@oar-sh/oar 0.9.24 → 0.9.25

package/.github/extensions/web-relay/skills/reasoning-stream.mjs

@@ -168,7 +168,9 @@ export function createReasoningStreamHandlers({
     const reasoningId = reasoningIdFor(event);
     const deltaContent = String(event?.data?.deltaContent ?? event?.data?.delta ?? "");
     if (!deltaContent) return;
-    const accumulated = (reasoningAccum.get(reasoningId) || "") + deltaContent;
+    // Capped before the gate: past the cap the text stops changing, so the
+    // same 16 KiB is not posted again and the accumulator stops growing.
+    const accumulated = capThought((reasoningAccum.get(reasoningId) || "") + deltaContent);
     reasoningAccum.set(reasoningId, accumulated);
     const lastSent = reasoningLastSent.get(reasoningId) || "";
     if (!shouldEmitDelta(accumulated, lastSent)) return;

package/CHANGELOG.md

@@ -3,6 +3,148 @@
 All notable changes to OAR are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [0.9.25] — 2026-11-09
+
+Highlights: a media gallery, and agents that make images. Every picture,
+video and file of a session is now in one place, the Media tab of the 🧠
+modal, and 🖼️ Media in the ︙ menu shows those of every session of the
+relay, with filters and a search; the file viewer moves through the whole
+gallery. Agents drive OpenAI Image sessions through `relay_tool`: they send
+pictures to edit and set the size, quality, count, format and background.
+While gpt-image works, the reply shows partial previews; the composer gets
+a custom size, a count, a format, a background and presets, and the
+gpt-image-2.5 and 2.6 models take xhigh and max quality. Every image turn
+shows what it cost, a daily cap of USD 5 per relay unless you change it
+keeps image spend in check, and a failed image turn costs at most two calls
+instead of up to five. The relay's memory no longer grows while several
+agents stream long thinking at once.
+
+### Added
+
+- **Media gallery.** The 🧠 modal has two tabs, Context (where it opens)
+  and Media: the session's pictures and videos as a square grid under month
+  headers, three columns on a phone, with a Files tab for attached PDFs,
+  audio and documents. **🖼️ Media** in the ︙ menu shows the media of every
+  session of the relay, with filters (All, Mine, Agent, Generated, a
+  provider, a session, Hide archived) and a search. It collects uploads,
+  `@file:` pictures, generated images and the pictures agents put in their
+  replies; a picture shown in several messages appears once, at its newest
+  message, and a deleted local file is left out. A tap opens the file
+  viewer, which now moves through the whole gallery (it loads more at the
+  end) and offers **Open in session** and **Copy path / link**. The pictures
+  on screen that could not load while the relay was away load again once it
+  is back; one scrolled out of view waits for the next reconnect.
+  Owner only: not in shared views, and no agent reads it through
+  `relay_tool`, on this relay or a paired one.
+- **Media index.** The relay keeps the gallery's index in its database
+  (migration 0039) and fills it for older messages in the background after
+  the upgrade, in short slices.
+- **Agents drive OpenAI Image sessions.** `relay_tool`'s `send` and
+  `create_session` take `images`, up to 4 absolute paths of PNG, JPEG or
+  WebP files on the target relay, and `image`, the turn's size (any W×H
+  within the model's limits), quality, count (1 to 4), output format and
+  background; `update_session` with `image` sets a session's own defaults
+  (migration 0040). The target relay takes only files inside the session's
+  working directory or images one of its sessions generated, follows links
+  to the real file, and checks each file's first bytes. Replies list the
+  pictures as `images` with their paths there, and a reply without text
+  reads like `1 image · 1536x1024 · gpt-image-2`. A paired relay must run
+  this version (`imageInputs` in `relay_info`); an older one is refused
+  before anything is sent. A new image session without a model starts on
+  gpt-image-2.5-flare (else its dated snapshot, else gpt-image-2, else the
+  first gpt-image model listed), and is refused when none is listed.
+
+- **Image previews.** While a gpt-image model makes an image, the reply's
+  bubble shows a timer with the size and quality, then two partial previews
+  as OpenAI streams them, then the final image. Previews reach your open
+  clients only, never the transcript, shared views, the media gallery or
+  agents, and their files go when the turn ends.
+- **Image composer.** An image chat's composer has a Custom… size (any
+  W×H the model takes, checked as you type), a Count (1 to 4), a Format
+  and a Background for gpt-image models.
+
+- **What image turns cost.** Every try of an OpenAI image turn is priced
+  as it ends, from the usage OpenAI reports and its published rates, and
+  estimated where OpenAI reports no usage for a try that may have been
+  billed; a model the relay has no price for counts at the dearest listed
+  price. The reply line ends with the cost, the chat menu shows what a
+  chat's images cost, and Check Usage has an OpenAI images card.
+- **A daily cap for OpenAI images.** USD 5 per relay and day unless you
+  change it (Settings → Providers → OpenAI; 0 is no cap). A request that
+  would pass it is not sent, and once it is reached new image messages are
+  refused, from you and from agents alike; estimates count toward it. A
+  warning shows from 80 %. Allow for today lifts it until midnight.
+- **Image presets.** Five built-in bundles of size, quality, format and
+  background, and your own (Save as preset… in the composer); agents name
+  one as image.preset.
+- **xhigh and max image quality.** The gpt-image-2.5 and 2.6 models take
+  the two higher qualities, in the composer and for agents; other models
+  keep auto, low, medium and high. Sizes for gpt-image-2 and later need at
+  least 655,360 pixels (1024x640), as OpenAI requires.
+
+### Changed
+
+- **OpenAI Image turns.** All attached images go to the edit, in order,
+  not only the first, and the format and background reach OpenAI. Quality
+  is checked per model family before the call (gpt-image: auto, low,
+  medium, high). OpenAI gets 3 minutes for a new image and 5 for
+  an edit (`openaiImageGenerateTimeoutMs`, `openaiImageEditTimeoutMs`).
+- **Copilot hides image models.** Copilot's `gpt-image-*` and `dall-e-*`
+  ids, which its runtime cannot serve, are left out of its model list; a
+  Copilot chat on one is refused with a pointer to OpenAI Image.
+
+### Fixed
+
+- **An image turn costs at most two calls.** A timeout, a server error or
+  a broken connection is tried once more, then the turn ends with a note
+  that says whether the request may have been billed; before, the turn went
+  back into the queue up to five times and ended as "Relay timeout after 5
+  attempts", each attempt a new billed request. When the second try works,
+  the reply notes that the first may have been billed as well. A relay
+  restart during the call no longer repeats it either.
+- **The relay's own image route is local only.** A paired relay's token can
+  no longer call it directly, past the queue.
+- **An agent's prompt header no longer reaches the image model.**
+- **Relay memory no longer grows while several agents stream long thinking
+  at the same time.** A few sessions thinking at length at once could make
+  the relay hold more and more memory until it ran out. Thinking still shows
+  live; a slow connection may skip some of the updates in between, and the
+  whole thought arrives when it ends and after a reconnect, as before.
+
+### Upgrade notes
+
+- **The first start takes a little longer on a big database.** Before it
+  listens, the relay copies its database to the backups folder, as before,
+  and migration 0039 creates the media index and queues every message for
+  it once: about 0.2 s per 200,000 messages on a small server. Migration
+  0040 adds two columns. Nothing else waits.
+- **The gallery fills in the background.** After the start the relay
+  indexes the older messages in slices of about 20 ms every half second,
+  in no particular order: about 3 minutes per 200,000 messages on a small
+  server, longer on a phone or with long messages. Until it ends, the
+  gallery shows what is indexed and "Indexing older messages… (N left)". A
+  restart picks up where it stopped.
+- **The daily cap for OpenAI images is on after the update**: USD 5 per
+  relay and day, in Settings → Providers → OpenAI (0 is no cap). Without an
+  OpenAI key nothing changes, and Check Usage shows no OpenAI images card
+  until something was booked in the month.
+- **Sessions still on 0.9.24's worker wait one worker start.** A session
+  whose worker still runs the old code is given a new worker before its
+  next message, as in 0.9.24. A Claude session's agent gets `images` and
+  `image` in `relay_tool` with its new worker.
+- **Mixed versions work together**, except for images across relays: a
+  0.9.25 relay refuses to send `images` or `image` to a paired 0.9.24 relay
+  and sends nothing, and a 0.9.24 relay cannot send them.
+- **Going back to 0.9.24** needs no database step. Install it with
+  `npm install -g @oar-sh/oar@0.9.24` (in a git checkout:
+  `git checkout v0.9.24`, then a relay restart). 0.9.24 ignores the media
+  index and the image defaults and has no daily image cap, so image turns
+  are not limited there. The index's triggers stay in the database and
+  queue the messages written on 0.9.24, which a later 0.9.25 indexes. To
+  remove the index, drop its two triggers first, then its three tables, as
+  `server/migrations/0039-media-index.mjs` describes; a table dropped
+  before its trigger breaks every new message.
+
 ## [0.9.24] — 2026-11-08
 
 Highlights: a much smaller install. The Claude and Cursor agent SDKs leave

package/README.md

@@ -45,29 +45,29 @@ flowchart LR
 <table>
 <tr>
 <td width="42%" rowspan="4" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.24" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-mobile.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/cfmail-mobile.png?v=0.9.25" alt="OAR on a phone: a finished agent turn in a conversation, with the composer below"></picture></a>
 <br><sub>On a phone: the same conversations, installable as an app.</sub>
 </td>
 <td width="58%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.24" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-agents.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/cfmail-agents.png?v=0.9.25" alt="Background subagents running in parallel in the task panel, each with live token counts, elapsed time, and its own Stop button"></picture></a>
 <br><sub>Agents working in parallel, each with live token counts and its own Stop.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.24" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-question.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/cfmail-question.png?v=0.9.25" alt="A question card in the middle of a turn: the agent offers several choices and a free-text reply"></picture></a>
 <br><sub>When the agent needs a decision, it asks, and waits for your answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.24" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
+<a href="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pingcf-thoughts.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/pingcf-thoughts.png?v=0.9.25" alt="An expanded Thoughts block showing the agent's reasoning above its reply"></picture></a>
 <br><sub>Read the reasoning, not just the answer.</sub>
 </td>
 </tr>
 <tr>
 <td valign="top">
-<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.24" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
+<a href="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-watching.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/pagewright-watching.png?v=0.9.25" alt="A session watching two other sessions: a finished reply arrives as a compact relay-event row, the watching 2 sessions list is open with Unsubscribe, and a request to also watch a session on a paired relay waits on an Allow / Deny card"></picture></a>
 <br><sub>Agents that watch agents: woken by events, approving nothing.</sub>
 </td>
 </tr>
@@ -100,7 +100,7 @@ The runtime (the *provider* in the UI) is chosen in **New Chat** and stays fixed
 | ------- | ---------- | ------------- |
 | [**GitHub Copilot**](docs/providers.md#github-copilot--engine-choice) (default) | GitHub's coding agent, with every model your Copilot plan offers | The Copilot CLI, signed in on the relay host |
 | [**OpenAI (BYOK)**](docs/providers.md#openai-byok-and-openai-image) | Copilot's agent against OpenAI or a compatible endpoint | Your own API key |
-| [**OpenAI Image**](docs/providers.md#openai-byok-and-openai-image) | A chat whose replies are images | The same key |
+| [**OpenAI Image**](docs/providers.md#openai-byok-and-openai-image) | A chat whose replies are images, with a daily spending cap; agents can use it too | The same key |
 | [**Claude**](docs/providers.md#claude-agent-sdk) | Claude Code on your machine | A Claude login, made from **⚙️ Settings** |
 | [**Claude API**](docs/providers.md#claude-api) | Claude Code on your machine, billed to a Claude Console API key; a Claude chat can switch between the two | A Claude Console API key |
 | [**Claude Cloud**](docs/providers.md#claude-cloud) (experimental) | Claude Code in a sandbox at Anthropic, on a GitHub repository | A claude.ai account with GitHub connected |
@@ -118,11 +118,11 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 <table>
 <tr>
 <td width="62%" valign="top">
-<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.24" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
+<a href="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/cfmail-steering.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/cfmail-steering.png?v=0.9.25" alt="A running Claude turn with a message steered into it mid-turn, the reply streaming with its tool calls, and the Steer button in the composer"></picture></a>
 <br><sub>Send a message while the agent works, and it steers the running turn.</sub>
 </td>
 <td width="38%" valign="top">
-<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.24" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
+<a href="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/usage-copilot-compact.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/usage-copilot-compact.png?v=0.9.25" alt="The GitHub Copilot card in Check Usage: premium requests and plan quota with reset dates, and the cost of the last turn"></picture></a>
 <br><sub>What each plan has left, in one place.</sub>
 </td>
 </tr>
@@ -134,12 +134,13 @@ API keys are entered in **⚙️ Settings** and stay on the relay host. The Clau
 - **Background work**: a task panel lists the commands and sub-agents that outlive a reply, each with its own **Stop** and its full record; a command's console shows its output live, says when it has gone quiet and counts a test run's passes and failures; the panel and its consoles come back after a relay restart, and a queued restart shows what it waits for and asks after a maximum wait ([Background tasks](docs/web-ui.md#background-tasks), [After a relay restart](docs/web-ui.md#after-a-relay-restart)).
 - **Choose how the agent works**: `ask`, `plan`, `agent` or `autopilot`, plus model and reasoning effort, per message, from the composer's **⚙** ([The composer](docs/web-ui.md#the-composer), [Relay modes](docs/web-ui.md#relay-modes)).
 - **Files and git**: browse the workspace, preview files, review git changes in a diff viewer, and publish a dev server as a preview link ([Files, git, and previews](docs/web-ui.md#files-git-and-previews), [preview servers](docs/preview-servers.md)).
-- **Usage and context**: plan limits and credits of every provider, the estimated spend of DeepSeek and Claude API keys, and what fills the model's context window ([Usage and context](docs/web-ui.md#usage-and-context)).
+- **Media**: the pictures and videos of a session, or of every session, in one gallery, with a file viewer that moves through all of them ([Media](docs/web-ui.md#media)).
+- **Usage and context**: plan limits and credits of every provider, the estimated spend of DeepSeek and Claude API keys and of OpenAI images, and what fills the model's context window ([Usage and context](docs/web-ui.md#usage-and-context)).
 - **Your conversations everywhere**: the history lives on the relay, drafts follow you from device to device, and conversations can be searched, archived, grouped and pinned ([The conversation list](docs/web-ui.md#the-conversation-list), [drafts](docs/web-ui.md#drafts-across-devices), [session groups](docs/web-ui.md#session-groups), [pins](docs/web-ui.md#pinned-messages)).
 - **Share** a conversation as a read-only link, hide single messages and the host's paths from it, and see when it was opened ([Sharing](docs/web-ui.md#sharing)).
 - **On your phone**: install OAR as an app and get push notifications; back walks through the conversations you opened, a pinch zooms the whole app, and held sideways it keeps a phone's layout ([Notifications and the app](docs/web-ui.md#notifications-and-the-app), [back and forward](docs/web-ui.md#back-and-forward), [zoom](docs/web-ui.md#zoom), [a phone held sideways](docs/web-ui.md#a-phone-held-sideways)).
 
-The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.24](CHANGELOG.md#0924--2026-11-08) as the latest.
+The full tour is in [Using the web UI](docs/web-ui.md); every setting and config key is in [Settings and configuration](docs/configuration.md). What changed in each release is in the [changelog](CHANGELOG.md), with [0.9.25](CHANGELOG.md#0925--2026-11-09) as the latest.
 
 ## Remote access
 
@@ -190,7 +191,7 @@ flowchart LR
 
 You stay in charge: per paired relay you decide whether agents may only read, also prompt, or do everything, and in the `ask` and `plan` modes every write asks you first. A subscription only notifies; it approves nothing.
 
-<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.24"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.24"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.24" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
+<p><a href="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.25"><picture><source media="(prefers-color-scheme: light)" srcset="https://oar.sh/assets/shots/pagewright-cross-relay.light.png?v=0.9.25"><img src="https://oar.sh/assets/shots/pagewright-cross-relay.png?v=0.9.25" alt="A session watching two sessions on a paired relay: a reply arrives as a relay-event row, and after a short outage the events the other relay kept arrive as one replayed row" width="720"></picture></a></p>
 
 How pairing, permissions and limits work is in [Agents working together](docs/agents-together.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oar-sh/oar",
-  "version": "0.9.24",
+  "version": "0.9.25",
   "type": "module",
   "description": "OAR — Open Agent Relay: drive your local coding agents from any browser",
   "license": "MIT",
@@ -25,6 +25,7 @@
     "server/",
     "!server/**/*.test.mjs",
     "!server/**/*-test-harness.mjs",
+    "!server/**/*-test-fixtures.mjs",
     "!server/**/fixtures/",
     "!server/README.md",
     "!server/data/",
@@ -36,6 +37,7 @@
     "shared/",
     "!shared/**/*.test.mjs",
     "!shared/**/*-test-harness.mjs",
+    "!shared/**/*-test-fixtures.mjs",
     "!shared/**/fixtures/",
     ".github/extensions/web-relay/",
     "!.github/extensions/web-relay/**/*.test.mjs",

package/server/claude-worker/claude-remote-relay-tool.mjs

@@ -15,6 +15,7 @@ import {
   REMOTE_RELAY_THINKING_DISPLAYS,
 } from '../../shared/remote-relay-contract.mjs';
 import { RELAY_ASK_URGENCIES } from '../../shared/relay-asks.mjs';
+import { OPENAI_IMAGE_BACKGROUNDS, OPENAI_IMAGE_OUTPUT_FORMATS } from '../../shared/openai-image-options.mjs';
 import {
   REMOTE_RELAY_CALL_FAILED,
   REMOTE_RELAY_TOOL_DESCRIPTION,
@@ -80,6 +81,20 @@ export const REMOTE_RELAY_TOOL_ZOD_SHAPE = {
   thinking_enabled: z.boolean().optional().describe(FIELDS.thinking_enabled.description),
   planOnly: z.boolean().optional().describe(FIELDS.planOnly.description),
   thinking_display: choice('thinking_display', REMOTE_RELAY_THINKING_DISPLAYS),
+  // A list, or one path as text, which the contract takes as well.
+  images: z.union([z.array(z.string()), z.string()]).optional().describe(FIELDS.images.description),
+  // Loose like quiet_hours: the contract's validator checks the values per
+  // model family and names an unknown key; the two fixed lists are enums as
+  // in the JSON schema.
+  image: z.looseObject({
+    size: z.string().optional().describe(FIELDS.image.properties.size.description),
+    quality: z.string().optional().describe(FIELDS.image.properties.quality.description),
+    count: z.number().optional().describe(FIELDS.image.properties.count.description),
+    output_format: z.enum([...OPENAI_IMAGE_OUTPUT_FORMATS]).optional().describe(FIELDS.image.properties.output_format.description),
+    background: z.enum([...OPENAI_IMAGE_BACKGROUNDS]).optional().describe(FIELDS.image.properties.background.description),
+    // Free text: the target relay knows its presets and resolves the name.
+    preset: z.string().optional().describe(FIELDS.image.properties.preset.description),
+  }).optional().describe(FIELDS.image.description),
   question_id: text('question_id'),
   // ask: the contract's validator refuses a question or detail that is too
   // long, or more than eight options, with a message the model can act on.

package/server/claude-worker/sdk-message-normalizer.mjs

@@ -555,6 +555,11 @@ export function createSdkMessageNormalizer() {
         const thinking = state.thinking.get(index);
         if (thinking) {
           thinking.text = capThought(thinking.text + String(event?.delta?.thinking || ''));
+          // Gated as stream text: a delta can be one token, and every update
+          // carries the whole thought. Past the cap the text stops changing,
+          // so nothing more goes out until the block's final frame.
+          if (!shouldEmitStreamUpdate(thinking.text, thinking.lastEmittedText)) return actions;
+          thinking.lastEmittedText = thinking.text;
           actions.push({
             channel: 'thought',
             payload: {
@@ -715,7 +720,7 @@ export function createSdkMessageNormalizer() {
       const assistantError = lastAssistantError;
       lastAssistantError = '';
       const apiErrorStatus = Number(sdkMessage.api_error_status ?? NaN);
-      return [{
+      return [...flushOpenThoughts(), {
         channel: 'result',
         payload: {
           text: String(sdkMessage.result || '').trim(),
@@ -745,6 +750,29 @@ export function createSdkMessageNormalizer() {
     return [];
   }
 
+  // A thinking block the turn left open (aborted, failed) never gets its
+  // final frame: what the delta gating held back goes out with the result,
+  // so the stored thought ends with the last delta.
+  function flushOpenThoughts() {
+    const actions = [];
+    for (const state of threads.values()) {
+      for (const thinking of state.thinking.values()) {
+        if (!thinking.text.trim() || thinking.text === thinking.lastEmittedText) continue;
+        thinking.lastEmittedText = thinking.text;
+        actions.push({
+          channel: 'thought',
+          payload: {
+            reasoningId: thinking.reasoningId,
+            text: thinking.text,
+            done: false,
+            subagentRunId: subagentRunIdFor(state.key === 'main' ? null : state.key),
+          },
+        });
+      }
+    }
+    return actions;
+  }
+
   function finalStreamText() {
     return threadState(null).streamText;
   }

package/server/copilot-worker/copilot-sdk-session-process.mjs

@@ -5005,10 +5005,12 @@ export function createCopilotSdkSessionRunner({
 
   /**
    * One image-model row (shared/worker-runtime/direct-openai-image.mjs). With
-   * an image operation the relay's execute route publishes the reply, the
-   * failure or the requeue itself; without one the shared helper publishes
-   * the reply, and a refusal by the provider is published here as the row's
-   * failure. Anything else requeues the row, as on the extension engine.
+   * an image operation the relay's execute route publishes the reply or the
+   * failure itself; without one the shared helper publishes the reply, and
+   * any failure of the request is published here as the row's failure, never
+   * requeued: the relay already retried it once, and a second run is billed
+   * again. Only an execute call that did not get through requeues the row
+   * (the route refuses to send an operation's request twice).
    */
   async function runDirectImageTurn(message) {
     const id = String(message.id || '');
@@ -5025,11 +5027,11 @@ export function createCopilotSdkSessionRunner({
       dbg('image turn', message.id, result.via, result.outcome);
     } catch (error) {
       if (isOpenAIImageTerminalError(error)) {
-        // A refusal by OpenAI, or a reply the relay could not process after
-        // OpenAI answered 2xx; the codes are the ones the relay's image
-        // operation uses for the same two cases.
-        const code = error.relayProcessing === true ? 'image-reply-unprocessed' : 'image-provider-rejected';
-        dbg(error.relayProcessing === true ? 'image reply not processed' : 'image turn refused by OpenAI', message.id, error.message);
+        // The relay's note and code (the ones its image operation uses for
+        // the same cases); an older relay names no code.
+        const code = error.imageCode
+          || (error.relayProcessing === true ? 'image-reply-unprocessed' : 'image-provider-rejected');
+        dbg('image turn failed', message.id, code, error.message);
         await publishResponse(message, {
           text: error.message,
           model: null,

package/server/cursor-worker/sdk-message-normalizer.mjs

@@ -170,6 +170,9 @@ export function createSdkMessageNormalizer() {
       deltaOwnsThinking = true;
       if (!openThought) openThought = { reasoningId: allocateThoughtId(), text: '' };
       openThought.text = capThought(openThought.text + String(update?.text || ''));
+      // Gated as stream text; the thought's close sends the whole text.
+      if (!shouldEmitStreamUpdate(openThought.text, openThought.lastEmittedText)) return actions;
+      openThought.lastEmittedText = openThought.text;
       actions.push({
         channel: 'thought',
         payload: {
@@ -201,6 +204,14 @@ export function createSdkMessageNormalizer() {
 
     if (type === 'turn-ended') {
       if (update?.usage && typeof update.usage === 'object') lastUsage = update.usage;
+      // A thought the turn left open: what the delta gating held back.
+      if (openThought?.text.trim() && openThought.text !== openThought.lastEmittedText) {
+        openThought.lastEmittedText = openThought.text;
+        actions.push({
+          channel: 'thought',
+          payload: { reasoningId: openThought.reasoningId, text: openThought.text, done: false, subagentRunId: null },
+        });
+      }
       return actions;
     }
 
@@ -231,6 +242,8 @@ export function createSdkMessageNormalizer() {
           state.openThought = { reasoningId: `cursor-thought-${runId}-${state.thoughtIndex++}`, text: '' };
         }
         state.openThought.text = capThought(state.openThought.text + String(nested.text || ''));
+        if (!shouldEmitStreamUpdate(state.openThought.text, state.openThought.lastEmittedText)) return actions;
+        state.openThought.lastEmittedText = state.openThought.text;
         actions.push({
           channel: 'thought',
           payload: {

package/server/db-schema.mjs

@@ -44,6 +44,8 @@ import { migrateConversationPlanOnly } from './migrations/0035-conversation-plan
 import { migrateTokenUsage } from './migrations/0036-token-usage.mjs';
 import { migrateRelayAsksQueueId } from './migrations/0037-relay-asks-queue-id.mjs';
 import { migrateTurnSeq } from './migrations/0038-turn-seq.mjs';
+import { migrateMediaIndex } from './migrations/0039-media-index.mjs';
+import { migrateImageSessionDefaults } from './migrations/0040-image-session-defaults.mjs';
 import { migrateImageConversationSchema } from './repositories/image-conversation-repository.mjs';
 
 // Mirrors DEFAULT_RELAY_MODE in server-runtime.mjs; used only by the one-time
@@ -1096,6 +1098,23 @@ try {
   console.warn(`[turn-seq] migration 0038 failed; retrying on next boot: ${error?.message || error}`);
 }
 
+// The media gallery index: tables, the two queue triggers on messages and a
+// one-time seed of the queue. The gallery works without it (empty), so a
+// failure is logged and retried next boot.
+try {
+  migrateMediaIndex(db);
+} catch (error) {
+  console.warn(`[media-index] migration 0039 failed; retrying on next boot: ${error?.message || error}`);
+}
+
+// An image session's own size/quality/count defaults. Image turns run on the
+// built-in defaults without it, so a failure is logged and retried next boot.
+try {
+  migrateImageSessionDefaults(db);
+} catch (error) {
+  console.warn(`[image-sessions] migration 0040 failed; retrying on next boot: ${error?.message || error}`);
+}
+
 const conversationColumns = db.prepare(`PRAGMA table_info(conversations)`).all().map((c) => c.name);
 if (!conversationColumns.includes('archived')) {
   db.exec(`ALTER TABLE conversations ADD COLUMN archived INTEGER NOT NULL DEFAULT 0`);

package/server/grok-worker/sdk-message-normalizer.mjs

@@ -148,6 +148,9 @@ export function createSdkMessageNormalizer() {
         openThought = { reasoningId: allocateThoughtId(), text: '' };
       }
       openThought.text = capThought(openThought.text + chunk);
+      // Gated as stream text; the thought's close sends the whole text.
+      if (!shouldEmitStreamUpdate(openThought.text, openThought.lastEmittedText)) return actions;
+      openThought.lastEmittedText = openThought.text;
       actions.push({
         channel: 'thought',
         payload: {

package/server/migrations/0039-media-index.mjs

@@ -0,0 +1,167 @@
+'use strict';
+
+/**
+ * Migration: the media gallery index.
+ *
+ * `media_items`: one row per picture, video or attached file of a message
+ * (services/media-extract.mjs decides what counts). Rows go with their
+ * message or conversation (foreign keys, ON DELETE CASCADE). `message_ts`
+ * copies the message time so the gallery pages by an index.
+ *
+ * `media_index_queue`: the ids of messages to (re)index. Two triggers on
+ * `messages` put a row id here on insert and when a column the index reads
+ * changes; they never parse anything, so the write path pays one small
+ * insert. The indexer (services/media-index-service.mjs) drains the queue in
+ * batches. `seq` grows on every re-queue, so a drain only removes the queue
+ * row it actually indexed.
+ *
+ * `media_index_meta`: the extractor version the queue was seeded for. When
+ * it is missing (first run) or older than MEDIA_EXTRACTOR_VERSION, every
+ * message is queued once and the version is stored; later boots seed nothing.
+ *
+ * Not in SCHEMA_SQL (db-schema.mjs): the triggers name columns that older
+ * migrations add. The triggers are checked on every boot and re-created when
+ * missing or different, like the FTS triggers.
+ *
+ * Additive and idempotent. Rolling back: drop the triggers first, then the
+ * tables (a trigger left pointing at a dropped table breaks message inserts):
+ *   DROP TRIGGER IF EXISTS media_index_on_insert;
+ *   DROP TRIGGER IF EXISTS media_index_on_update;
+ *   DROP TABLE IF EXISTS media_index_queue; DROP TABLE IF EXISTS media_items;
+ *   DROP TABLE IF EXISTS media_index_meta;
+ *
+ * Usage: node server/migrations/0039-media-index.mjs [path/to/oar.db]
+ */
+
+import { fileURLToPath } from 'url';
+import path from 'path';
+import process from 'process';
+import Database from 'better-sqlite3';
+import { cliDbPath } from '../services/database-file.mjs';
+import { MEDIA_EXTRACTOR_VERSION } from '../services/media-extract.mjs';
+
+export const MEDIA_INDEX_TRIGGERS = Object.freeze(['media_index_on_insert', 'media_index_on_update']);
+// Columns the index reads; a change to one re-queues the message.
+const WATCHED_COLUMNS = Object.freeze(['text', 'attachments', 'timestamp', 'role', 'kind', 'origin_json', 'conversation_id']);
+
+const QUEUE_UPSERT = `INSERT INTO media_index_queue (message_id, seq) VALUES (NEW.id, 0)
+    ON CONFLICT(message_id) DO UPDATE SET seq = seq + 1;`;
+
+function tableExists(db, name) {
+  return !!db.prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`).get(name);
+}
+
+function columnsOf(db, table) {
+  return db.prepare(`PRAGMA table_info(${table})`).all().map((column) => column.name);
+}
+
+export function mediaIndexTriggerSql(messageColumns) {
+  const watched = WATCHED_COLUMNS.filter((column) => messageColumns.includes(column));
+  return {
+    media_index_on_insert: `CREATE TRIGGER media_index_on_insert AFTER INSERT ON messages BEGIN
+    ${QUEUE_UPSERT}
+  END`,
+    media_index_on_update: `CREATE TRIGGER media_index_on_update AFTER UPDATE OF ${watched.join(', ')} ON messages BEGIN
+    ${QUEUE_UPSERT}
+  END`,
+  };
+}
+
+export function migrateMediaIndex(db) {
+  if (!tableExists(db, 'messages') || !tableExists(db, 'conversations')) {
+    return { applied: false, tablesCreated: 0, triggersCreated: 0, seeded: 0 };
+  }
+  let tablesCreated = 0;
+  let triggersCreated = 0;
+  let seeded = 0;
+  const run = db.transaction(() => {
+    if (!tableExists(db, 'media_items')) {
+      db.exec(`
+        CREATE TABLE media_items (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          message_id TEXT NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+          conversation_id TEXT NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+          ordinal INTEGER NOT NULL,
+          role TEXT NOT NULL,
+          sender TEXT NOT NULL,
+          origin TEXT NOT NULL,
+          locator_kind TEXT NOT NULL,
+          locator TEXT NOT NULL,
+          identity_key TEXT NOT NULL,
+          category TEXT NOT NULL,
+          media_kind TEXT NOT NULL,
+          mime TEXT,
+          name TEXT,
+          alt TEXT,
+          size_bytes INTEGER,
+          message_ts TEXT NOT NULL,
+          UNIQUE (message_id, ordinal)
+        );
+        CREATE INDEX idx_media_items_conv ON media_items(conversation_id, category, message_ts DESC, id DESC);
+        CREATE INDEX idx_media_items_all ON media_items(category, message_ts DESC, id DESC);
+        CREATE INDEX idx_media_items_identity ON media_items(identity_key);
+      `);
+      tablesCreated += 1;
+    }
+    if (!tableExists(db, 'media_index_queue')) {
+      db.exec(`
+        CREATE TABLE media_index_queue (
+          message_id TEXT PRIMARY KEY REFERENCES messages(id) ON DELETE CASCADE,
+          seq INTEGER NOT NULL DEFAULT 0
+        )
+      `);
+      tablesCreated += 1;
+    }
+    if (!tableExists(db, 'media_index_meta')) {
+      db.exec(`CREATE TABLE media_index_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);
+      tablesCreated += 1;
+    }
+
+    const expected = mediaIndexTriggerSql(columnsOf(db, 'messages'));
+    for (const name of MEDIA_INDEX_TRIGGERS) {
+      const row = db.prepare(`SELECT sql FROM sqlite_master WHERE type = 'trigger' AND name = ?`).get(name);
+      if (row?.sql === expected[name]) continue;
+      if (row) db.exec(`DROP TRIGGER ${name}`);
+      db.exec(expected[name]);
+      triggersCreated += 1;
+    }
+
+    const version = db.prepare(`SELECT value FROM media_index_meta WHERE key = 'extractor_version'`).get()?.value;
+    if (String(version || '') !== String(MEDIA_EXTRACTOR_VERSION)) {
+      seeded = db.prepare(`
+        INSERT INTO media_index_queue (message_id, seq)
+        SELECT id, 0 FROM messages WHERE true
+        ON CONFLICT(message_id) DO UPDATE SET seq = seq + 1
+      `).run().changes;
+      db.prepare(`INSERT INTO media_index_meta (key, value) VALUES ('extractor_version', ?)
+        ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(String(MEDIA_EXTRACTOR_VERSION));
+    }
+  });
+  run();
+  return { applied: tablesCreated + triggersCreated + seeded > 0, tablesCreated, triggersCreated, seeded };
+}
+
+export function migrate(dbPath, options = {}) {
+  const db = new Database(dbPath, options);
+  try {
+    return migrateMediaIndex(db);
+  } finally {
+    db.close();
+  }
+}
+
+const isMain = process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  try {
+    const dbPath = cliDbPath(process.argv[2], new URL('..', import.meta.url));
+    const result = migrate(dbPath);
+    console.log(`Migration 0039 on ${dbPath}`);
+    console.log(result.applied
+      ? `  media index: tables created ${result.tablesCreated}, triggers created ${result.triggersCreated}, messages queued ${result.seeded}`
+      : '  skipped: nothing to change');
+    process.exit(0);
+  } catch (err) {
+    console.error(`Migration 0039 failed: ${err?.message || err}`);
+    process.exit(1);
+  }
+}