@mindexec/cli 0.2.465 → 0.2.467

package/codex-runtime.js

@@ -34,14 +34,47 @@ const API_SANDBOX_BY_SDK_VALUE = Object.freeze({
 });
 
 const DEFAULT_TIMEOUT_MS = 8 * 60 * 1000;
+const CODEX_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 const MAX_LOG_CHARS = 4000;
 const MAX_EVENT_LOG = 120;
+const MAX_IMAGE_REFERENCE_COUNT = 8;
+const MAX_IMAGE_REFERENCE_BYTES = 40 * 1024 * 1024;
+const MAX_GENERATED_IMAGE_BYTES = 50 * 1024 * 1024;
 const TEMP_DIR = '.ai/codex';
-const CODEX_SOURCE_HOME = path.join(os.homedir(), '.codex');
 const CODEX_RUNTIME_HOME_ENV = 'MINDEXEC_CODEX_HOME';
-const DEFAULT_CODEX_RUNTIME_HOME = path.join(os.homedir(), '.mindexec', 'codex-runtime');
 const CODEX_RUNTIME_CONFIG_MARKER = '# Generated by MindExec LocalBridge for isolated AI node runs.';
-const CODEX_RUNTIME_AUTH_FILES = ['auth.json'];
+const CODEX_TARGET_BY_PLATFORM = Object.freeze({
+    'win32:x64': {
+        packageName: '@openai/codex-win32-x64',
+        targetTriple: 'x86_64-pc-windows-msvc',
+        binaryName: 'codex.exe'
+    },
+    'win32:arm64': {
+        packageName: '@openai/codex-win32-arm64',
+        targetTriple: 'aarch64-pc-windows-msvc',
+        binaryName: 'codex.exe'
+    },
+    'darwin:x64': {
+        packageName: '@openai/codex-darwin-x64',
+        targetTriple: 'x86_64-apple-darwin',
+        binaryName: 'codex'
+    },
+    'darwin:arm64': {
+        packageName: '@openai/codex-darwin-arm64',
+        targetTriple: 'aarch64-apple-darwin',
+        binaryName: 'codex'
+    },
+    'linux:x64': {
+        packageName: '@openai/codex-linux-x64',
+        targetTriple: 'x86_64-unknown-linux-musl',
+        binaryName: 'codex'
+    },
+    'linux:arm64': {
+        packageName: '@openai/codex-linux-arm64',
+        targetTriple: 'aarch64-unknown-linux-musl',
+        binaryName: 'codex'
+    }
+});
 
 let cachedSdkModule = null;
 let cachedSdkLoadError = null;
@@ -94,35 +127,35 @@ function normalizeProviderKind(value) {
     return '';
 }
 
-function resolveCodexRuntimeHome() {
+function resolveUserCodexHome() {
+    const configured = String(process.env.CODEX_HOME || '').trim();
+    return path.resolve(configured || path.join(os.homedir(), '.codex'));
+}
+
+export function resolveCodexRuntimeHome() {
     const configured = String(process.env[CODEX_RUNTIME_HOME_ENV] || '').trim();
-    return path.resolve(configured || DEFAULT_CODEX_RUNTIME_HOME);
+    return path.resolve(configured || resolveUserCodexHome());
 }
 
-async function copyCodexRuntimeFileIfPresent(fileName, runtimeHome) {
-    const source = path.join(CODEX_SOURCE_HOME, fileName);
-    const target = path.join(runtimeHome, fileName);
-    try {
-        const sourceStat = await fs.stat(source);
-        if (!sourceStat.isFile()) {
-            return false;
-        }
+function usesExplicitIsolatedCodexHome() {
+    return String(process.env[CODEX_RUNTIME_HOME_ENV] || '').trim().length > 0;
+}
 
-        await fs.copyFile(source, target);
-        return true;
-    } catch {
-        return false;
-    }
+function buildCodexSdkConfigOverrides(additional = {}) {
+    return {
+        mcp_servers: {},
+        ...additional
+    };
 }
 
-async function ensureCodexRuntimeHome() {
+export async function ensureCodexRuntimeHome() {
     const runtimeHome = resolveCodexRuntimeHome();
     await fs.mkdir(runtimeHome, { recursive: true });
     await fs.mkdir(path.join(runtimeHome, 'sessions'), { recursive: true });
     await fs.mkdir(path.join(runtimeHome, 'generated_images'), { recursive: true });
 
-    for (const fileName of CODEX_RUNTIME_AUTH_FILES) {
-        await copyCodexRuntimeFileIfPresent(fileName, runtimeHome);
+    if (!usesExplicitIsolatedCodexHome()) {
+        return runtimeHome;
     }
 
     const configPath = path.join(runtimeHome, 'config.toml');
@@ -145,7 +178,7 @@ async function ensureCodexRuntimeHome() {
     return runtimeHome;
 }
 
-function buildCodexChildEnv() {
+export function buildCodexChildEnv() {
     const env = {};
     for (const [key, value] of Object.entries(process.env)) {
         if (value !== undefined) {
@@ -154,10 +187,87 @@ function buildCodexChildEnv() {
     }
 
     env.CODEX_HOME = resolveCodexRuntimeHome();
-    env.MINDEXEC_CODEX_ISOLATED_HOME = '1';
+    if (usesExplicitIsolatedCodexHome()) {
+        env.MINDEXEC_CODEX_ISOLATED_HOME = '1';
+    } else {
+        delete env.MINDEXEC_CODEX_ISOLATED_HOME;
+    }
     return env;
 }
 
+function resolveBundledCodexExecutable(packageRoot) {
+    const target = CODEX_TARGET_BY_PLATFORM[`${process.platform}:${process.arch}`];
+    if (!target) {
+        throw new Error(`Unsupported Codex login platform: ${process.platform} (${process.arch}).`);
+    }
+
+    return path.join(
+        packageRoot,
+        'node_modules',
+        ...target.packageName.split('/'),
+        'vendor',
+        target.targetTriple,
+        'bin',
+        target.binaryName);
+}
+
+function runBundledCodexCommand(packageRoot, args, timeoutMs = CODEX_LOGIN_TIMEOUT_MS) {
+    return new Promise((resolve) => {
+        let executablePath;
+        try {
+            executablePath = resolveBundledCodexExecutable(packageRoot);
+        } catch (err) {
+            resolve({ success: false, exitCode: -1, stdout: '', stderr: '', error: err?.message || String(err) });
+            return;
+        }
+
+        const child = spawn(executablePath, args, {
+            env: buildCodexChildEnv(),
+            windowsHide: true,
+            stdio: ['ignore', 'pipe', 'pipe']
+        });
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        let timeout = null;
+
+        const finish = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            if (timeout) {
+                clearTimeout(timeout);
+            }
+            resolve({
+                success: result.exitCode === 0,
+                exitCode: result.exitCode,
+                stdout: truncateLog(stdout),
+                stderr: truncateLog(stderr),
+                error: result.error || ''
+            });
+        };
+
+        child.stdout?.on('data', chunk => {
+            stdout = truncateLog(`${stdout}${chunk}`, MAX_LOG_CHARS);
+        });
+        child.stderr?.on('data', chunk => {
+            stderr = truncateLog(`${stderr}${chunk}`, MAX_LOG_CHARS);
+        });
+        child.once('error', err => finish({ exitCode: -1, error: err?.message || String(err) }));
+        child.once('exit', code => finish({ exitCode: Number.isFinite(Number(code)) ? Number(code) : -1 }));
+
+        timeout = setTimeout(() => {
+            try {
+                child.kill();
+            } catch {
+                // Ignore a process that already exited while the timeout fired.
+            }
+            finish({ exitCode: -1, error: 'Codex browser login timed out.' });
+        }, timeoutMs);
+    });
+}
+
 function normalizeReasoningEffort(value) {
     const normalized = String(value || '').trim().toLowerCase();
     return ['minimal', 'low', 'medium', 'high', 'xhigh'].includes(normalized)
@@ -489,8 +599,8 @@ function serializeThreadOptionsForStatus(options) {
     };
 }
 
-async function checkSdkAvailability(packageRoot) {
-    const sdk = await loadCodexSdk();
+async function checkSdkAvailability(packageRoot, sdkLoader = loadCodexSdk) {
+    const sdk = await sdkLoader();
     return {
         kind: PROVIDER_KIND.typeScriptSdk,
         available: Boolean(sdk?.Codex),
@@ -541,19 +651,291 @@ function extractPrompt(body) {
     return prompt;
 }
 
+function looksLikeCodexAuthenticationError(value) {
+    const text = String(value || '').toLowerCase();
+    return text.includes('invalid_refresh_token')
+        || text.includes('invalid refresh token')
+        || text.includes('login required')
+        || text.includes('not logged in')
+        || text.includes('please log out and sign in again')
+        || text.includes('could not parse your authentication token')
+        || text.includes('authrequired')
+        || text.includes('401 unauthorized');
+}
+
+function normalizeImageMimeType(value, fallback = 'image/png') {
+    const normalized = String(value || '').trim().toLowerCase();
+    return /^image\/[a-z0-9.+-]+$/.test(normalized) ? normalized : fallback;
+}
+
+function inferImageMimeType(buffer, fallback = 'image/png') {
+    if (!Buffer.isBuffer(buffer) || buffer.length < 4) {
+        return fallback;
+    }
+
+    if (buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47) {
+        return 'image/png';
+    }
+    if (buffer[0] === 0xff && buffer[1] === 0xd8) {
+        return 'image/jpeg';
+    }
+    if (buffer.slice(0, 3).toString('ascii') === 'GIF') {
+        return 'image/gif';
+    }
+    if (buffer.length >= 12
+        && buffer.slice(0, 4).toString('ascii') === 'RIFF'
+        && buffer.slice(8, 12).toString('ascii') === 'WEBP') {
+        return 'image/webp';
+    }
+
+    return fallback;
+}
+
+function normalizeGeneratedImageBase64(value, hintedMimeType = '') {
+    const text = String(value || '').trim();
+    if (!text) {
+        return null;
+    }
+
+    const dataUrlMatch = text.match(/^data:(image\/[a-z0-9.+-]+);base64,([a-z0-9+/=\r\n]+)$/i);
+    const base64 = (dataUrlMatch ? dataUrlMatch[2] : text).replace(/\s+/g, '');
+    if (base64.length < 32 || !/^[a-z0-9+/]+={0,2}$/i.test(base64)) {
+        return null;
+    }
+
+    try {
+        const bytes = Buffer.from(base64, 'base64');
+        if (!bytes.length || bytes.length > MAX_GENERATED_IMAGE_BYTES) {
+            return null;
+        }
+        const mimeType = inferImageMimeType(
+            bytes,
+            normalizeImageMimeType(dataUrlMatch?.[1] || hintedMimeType));
+        return { imageBase64: bytes.toString('base64'), mimeType };
+    } catch {
+        return null;
+    }
+}
+
+function extractGeneratedImageFromEvent(value, depth = 0, hintedMimeType = '') {
+    if (value == null || depth > 10) {
+        return null;
+    }
+
+    if (typeof value === 'string') {
+        return value.startsWith('data:image/')
+            ? normalizeGeneratedImageBase64(value, hintedMimeType)
+            : null;
+    }
+
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            const found = extractGeneratedImageFromEvent(entry, depth + 1, hintedMimeType);
+            if (found) {
+                return found;
+            }
+        }
+        return null;
+    }
+
+    if (typeof value !== 'object') {
+        return null;
+    }
+
+    const localMimeType = normalizeImageMimeType(
+        value.mime_type || value.mimeType || value.content_type || value.contentType,
+        hintedMimeType || 'image/png');
+    for (const key of ['b64_json', 'image_base64', 'imageBase64', 'base64']) {
+        if (typeof value[key] === 'string') {
+            const found = normalizeGeneratedImageBase64(value[key], localMimeType);
+            if (found) {
+                return found;
+            }
+        }
+    }
+
+    for (const key of ['result', 'output', 'image', 'images', 'data', 'payload', 'item']) {
+        if (value[key] != null) {
+            const found = extractGeneratedImageFromEvent(value[key], depth + 1, localMimeType);
+            if (found) {
+                return found;
+            }
+        }
+    }
+
+    return null;
+}
+
+function imageExtensionForReference(reference) {
+    const fileNameExtension = path.extname(String(reference?.fileName || '')).toLowerCase();
+    if (['.png', '.jpg', '.jpeg', '.webp', '.gif'].includes(fileNameExtension)) {
+        return fileNameExtension === '.jpeg' ? '.jpg' : fileNameExtension;
+    }
+
+    const mimeType = normalizeImageMimeType(reference?.mimeType);
+    if (mimeType === 'image/jpeg') return '.jpg';
+    if (mimeType === 'image/webp') return '.webp';
+    if (mimeType === 'image/gif') return '.gif';
+    return '.png';
+}
+
+async function writeSdkImageReferences(runtimeHome, references) {
+    const normalized = Array.isArray(references)
+        ? references.slice(0, MAX_IMAGE_REFERENCE_COUNT)
+        : [];
+    if (!normalized.length) {
+        return { directory: '', paths: [] };
+    }
+
+    const root = path.join(runtimeHome, 'image-inputs');
+    const directory = path.join(root, crypto.randomUUID());
+    await fs.mkdir(directory, { recursive: true });
+    const paths = [];
+    let totalBytes = 0;
+
+    try {
+        for (let index = 0; index < normalized.length; index += 1) {
+            const reference = normalized[index];
+            const bytes = Buffer.from(String(reference?.base64 || ''), 'base64');
+            totalBytes += bytes.length;
+            if (!bytes.length || totalBytes > MAX_IMAGE_REFERENCE_BYTES) {
+                throw new Error('Codex SDK image references are empty or exceed the 40 MB request limit.');
+            }
+
+            const filePath = path.join(directory, `reference-${index + 1}${imageExtensionForReference(reference)}`);
+            await fs.writeFile(filePath, bytes);
+            paths.push(filePath);
+        }
+
+        return { directory, paths };
+    } catch (err) {
+        await fs.rm(directory, { recursive: true, force: true }).catch(() => {});
+        throw err;
+    }
+}
+
+async function cleanupSdkImageReferences(runtimeHome, directory) {
+    if (!directory) {
+        return;
+    }
+
+    const root = path.resolve(runtimeHome, 'image-inputs');
+    const target = path.resolve(directory);
+    if (!target.startsWith(`${root}${path.sep}`)) {
+        return;
+    }
+    await fs.rm(target, { recursive: true, force: true }).catch(() => {});
+}
+
+function buildSdkImagePrompt(body, referenceCount) {
+    const prompt = extractPrompt(body);
+    const action = String(body?.action || '').trim().toLowerCase() === 'edit' || referenceCount > 0
+        ? 'edit'
+        : 'generate';
+    const size = String(body?.size || '').trim();
+    const quality = String(body?.quality || '').trim();
+    return [
+        action === 'edit'
+            ? `Use the image generation tool to edit the ${referenceCount} attached reference image(s).`
+            : 'Use the image generation tool to create one new image.',
+        prompt,
+        size ? `Requested output size: ${size}.` : '',
+        quality ? `Requested quality: ${quality}.` : '',
+        'Return exactly one generated image. Do not answer with instructions or prose.'
+    ].filter(Boolean).join('\n\n');
+}
+
+async function listGeneratedImageCandidates(directory, minimumMtimeMs, depth = 0) {
+    if (depth > 4) {
+        return [];
+    }
+
+    const entries = await fs.readdir(directory, { withFileTypes: true }).catch(() => []);
+    const candidates = [];
+    for (const entry of entries) {
+        const fullPath = path.join(directory, entry.name);
+        if (entry.isDirectory()) {
+            candidates.push(...await listGeneratedImageCandidates(fullPath, minimumMtimeMs, depth + 1));
+            continue;
+        }
+        if (!entry.isFile() || !/\.(png|jpe?g|webp|gif)$/i.test(entry.name)) {
+            continue;
+        }
+
+        const stat = await fs.stat(fullPath).catch(() => null);
+        if (stat && stat.size > 0 && stat.size <= MAX_GENERATED_IMAGE_BYTES && stat.mtimeMs >= minimumMtimeMs) {
+            candidates.push({ fullPath, mtimeMs: stat.mtimeMs });
+        }
+    }
+    return candidates;
+}
+
+async function recoverSdkGeneratedImage(runtimeHome, startedAtMs) {
+    const generatedRoot = path.join(runtimeHome, 'generated_images');
+    const minimumMtimeMs = startedAtMs - 15 * 1000;
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+        const candidates = await listGeneratedImageCandidates(generatedRoot, minimumMtimeMs);
+        candidates.sort((left, right) => right.mtimeMs - left.mtimeMs);
+        if (candidates[0]) {
+            const bytes = await fs.readFile(candidates[0].fullPath);
+            return {
+                imageBase64: bytes.toString('base64'),
+                mimeType: inferImageMimeType(bytes)
+            };
+        }
+        await new Promise(resolve => setTimeout(resolve, 350));
+    }
+    return null;
+}
+
 export function createCodexRuntime(options) {
     const packageRoot = options.packageRoot;
     const resolveWorkingDirectory = options.resolveWorkingDirectory;
     const getCurrentRuntime = options.getCurrentRuntime;
     const getModelCatalog = options.getModelCatalog;
     const log = typeof options.log === 'function' ? options.log : () => {};
+    const sdkLoader = typeof options.loadCodexSdk === 'function' ? options.loadCodexSdk : loadCodexSdk;
+    const prepareRuntimeHome = typeof options.ensureCodexRuntimeHome === 'function'
+        ? options.ensureCodexRuntimeHome
+        : ensureCodexRuntimeHome;
+    const childEnvFactory = typeof options.buildCodexChildEnv === 'function'
+        ? options.buildCodexChildEnv
+        : buildCodexChildEnv;
 
     const threads = new Map();
     const activeTurns = new Map();
+    let activeLoginPromise = null;
+
+    async function loginWithBundledCodex() {
+        if (typeof options.loginCodex === 'function') {
+            return options.loginCodex();
+        }
+
+        if (activeLoginPromise) {
+            return activeLoginPromise;
+        }
+
+        activeLoginPromise = (async () => {
+            await prepareRuntimeHome();
+            await runBundledCodexCommand(packageRoot, ['logout'], 15000).catch(() => null);
+            log('Codex SDK browser login start', { runtimeHome: resolveCodexRuntimeHome() });
+            const loginResult = await runBundledCodexCommand(packageRoot, ['login']);
+            log('Codex SDK browser login finish', {
+                success: loginResult.success,
+                exitCode: loginResult.exitCode,
+                error: loginResult.error || ''
+            });
+            return loginResult;
+        })().finally(() => {
+            activeLoginPromise = null;
+        });
+
+        return activeLoginPromise;
+    }
 
     async function getCapabilities(options = {}) {
         const [sdk, legacy, modelCatalog] = await Promise.all([
-            checkSdkAvailability(packageRoot),
+            checkSdkAvailability(packageRoot, sdkLoader),
             checkLegacyAvailability(),
             getModelCatalog({ forceRefresh: Boolean(options.forceRefresh) })
         ]);
@@ -583,6 +965,7 @@ export function createCodexRuntime(options) {
                 'POST /api/codex/thread/run',
                 'POST /api/codex/thread/resume',
                 'POST /api/codex/thread/cancel',
+                'POST /api/codex/image/run',
                 'GET /api/codex/thread/{threadId}/status'
             ],
             runtime: getCurrentRuntime(),
@@ -598,7 +981,7 @@ export function createCodexRuntime(options) {
 
     async function resolveProvider(requestedProviderKind) {
         const requested = normalizeProviderKind(requestedProviderKind);
-        const sdk = await checkSdkAvailability(packageRoot);
+        const sdk = await checkSdkAvailability(packageRoot, sdkLoader);
         const legacy = requested === PROVIDER_KIND.typeScriptSdk
             ? null
             : await checkLegacyAvailability();
@@ -621,10 +1004,11 @@ export function createCodexRuntime(options) {
         const now = new Date().toISOString();
 
         if (providerKind === PROVIDER_KIND.typeScriptSdk) {
-            const sdk = await loadCodexSdk();
-            await ensureCodexRuntimeHome();
+            const sdk = await sdkLoader();
+            await prepareRuntimeHome();
             const codex = new sdk.Codex({
-                env: buildCodexChildEnv()
+                env: childEnvFactory(),
+                config: buildCodexSdkConfigOverrides()
             });
             const thread = codex.startThread(threadOptions);
             const localThreadId = `local_${crypto.randomUUID()}`;
@@ -686,10 +1070,11 @@ export function createCodexRuntime(options) {
             };
         }
 
-        const sdk = await loadCodexSdk();
-        await ensureCodexRuntimeHome();
+        const sdk = await sdkLoader();
+        await prepareRuntimeHome();
         const codex = new sdk.Codex({
-            env: buildCodexChildEnv()
+            env: childEnvFactory(),
+            config: buildCodexSdkConfigOverrides()
         });
         const officialId = requestedThreadId && !requestedThreadId.startsWith('local_')
             ? requestedThreadId
@@ -831,7 +1216,7 @@ export function createCodexRuntime(options) {
         const tempDir = path.join(workingDirectory, TEMP_DIR);
         const schema = normalizeOutputSchema(body.outputSchema || body.outputSchemaJson);
         let schemaPath = null;
-        await ensureCodexRuntimeHome();
+        await prepareRuntimeHome();
         const args = [
             'exec',
             '-',
@@ -844,7 +1229,9 @@ export function createCodexRuntime(options) {
             '-s',
             threadOptions.sandboxMode,
             '--config',
-            `model_reasoning_effort=${threadOptions.modelReasoningEffort}`
+            `model_reasoning_effort=${threadOptions.modelReasoningEffort}`,
+            '--config',
+            'mcp_servers={}'
         ];
         if (threadOptions.model) {
             args.push('-m', threadOptions.model);
@@ -871,7 +1258,7 @@ export function createCodexRuntime(options) {
             const childResult = await new Promise((resolve) => {
                 const child = spawn('codex', args, {
                     cwd: workingDirectory,
-                    env: buildCodexChildEnv(),
+                    env: childEnvFactory(),
                     windowsHide: true,
                     signal: abortController.signal
                 });
@@ -975,6 +1362,124 @@ export function createCodexRuntime(options) {
         });
     }
 
+    async function runSdkImageOnce(body = {}) {
+        const workingDirectory = await resolveWorkingDirectory(body.workingDir || body.workingDirectory || '');
+        const runtimeHome = await prepareRuntimeHome();
+        const sdk = await sdkLoader();
+        if (!sdk?.Codex) {
+            return {
+                success: false,
+                providerKind: PROVIDER_KIND.unavailable,
+                imageBase64: '',
+                mimeType: '',
+                error: cachedSdkLoadError || 'Codex TypeScript SDK is unavailable.',
+                threadId: '',
+                authenticationRequired: false,
+                loginOpened: false
+            };
+        }
+
+        const references = await writeSdkImageReferences(runtimeHome, body.referenceImages);
+        const prompt = buildSdkImagePrompt(body, references.paths.length);
+        const threadOptions = buildThreadOptions({
+            ...body,
+            sandbox: 'read_only',
+            approvalPolicy: 'on-request',
+            reasoningEffort: 'low',
+            networkAccessEnabled: true,
+            webSearchMode: 'disabled'
+        }, workingDirectory);
+        const startedAtMs = Date.now();
+        let threadId = '';
+        let error = '';
+        let generatedImage = null;
+
+        try {
+            const codex = new sdk.Codex({
+                env: childEnvFactory(),
+                config: buildCodexSdkConfigOverrides({
+                    features: { image_generation: true }
+                })
+            });
+            const thread = codex.startThread(threadOptions);
+            const input = [
+                { type: 'text', text: prompt },
+                ...references.paths.map(referencePath => ({ type: 'local_image', path: referencePath }))
+            ];
+            const { events } = await thread.runStreamed(input);
+
+            for await (const event of events) {
+                if (event?.type === 'thread.started' && event.thread_id) {
+                    threadId = String(event.thread_id);
+                } else if (event?.type === 'turn.failed') {
+                    error = event.error?.message || 'Codex SDK image turn failed.';
+                } else if (event?.type === 'error') {
+                    error = event.message || 'Codex SDK image stream failed.';
+                }
+
+                generatedImage ||= extractGeneratedImageFromEvent(event);
+            }
+        } catch (err) {
+            error = err?.message || String(err);
+        } finally {
+            await cleanupSdkImageReferences(runtimeHome, references.directory);
+        }
+
+        const authenticationRequired = looksLikeCodexAuthenticationError(error);
+        if (!authenticationRequired) {
+            generatedImage ||= await recoverSdkGeneratedImage(runtimeHome, startedAtMs);
+        }
+        if (generatedImage) {
+            return {
+                success: true,
+                providerKind: PROVIDER_KIND.typeScriptSdk,
+                imageBase64: generatedImage.imageBase64,
+                mimeType: generatedImage.mimeType,
+                error: '',
+                threadId,
+                authenticationRequired: false,
+                loginOpened: false
+            };
+        }
+
+        return {
+            success: false,
+            providerKind: PROVIDER_KIND.typeScriptSdk,
+            imageBase64: '',
+            mimeType: '',
+            error: error || 'Codex SDK completed without returning an image.',
+            threadId,
+            authenticationRequired,
+            loginOpened: false
+        };
+    }
+
+    async function runImage(body = {}) {
+        extractPrompt(body);
+        const firstResult = await runSdkImageOnce(body);
+        if (!firstResult.authenticationRequired) {
+            return firstResult;
+        }
+
+        const loginResult = await loginWithBundledCodex();
+        const loginSucceeded = loginResult === true || loginResult?.success === true;
+        if (!loginSucceeded) {
+            return {
+                ...firstResult,
+                loginOpened: true,
+                error: loginResult?.error
+                    || 'Codex sign-in was not completed. Finish the browser login and retry.'
+            };
+        }
+
+        const retryResult = await runSdkImageOnce(body);
+        return {
+            ...retryResult,
+            loginOpened: true,
+            authenticationRequired: retryResult.authenticationRequired
+        };
+    }
+
     async function resumeThread(body = {}) {
         const providerKind = await resolveProvider(body.providerKind || body.runtime);
         const threadId = String(body.threadId || '').trim();
@@ -1000,10 +1505,11 @@ export function createCodexRuntime(options) {
         if (providerKind === PROVIDER_KIND.typeScriptSdk) {
             const workingDirectory = await resolveWorkingDirectory(body.workingDir || body.workingDirectory || '');
             const threadOptions = buildThreadOptions(body, workingDirectory);
-            const sdk = await loadCodexSdk();
-            await ensureCodexRuntimeHome();
+            const sdk = await sdkLoader();
+            await prepareRuntimeHome();
             const codex = new sdk.Codex({
-                env: buildCodexChildEnv()
+                env: childEnvFactory(),
+                config: buildCodexSdkConfigOverrides()
             });
             const thread = codex.resumeThread(threadId, threadOptions);
             threads.set(threadId, {
@@ -1094,6 +1600,7 @@ export function createCodexRuntime(options) {
         getCapabilities,
         startThread,
         runThread,
+        runImage,
         resumeThread,
         cancelThread,
         getThreadStatus