@mrgoonie/multix 0.15.1 → 0.15.3

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.3](https://github.com/mrgoonie/multix-cli/compare/v0.15.2...v0.15.3) (2026-10-11)
+
+
+### Fixed
+
+* **core:** never forward API-key headers across origins on redirect ([#101](https://github.com/mrgoonie/multix-cli/issues/101)) ([5fd673d](https://github.com/mrgoonie/multix-cli/commit/5fd673ddac9e30b592348cafd6ab68343fa644d7))
+
+## [0.15.2](https://github.com/mrgoonie/multix-cli/compare/v0.15.1...v0.15.2) (2026-10-11)
+
+
+### Fixed
+
+* **doc:** do not retry configuration and non-transient errors ([#96](https://github.com/mrgoonie/multix-cli/issues/96)) ([6c505a6](https://github.com/mrgoonie/multix-cli/commit/6c505a64f88cbcc3ee992ca4112473400189305f))
+
 ## [0.15.1](https://github.com/mrgoonie/multix-cli/compare/v0.15.0...v0.15.1) (2026-10-11)
 
 

package/dist/cli.js

@@ -489,7 +489,8 @@ var PollTimeoutError = class extends MultixError {
 };
 function isTransientHttpError(error) {
   if (!(error instanceof HttpError)) return false;
-  return error.status === 0 || error.status === 429 || error.status >= 500;
+  const { status } = error;
+  return status === 0 || status === 408 || status === 429 || status >= 500;
 }
 var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 async function pollUntil(opts) {
@@ -540,6 +541,113 @@ init_errors();
 
 // src/core/fetch-json.ts
 init_errors();
+
+// src/core/redirect-fetch.ts
+init_errors();
+var MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var BODY_HEADERS = ["content-type", "content-length", "content-encoding", "content-language"];
+function withoutBodyHeaders(headers2) {
+  if (headers2 === void 0) return void 0;
+  const copy = new Headers(headers2);
+  for (const name of BODY_HEADERS) copy.delete(name);
+  return copy;
+}
+async function fetchFollowingRedirects(url, init = {}, opts = {}) {
+  const doFetch = opts.fetch ?? ((input, i) => globalThis.fetch(input, i));
+  const { validateUrl } = opts;
+  const maxRedirects = opts.maxRedirects ?? MAX_REDIRECTS;
+  let current = url;
+  let hopInit = { ...init, redirect: "manual" };
+  for (let hop = 0; ; hop++) {
+    await validateUrl?.(current);
+    let response;
+    try {
+      response = await doFetch(current, hopInit);
+    } catch (cause) {
+      if (!opts.wrapNetworkErrors) throw cause;
+      const msg = cause instanceof Error ? cause.message : String(cause);
+      throw new HttpError(0, msg, current);
+    }
+    if (validateUrl && response.url && response.url !== current) {
+      try {
+        await validateUrl(response.url);
+      } catch (err2) {
+        await response.body?.cancel().catch(() => {
+        });
+        throw err2;
+      }
+    }
+    const location = response.headers.get("location");
+    if (!REDIRECT_STATUSES.has(response.status) || !location) {
+      return { response, url: current };
+    }
+    let next;
+    try {
+      next = new URL(location, current);
+    } catch {
+    }
+    const crossOrigin = next !== void 0 && next.origin !== new URL(current).origin;
+    if (crossOrigin && opts.crossOrigin === "stop") return { response, url: current };
+    await response.body?.cancel().catch(() => {
+    });
+    if (hop >= maxRedirects) {
+      throw new HttpError(response.status, `too many redirects (over ${maxRedirects})`, current);
+    }
+    if (!next) {
+      throw new HttpError(response.status, "redirect with a malformed Location header", current);
+    }
+    if (crossOrigin) {
+      if (opts.crossOrigin === "error") {
+        throw new HttpError(
+          response.status,
+          `refusing to follow a redirect to another origin (${next.origin})`,
+          current
+        );
+      }
+      hopInit = { ...hopInit, headers: void 0 };
+    }
+    const method = (hopInit.method ?? "GET").toUpperCase();
+    const toGet = response.status === 303 && method !== "GET" && method !== "HEAD" || (response.status === 301 || response.status === 302) && method === "POST";
+    if (toGet) {
+      hopInit = {
+        ...hopInit,
+        method: "GET",
+        body: void 0,
+        headers: withoutBodyHeaders(hopInit.headers)
+      };
+    }
+    current = next.toString();
+  }
+}
+async function fetchSameOrigin(url, init = {}, fetchImpl) {
+  const { response } = await fetchFollowingRedirects(url, init, {
+    fetch: fetchImpl,
+    crossOrigin: "stop"
+  });
+  return response;
+}
+async function fetchWithValidatedRedirects(url, opts = {}) {
+  const { signal, headers: headers2, validateUrl } = opts;
+  const init = { ...signal ? { signal } : {}, ...headers2 ? { headers: headers2 } : {} };
+  if (!validateUrl && !headers2) {
+    const doFetch = opts.fetch ?? ((input, i) => globalThis.fetch(input, i));
+    try {
+      return { response: await doFetch(url, init), url };
+    } catch (cause) {
+      const msg = cause instanceof Error ? cause.message : String(cause);
+      throw new HttpError(0, msg, url);
+    }
+  }
+  return fetchFollowingRedirects(url, init, {
+    validateUrl,
+    maxRedirects: opts.maxRedirects,
+    fetch: opts.fetch,
+    wrapNetworkErrors: true
+  });
+}
+
+// src/core/fetch-json.ts
 var DEFAULT_TIMEOUT_MS = 12e4;
 var SNIPPET_MAX = 500;
 function parseRetryAfter(value, now = Date.now()) {
@@ -565,6 +673,10 @@ async function httpErrorFromResponse(response, url) {
     parseRetryAfter(response.headers.get("retry-after"))
   );
 }
+var NON_CREDENTIAL_HEADERS = /* @__PURE__ */ new Set(["accept", "accept-language", "content-type", "user-agent"]);
+function carriesCredentialHeaders(headers2) {
+  return Object.keys(headers2).some((name) => !NON_CREDENTIAL_HEADERS.has(name.toLowerCase()));
+}
 async function fetchJson(opts) {
   const { url, method = "GET", headers: headers2 = {}, body, timeoutMs = DEFAULT_TIMEOUT_MS } = opts;
   const doFetch = opts.fetch ?? ((input, init2) => globalThis.fetch(input, init2));
@@ -579,13 +691,11 @@ async function fetchJson(opts) {
   if (body !== void 0) {
     init.body = JSON.stringify(body);
   }
-  let response;
-  try {
-    response = await doFetch(url, init);
-  } catch (cause) {
-    const msg = cause instanceof Error ? cause.message : String(cause);
-    throw new HttpError(0, msg, url);
-  }
+  const { response } = await fetchFollowingRedirects(url, init, {
+    fetch: doFetch,
+    crossOrigin: carriesCredentialHeaders(headers2) ? "error" : "drop-headers",
+    wrapNetworkErrors: true
+  });
   if (!response.ok) {
     throw await httpErrorFromResponse(response, url);
   }
@@ -902,7 +1012,7 @@ var AtlasCloudClient = class {
   }
   /**
    * Poll until the prediction is terminal (success or failure) or the deadline
-   * passes. Network errors, 429 (honouring Retry-After) and 5xx are retried.
+   * passes. Network errors, 408, 429 (honouring Retry-After) and 5xx are retried.
    * Throws PollTimeoutError on timeout; returns the terminal prediction otherwise.
    */
   async waitForPrediction(id, opts) {
@@ -933,13 +1043,18 @@ var AtlasCloudClient = class {
     const url = `${this.baseUrl}/model/uploadMedia`;
     let response;
     try {
-      response = await this.doFetch(url, {
-        method: "POST",
-        headers: this.authHeaders(),
-        body: form,
-        signal: AbortSignal.timeout(this.uploadTimeoutMs)
-      });
+      response = await fetchSameOrigin(
+        url,
+        {
+          method: "POST",
+          headers: this.authHeaders(),
+          body: form,
+          signal: AbortSignal.timeout(this.uploadTimeoutMs)
+        },
+        (input, init) => this.doFetch(input, init)
+      );
     } catch (cause) {
+      if (cause instanceof HttpError) throw cause;
       throw new HttpError(0, cause instanceof Error ? cause.message : String(cause), url);
     }
     if (!response.ok) throw await httpErrorFromResponse(response, url);
@@ -1132,7 +1247,6 @@ async function httpJson(opts) {
 }
 var MAX_DOWNLOAD_ENV = "MULTIX_MAX_DOWNLOAD_MB";
 var DEFAULT_MAX_DOWNLOAD_MB = 2048;
-var MAX_REDIRECTS = 5;
 function formatMb2(bytes) {
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
@@ -1162,44 +1276,6 @@ function maxDownloadBytes() {
   }
   return bytes;
 }
-async function fetchWithValidatedRedirects(url, opts = {}) {
-  const doFetch = opts.fetch ?? ((input, init) => globalThis.fetch(input, init));
-  const { validateUrl, signal } = opts;
-  const maxRedirects = opts.maxRedirects ?? MAX_REDIRECTS;
-  let current = url;
-  let headers2 = opts.headers;
-  for (let hop = 0; ; hop++) {
-    await validateUrl?.(current);
-    let response;
-    try {
-      response = await doFetch(current, {
-        ...signal ? { signal } : {},
-        ...headers2 ? { headers: headers2 } : {},
-        ...validateUrl ? { redirect: "manual" } : {}
-      });
-    } catch (cause) {
-      const msg = cause instanceof Error ? cause.message : String(cause);
-      throw new HttpError(0, msg, current);
-    }
-    const location = response.headers.get("location");
-    if (!validateUrl || !location || response.status < 300 || response.status >= 400) {
-      return { response, url: current };
-    }
-    await response.body?.cancel().catch(() => {
-    });
-    if (hop >= maxRedirects) {
-      throw new HttpError(response.status, `too many redirects (over ${maxRedirects})`, current);
-    }
-    let next;
-    try {
-      next = new URL(location, current);
-    } catch {
-      throw new HttpError(response.status, "redirect with a malformed Location header", current);
-    }
-    if (next.origin !== new URL(current).origin) headers2 = void 0;
-    current = next.toString();
-  }
-}
 function removeQuietly(file) {
   try {
     fs3.rmSync(file, { force: true });
@@ -1261,7 +1337,7 @@ async function downloadToFile(url, opts) {
       yield chunk;
     }
   }
-  const part = `${dest}.part`;
+  const part = `${dest}.${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.part`;
   let fileStream;
   try {
     fileStream = fs3.createWriteStream(part);
@@ -3131,8 +3207,13 @@ init_errors();
 function cloudflareProviderFailure(status) {
   return new ProviderError(`Cloudflare request failed with HTTP ${status}`, "Cloudflare");
 }
+async function cloudflareResponseFailure(response) {
+  await response.body?.cancel().catch(() => {
+  });
+  return cloudflareProviderFailure(response.status);
+}
 async function readCloudflareJson(response) {
-  if (!response.ok) throw cloudflareProviderFailure(response.status);
+  if (!response.ok) throw await cloudflareResponseFailure(response);
   try {
     return await response.json();
   } catch {
@@ -3152,12 +3233,11 @@ function videoHeaders(config, opts) {
   };
 }
 function send(opts, url, init) {
-  const f = opts.fetch;
   const withTimeout = {
     ...init,
     signal: AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS)
   };
-  return f ? f(url, withTimeout) : globalThis.fetch(url, withTimeout);
+  return fetchSameOrigin(url, withTimeout, opts.fetch);
 }
 function parseCloudflareVideoPrediction(value) {
   if (!value || typeof value !== "object") {
@@ -3210,7 +3290,7 @@ function gatewayUrl(accountId) {
 async function runCloudflareJson(model, input) {
   const config = requireCloudflareConfig();
   const useGateway = Boolean(config.gatewayId);
-  const response = await globalThis.fetch(
+  const response = await fetchSameOrigin(
     useGateway ? gatewayUrl(config.accountId) : nativeUrl(config.accountId, model),
     {
       method: "POST",
@@ -3227,7 +3307,7 @@ async function runCloudflareJson(model, input) {
 async function runCloudflareBytes(model, input) {
   const config = requireCloudflareConfig();
   const useGateway = Boolean(config.gatewayId);
-  const response = await globalThis.fetch(
+  const response = await fetchSameOrigin(
     useGateway ? gatewayUrl(config.accountId) : nativeUrl(config.accountId, model),
     {
       method: "POST",
@@ -3235,7 +3315,7 @@ async function runCloudflareBytes(model, input) {
       body: JSON.stringify(useGateway ? { model, input } : input)
     }
   );
-  if (!response.ok) throw cloudflareProviderFailure(response.status);
+  if (!response.ok) throw await cloudflareResponseFailure(response);
   const contentType = response.headers.get("content-type") ?? "";
   if (!contentType.includes("audio/mpeg")) {
     throw new ProviderError("Cloudflare did not return MPEG audio", "Cloudflare");
@@ -3557,7 +3637,7 @@ function apiPostJson(endpoint2, payload, apiKey, opts = {}) {
 }
 async function apiDelete(endpoint2, apiKey) {
   const url = `${ELEVENLABS_BASE_URL}/${endpoint2.replace(/^\//, "")}`;
-  const res = await globalThis.fetch(url, {
+  const res = await fetchSameOrigin(url, {
     method: "DELETE",
     headers: authHeaders(apiKey),
     signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS2)
@@ -3591,8 +3671,9 @@ async function apiPostBinary(endpoint2, body, apiKey, opts = {}) {
   }
   let res;
   try {
-    res = await globalThis.fetch(url.toString(), init);
+    res = await fetchSameOrigin(url.toString(), init);
   } catch (cause) {
+    if (cause instanceof HttpError) throw cause;
     const msg = cause instanceof Error ? cause.message : String(cause);
     throw new HttpError(0, msg, url.toString());
   }
@@ -3606,13 +3687,14 @@ async function apiPostMultipart(endpoint2, form, apiKey, opts = {}) {
   const url = `${ELEVENLABS_BASE_URL}/${endpoint2.replace(/^\//, "")}`;
   let res;
   try {
-    res = await globalThis.fetch(url, {
+    res = await fetchSameOrigin(url, {
       method: "POST",
       headers: authHeaders(apiKey),
       body: form,
       signal: AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
     });
   } catch (cause) {
+    if (cause instanceof HttpError) throw cause;
     const msg = cause instanceof Error ? cause.message : String(cause);
     throw new HttpError(0, msg, url);
   }
@@ -3821,7 +3903,7 @@ Dubbed file: ${dest}`);
 }
 async function downloadDub(url, apiKey, dest) {
   fs15.mkdirSync(path18.dirname(dest), { recursive: true });
-  const res = await globalThis.fetch(url, {
+  const { response: res } = await fetchWithValidatedRedirects(url, {
     headers: { "xi-api-key": apiKey },
     signal: AbortSignal.timeout(6e5)
   });
@@ -3830,7 +3912,6 @@ async function downloadDub(url, apiKey, dest) {
   }
   const arr = new Uint8Array(await res.arrayBuffer());
   fs15.writeFileSync(dest, arr);
-  void downloadFile;
 }
 
 // src/providers/elevenlabs/commands/isolate.ts
@@ -5813,13 +5894,14 @@ function checkVeoResult(op) {
   return op;
 }
 async function downloadVeoVideo(apiKey, uri, dest) {
-  let host = "";
+  let parsed;
   try {
-    host = new URL(uri).hostname;
+    parsed = new URL(uri);
   } catch {
     throw new ProviderError("Veo returned an invalid video URI", "gemini");
   }
-  await downloadFile(uri, dest, 3e5, host === API_HOST ? headers(apiKey) : void 0);
+  const keyed = parsed.protocol === "https:" && parsed.hostname === API_HOST;
+  await downloadFile(uri, dest, 3e5, keyed ? headers(apiKey) : void 0);
 }
 async function runVeo(model, request, dest, logger) {
   const body = buildVeoRequest(request);
@@ -6315,10 +6397,8 @@ var HEYGEN_OPERATIONS = {
 };
 
 // src/providers/heygen/node-helpers.ts
-import { once } from "events";
 import fs29 from "fs";
 import path32 from "path";
-import { pipeline as pipeline2 } from "stream/promises";
 init_errors();
 init_redact();
 
@@ -6665,13 +6745,18 @@ var HeygenClient = class {
       form.append("file", typed, input.filename);
       let response;
       try {
-        response = await doFetch(url, {
-          method: "POST",
-          headers: this.headers(key),
-          body: form,
-          signal: AbortSignal.timeout(this.timeoutMs)
-        });
+        response = await fetchSameOrigin(
+          url,
+          {
+            method: "POST",
+            headers: this.headers(key),
+            body: form,
+            signal: AbortSignal.timeout(this.timeoutMs)
+          },
+          doFetch
+        );
       } catch (cause) {
+        if (cause instanceof HttpError) throw toHeygenApiError(cause);
         const msg = cause instanceof Error ? cause.message : String(cause);
         const err3 = toHeygenApiError(new HttpError(0, msg, url));
         if (attempt >= this.maxAttempts) throw err3;
@@ -7322,44 +7407,11 @@ function inferExtension(url, fallback) {
 function safeSlug(value) {
   return value.replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "out";
 }
-var MAX_REDIRECTS2 = 5;
-var isRedirect = (status) => [301, 302, 303, 307, 308].includes(status);
-async function downloadHttpsOnly(url, dest, timeoutMs) {
-  const signal = AbortSignal.timeout(timeoutMs);
-  let current = url;
-  for (let hop = 0; ; hop++) {
-    if (!isHttpsUrl(current)) {
-      throw new HttpError(0, "refusing to follow a redirect to a non-https URL", current);
-    }
-    let response;
-    try {
-      response = await globalThis.fetch(current, { signal, redirect: "manual" });
-    } catch (cause) {
-      throw new HttpError(0, cause instanceof Error ? cause.message : String(cause), current);
-    }
-    if (response.url && !isHttpsUrl(response.url)) {
-      await response.body?.cancel();
-      throw new HttpError(0, "redirected to a non-https URL", response.url);
-    }
-    const location = response.headers.get("location");
-    if (isRedirect(response.status) && location) {
-      await response.body?.cancel();
-      if (hop >= MAX_REDIRECTS2) throw new HttpError(0, "too many redirects", url);
-      current = new URL(location, current).href;
-      continue;
-    }
-    if (!response.ok) throw new HttpError(response.status, "(download failed)", current);
-    if (!response.body) throw new HttpError(0, "Response body is null", current);
-    fs29.mkdirSync(path32.dirname(dest), { recursive: true });
-    const fileStream = fs29.createWriteStream(dest);
-    try {
-      await pipeline2(response.body, fileStream);
-    } catch (err2) {
-      if (!fileStream.closed) await once(fileStream, "close");
-      throw err2;
-    }
-    return;
-  }
+function requireHttps2(url) {
+  if (!isHttpsUrl(url)) throw new HttpError(0, "redirected to a non-https URL", url);
+}
+function downloadHttps(url, dest, timeoutMs) {
+  return downloadToFile(url, { dest, timeoutMs, validateUrl: requireHttps2 });
 }
 async function downloadOutput(url, dest, resumeHint) {
   if (!url) {
@@ -7370,12 +7422,9 @@ async function downloadOutput(url, dest, resumeHint) {
       `Refusing to download HeyGen output from a non-https URL (${redactUrl(url)})`
     );
   }
-  const tmp = `${dest}.${process.pid}-${Date.now()}.part`;
   try {
-    await downloadHttpsOnly(url, tmp, 6e5);
-    fs29.renameSync(tmp, dest);
+    await downloadHttps(url, dest, 6e5);
   } catch (e) {
-    fs29.rmSync(tmp, { force: true });
     const status = e instanceof HttpError ? e.status : 0;
     const expired = status === 403 || status === 404 || status === 410;
     const reason = e instanceof Error ? e.message : String(e);
@@ -7437,7 +7486,7 @@ function captionPathFor(dest, capExt) {
   const capDest = `${stem}.${capExt}`;
   return capDest.toLowerCase() === dest.toLowerCase() ? `${stem}.captions.${capExt}` : capDest;
 }
-var downloadThumbHttpsOnly = (url, dest) => downloadHttpsOnly(url, dest, 12e4);
+var downloadThumbHttpsOnly = (url, dest) => downloadHttps(url, dest, 12e4);
 function summarizeState(state) {
   const out = {
     kind: state.kind,
@@ -9584,13 +9633,14 @@ async function postOpenAIForm(pathname, form, apiKey, timeoutMs = DEFAULT_TIMEOU
   const url = endpoint(pathname);
   let res;
   try {
-    res = await globalThis.fetch(url, {
+    res = await fetchSameOrigin(url, {
       method: "POST",
       headers: authHeaders4(apiKey),
       body: form,
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
+    if (cause instanceof HttpError) throw cause;
     throw new HttpError(0, cause instanceof Error ? cause.message : String(cause), url);
   }
   if (!res.ok) {
@@ -9603,13 +9653,14 @@ async function postOpenAIBinary(pathname, body, apiKey, timeoutMs = DEFAULT_TIME
   const url = endpoint(pathname);
   let res;
   try {
-    res = await globalThis.fetch(url, {
+    res = await fetchSameOrigin(url, {
       method: "POST",
       headers: authHeaders4(apiKey, { "Content-Type": "application/json" }),
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(timeoutMs)
     });
   } catch (cause) {
+    if (cause instanceof HttpError) throw cause;
     throw new HttpError(0, cause instanceof Error ? cause.message : String(cause), url);
   }
   if (!res.ok) {
@@ -10449,7 +10500,9 @@ async function downloadOpenRouterVideo(opts) {
   const apiKey = requireOpenRouterKey();
   const url = videoContentUrl(jobId);
   const dest = path50.join(getOutputDir(), `openrouter_video_${jobId}.mp4`);
-  const r = await globalThis.fetch(url, { headers: { Authorization: `Bearer ${apiKey}` } });
+  const { response: r } = await fetchWithValidatedRedirects(url, {
+    headers: { Authorization: `Bearer ${apiKey}` }
+  });
   if (!r.ok) {
     logger.error(`Download HTTP ${r.status}`);
     process.exit(1);
@@ -10460,8 +10513,8 @@ async function downloadOpenRouterVideo(opts) {
   }
   fs43.mkdirSync(path50.dirname(dest), { recursive: true });
   const ws = fs43.createWriteStream(dest);
-  const { pipeline: pipeline3 } = await import("stream/promises");
-  await pipeline3(r.body, ws);
+  const { pipeline: pipeline2 } = await import("stream/promises");
+  await pipeline2(r.body, ws);
   logger.success(`Saved ${dest}`);
   if (opts.output) {
     fs43.mkdirSync(path50.dirname(path50.resolve(opts.output)), { recursive: true });
@@ -10877,7 +10930,7 @@ var ReplicateClient = class {
   /**
    * Poll until the prediction reaches a terminal status (succeeded, failed,
    * canceled, aborted) and return it — callers decide success via
-   * assertSucceeded. Retries network/429/5xx; throws PollTimeoutError on deadline.
+   * assertSucceeded. Retries network/408/429/5xx; throws PollTimeoutError on deadline.
    */
   async waitForPrediction(prediction, opts) {
     if (typeof prediction !== "string" && isTerminalStatus2(prediction.status)) return prediction;
@@ -10923,13 +10976,18 @@ var ReplicateClient = class {
     const subject = `file upload ${opts.filename}`;
     let response;
     try {
-      response = await this.doFetch(url, {
-        method: "POST",
-        headers: this.headers(),
-        body: form,
-        signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
-      });
+      response = await fetchSameOrigin(
+        url,
+        {
+          method: "POST",
+          headers: this.headers(),
+          body: form,
+          signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS)
+        },
+        this.doFetch
+      );
     } catch (cause) {
+      if (cause instanceof HttpError) throw mapReplicateError(cause, subject);
       const msg = cause instanceof Error ? cause.message : String(cause);
       throw mapReplicateError(new HttpError(0, msg, url), subject);
     }
@@ -12061,6 +12119,7 @@ async function convertResolved(inputs, ctx) {
       } catch (e) {
         errorMsg = labelError(e instanceof Error ? e.message : String(e), input);
         if (isGeminiRateLimitError(e)) break;
+        if (!isTransientHttpError(e)) break;
         if (attempt < 2) {
           const wait = 2 ** attempt * 1e3;
           logger?.debug(`Retry ${attempt + 1} after ${wait / 1e3}s: ${errorMsg}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrgoonie/multix",
-  "version": "0.15.1",
+  "version": "0.15.3",
   "description": "AI multimodal CLI — OpenAI, Gemini, MiniMax, OpenRouter, Leonardo, BytePlus, ElevenLabs, fal.ai, Atlas Cloud, Replicate, HeyGen, ffmpeg, ImageMagick, doc-to-md",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multix
 description: AI multimodal CLI — generate and edit images (OpenAI, Codex driver, Gemini Nano Banana, Imagen, MiniMax, OpenRouter, Leonardo, BytePlus Seedream, Cloudflare Workers AI FLUX.1 Schnell, fal.ai FLUX, Replicate FLUX), generate video (Gemini Veo, MiniMax Hailuo, OpenRouter via Veo/Seedance/Kling, Leonardo via Motion/Veo/Kling/Hailuo/Seedance/LTX, BytePlus Seedance, Cloudflare AI Gateway via Replicate, fal.ai queue models, Replicate direct API models incl. P-Video, HeyGen Video Agent and scripted avatar videos), video translation and lipsync (HeyGen), TTS/STT/music (OpenAI, Gemini Flash TTS incl. Gemini 3.8 with delivery-style control, MiniMax, Cloudflare Workers AI MeloTTS, ElevenLabs), 3D models (BytePlus Hyper3D/Hitem3d), analyze/transcribe media, convert documents to Markdown, optimize media via ffmpeg/ImageMagick, and self-update the CLI. Use whenever the user wants to create, edit, or transform images/video/audio/3D/documents from a CLI, mentions any of: OpenAI, Codex image driver, image-to-image, i2i, image edit, watercolor/cyberpunk style transfer, reference image, OpenRouter, Nano Banana, Flux, Seedream, Veo, Hailuo, Seedance, Kling, Cloudflare Workers AI, AI Gateway, fal.ai, Atlas Cloud, Replicate, replicate.com models, Replicate predictions, HeyGen, avatar video, talking head, Video Agent, video translation, dubbing, lipsync, video generation, text-to-video, image-to-video, i2v, ElevenLabs voice cloning, updating/upgrading multix, or asks for batch media optimization.
-version: 0.15.1 # x-release-please-version
+version: 0.15.3 # x-release-please-version
 ---
 
 # multix — AI Multimodal CLI