@mrgoonie/multix 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.2](https://github.com/mrgoonie/multix-cli/compare/v1.0.1...v1.0.2) (2026-10-11)
+
+
+### Fixed
+
+* **fal:** only send the key to trusted queue status and response URLs ([#112](https://github.com/mrgoonie/multix-cli/issues/112)) ([92e61c5](https://github.com/mrgoonie/multix-cli/commit/92e61c547999e0bb30f1f4be6d9bbc1ce8226d24))
+
+## [1.0.1](https://github.com/mrgoonie/multix-cli/compare/v1.0.0...v1.0.1) (2026-10-11)
+
+
+### Changed
+
+* **gemini:** move file-system work out of the Gemini client ([#109](https://github.com/mrgoonie/multix-cli/issues/109)) ([7df49b2](https://github.com/mrgoonie/multix-cli/commit/7df49b24994bf169cb5709adbada61663a66c786))
+
 ## [1.0.0](https://github.com/mrgoonie/multix-cli/compare/v0.15.3...v1.0.0) (2026-10-11)
 
 

package/dist/cli.js

@@ -4520,6 +4520,7 @@ var FAL_DEFAULTS = {
 };
 
 // src/providers/fal/run-helpers.ts
+init_errors();
 import fs18 from "fs";
 import path21 from "path";
 init_redact();
@@ -4528,6 +4529,34 @@ init_redact();
 init_errors();
 init_errors();
 init_redact();
+var FAL_QUEUE_HOST = "queue.fal.run";
+function parseUrl(url) {
+  try {
+    return new URL(url);
+  } catch {
+    return void 0;
+  }
+}
+function normalizedHost(u) {
+  return u.hostname.toLowerCase().replace(/\.$/, "");
+}
+function normalizedOrigin(u) {
+  return `${u.protocol}//${normalizedHost(u)}:${u.port}`;
+}
+function assertTrustedFalUrl(url, baseUrl) {
+  const target = parseUrl(url);
+  if (!target) {
+    throw new ProviderError("Refusing to send the fal key to a malformed URL", "fal");
+  }
+  const base = parseUrl(baseUrl);
+  if (base && normalizedOrigin(target) === normalizedOrigin(base)) return;
+  const host = normalizedHost(target);
+  if (target.protocol === "https:" && host === FAL_QUEUE_HOST && target.port === "") return;
+  throw new ProviderError(
+    `Refusing to send the fal key to ${host || "this URL"}: not https://${FAL_QUEUE_HOST} or the FAL_BASE_URL origin`,
+    "fal"
+  );
+}
 function requireFalKey() {
   const key = resolveRoutedKey(FAL_ROUTING);
   if (!key) {
@@ -4549,10 +4578,22 @@ var FalClient = class {
   async request(path57, opts = {}) {
     const base = this.baseUrl.replace(/\/$/, "");
     const suffix = path57.startsWith("/") ? path57 : `/${path57}`;
-    return this.requestAbsolute(base + suffix, opts);
+    return this.send(base + suffix, opts);
   }
-  /** Same auth/headers as `request`, but `url` is used verbatim (e.g. a status_url/response_url returned by submit). */
+  /**
+   * Same auth/headers as `request`, but `url` is used verbatim (e.g. a
+   * status_url/response_url returned by submit). The URL must pass
+   * {@link assertTrustedFalUrl} before the key is sent.
+   */
   async requestAbsolute(url, opts = {}) {
+    assertTrustedFalUrl(url, this.baseUrl);
+    return this.send(url, opts);
+  }
+  /** Throws a ProviderError when `url` may not receive the key (see {@link assertTrustedFalUrl}). */
+  assertTrustedUrl(url) {
+    assertTrustedFalUrl(url, this.baseUrl);
+  }
+  async send(url, opts) {
     opts.logger?.debug(`${opts.method ?? "GET"} ${redactUrl(url)}`);
     return httpJson({
       url,
@@ -4620,6 +4661,13 @@ async function submitAndWait(opts) {
   const submitRes = await client.post(submitPath(model), input, logger);
   const requestId = submitRes.request_id;
   logger.debug(`request_id: ${requestId}`);
+  for (const field of ["status_url", "response_url"]) {
+    const url = submitRes[field];
+    if (typeof url !== "string" || url === "") {
+      throw new ProviderError(`fal submit response is missing ${field}`, "fal");
+    }
+    client.assertTrustedUrl(url);
+  }
   logger.info("Polling for completion...");
   const waitTimeoutMs = opts.waitTimeoutMs ?? 48e4;
   const intervalMs = opts.pollIntervalMs ?? 3e3;
@@ -5150,118 +5198,9 @@ async function resolveFileInputs(files, opts = {}) {
 }
 
 // src/providers/gemini/client.ts
-import fs21 from "fs";
-import path25 from "path";
 init_errors();
 
-// src/providers/gemini/key-pool.ts
-init_errors();
-var PRIMARY_KEY_ENV = "GEMINI_API_KEY";
-var DEFAULT_COOLDOWN_MS = 6e4;
-var cooldownUntil = /* @__PURE__ */ new Map();
-function listGeminiKeys(env = process.env) {
-  const numbered = Object.keys(env).map((name) => ({ name, match: /^GEMINI_API_KEY_(\d+)$/.exec(name) })).filter((e) => e.match !== null).sort((a, b) => Number(a.match[1]) - Number(b.match[1])).map((e) => e.name);
-  const seen = /* @__PURE__ */ new Set();
-  const keys = [];
-  for (const name of [PRIMARY_KEY_ENV, ...numbered]) {
-    const value = env[name]?.trim();
-    if (!value || seen.has(value)) continue;
-    seen.add(value);
-    keys.push({ name, value });
-  }
-  return keys;
-}
-function isGeminiRateLimitError(error) {
-  if (!(error instanceof HttpError)) return false;
-  if (error.status === 429) return true;
-  return (error.status === 400 || error.status === 403) && error.snippet.includes("RESOURCE_EXHAUSTED");
-}
-function cooldownMs(error) {
-  if (!(error instanceof HttpError)) return DEFAULT_COOLDOWN_MS;
-  if (error.retryAfterMs !== void 0 && error.retryAfterMs > 0) return error.retryAfterMs;
-  const delay = /"retryDelay"\s*:\s*"(\d+(?:\.\d+)?)s"/.exec(error.snippet);
-  if (delay?.[1]) return Math.ceil(Number(delay[1]) * 1e3);
-  return DEFAULT_COOLDOWN_MS;
-}
-function keysToTry(keys, now) {
-  const until = (k) => cooldownUntil.get(k.value) ?? 0;
-  const ready = keys.filter((k) => until(k) <= now);
-  if (ready.length > 0) return ready;
-  const soonest = [...keys].sort((a, b) => until(a) - until(b))[0];
-  return soonest ? [soonest] : [];
-}
-async function withGeminiKey(fn, opts = {}) {
-  const now = opts.now ?? Date.now;
-  const keys = listGeminiKeys(opts.env);
-  if (keys.length === 0) {
-    throw new ConfigError(
-      "GEMINI_API_KEY is not set. Get one at https://aistudio.google.com/apikey"
-    );
-  }
-  const ordered = keysToTry(keys, now());
-  let lastError;
-  for (const [i, key] of ordered.entries()) {
-    try {
-      return await fn(key.value, key.name);
-    } catch (error) {
-      if (!isGeminiRateLimitError(error)) throw error;
-      lastError = error;
-      cooldownUntil.set(key.value, now() + cooldownMs(error));
-      const next = ordered[i + 1];
-      if (next) opts.logger?.warn(`${key.name} is rate-limited; retrying with ${next.name}`);
-    }
-  }
-  if (keys.length > 1) {
-    opts.logger?.warn(`All ${keys.length} Gemini keys are rate-limited; try again later`);
-  }
-  throw lastError;
-}
-
-// src/providers/gemini/task-resolver.ts
-import path24 from "path";
-var MIME_MAP = {
-  // Audio
-  ".mp3": "audio/mp3",
-  ".wav": "audio/wav",
-  ".aac": "audio/aac",
-  ".flac": "audio/flac",
-  ".ogg": "audio/ogg",
-  ".aiff": "audio/aiff",
-  ".m4a": "audio/mp4",
-  // Image
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".png": "image/png",
-  ".webp": "image/webp",
-  ".heic": "image/heic",
-  ".heif": "image/heif",
-  ".gif": "image/gif",
-  ".bmp": "image/bmp",
-  // Video
-  ".mp4": "video/mp4",
-  ".mpeg": "video/mpeg",
-  ".mov": "video/quicktime",
-  ".avi": "video/x-msvideo",
-  ".flv": "video/x-flv",
-  ".mpg": "video/mpeg",
-  ".webm": "video/webm",
-  ".wmv": "video/x-ms-wmv",
-  ".3gpp": "video/3gpp",
-  // Document
-  ".pdf": "application/pdf",
-  ".txt": "text/plain",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".md": "text/markdown",
-  ".csv": "text/csv",
-  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation"
-};
-function getMimeType(filePath) {
-  const ext = path24.extname(filePath).toLowerCase();
-  return MIME_MAP[ext] ?? "application/octet-stream";
-}
+// src/providers/gemini/media-types.ts
 function requiresProcessingWait(mimeType) {
   return mimeType.startsWith("audio/") || mimeType.startsWith("video/");
 }
@@ -5270,39 +5209,24 @@ function requiresProcessingWait(mimeType) {
 var BASE = "https://generativelanguage.googleapis.com";
 var FILES_BASE = `${BASE}/upload/v1beta/files`;
 var GENERATE_BASE = `${BASE}/v1beta/models`;
-function withKey(opts, fn) {
-  return opts.apiKey ? fn(opts.apiKey) : withGeminiKey(fn, { logger: opts.logger });
-}
 function authHeaders2(apiKey) {
   return { "x-goog-api-key": apiKey };
 }
 var DEFAULT_TIMEOUT_MS3 = 3e5;
-var UPLOAD_MIN_KBPS_ENV = "MULTIX_UPLOAD_MIN_KBPS";
 var DEFAULT_MIN_UPLOAD_BYTES_PER_SEC = 1e6;
 var UPLOAD_TIMEOUT_SLACK_MS = 6e4;
-function minUploadBytesPerSec() {
-  const raw = resolveKey(UPLOAD_MIN_KBPS_ENV)?.trim();
-  if (!raw) return DEFAULT_MIN_UPLOAD_BYTES_PER_SEC;
-  const kbps = Number(raw);
-  if (!Number.isFinite(kbps) || kbps < 1) {
-    throw new ConfigError(
-      `${UPLOAD_MIN_KBPS_ENV} must be a number of kilobytes per second, at least 1, got "${raw}"`
-    );
-  }
-  return kbps * 1e3;
-}
 function uploadTimeoutMs(size, timeoutMs = DEFAULT_TIMEOUT_MS3, bytesPerSec = DEFAULT_MIN_UPLOAD_BYTES_PER_SEC) {
   return Math.max(timeoutMs, UPLOAD_TIMEOUT_SLACK_MS + Math.ceil(size / bytesPerSec * 1e3));
 }
-async function uploadFile(filePath, opts = {}) {
-  const size = fs21.statSync(filePath).size;
+async function uploadFile(source, opts) {
+  const size = source.blob.size;
   if (size > FILES_API_MAX_BYTES) {
     throw new ValidationError(
-      `File too large for the Gemini Files API: ${path25.basename(filePath)} is ${formatMb3(size)} MB (limit 2 GB = ${FILES_API_MAX_BYTES} bytes)`
+      `File too large for the Gemini Files API: ${source.displayName} is ${formatMb3(size)} MB (limit 2 GB = ${FILES_API_MAX_BYTES} bytes)`
     );
   }
-  const bytesPerSec = minUploadBytesPerSec();
-  return withKey(opts, (apiKey) => uploadFileWithKey(filePath, apiKey, { ...opts, bytesPerSec }));
+  const { apiKey, minUploadBytesPerSec: minUploadBytesPerSec2 = DEFAULT_MIN_UPLOAD_BYTES_PER_SEC } = opts;
+  return uploadFileWithKey(source, apiKey, { ...opts, bytesPerSec: minUploadBytesPerSec2 });
 }
 function formatMb3(bytes) {
   return (bytes / 1024 / 1024).toFixed(2);
@@ -5351,11 +5275,10 @@ async function readFinalizedFile(resp) {
   }
   return file;
 }
-async function uploadFileWithKey(filePath, apiKey, opts) {
+async function uploadFileWithKey(source, apiKey, opts) {
   const { timeoutMs = DEFAULT_TIMEOUT_MS3, logger, bytesPerSec } = opts;
-  const mimeType = getMimeType(filePath);
-  const displayName = path25.basename(filePath);
-  const file = await fs21.openAsBlob(filePath);
+  const { mimeType, displayName, label = source.displayName } = source;
+  const file = source.blob.type ? source.blob.slice(0, source.blob.size, "") : source.blob;
   logger?.debug(`Uploading ${displayName} (${formatMb3(file.size)} MB)`);
   const start = await uploadFetch(
     FILES_BASE,
@@ -5397,44 +5320,38 @@ async function uploadFileWithKey(filePath, apiKey, opts) {
     const deadline = Date.now() + timeoutMs;
     while (fileRef.state === "PROCESSING" && Date.now() < deadline) {
       await sleep2(2e3);
-      fileRef = await httpJson({
+      fileRef = await fetchJson({
         url: `${BASE}/v1beta/${fileRef.name}`,
         headers: authHeaders2(apiKey)
       }).then((r) => r.file);
       logger?.debug(`Processing... state=${fileRef.state}`);
     }
     if (fileRef.state === "FAILED")
-      throw new ProviderError(`File processing failed: ${filePath}`, "gemini");
+      throw new ProviderError(`File processing failed: ${label}`, "gemini");
     if (fileRef.state === "PROCESSING")
-      throw new ProviderError(`Processing timeout: ${filePath}`, "gemini");
+      throw new ProviderError(`Processing timeout: ${label}`, "gemini");
   }
   logger?.debug(`Uploaded: ${fileRef.name} (${fileRef.uri})`);
   return fileRef;
 }
-async function generateContent(req, opts = {}) {
-  return withKey(
-    opts,
-    (apiKey) => httpJson({
-      url: `${GENERATE_BASE}/${req.model}:generateContent`,
-      method: "POST",
-      headers: authHeaders2(apiKey),
-      body: {
-        contents: req.contents,
-        ...req.generationConfig ? { generationConfig: req.generationConfig } : {}
-      }
-    })
-  );
+async function generateContent(req, opts) {
+  return fetchJson({
+    url: `${GENERATE_BASE}/${req.model}:generateContent`,
+    method: "POST",
+    headers: authHeaders2(opts.apiKey),
+    body: {
+      contents: req.contents,
+      ...req.generationConfig ? { generationConfig: req.generationConfig } : {}
+    }
+  });
 }
-async function createInteraction(body, opts = {}) {
-  return withKey(
-    opts,
-    (apiKey) => httpJson({
-      url: `${BASE}/v1beta/interactions`,
-      method: "POST",
-      headers: authHeaders2(apiKey),
-      body
-    })
-  );
+async function createInteraction(body, opts) {
+  return fetchJson({
+    url: `${BASE}/v1beta/interactions`,
+    method: "POST",
+    headers: authHeaders2(opts.apiKey),
+    body
+  });
 }
 function extractInteractionAudio(resp) {
   let found = null;
@@ -5473,6 +5390,150 @@ function extractImages(resp) {
     (p) => p.inlineData !== void 0
   ).map((p) => ({ mimeType: p.inlineData.mimeType, data: p.inlineData.data }));
 }
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/providers/gemini/key-pool.ts
+init_errors();
+var PRIMARY_KEY_ENV = "GEMINI_API_KEY";
+var DEFAULT_COOLDOWN_MS = 6e4;
+var cooldownUntil = /* @__PURE__ */ new Map();
+function listGeminiKeys(env = process.env) {
+  const numbered = Object.keys(env).map((name) => ({ name, match: /^GEMINI_API_KEY_(\d+)$/.exec(name) })).filter((e) => e.match !== null).sort((a, b) => Number(a.match[1]) - Number(b.match[1])).map((e) => e.name);
+  const seen = /* @__PURE__ */ new Set();
+  const keys = [];
+  for (const name of [PRIMARY_KEY_ENV, ...numbered]) {
+    const value = env[name]?.trim();
+    if (!value || seen.has(value)) continue;
+    seen.add(value);
+    keys.push({ name, value });
+  }
+  return keys;
+}
+function isGeminiRateLimitError(error) {
+  if (!(error instanceof HttpError)) return false;
+  if (error.status === 429) return true;
+  return (error.status === 400 || error.status === 403) && error.snippet.includes("RESOURCE_EXHAUSTED");
+}
+function cooldownMs(error) {
+  if (!(error instanceof HttpError)) return DEFAULT_COOLDOWN_MS;
+  if (error.retryAfterMs !== void 0 && error.retryAfterMs > 0) return error.retryAfterMs;
+  const delay = /"retryDelay"\s*:\s*"(\d+(?:\.\d+)?)s"/.exec(error.snippet);
+  if (delay?.[1]) return Math.ceil(Number(delay[1]) * 1e3);
+  return DEFAULT_COOLDOWN_MS;
+}
+function keysToTry(keys, now) {
+  const until = (k) => cooldownUntil.get(k.value) ?? 0;
+  const ready = keys.filter((k) => until(k) <= now);
+  if (ready.length > 0) return ready;
+  const soonest = [...keys].sort((a, b) => until(a) - until(b))[0];
+  return soonest ? [soonest] : [];
+}
+async function withGeminiKey(fn, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const keys = listGeminiKeys(opts.env);
+  if (keys.length === 0) {
+    throw new ConfigError(
+      "GEMINI_API_KEY is not set. Get one at https://aistudio.google.com/apikey"
+    );
+  }
+  const ordered = keysToTry(keys, now());
+  let lastError;
+  for (const [i, key] of ordered.entries()) {
+    try {
+      return await fn(key.value, key.name);
+    } catch (error) {
+      if (!isGeminiRateLimitError(error)) throw error;
+      lastError = error;
+      cooldownUntil.set(key.value, now() + cooldownMs(error));
+      const next = ordered[i + 1];
+      if (next) opts.logger?.warn(`${key.name} is rate-limited; retrying with ${next.name}`);
+    }
+  }
+  if (keys.length > 1) {
+    opts.logger?.warn(`All ${keys.length} Gemini keys are rate-limited; try again later`);
+  }
+  throw lastError;
+}
+
+// src/providers/gemini/local-files.ts
+import fs21 from "fs";
+import path25 from "path";
+init_errors();
+
+// src/providers/gemini/task-resolver.ts
+import path24 from "path";
+var MIME_MAP = {
+  // Audio
+  ".mp3": "audio/mp3",
+  ".wav": "audio/wav",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
+  ".ogg": "audio/ogg",
+  ".aiff": "audio/aiff",
+  ".m4a": "audio/mp4",
+  // Image
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".webp": "image/webp",
+  ".heic": "image/heic",
+  ".heif": "image/heif",
+  ".gif": "image/gif",
+  ".bmp": "image/bmp",
+  // Video
+  ".mp4": "video/mp4",
+  ".mpeg": "video/mpeg",
+  ".mov": "video/quicktime",
+  ".avi": "video/x-msvideo",
+  ".flv": "video/x-flv",
+  ".mpg": "video/mpeg",
+  ".webm": "video/webm",
+  ".wmv": "video/x-ms-wmv",
+  ".3gpp": "video/3gpp",
+  // Document
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".md": "text/markdown",
+  ".csv": "text/csv",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+};
+function getMimeType(filePath) {
+  const ext = path24.extname(filePath).toLowerCase();
+  return MIME_MAP[ext] ?? "application/octet-stream";
+}
+
+// src/providers/gemini/local-files.ts
+var INLINE_MAX_BYTES = 20 * 1024 * 1024;
+var UPLOAD_MIN_KBPS_ENV = "MULTIX_UPLOAD_MIN_KBPS";
+function minUploadBytesPerSec() {
+  const raw = resolveKey(UPLOAD_MIN_KBPS_ENV)?.trim();
+  if (!raw) return DEFAULT_MIN_UPLOAD_BYTES_PER_SEC;
+  const kbps = Number(raw);
+  if (!Number.isFinite(kbps) || kbps < 1) {
+    throw new ConfigError(
+      `${UPLOAD_MIN_KBPS_ENV} must be a number of kilobytes per second, at least 1, got "${raw}"`
+    );
+  }
+  return kbps * 1e3;
+}
+async function uploadLocalFile(filePath, opts = {}) {
+  const bytesPerSec = minUploadBytesPerSec();
+  const blob = await fs21.openAsBlob(filePath);
+  const source = {
+    blob,
+    displayName: path25.basename(filePath),
+    mimeType: getMimeType(filePath),
+    label: filePath
+  };
+  const upload = (apiKey) => uploadFile(source, { ...opts, apiKey, minUploadBytesPerSec: bytesPerSec });
+  return opts.apiKey ? upload(opts.apiKey) : withGeminiKey(upload, { logger: opts.logger });
+}
 function inlinePart(filePath) {
   const data = fs21.readFileSync(filePath).toString("base64");
   const mimeType = getMimeType(filePath);
@@ -5480,10 +5541,7 @@ function inlinePart(filePath) {
 }
 function shouldUseFileApi(filePath) {
   const stat = fs21.statSync(filePath);
-  return stat.size > 20 * 1024 * 1024;
-}
-function sleep2(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return stat.size > INLINE_MAX_BYTES;
 }
 
 // src/providers/gemini/models.ts
@@ -5619,7 +5677,7 @@ function registerAnalyzeCommand(parent) {
               let contentParts;
               if (useApi) {
                 logger.debug("File >20MB \u2014 using Files API");
-                const ref = await uploadFile(filePath, { logger, apiKey });
+                const ref = await uploadLocalFile(filePath, { logger, apiKey });
                 contentParts = [
                   { text: opts.prompt },
                   { fileData: { mimeType: ref.mimeType, fileUri: ref.uri } }
@@ -5682,7 +5740,7 @@ function registerExtractCommand(parent) {
               const useApi = shouldUseFileApi(filePath);
               let contentParts;
               if (useApi) {
-                const ref = await uploadFile(filePath, { logger, apiKey });
+                const ref = await uploadLocalFile(filePath, { logger, apiKey });
                 contentParts = [
                   { text: opts.prompt },
                   { fileData: { mimeType: ref.mimeType, fileUri: ref.uri } }
@@ -5808,12 +5866,15 @@ async function generateGeminiSpeech(opts) {
   logger?.debug(`Gemini TTS model=${model} mode=${speakers?.length ? "multi" : "single"}`);
   let resp;
   try {
-    resp = await generateContent(
-      {
-        model,
-        contents: [{ parts: [{ text }] }],
-        generationConfig
-      },
+    resp = await withGeminiKey(
+      (apiKey) => generateContent(
+        {
+          model,
+          contents: [{ parts: [{ text }] }],
+          generationConfig
+        },
+        { apiKey, logger }
+      ),
       { logger }
     );
   } catch (e) {
@@ -5851,7 +5912,10 @@ async function generateInteractionsSpeech(opts) {
   }
   let resp;
   try {
-    resp = await createInteraction(buildInteractionsSpeechBody(opts), { logger });
+    resp = await withGeminiKey(
+      (apiKey) => createInteraction(buildInteractionsSpeechBody(opts), { apiKey, logger }),
+      { logger }
+    );
   } catch (e) {
     return { status: "error", error: e instanceof Error ? e.message : String(e) };
   }
@@ -6209,12 +6273,15 @@ function registerGenerateCommand(parent) {
       const savedFiles = [];
       for (let i = 0; i < numImages; i++) {
         try {
-          const resp = await generateContent(
-            {
-              model,
-              contents: [{ parts: [{ text: opts.prompt }] }],
-              generationConfig
-            },
+          const resp = await withGeminiKey(
+            (apiKey) => generateContent(
+              {
+                model,
+                contents: [{ parts: [{ text: opts.prompt }] }],
+                generationConfig
+              },
+              { apiKey, logger }
+            ),
             { logger }
           );
           const images = extractImages(resp);
@@ -6304,7 +6371,9 @@ function registerGeminiImageToImageCommand(parent) {
         contents: [{ parts }],
         generationConfig: { responseModalities: ["IMAGE"] }
       };
-      const resp = await generateContent(req, { logger });
+      const resp = await withGeminiKey((apiKey) => generateContent(req, { apiKey, logger }), {
+        logger
+      });
       const images = extractImages(resp);
       if (images.length === 0) {
         logger.error(
@@ -6437,7 +6506,7 @@ function registerTranscribeCommand2(parent) {
               let contentParts;
               if (useApi) {
                 logger.debug("File >20MB \u2014 using Files API");
-                const ref = await uploadFile(filePath, { logger, apiKey });
+                const ref = await uploadLocalFile(filePath, { logger, apiKey });
                 contentParts = [
                   { text: opts.prompt },
                   { fileData: { mimeType: ref.mimeType, fileUri: ref.uri } }
@@ -7533,7 +7602,7 @@ function createHeygenClientFromEnv() {
   const baseUrl = resolveProviderBaseUrl(HEYGEN_ROUTING);
   return new HeygenClient({ apiKey, baseUrl: checkBaseUrl(baseUrl, "HEYGEN_BASE_URL") });
 }
-async function uploadLocalFile(client, filePath, logger) {
+async function uploadLocalFile2(client, filePath, logger) {
   const abs = path32.resolve(filePath);
   let stat;
   try {
@@ -7569,7 +7638,7 @@ async function resolveMediaInput(client, value, logger) {
   const ref = classifyMediaRef(value);
   if (ref.kind === "url") return { type: "url", url: ref.url };
   if (ref.kind === "asset") return { type: "asset_id", asset_id: ref.assetId };
-  return uploadLocalFile(client, ref.path, logger);
+  return uploadLocalFile2(client, ref.path, logger);
 }
 async function resolveMediaInputs(client, values, logger) {
   const out = [];
@@ -12375,7 +12444,7 @@ async function convertResolved(inputs, ctx) {
             let contentParts;
             if (useApi) {
               logger?.debug("File >20MB \u2014 using Files API");
-              const ref = await uploadFile(filePath, { logger, apiKey });
+              const ref = await uploadLocalFile(filePath, { logger, apiKey });
               contentParts = [
                 { text: prompt },
                 { fileData: { mimeType: ref.mimeType, fileUri: ref.uri } }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrgoonie/multix",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "AI multimodal CLI — OpenAI, Gemini, MiniMax, OpenRouter, Leonardo, BytePlus, ElevenLabs, fal.ai, Atlas Cloud, Replicate, HeyGen, ffmpeg, ImageMagick, doc-to-md",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: multix
 description: AI multimodal CLI — generate and edit images (OpenAI, Codex driver, Gemini Nano Banana, Imagen, MiniMax, OpenRouter, Leonardo, BytePlus Seedream, Cloudflare Workers AI FLUX.1 Schnell, fal.ai FLUX, Replicate FLUX), generate video (Gemini Veo, MiniMax Hailuo, OpenRouter via Veo/Seedance/Kling, Leonardo via Motion/Veo/Kling/Hailuo/Seedance/LTX, BytePlus Seedance, Cloudflare AI Gateway via Replicate, fal.ai queue models, Replicate direct API models incl. P-Video, HeyGen Video Agent and scripted avatar videos), video translation and lipsync (HeyGen), TTS/STT/music (OpenAI, Gemini Flash TTS incl. Gemini 3.8 with delivery-style control, MiniMax, Cloudflare Workers AI MeloTTS, ElevenLabs), 3D models (BytePlus Hyper3D/Hitem3d), analyze/transcribe media, convert documents to Markdown, optimize media via ffmpeg/ImageMagick, and self-update the CLI. Use whenever the user wants to create, edit, or transform images/video/audio/3D/documents from a CLI, mentions any of: OpenAI, Codex image driver, image-to-image, i2i, image edit, watercolor/cyberpunk style transfer, reference image, OpenRouter, Nano Banana, Flux, Seedream, Veo, Hailuo, Seedance, Kling, Cloudflare Workers AI, AI Gateway, fal.ai, Atlas Cloud, Replicate, replicate.com models, Replicate predictions, HeyGen, avatar video, talking head, Video Agent, video translation, dubbing, lipsync, video generation, text-to-video, image-to-video, i2v, ElevenLabs voice cloning, updating/upgrading multix, or asks for batch media optimization.
-version: 1.0.0 # x-release-please-version
+version: 1.0.2 # x-release-please-version
 ---
 
 # multix — AI Multimodal CLI