@offerpilot/axiomruntime 0.0.2 → 0.0.4

package/README.md

@@ -1,6 +1,6 @@
-# AI Runtime（当前阶段：AI Gateway）
+# AxiomRuntime（当前阶段：Provider Gateway）
 
-本项目的长期目标是构建一套企业级 AI Runtime：让模型、Agent、记忆、知识、技能、工作流和工具在统一的运行、治理与学习体系中协作，并持续把个人经验沉淀为组织能力。
+本项目的长期目标是构建一套 AI Runtime：让模型、Agent、记忆、知识、技能、工作流和工具在统一的运行、治理与学习体系中协作，并持续把个人经验沉淀为可复用能力。
 
 Runtime 才是产品。Memory、Agent 和 LLM 都是可以替换和组合的能力模块。
 
@@ -10,19 +10,25 @@ Runtime 才是产品。Memory、Agent 和 LLM 都是可以替换和组合的能
 
 ## 文档导航
 
-- [中文文档总览](./docs/README.md)
-- [doc_2.0 文档层总览](./docs/README.md)
-- [中文使用指南](./docs/usage.md)
-- [HTML 命令手册](./docs/USAGE.html)
-- [整体架构与当前实现快照](./docs/00-overview.md)
+文档共三份，均标注实现状态（🟢 已实现 / 🟡 部分实现 / 🔴 规划中）：
 
-AI 与维护者使用的英文权威文档位于 `AGENTS.md`、`docs/AI_RUNTIME_ARCHITECTURE.md` 和 `docs/CONVENTIONS.md`；产品规范、宪法摘要、记忆/学习与 Telegram 设计等构成 `doc_2.0` 文档层（现已展开在 `docs/` 与 `docs/modules/` 下，索引见 `docs/README.md`）。
+| 文档 | 读者 | 内容 |
+|---|---|---|
+| [使用指南](./docs/usage.md) | 使用者 | 安装、上手、每个命令怎么用 |
+| [技术架构](./docs/architecture.md) | 开发者 | 分层设计、执行主链、所有权边界、Mermaid 图 |
+| [产品需求文档](./docs/prd.md) | 开发者 + 产品 | 定位、能力清单、发布计划、交付风险、验收标准 |
+
+另有 [HTML 命令手册](./docs/USAGE.html)，`ai help` 会直接打开。
+
+维护者与 AI 协作规则见 `AGENTS.md` 和 `CLAUDE.md`（英文）。
 
 ## 当前边界
 
 - 已交付：本地 Provider Gateway、Claude/Codex 启动与 fallback、Telegram、会话、用量、诊断和早期 Memory。
 - 演进中：统一 Runtime 执行上下文、自动学习与记忆治理、Skill/Capability 生命周期、插件体系。
-- 长期方向：组织与租户隔离、能力注册与共享、企业集成、Web/Desktop/API 治理界面。
+- 长期方向：组织与租户隔离、能力注册与共享、外部系统集成、Web/Desktop/API 治理界面。
+
+完整的已实现与规划对照见 [产品需求文档 §3](./docs/prd.md)。
 
 ## 通过 npm 安装
 
@@ -85,9 +91,9 @@ npm run build
 npm test
 ```
 
-## 内网 Runtime 服务
+## 本机 Runtime 服务
 
-常驻服务为其他应用提供两类受鉴权接口，同时保留现有 `ai` CLI 和 Telegram 行为：
+从源码进行本地开发或集成时，可以启动受鉴权的 Runtime HTTP 服务，同时保留现有 `ai` CLI 和 Telegram 行为：
 
 - `POST /v1/chat/completions`、`/v1/responses`、`/v1/embeddings`：OpenAI 兼容模型调用，按 provider 优先级、模型目录、健康度和熔断状态自动切换。
 - `POST /v1/agent/runs`：复用 Telegram 背后的 Claude/Codex Engine。只接受受控 `workspace_id`，默认 `read_only`，服务端限制并发和超时。
@@ -98,23 +104,7 @@ npm run build
 AI_GATEWAY_SERVER_TOKEN='replace-me' npm run server
 ```
 
-生产 Compose 位于 `deploy/docker-compose.prod.yml`，默认仅映射宿主机 `127.0.0.1:8020`，并加入外部 Docker 网络 `ai-runtime`。Provider 配置挂载到 `/var/lib/ai-gateway`，服务 Token 通过只读文件挂载，不写入镜像或仓库。
-
-### GitLab 自动部署
-
-默认分支提交通过测试后，GitLab CI 会构建以 commit SHA 标记的镜像，并由锁定当前项目的受保护 Runner（标签 `axiomruntime-prod`）部署到 `154.201.73.41:/opt/AxiomRuntime`。部署只操作 `axiomruntime` Compose 项目；健康检查失败时恢复上一镜像，不清理服务器上的其他容器或镜像。
-
-镜像构建会在一次性 build stage 中编译 `better-sqlite3` 原生 addon，再把裁掉开发依赖后的 production dependency tree 复制到相同 Node.js 版本的最终镜像；最终镜像不包含编译器。
-
-首次部署前，服务器必须已有 `/opt/AxiomRuntime/config/providers.json` 和 `/opt/AxiomRuntime/secrets/server-token`，且容器用户 `10001:10001` 可以读写配置目录。CI 只校验这些文件，不生成或覆盖凭据。
-
-Telegram 容器默认不启动，以免与现有 long polling 进程争抢消息。完成迁移并停止旧 Bot 后，在服务器 `/opt/AxiomRuntime/.env` 中设置：
-
-```dotenv
-COMPOSE_PROFILES=telegram
-```
-
-启用前还要把各 Bot 的 `defaultCwd` 改为容器内的 `/workspace/...`，对应宿主机 `/opt/AxiomRuntime/workspaces/...`。之后的自动部署会同时更新 Runtime API 和所有位于 `config/telegram/bots/*.json` 的 Telegram Bot。资源上限和工作目录可参考 `.env.server.example` 调整。
+项目不通过 GitLab CI 构建镜像或部署服务器。正式分发统一使用 npm：普通分支和合并请求运行测试，版本 tag 通过校验后发布 `@offerpilot/axiomruntime`，用户通过 `npm install --global @offerpilot/axiomruntime` 安装或升级。
 
 ## 本机注册 `ai` 命令
 
@@ -179,7 +169,7 @@ Telegram Bot 集成说明：
 
 - 多 Bot 使用 `ai telegram add <name>` 创建，并以统一的 `--bot <name>` 选择目标；例如 `ai telegram edit --bot ops`、`start|stop|status --bot ops`、`delete --bot ops`。裸 `ai telegram` 会先选操作再选 Bot，删除有二次确认；批量生命周期操作使用 `--all`。
 - `ai telegram config set <key> <value> --bot <name>` 只修改指定 Bot；旧位置参数写法继续兼容。
-- 如果本机不能直连 Telegram API，可设置 `ai telegram config set proxyUrl http://127.0.0.1:7890 --bot <name>`。
+- 如果本机不能直连 Telegram API，可设置 `ai telegram config set proxyUrl http://127.0.0.1:7890 --bot <name>`；代理地址需包含协议，交互式新增或编辑 Bot 时也会显示该完整示例。
 - Bot 首次 `/start` 或 `/reset` 会先选择工作路径，再选择 Claude Code/Codex，并展示当前会话、provider 和模型卡片。
 - Bot 会记录选择过的工作路径；自定义路径会按 `~/输入名称` 创建或复用。
 - Telegram 默认命令菜单只保留 `/claude`、`/codex`、`/reset`、`/cwd` 和 `/help`；选择 CLI 后，会在当前 chat 的 `/` 菜单追加该 CLI 的 slash 命令映射。
@@ -190,3 +180,4 @@ Telegram Bot 集成说明：
 
 - [docs/usage.md](./docs/usage.md)
 - [docs/USAGE.html](./docs/USAGE.html)
+- [docs/prd.md](./docs/prd.md) 的「已知限制」一节

package/dist/cli/commands/image.js

@@ -0,0 +1,75 @@
+import { readCache } from "../../core/config/cache-store.js";
+import { generateImage } from "../../core/images/image-generation-service.js";
+import { listProviders, refreshAllProviders } from "../../core/providers/provider-service.js";
+import { promptSelect, promptText } from "../prompts/prompt.js";
+export async function runImageCommand(args) {
+    await refreshAllProviders();
+    const [providers, cache] = await Promise.all([listProviders(), readCache()]);
+    const input = await resolveImageCommandInput(args, providers, cache.providers);
+    const result = await generateImage(input);
+    console.log(`Generated with ${result.provider} / ${result.model}`);
+    if (result.filePath)
+        console.log(`Image saved: ${result.filePath}`);
+    if (result.url)
+        console.log(`Image URL: ${result.url}`);
+    if (result.revisedPrompt)
+        console.log(`Revised prompt: ${result.revisedPrompt}`);
+}
+export async function resolveImageCommandInput(args, providers, providerCache, select = promptSelect, text = promptText) {
+    if (!providers.length) {
+        throw new Error("No providers configured. Run `ai add` first.");
+    }
+    const target = args[0]?.trim();
+    const namedProvider = target ? providers.find((provider) => provider.name === target) : undefined;
+    if (target && !namedProvider) {
+        const prompt = args.slice(1).join(" ").trim() || await text("Image prompt");
+        return { target, prompt: requirePrompt(prompt) };
+    }
+    const provider = namedProvider ?? await selectImageProvider(providers, providerCache, select);
+    const models = getProviderImageModels(provider, providerCache);
+    const secondArg = args[1]?.trim();
+    const hasExplicitModel = Boolean(secondArg && models.includes(secondArg));
+    const model = hasExplicitModel
+        ? secondArg
+        : target
+            ? getDefaultImageModel(provider, models)
+            : await selectImageModel(provider, models, select);
+    const promptArgs = hasExplicitModel ? args.slice(2) : args.slice(1);
+    const prompt = promptArgs.join(" ").trim() || await text("Image prompt");
+    return { provider: provider.name, model, prompt: requirePrompt(prompt) };
+}
+async function selectImageProvider(providers, providerCache, select) {
+    const availableProviders = providers.filter((provider) => getProviderImageModels(provider, providerCache).length);
+    if (!availableProviders.length) {
+        throw new Error("No configured provider has available image models. Run `ai status` to refresh model lists.");
+    }
+    const providerName = await select("Select image provider", availableProviders.map((provider) => ({
+        label: `${provider.name} / ${getProviderImageModels(provider, providerCache).length} models`,
+        value: provider.name
+    })));
+    return availableProviders.find((provider) => provider.name === providerName);
+}
+async function selectImageModel(provider, models, select) {
+    if (!models.length) {
+        throw new Error(`Provider ${provider.name} has no available image models. Run \`ai status\` first.`);
+    }
+    return select(`Select image model for ${provider.name}`, models.map((model) => ({ label: model, value: model })));
+}
+function getProviderImageModels(provider, providerCache) {
+    const cachedModels = providerCache[provider.name]?.models ?? [];
+    const models = cachedModels.length ? [...new Set(cachedModels)] : provider.model ? [provider.model] : [];
+    return provider.model && models.includes(provider.model)
+        ? [provider.model, ...models.filter((model) => model !== provider.model)]
+        : models;
+}
+function getDefaultImageModel(provider, models) {
+    if (provider.model && models.includes(provider.model))
+        return provider.model;
+    throw new Error(`Provider ${provider.name} has no usable default image model. Specify one of: ${models.join(", ") || "(none)"}.`);
+}
+function requirePrompt(value) {
+    const prompt = value.trim();
+    if (!prompt)
+        throw new Error("Image prompt is required.");
+    return prompt;
+}

package/dist/cli/commands/telegram.js

@@ -8,6 +8,7 @@ import { botExists, isBotRunning, isValidBotName, listBots, migrateLegacyConfig,
 import { ensureTelegramLogFile, readRecentTelegramLogLines } from "../../telegram/log.js";
 import { checkTelegramApi, getTelegramProxyUrl } from "../../telegram/network.js";
 import { promptConfirm, promptSelect, promptText } from "../prompts/prompt.js";
+export const TELEGRAM_PROXY_URL_PROMPT = "Proxy URL (include protocol, e.g. http://127.0.0.1:7890)";
 export async function runTelegramCommand(args) {
     const target = parseTelegramTargetArgs(args);
     const [subcommand, ...rest] = target.args;
@@ -202,7 +203,7 @@ async function addBot(nameArg) {
     if (!token.trim())
         throw new Error("Token is required.");
     const allowedUserIds = await promptText("Allowed user IDs (comma-separated, empty for allowAll)");
-    const proxyUrl = await promptText("Proxy URL (empty to skip)", { defaultValue: "" });
+    const proxyUrl = await promptText(`${TELEGRAM_PROXY_URL_PROMPT} (empty to skip)`, { defaultValue: "" });
     const config = {
         token: token.trim(),
         ...(proxyUrl.trim() ? { proxyUrl: proxyUrl.trim() } : {})
@@ -494,7 +495,7 @@ async function editBotConfigInteractive(name) {
         const current = String(config[field] ?? "");
         const value = field === "token"
             ? await promptText("token (leave empty to keep current)") || current
-            : await promptText(field, { defaultValue: current });
+            : await promptText(field === "proxyUrl" ? TELEGRAM_PROXY_URL_PROMPT : field, { defaultValue: current });
         config = await setBotConfigValue(name, field, value);
     }
 }
@@ -539,7 +540,7 @@ async function editTelegramConfigInteractive() {
         const current = String(config[field] ?? "");
         const value = field === "token"
             ? await promptText("token (leave empty to keep current)") || current
-            : await promptText(field, { defaultValue: current });
+            : await promptText(field === "proxyUrl" ? TELEGRAM_PROXY_URL_PROMPT : field, { defaultValue: current });
         config = await setTelegramConfigValue(field, value);
     }
 }

package/dist/cli/index.js

@@ -4,6 +4,7 @@ import { runContextCommand } from "./commands/context.js";
 import { runDoctorCommand } from "./commands/doctor.js";
 import { runProviderDeleteCommand, runProviderEditCommand } from "./commands/edit.js";
 import { runHelpCommand } from "./commands/help.js";
+import { runImageCommand } from "./commands/image.js";
 import { runListCommand } from "./commands/list.js";
 import { runLogCommand } from "./commands/log.js";
 import { runMemoryCommand } from "./commands/memory.js";
@@ -53,7 +54,7 @@ async function main() {
     console.error("Run `ai help` for usage.");
     process.exitCode = 1;
 }
-function sanitizeArgs(command, args) {
+export function sanitizeArgs(command, args) {
     const redactedProxyArgs = redactCodexProxyCommandArgs(command, args);
     if (redactedProxyArgs)
         return redactedProxyArgs;
@@ -69,6 +70,9 @@ function sanitizeArgs(command, args) {
     if (command === "telegram") {
         return maskTelegramConfigSecretArgs(args);
     }
+    if (command === "image" && args.length > 1) {
+        return [args[0], `[prompt ${args.slice(1).join(" ").length} chars]`];
+    }
     return args.map((arg, index) => {
         const previous = args[index - 1]?.toLowerCase();
         if (previous === "--api-key" || previous === "--apikey" || previous === "--key") {
@@ -136,7 +140,7 @@ function maskSecretArg(value) {
     return `${value.slice(0, 4)}****${value.slice(-4)}`;
 }
 async function runInteractive() {
-    const interactiveCommandNames = ["setup", "use", "set", "add", "memory", "telegram", "status", "session", "report", "doctor", "log", "context", "help", "last"];
+    const interactiveCommandNames = ["setup", "use", "image", "set", "add", "memory", "telegram", "status", "session", "report", "doctor", "log", "context", "help", "last"];
     const command = await promptSelect("AI Gateway", [
         ...interactiveCommandNames
             .flatMap((name) => {
@@ -255,6 +259,11 @@ function registerBuiltInCommands() {
         description: "use",
         run: (args) => runUseCommand(args)
     });
+    registerCliCommand({
+        name: "image",
+        description: "generate image",
+        run: (args) => runImageCommand(args)
+    });
     registerCliCommand({
         name: "set",
         description: "set Codex provider or proxy",

package/dist/core/context/context-service.js

@@ -28,9 +28,9 @@ const DOC_CANDIDATES = [
     "README.md",
     "AGENTS.md",
     "CLAUDE.md",
-    "docs/00-overview.md",
-    "docs/CONVENTIONS.md",
-    "docs/usage.md"
+    "docs/usage.md",
+    "docs/architecture.md",
+    "docs/prd.md"
 ];
 export async function generateProjectContext(root = getProjectRoot()) {
     const content = [

package/dist/core/images/image-generation-service.js

@@ -0,0 +1,258 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { isProviderCircuitOpen, readCache, recordProviderRuntimeFailure, recordProviderRuntimeSuccess } from "../config/cache-store.js";
+import { readProviders } from "../config/providers-store.js";
+import { writeLog } from "../logs/log-service.js";
+import { startOpenAiUsageProxy } from "../runner/openai-usage-proxy.js";
+import { isRecord } from "../utils/is-record.js";
+const IMAGE_REQUEST_TIMEOUT_MS = 120_000;
+const MAX_IMAGE_RESPONSE_BYTES = 32 * 1024 * 1024;
+const MAX_IMAGE_BYTES = 20 * 1024 * 1024;
+export async function resolveImageProviderCandidates(selection) {
+    const target = typeof selection === "string" ? selection.trim() : "";
+    let providerName = typeof selection === "string" ? "" : selection.providerName?.trim() ?? "";
+    let requestedModel = typeof selection === "string" ? "" : selection.model?.trim() ?? "";
+    if (!target && !providerName && !requestedModel)
+        throw new Error("Image provider or model is required.");
+    const [providers, cache] = await Promise.all([readProviders(), readCache()]);
+    if (!providers.length) {
+        throw new Error("No providers configured. Run `ai add` first.");
+    }
+    if (target) {
+        const targetProvider = providers.find((provider) => provider.name === target);
+        if (targetProvider)
+            providerName = targetProvider.name;
+        else
+            requestedModel = target;
+    }
+    const preferredProvider = providerName ? providers.find((provider) => provider.name === providerName) : undefined;
+    if (providerName && !preferredProvider) {
+        throw new Error(`Provider not found: ${providerName}`);
+    }
+    const targetModel = requestedModel || preferredProvider?.model.trim() || "";
+    if (!targetModel) {
+        throw new Error(`Provider ${providerName} has no default image model. Configure its model first.`);
+    }
+    const candidates = providers.flatMap((provider) => {
+        const cached = cache.providers[provider.name];
+        if (isProviderCircuitOpen(cached))
+            return [];
+        if (cached?.status === "error" && !cached.circuitOpenUntil)
+            return [];
+        const knownModels = cached?.models ?? [];
+        const offersModel = knownModels.includes(targetModel)
+            || (!knownModels.length && provider.model === targetModel);
+        return offersModel ? [{ provider, model: targetModel }] : [];
+    });
+    if (!preferredProvider)
+        return candidates;
+    return [
+        ...candidates.filter((candidate) => candidate.provider.name === preferredProvider.name),
+        ...candidates.filter((candidate) => candidate.provider.name !== preferredProvider.name)
+    ];
+}
+export async function generateImage(input) {
+    const prompt = input.prompt.trim();
+    if (!prompt)
+        throw new Error("Image prompt is required.");
+    const selection = input.target ?? { providerName: input.provider, model: input.model };
+    const candidates = await resolveImageProviderCandidates(selection);
+    if (!candidates.length) {
+        const selectionName = input.target ?? input.provider ?? input.model ?? "(unknown)";
+        throw new Error(`No usable provider offers image model for ${selectionName}. Run \`ai status\` to refresh model lists.`);
+    }
+    const failures = [];
+    for (const candidate of candidates) {
+        try {
+            const result = await generateWithProvider(candidate, prompt, input.outputDir ?? process.cwd());
+            await recordProviderRuntimeSuccess(candidate.provider.name);
+            return result;
+        }
+        catch (error) {
+            const message = summarizeError(error);
+            failures.push(`${candidate.provider.name}: ${message}`);
+            await recordProviderRuntimeFailure(candidate.provider.name, message);
+            await writeLog({
+                level: "warn",
+                category: "provider",
+                action: "image_generation_provider_failed",
+                message: `Image generation failed for ${candidate.provider.name} / ${candidate.model}: ${message}`,
+                metadata: { provider: candidate.provider.name, model: candidate.model }
+            });
+        }
+    }
+    throw new Error(`Image generation failed. ${failures.join("; ")}`);
+}
+async function generateWithProvider(candidate, prompt, outputDir) {
+    const usageProxy = await startOpenAiUsageProxy({
+        provider: candidate.provider,
+        model: candidate.model,
+        tool: "image",
+        engine: "codex",
+        upstreamHeadersTimeoutMs: IMAGE_REQUEST_TIMEOUT_MS
+    });
+    try {
+        const response = await fetchWithTimeout(`${usageProxy.baseUrl}/images/generations`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${candidate.provider.apiKey}`,
+                "content-type": "application/json"
+            },
+            body: JSON.stringify({ model: candidate.model, prompt, n: 1 })
+        });
+        const text = await readBoundedResponseText(response, MAX_IMAGE_RESPONSE_BYTES);
+        const payload = parseJsonResponse(text);
+        if (!response.ok) {
+            throw new Error(readProviderError(payload) ?? `Provider returned HTTP ${response.status}.`);
+        }
+        const image = readFirstImage(payload);
+        if (!image)
+            throw new Error("Provider response did not contain an image.");
+        const baseResult = {
+            provider: candidate.provider.name,
+            model: candidate.model,
+            ...(image.revisedPrompt ? { revisedPrompt: image.revisedPrompt } : {})
+        };
+        if (image.base64) {
+            const buffer = decodeImage(image.base64);
+            const extension = detectImageExtension(buffer);
+            const filePath = await writeImageFile(outputDir, buffer, extension);
+            await writeLog({
+                category: "usage",
+                action: "image_generated",
+                message: `Generated image with ${candidate.provider.name} / ${candidate.model}.`,
+                metadata: { provider: candidate.provider.name, model: candidate.model, filePath, bytes: buffer.length }
+            });
+            return { ...baseResult, filePath };
+        }
+        await writeLog({
+            category: "usage",
+            action: "image_generated_url",
+            message: `Generated image URL with ${candidate.provider.name} / ${candidate.model}.`,
+            metadata: { provider: candidate.provider.name, model: candidate.model, urlHost: new URL(image.url).host }
+        });
+        return { ...baseResult, url: image.url };
+    }
+    finally {
+        await usageProxy.close().catch(() => undefined);
+    }
+}
+async function fetchWithTimeout(url, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), IMAGE_REQUEST_TIMEOUT_MS);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function readBoundedResponseText(response, maxBytes) {
+    const contentLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        throw new Error(`Provider image response exceeds ${maxBytes} bytes.`);
+    }
+    if (!response.body)
+        return "";
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of response.body) {
+        const buffer = Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > maxBytes)
+            throw new Error(`Provider image response exceeds ${maxBytes} bytes.`);
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks, bytes).toString("utf8");
+}
+function parseJsonResponse(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error("Provider returned an invalid image response.");
+    }
+}
+function readFirstImage(payload) {
+    if (!isRecord(payload) || !Array.isArray(payload.data) || !isRecord(payload.data[0]))
+        return null;
+    const item = payload.data[0];
+    const base64 = typeof item.b64_json === "string" && item.b64_json.trim() ? item.b64_json.trim() : undefined;
+    const url = typeof item.url === "string" && isSafeImageUrl(item.url) ? item.url : undefined;
+    const revisedPrompt = typeof item.revised_prompt === "string" && item.revised_prompt.trim()
+        ? item.revised_prompt.trim()
+        : undefined;
+    if (!base64 && !url)
+        return null;
+    return { base64, url, revisedPrompt };
+}
+function isSafeImageUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password;
+    }
+    catch {
+        return false;
+    }
+}
+function decodeImage(value) {
+    const normalized = value.replace(/\s+/g, "");
+    if (!normalized || normalized.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(normalized)) {
+        throw new Error("Provider returned invalid base64 image data.");
+    }
+    const buffer = Buffer.from(normalized, "base64");
+    if (!buffer.length)
+        throw new Error("Provider returned an empty image.");
+    if (buffer.length > MAX_IMAGE_BYTES)
+        throw new Error(`Generated image exceeds ${MAX_IMAGE_BYTES} bytes.`);
+    return buffer;
+}
+function detectImageExtension(buffer) {
+    if (buffer.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return "png";
+    if (buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff)
+        return "jpg";
+    if (buffer.subarray(0, 4).toString("ascii") === "RIFF" && buffer.subarray(8, 12).toString("ascii") === "WEBP")
+        return "webp";
+    if (["GIF87a", "GIF89a"].includes(buffer.subarray(0, 6).toString("ascii")))
+        return "gif";
+    throw new Error("Provider returned an unsupported image format.");
+}
+async function writeImageFile(outputDir, buffer, extension) {
+    const resolvedDir = path.resolve(outputDir);
+    await fs.mkdir(resolvedDir, { recursive: true });
+    const fileName = `axiom-image-${formatTimestamp(new Date())}-${randomUUID().slice(0, 8)}.${extension}`;
+    const filePath = path.join(resolvedDir, fileName);
+    const temporaryPath = path.join(resolvedDir, `.${fileName}.${process.pid}.tmp`);
+    try {
+        await fs.writeFile(temporaryPath, buffer, { mode: 0o600, flag: "wx" });
+        await fs.rename(temporaryPath, filePath);
+        return filePath;
+    }
+    catch (error) {
+        await fs.rm(temporaryPath, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+function formatTimestamp(date) {
+    return date.toISOString().replace(/[-:]/g, "").replace(/\..+$/, "").replace("T", "-");
+}
+function readProviderError(payload) {
+    if (!isRecord(payload))
+        return null;
+    const error = payload.error;
+    if (typeof error === "string" && error.trim())
+        return error.trim().slice(0, 500);
+    if (isRecord(error) && typeof error.message === "string" && error.message.trim()) {
+        return error.message.trim().slice(0, 500);
+    }
+    return typeof payload.message === "string" && payload.message.trim()
+        ? payload.message.trim().slice(0, 500)
+        : null;
+}
+function summarizeError(error) {
+    if (error instanceof Error && error.name === "AbortError")
+        return "Image request timed out.";
+    return (error instanceof Error ? error.message : String(error)).slice(0, 500);
+}

package/dist/core/integrations/codex-provider-config.js

@@ -5,6 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import lockfile from "proper-lockfile";
 import { resolveToolCommand } from "../runner/command-resolver.js";
+import { getRunnerEngine } from "../runner/engine-registry.js";
 const LOCK_OPTIONS = {
     realpath: false,
     stale: 10_000,
@@ -128,6 +129,7 @@ export function buildCodexProviderConfig(current, provider, providerId, model =
     if (!provider.apiKey.trim())
         throw new Error(`Provider ${provider.name} has no API key.`);
     const selectedModel = assertCodexGptModel(model);
+    const baseUrl = getRunnerEngine("codex").normalizeBaseUrl(provider.baseUrl);
     const eol = current.includes("\r\n") ? "\r\n" : "\n";
     let next = removeProviderTables(current, providerId);
     next = setTopLevelTomlString(next, "cli_auth_credentials_store", "file");
@@ -136,9 +138,8 @@ export function buildCodexProviderConfig(current, provider, providerId, model =
     const table = [
         `[model_providers.${providerId}]`,
         `name = ${tomlString(provider.name)}`,
-        `base_url = ${tomlString(provider.baseUrl.trim().replace(/\/+$/, ""))}`,
+        `base_url = ${tomlString(baseUrl)}`,
         `env_key = ${tomlString("OPENAI_API_KEY")}`,
-        "requires_openai_auth = true",
         `wire_api = ${tomlString("responses")}`
     ].join(eol);
     return `${next.trimEnd()}${eol}${eol}${table}${eol}`;

package/dist/core/runner/engine-registry.js

@@ -78,8 +78,6 @@ registerRunnerEngine({
             "-c",
             `model_providers.${providerId}.env_key=${tomlString("OPENAI_API_KEY")}`,
             "-c",
-            `model_providers.${providerId}.requires_openai_auth=true`,
-            "-c",
             `model_providers.${providerId}.wire_api=${tomlString("responses")}`,
             "--model",
             model

package/dist/core/runner/openai-usage-http.js

@@ -14,20 +14,22 @@ const RESPONSE_HEADERS_TO_DROP = new Set([
     "content-encoding",
     "content-length"
 ]);
-export function buildUpstreamUrl(upstreamBaseUrl, incomingUrl) {
+export function buildUpstreamUrl(upstreamBaseUrl, incomingUrl, options = {}) {
     const local = new URL(incomingUrl, "http://127.0.0.1");
     let suffix = local.pathname;
-    if (suffix === "/v1") {
-        suffix = "";
-    }
-    else if (suffix.startsWith("/v1/")) {
-        suffix = suffix.slice(3);
+    if (options.stripV1Prefix !== false) {
+        if (suffix === "/v1") {
+            suffix = "";
+        }
+        else if (suffix.startsWith("/v1/")) {
+            suffix = suffix.slice(3);
+        }
     }
     const upstream = new URL(`${upstreamBaseUrl.replace(/\/+$/, "")}${suffix}`);
     upstream.search = local.search;
     return upstream.toString();
 }
-export function buildUpstreamHeaders(headers, apiKey) {
+export function buildUpstreamHeaders(headers, apiKey, options = {}) {
     const next = {};
     for (const [key, value] of Object.entries(headers)) {
         const normalized = key.toLowerCase();
@@ -40,7 +42,12 @@ export function buildUpstreamHeaders(headers, apiKey) {
             next[key] = value;
         }
     }
-    next.authorization = `Bearer ${apiKey}`;
+    if (options.includeAuthorization !== false) {
+        next.authorization = `Bearer ${apiKey}`;
+    }
+    if (options.includeAnthropicApiKey) {
+        next["x-api-key"] = apiKey;
+    }
     next["accept-encoding"] = "identity";
     return next;
 }
@@ -53,21 +60,57 @@ export function writeResponseHead(res, response) {
         }
     }
 }
-export async function streamResponse(response, res) {
+export async function streamResponse(response, res, options = {}) {
+    const maxCaptureBytes = normalizeCaptureLimit(options.maxCaptureBytes);
     const chunks = [];
     let capturedBytes = 0;
+    const tailChunks = [];
+    let tailBytes = 0;
+    let responseBytes = 0;
+    const tailLimit = Math.floor(maxCaptureBytes / 2);
     if (!response.body)
         return Buffer.alloc(0);
     for await (const chunk of response.body) {
         const buffer = Buffer.from(chunk);
-        if (capturedBytes < MAX_USAGE_CAPTURE_BYTES) {
-            const remaining = MAX_USAGE_CAPTURE_BYTES - capturedBytes;
+        responseBytes += buffer.length;
+        if (capturedBytes < maxCaptureBytes) {
+            const remaining = maxCaptureBytes - capturedBytes;
             chunks.push(buffer.length > remaining ? buffer.subarray(0, remaining) : buffer);
             capturedBytes += Math.min(buffer.length, remaining);
         }
+        tailBytes = appendTailChunk(tailChunks, buffer, tailLimit, tailBytes);
         res.write(buffer);
     }
-    return Buffer.concat(chunks);
+    const captured = Buffer.concat(chunks, capturedBytes);
+    if (responseBytes <= maxCaptureBytes)
+        return captured;
+    return Buffer.concat([
+        captured.subarray(0, tailLimit),
+        Buffer.from("\n"),
+        Buffer.concat(tailChunks, tailBytes)
+    ]);
+}
+function normalizeCaptureLimit(value) {
+    if (!Number.isFinite(value) || value === undefined || value <= 0)
+        return MAX_USAGE_CAPTURE_BYTES;
+    return Math.max(1024, Math.floor(value));
+}
+function appendTailChunk(chunks, buffer, limit, currentBytes) {
+    if (buffer.length >= limit) {
+        chunks.splice(0, chunks.length, buffer.subarray(buffer.length - limit));
+        return limit;
+    }
+    chunks.push(buffer);
+    let bytes = currentBytes + buffer.length;
+    while (chunks.length && bytes - chunks[0].length >= limit) {
+        bytes -= chunks.shift().length;
+    }
+    if (bytes > limit && chunks.length) {
+        const excess = bytes - limit;
+        chunks[0] = chunks[0].subarray(excess);
+        bytes = limit;
+    }
+    return bytes;
 }
 export async function readRequestBody(req) {
     const chunks = [];