,12 @@ export interface TurnRequest {
   systemPrompt?: string;
   /** Model name passed straight to the provider. */
   model?: string;
+  /**
+   * Local files holding the request's images. Codex takes an image as a path
+   * and has no base64 form, so an inline attachment reaches the agent only
+   * after the caller has written it to disk.
+   */
+  imagePaths?: string[];
 }
 
 export interface TurnRun {
@@ -133,11 +141,14 @@ export async function startAgentTurn(providerId: string, req: TurnRequest): Prom
   const events = provider.sendMessage(session.id, message, {
     permissionMode: PROXY_PERMISSION_MODE,
     ...(req.model ? { model: req.model } : {}),
+    ...(req.imagePaths?.length ? { imagePaths: req.imagePaths } : {}),
   });
 
   return {
     events: withTimeout(events),
     cleanup: async () => {
+      // abortQuery is what kills the runtime; deleteSession alone may only drop
+      // the record, depending on the provider.
       try { provider.abortQuery?.(session.id, "proxy"); } catch { /* best effort */ }
       try { await provider.deleteSession(session.id); } catch { /* best effort */ }
     },