@offerpilot/axiomruntime 0.0.2 → 0.0.4

package/dist/core/runner/openai-usage-proxy.js

@@ -1 +1,2 @@
 export { startOpenAiUsageProxy } from "./openai-usage-server.js";
+export { sumKnownProxyCosts, sumProxyUsage } from "./openai-usage-summary.js";

package/dist/core/runner/openai-usage-recording.js

@@ -59,15 +59,47 @@ export async function recordUsageFromResponse(input) {
 }
 function extractBestUsageCandidate(text, contentType, fallbackModel) {
     const values = contentType.includes("text/event-stream") ? parseSseValues(text) : parseJsonValues(text);
-    let best = null;
+    const candidates = [];
     for (const value of values) {
-        for (const candidate of collectUsageCandidates(value, fallbackModel)) {
-            if (!best || candidate.usage.totalTokens >= best.usage.totalTokens) {
-                best = candidate;
-            }
+        candidates.push(...collectUsageCandidates(value, fallbackModel));
+    }
+    return mergeUsageCandidates(candidates, fallbackModel);
+}
+function mergeUsageCandidates(candidates, fallbackModel) {
+    if (!candidates.length)
+        return null;
+    let inputTokens = 0;
+    let outputTokens = 0;
+    let totalTokens = 0;
+    let cacheReadInputTokens;
+    let model = fallbackModel;
+    let modelCandidateTokens = -1;
+    let costUsd;
+    for (const candidate of candidates) {
+        inputTokens = Math.max(inputTokens, candidate.usage.inputTokens);
+        outputTokens = Math.max(outputTokens, candidate.usage.outputTokens);
+        totalTokens = Math.max(totalTokens, candidate.usage.totalTokens);
+        if (candidate.usage.cacheReadInputTokens !== undefined) {
+            cacheReadInputTokens = Math.max(cacheReadInputTokens ?? 0, candidate.usage.cacheReadInputTokens);
+        }
+        if (candidate.usage.totalTokens >= modelCandidateTokens) {
+            model = candidate.model;
+            modelCandidateTokens = candidate.usage.totalTokens;
+        }
+        if (candidate.costUsd !== undefined) {
+            costUsd = Math.max(costUsd ?? 0, candidate.costUsd);
         }
     }
-    return best;
+    return {
+        model,
+        usage: {
+            inputTokens,
+            outputTokens,
+            totalTokens: Math.max(totalTokens, inputTokens + outputTokens),
+            ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {})
+        },
+        ...(costUsd !== undefined ? { costUsd } : {})
+    };
 }
 function parseJsonValues(text) {
     const trimmed = text.trim();

package/dist/core/runner/openai-usage-server.js

@@ -8,7 +8,8 @@ import { getToolBaseUrl } from "./tool-runner.js";
 const DEFAULT_UPSTREAM_HEADERS_TIMEOUT_MS = 45_000;
 const MAX_CONSECUTIVE_HEADERS_TIMEOUTS = 2;
 export async function startOpenAiUsageProxy(input) {
-    const upstreamBaseUrl = getToolBaseUrl("codex", input.provider);
+    const engine = input.engine ?? (input.tool === "claude" ? "claude" : "codex");
+    const upstreamBaseUrl = getToolBaseUrl(engine, input.provider);
     const upstreamHeadersTimeoutMs = normalizePositiveTimeout(input.upstreamHeadersTimeoutMs, DEFAULT_UPSTREAM_HEADERS_TIMEOUT_MS);
     // Codex already retries failed Responses requests. Give those retries fresh
     // upstream connections so a stale gateway keep-alive socket cannot poison an
@@ -50,7 +51,7 @@ export async function startOpenAiUsageProxy(input) {
             requestModel = extractRequestModel(requestBody) ?? input.model;
             requestBytes = requestBody.length;
             requestShape = summarizeRequestShape(requestBody);
-            const responsesStream = isResponsesStreamRequest(req.url ?? "/", requestBody);
+            const responsesStream = engine === "codex" && isResponsesStreamRequest(req.url ?? "/", requestBody);
             void writeLog({
                 category: "usage",
                 action: "openai_usage_proxy_request",
@@ -62,7 +63,9 @@ export async function startOpenAiUsageProxy(input) {
                     path: new URL(req.url ?? "/", "http://127.0.0.1").pathname
                 }
             });
-            const upstreamUrl = buildUpstreamUrl(upstreamBaseUrl, req.url ?? "/");
+            const upstreamUrl = buildUpstreamUrl(upstreamBaseUrl, req.url ?? "/", {
+                stripV1Prefix: engine === "codex"
+            });
             upstreamPath = new URL(upstreamUrl).pathname;
             if (consecutiveHeadersTimeouts >= MAX_CONSECUTIVE_HEADERS_TIMEOUTS) {
                 await writeLog({
@@ -87,7 +90,10 @@ export async function startOpenAiUsageProxy(input) {
             }
             const upstreamResponse = await fetch(upstreamUrl, {
                 method: req.method,
-                headers: buildUpstreamHeaders(req.headers, input.provider.apiKey),
+                headers: buildUpstreamHeaders(req.headers, input.provider.apiKey, {
+                    includeAnthropicApiKey: engine === "claude",
+                    includeAuthorization: engine !== "claude"
+                }),
                 body: requestBody.length && methodMayHaveBody(req.method) ? requestBody : undefined,
                 dispatcher: upstreamDispatcher
             });
@@ -150,7 +156,9 @@ export async function startOpenAiUsageProxy(input) {
                 return;
             }
             writeResponseHead(res, upstreamResponse);
-            const captured = await streamResponse(upstreamResponse, res);
+            const captured = await streamResponse(upstreamResponse, res, {
+                maxCaptureBytes: input.tool === "image" ? 32 * 1024 * 1024 : undefined
+            });
             const recordedUsage = await recordUsageFromResponse({
                 text: captured.toString("utf8"),
                 contentType: upstreamResponse.headers.get("content-type") ?? "",
@@ -208,7 +216,7 @@ export async function startOpenAiUsageProxy(input) {
         throw new Error("Failed to start AI Gateway OpenAI proxy.");
     }
     return {
-        baseUrl: `http://127.0.0.1:${address.port}/v1`,
+        baseUrl: `http://127.0.0.1:${address.port}${engine === "codex" ? "/v1" : ""}`,
         async close() {
             const closeServer = server.listening
                 ? new Promise((resolve, reject) => {

package/dist/core/runner/openai-usage-summary.js

@@ -0,0 +1,18 @@
+export function sumKnownProxyCosts(records) {
+    const knownCosts = records
+        .map((record) => record.costUsd)
+        .filter((cost) => typeof cost === "number" && Number.isFinite(cost) && cost >= 0);
+    if (!knownCosts.length)
+        return undefined;
+    return Number(knownCosts.reduce((sum, cost) => sum + cost, 0).toFixed(8));
+}
+export function sumProxyUsage(records) {
+    if (!records.length)
+        return undefined;
+    return records.reduce((sum, record) => ({
+        inputTokens: sum.inputTokens + record.usage.inputTokens,
+        outputTokens: sum.outputTokens + record.usage.outputTokens,
+        totalTokens: sum.totalTokens + record.usage.totalTokens,
+        cacheReadInputTokens: (sum.cacheReadInputTokens ?? 0) + (record.usage.cacheReadInputTokens ?? 0)
+    }), { inputTokens: 0, outputTokens: 0, totalTokens: 0, cacheReadInputTokens: 0 });
+}

package/dist/core/runner/tool-runner.js

@@ -7,6 +7,7 @@ import { writeLog } from "../logs/log-service.js";
 import { isRecord } from "../utils/is-record.js";
 import { resolveToolCommand } from "./command-resolver.js";
 import { getRunnerEngine } from "./engine-registry.js";
+import { startOpenAiUsageProxy } from "./openai-usage-proxy.js";
 import { CLAUDE_ROOT_PERMISSION_WARNING, resolveClaudePermissionMode } from "./claude-permission-policy.js";
 import { finishSession, startSession } from "../sessions/session-service.js";
 export async function runTool(tool, provider, model, options = {}) {
@@ -21,55 +22,101 @@ export async function runTool(tool, provider, model, options = {}) {
         console.warn(`Warning: ${launchPolicy.warning}`);
     }
     const effectiveProvider = launchPolicy.provider;
-    const env = buildRunnerEnv(tool, effectiveProvider, model);
-    const temporaryFiles = [];
-    const claudeSettingsPath = engine.requiresSettingsFile
-        ? writeTemporaryClaudeSettings(effectiveProvider, { permissionMode: launchPolicy.claudeSettingsPermissionMode })
-        : null;
-    if (claudeSettingsPath)
-        temporaryFiles.push(claudeSettingsPath);
-    const args = buildRunnerArgs(tool, effectiveProvider, model, claudeSettingsPath);
-    const effectiveBaseUrl = getToolBaseUrl(tool, effectiveProvider);
-    await writeLog({
-        category: "usage",
-        action: "tool_spawn",
-        message: `Spawning ${tool}: ${provider.name} / ${model}`,
-        metadata: {
-            tool,
-            provider: provider.name,
-            model,
-            mode: effectiveProvider.mode,
-            configuredMode: provider.mode,
-            permissionConstraint: launchPolicy.reason,
-            baseUrl: effectiveBaseUrl,
-            configuredBaseUrl: provider.baseUrl,
-            apiKeyFingerprint: getSecretFingerprint(provider.apiKey),
-            command,
-            args,
-            authInjection: engine.authInjection
-        }
-    });
-    const session = await startSession({
-        tool,
+    const usageProxy = await startOpenAiUsageProxy({
         provider: effectiveProvider,
         model,
-        projectPath: process.cwd(),
-        fallbackFrom: options.fallbackFrom ?? null
+        tool,
+        engine: tool
     });
+    const temporaryFiles = [];
+    const setup = await (async () => {
+        try {
+            const routedProvider = { ...effectiveProvider, baseUrl: usageProxy.baseUrl };
+            const env = buildRunnerEnv(tool, routedProvider, model);
+            const claudeSettingsPath = engine.requiresSettingsFile
+                ? writeTemporaryClaudeSettings(routedProvider, { permissionMode: launchPolicy.claudeSettingsPermissionMode })
+                : null;
+            if (claudeSettingsPath)
+                temporaryFiles.push(claudeSettingsPath);
+            const args = buildRunnerArgs(tool, routedProvider, model, claudeSettingsPath);
+            const effectiveBaseUrl = getToolBaseUrl(tool, effectiveProvider);
+            await writeLog({
+                category: "usage",
+                action: "tool_spawn",
+                message: `Spawning ${tool}: ${provider.name} / ${model}`,
+                metadata: {
+                    tool,
+                    provider: provider.name,
+                    model,
+                    mode: effectiveProvider.mode,
+                    configuredMode: provider.mode,
+                    permissionConstraint: launchPolicy.reason,
+                    baseUrl: effectiveBaseUrl,
+                    transportBaseUrl: usageProxy.baseUrl,
+                    configuredBaseUrl: provider.baseUrl,
+                    apiKeyFingerprint: getSecretFingerprint(provider.apiKey),
+                    command,
+                    args,
+                    authInjection: engine.authInjection
+                }
+            });
+            const session = await startSession({
+                tool,
+                provider: effectiveProvider,
+                model,
+                projectPath: process.cwd(),
+                fallbackFrom: options.fallbackFrom ?? null
+            });
+            return { args, env, session };
+        }
+        catch (error) {
+            cleanupTemporaryFiles(temporaryFiles);
+            await usageProxy.close().catch(() => undefined);
+            throw error;
+        }
+    })();
+    const { args, env, session } = setup;
     return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            stdio: "inherit",
-            env
-        });
-        child.on("error", (error) => {
+        let finished = false;
+        const finish = async (exitCode, error) => {
+            if (finished)
+                return;
+            finished = true;
             cleanupTemporaryFiles(temporaryFiles);
-            void finishSession(session.id, 1);
-            reject(new Error(`Failed to start ${command}. Run \`ai doctor\` to check local CLI installation. ${error.message}`));
+            await usageProxy.close().catch(async (closeError) => {
+                await writeLog({
+                    level: "warn",
+                    category: "usage",
+                    action: "usage_proxy_close_failed",
+                    message: `Failed to close usage proxy for ${tool}: ${closeError instanceof Error ? closeError.message : String(closeError)}`,
+                    metadata: { tool, provider: provider.name, model }
+                }).catch(() => undefined);
+            });
+            await finishSession(session.id, exitCode).catch(() => undefined);
+            if (error) {
+                reject(error);
+            }
+            else {
+                resolve(exitCode);
+            }
+        };
+        let child;
+        try {
+            child = spawn(command, args, {
+                stdio: "inherit",
+                env
+            });
+        }
+        catch (error) {
+            void finish(1, new Error(`Failed to start ${command}. Run \`ai doctor\` to check local CLI installation. ${error instanceof Error ? error.message : String(error)}`));
+            return;
+        }
+        child.on("error", (error) => {
+            void finish(1, new Error(`Failed to start ${command}. Run \`ai doctor\` to check local CLI installation. ${error.message}`));
         });
         child.on("close", (code) => {
-            cleanupTemporaryFiles(temporaryFiles);
             const exitCode = code ?? 0;
-            void finishSession(session.id, exitCode).finally(() => resolve(exitCode));
+            void finish(exitCode);
         });
     });
 }

package/dist/telegram/engine/claude-engine.js

@@ -4,6 +4,7 @@ import { requiresDangerousConfirmation } from "../interaction/approval.js";
 import { writeTelegramLog } from "../log.js";
 import { isRecord } from "../../core/utils/is-record.js";
 import { CLAUDE_ROOT_PERMISSION_WARNING, resolveClaudePermissionMode } from "../../core/runner/claude-permission-policy.js";
+import { sumKnownProxyCosts, sumProxyUsage } from "../../core/runner/openai-usage-proxy.js";
 export class ClaudeEngine {
     name = "claude";
     processes = new Map();
@@ -16,42 +17,41 @@ export class ClaudeEngine {
         this.controllers.set(params.chatId, controller);
         const signal = params.signal ?? controller.signal;
         const startTime = Date.now();
-        if (permissionMode === "bypassPermissions" && requiresDangerousConfirmation(params.prompt)) {
-            const approved = await params.onPermission(createCommandPermissionRequest("Claude prompt", params.prompt));
-            if (!approved) {
-                cleanupRuntime(runtime);
-                throw new Error("Dangerous command denied.");
+        try {
+            if (permissionMode === "bypassPermissions" && requiresDangerousConfirmation(params.prompt)) {
+                const approved = await params.onPermission(createCommandPermissionRequest("Claude prompt", params.prompt));
+                if (!approved) {
+                    throw new Error("Dangerous command denied.");
+                }
             }
-        }
-        const args = buildClaudeArgs({
-            prompt: params.prompt,
-            model: runtime.model,
-            settingsPath: runtime.claudeSettingsPath,
-            permissionMode,
-            resume: params.resume,
-            allowedTools: params.allowedTools
-        });
-        const permissionWarning = runtime.claudePermission?.constrained ? CLAUDE_ROOT_PERMISSION_WARNING : null;
-        await params.onProgress?.({ phase: "thinking", message: permissionWarning ?? "Claude started" });
-        if (permissionWarning) {
-            await writeTelegramLog({
-                level: "warn",
-                action: "claude_permission_constrained",
-                message: permissionWarning,
-                metadata: { requestedPermissionMode, effectivePermissionMode: permissionMode, reason: runtime.claudePermission?.reason }
+            const args = buildClaudeArgs({
+                prompt: params.prompt,
+                model: runtime.model,
+                settingsPath: runtime.claudeSettingsPath,
+                permissionMode,
+                resume: params.resume,
+                allowedTools: params.allowedTools
             });
-        }
-        await writeTelegramLog({
-            action: "claude_start",
-            message: `Starting Claude for Telegram chat ${params.chatId}`,
-            metadata: {
-                ...summarizeRuntime(runtime.provider, runtime.model, "claude"),
-                cwd: params.cwd,
-                requestedPermissionMode,
-                effectivePermissionMode: permissionMode
+            const permissionWarning = runtime.claudePermission?.constrained ? CLAUDE_ROOT_PERMISSION_WARNING : null;
+            await params.onProgress?.({ phase: "thinking", message: permissionWarning ?? "Claude started" });
+            if (permissionWarning) {
+                await writeTelegramLog({
+                    level: "warn",
+                    action: "claude_permission_constrained",
+                    message: permissionWarning,
+                    metadata: { requestedPermissionMode, effectivePermissionMode: permissionMode, reason: runtime.claudePermission?.reason }
+                });
             }
-        });
-        try {
+            await writeTelegramLog({
+                action: "claude_start",
+                message: `Starting Claude for Telegram chat ${params.chatId}`,
+                metadata: {
+                    ...summarizeRuntime(runtime.provider, runtime.model, "claude"),
+                    cwd: params.cwd,
+                    requestedPermissionMode,
+                    effectivePermissionMode: permissionMode
+                }
+            });
             const progressParser = createJsonLineAccumulator((event) => handleClaudeProgressEvent(event, params.onProgress));
             const result = await spawnCapture({
                 command: runtime.command,
@@ -79,6 +79,8 @@ export class ClaudeEngine {
             await params.onProgress?.({ phase: "done" });
             return {
                 ...parsed,
+                cost: parsed.cost ?? sumKnownProxyCosts(runtime.usageProxy.getRecords()),
+                usage: sumProxyUsage(runtime.usageProxy.getRecords()),
                 provider: runtime.provider.name,
                 model: runtime.model
             };
@@ -86,7 +88,7 @@ export class ClaudeEngine {
         finally {
             this.processes.delete(params.chatId);
             this.controllers.delete(params.chatId);
-            cleanupRuntime(runtime);
+            await cleanupRuntime(runtime);
         }
     }
     abort(chatId) {

package/dist/telegram/engine/codex-engine.js

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import { cleanupRuntime, createCommandPermissionRequest, formatEngineTimeout, prepareEngineRuntime, summarizeRuntime } from "./engine-utils.js";
 import { createJsonLineAccumulator, extractJsonLines, spawnCapture, stripAnsi, terminateProcessTree } from "./process-utils.js";
-import { startOpenAiUsageProxy } from "../../core/runner/openai-usage-proxy.js";
+import { sumKnownProxyCosts, sumProxyUsage } from "../../core/runner/openai-usage-proxy.js";
 import { requiresDangerousConfirmation } from "../interaction/approval.js";
 import { writeTelegramLog } from "../log.js";
 import { isRecord } from "../../core/utils/is-record.js";
@@ -18,28 +18,21 @@ export class CodexEngine {
         const signal = params.signal ?? controller.signal;
         const startTime = Date.now();
         const permissionMode = params.permissionMode ?? "default";
-        if (permissionMode === "bypassPermissions" && requiresDangerousConfirmation(params.prompt)) {
-            const approved = await params.onPermission(createCommandPermissionRequest("Codex prompt", params.prompt));
-            if (!approved) {
-                cleanupRuntime(runtime);
-                throw new Error("Dangerous command denied.");
-            }
-        }
-        let usageProxy = null;
-        await params.onProgress?.({ phase: "thinking", message: "Codex started" });
-        await writeTelegramLog({
-            action: "codex_start",
-            message: `Starting Codex for Telegram chat ${params.chatId}`,
-            metadata: { ...summarizeRuntime(runtime.provider, runtime.model, "codex"), cwd: params.cwd }
-        });
         try {
-            usageProxy = await startOpenAiUsageProxy({
-                provider: runtime.provider,
-                model: runtime.model,
-                tool: "telegram"
+            if (permissionMode === "bypassPermissions" && requiresDangerousConfirmation(params.prompt)) {
+                const approved = await params.onPermission(createCommandPermissionRequest("Codex prompt", params.prompt));
+                if (!approved) {
+                    throw new Error("Dangerous command denied.");
+                }
+            }
+            await params.onProgress?.({ phase: "thinking", message: "Codex started" });
+            await writeTelegramLog({
+                action: "codex_start",
+                message: `Starting Codex for Telegram chat ${params.chatId}`,
+                metadata: { ...summarizeRuntime(runtime.provider, runtime.model, "codex"), cwd: params.cwd }
             });
             const args = buildCodexArgs(params.prompt, runtime.model, params.cwd, permissionMode, {
-                baseUrl: usageProxy.baseUrl
+                baseUrl: runtime.usageProxy.baseUrl
             }, params.resume, params.imagePaths);
             const progressParser = createJsonLineAccumulator((event) => handleCodexProgressEvent(event, params.onProgress));
             const result = await spawnCapture({
@@ -49,8 +42,8 @@ export class CodexEngine {
                 env: {
                     ...runtime.env,
                     OPENAI_API_KEY: runtime.provider.apiKey,
-                    OPENAI_BASE_URL: usageProxy.baseUrl,
-                    AI_GATEWAY_BASE_URL: usageProxy.baseUrl
+                    OPENAI_BASE_URL: runtime.usageProxy.baseUrl,
+                    AI_GATEWAY_BASE_URL: runtime.usageProxy.baseUrl
                 },
                 signal,
                 timeoutMs: params.timeoutMs,
@@ -83,8 +76,8 @@ export class CodexEngine {
             return {
                 ...parsed,
                 sessionId,
-                cost: sumKnownProxyCosts(usageProxy.getRecords()),
-                usage: sumProxyUsage(usageProxy.getRecords()),
+                cost: sumKnownProxyCosts(runtime.usageProxy.getRecords()),
+                usage: sumProxyUsage(runtime.usageProxy.getRecords()),
                 provider: runtime.provider.name,
                 model: runtime.model
             };
@@ -92,8 +85,7 @@ export class CodexEngine {
         finally {
             this.processes.delete(params.chatId);
             this.controllers.delete(params.chatId);
-            await usageProxy?.close().catch(() => undefined);
-            cleanupRuntime(runtime);
+            await cleanupRuntime(runtime);
         }
     }
     abort(chatId) {
@@ -169,8 +161,6 @@ function buildCodexProviderOverrideArgs(providerOverride) {
         "-c",
         `model_providers.${providerId}.env_key=${tomlString("OPENAI_API_KEY")}`,
         "-c",
-        `model_providers.${providerId}.requires_openai_auth=true`,
-        "-c",
         `model_providers.${providerId}.wire_api=${tomlString("responses")}`
     ];
 }
@@ -417,21 +407,3 @@ function readChangedFiles(event) {
         return [event.path];
     return [];
 }
-function sumKnownProxyCosts(records) {
-    const knownCosts = records
-        .map((record) => record.costUsd)
-        .filter((cost) => typeof cost === "number" && Number.isFinite(cost) && cost >= 0);
-    if (!knownCosts.length)
-        return undefined;
-    return Number(knownCosts.reduce((sum, cost) => sum + cost, 0).toFixed(8));
-}
-function sumProxyUsage(records) {
-    if (!records.length)
-        return undefined;
-    return records.reduce((sum, record) => ({
-        inputTokens: sum.inputTokens + record.usage.inputTokens,
-        outputTokens: sum.outputTokens + record.usage.outputTokens,
-        totalTokens: sum.totalTokens + record.usage.totalTokens,
-        cacheReadInputTokens: (sum.cacheReadInputTokens ?? 0) + (record.usage.cacheReadInputTokens ?? 0)
-    }), { inputTokens: 0, outputTokens: 0, totalTokens: 0, cacheReadInputTokens: 0 });
-}

package/dist/telegram/engine/engine-utils.js

@@ -3,6 +3,7 @@ import { resolveExactProviderForTool, resolveProviderForTool } from "../../core/
 import { buildRunnerEnv, cleanupTemporaryFiles, getToolBaseUrl, writeTemporaryClaudeSettings } from "../../core/runner/tool-runner.js";
 import { resolveClaudePermissionMode } from "../../core/runner/claude-permission-policy.js";
 import { resolveToolCommand } from "../../core/runner/command-resolver.js";
+import { startOpenAiUsageProxy } from "../../core/runner/openai-usage-proxy.js";
 export async function prepareEngineRuntime(tool, providerName, modelName, permissionMode) {
     // Telegram resolves and orders fallback candidates before invoking an
     // engine. Once a candidate is selected, execute it exactly so the engine
@@ -18,26 +19,41 @@ export async function prepareEngineRuntime(tool, providerName, modelName, permis
         ? resolveClaudePermissionMode(permissionMode ?? "default")
         : null;
     const effectiveProvider = claudePermission?.constrained ? { ...provider, mode: "ask" } : provider;
-    const env = {
-        ...buildRunnerEnv(tool, effectiveProvider, model),
-        AI_GATEWAY_SOURCE: "telegram"
-    };
     const temporaryFiles = [];
-    const claudeSettingsPath = tool === "claude"
-        ? writeTemporaryClaudeSettings(provider, {
-            permissionMode: permissionMode === "readOnly"
-                ? "readOnly"
-                : claudePermission?.privileged
-                    ? "safeDefault"
-                    : "provider"
-        })
-        : null;
-    if (claudeSettingsPath)
-        temporaryFiles.push(claudeSettingsPath);
-    return { provider, model, env, command, temporaryFiles, claudeSettingsPath, claudePermission };
+    const usageProxy = await startOpenAiUsageProxy({
+        provider: effectiveProvider,
+        model,
+        tool: "telegram",
+        engine: tool
+    });
+    try {
+        const routedProvider = { ...effectiveProvider, baseUrl: usageProxy.baseUrl };
+        const env = {
+            ...buildRunnerEnv(tool, routedProvider, model),
+            AI_GATEWAY_SOURCE: "telegram"
+        };
+        const claudeSettingsPath = tool === "claude"
+            ? writeTemporaryClaudeSettings(routedProvider, {
+                permissionMode: permissionMode === "readOnly"
+                    ? "readOnly"
+                    : claudePermission?.privileged
+                        ? "safeDefault"
+                        : "provider"
+            })
+            : null;
+        if (claudeSettingsPath)
+            temporaryFiles.push(claudeSettingsPath);
+        return { provider, model, env, command, temporaryFiles, claudeSettingsPath, claudePermission, usageProxy };
+    }
+    catch (error) {
+        cleanupTemporaryFiles(temporaryFiles);
+        await usageProxy.close().catch(() => undefined);
+        throw error;
+    }
 }
-export function cleanupRuntime(runtime) {
+export async function cleanupRuntime(runtime) {
     cleanupTemporaryFiles(runtime.temporaryFiles);
+    await runtime.usageProxy.close().catch(() => undefined);
 }
 export function resolveWorkingCommand(tool) {
     return resolveToolCommand(tool);

package/docs/USAGE.html

@@ -531,6 +531,12 @@ ai setup</pre>
                 <td>用默认 provider 和默认模型启动 Claude Code 或 Codex。</td>
                 <td>不指定时使用 <code>level: 1</code>。</td>
               </tr>
+              <tr data-search="image generate image prompt model b64 url">
+                <td><span class="group-label">使用</span></td>
+                <td><code class="cmd">ai image 51talk-image "一只戴墨镜的猫"</code></td>
+                <td>调用已配置的图片 Provider 和默认模型生成图片并保存到当前目录。</td>
+                <td>支持 Provider fallback；真实 usage 写入 <code>usage.json</code>。</td>
+              </tr>
               <tr data-search="use provider model named">
                 <td><span class="group-label">使用</span></td>
                 <td><code class="cmd">ai use claude 51talk claude-opus-4-6</code><br /><code class="cmd">ai use codex 51talk gpt-5.5</code></td>
@@ -632,6 +638,20 @@ ai use claude 51talk
 ai use codex 51talk gpt-5.5</pre>
                 <p>不指定 provider 时使用 <code>level: 1</code>；不指定模型时使用 provider 默认 <code>model</code>。</p>
               </div>
+              <div class="note">
+                <h3>生成图片</h3>
+                <pre>ai image
+ai image 51talk-image "一只戴墨镜的猫，数字插画"
+ai image 51talk-image gpt-image-2 "一只戴墨镜的猫，数字插画"</pre>
+                <ul>
+                  <li>直接运行 <code>ai image</code> 时，会依次选择 Provider、具体模型并输入提示词。</li>
+                  <li>第一个参数是 Provider 名；第二个参数匹配模型缓存时作为具体模型，否则从第二个参数开始作为提示词并使用默认模型。</li>
+                  <li>命令执行前会自动刷新模型缓存；也可以先运行 <code>ai status</code> 检查。指定模型时建议给提示词加引号。</li>
+                  <li><code>b64_json</code> 会以 <code>0600</code> 权限保存到当前目录并输出绝对路径；远程响应只接受无凭证的 <code>https</code> URL。</li>
+                  <li>图片请求最长等待 120 秒；超时会自动失败并尝试下一个 Provider。</li>
+                  <li>请求经过 execution-scoped Transport Proxy，真实 usage 复用唯一 <code>UsageObserver</code> 账本。</li>
+                </ul>
+              </div>
               <div class="note">
                 <h3>运行规则</h3>
                 <ul>
@@ -640,6 +660,7 @@ ai use codex 51talk gpt-5.5</pre>
                   <li><code>ai use codex</code> 使用本次子进程的 <code>-c model_provider=...</code> 固定所选 provider，并通过 <code>env_key = "OPENAI_API_KEY"</code> 使用 AI Gateway 注入的 Key；不会修改 Codex 全局认证或配置。</li>
                   <li>provider 的 <code>mode</code> 为 <code>auto</code> 时，非 root 执行 Claude Code 会追加 <code>--dangerously-skip-permissions</code>；<code>ask</code> 模式不会追加，并会在启动前确认。root 下请求 <code>auto</code> 会被安全约束为默认权限，临时 settings 中继承的 bypass 配置也会被清除。</li>
                   <li>OpenAI 兼容地址用于 Codex 时会使用 <code>/v1</code>，用于 Claude 时会去掉 <code>/v1</code>。</li>
+                  <li>Claude 与 Codex 的本次子进程都会通过 execution-scoped 本地代理转发；原生终端交互不变，provider 返回的真实 usage 会按 provider/model 写入 <code>usage.json</code>。</li>
                   <li>日志只记录 Key 指纹，不记录完整 API Key。</li>
                 </ul>
               </div>
@@ -658,6 +679,7 @@ ai set codex proxy off</pre>
                   <li><code>provider name model-id</code> 显式选择该 provider 已探测的 <code>gpt-*</code> 模型；只给 provider 时自动选最新 GPT。</li>
                   <li><code>provider</code> 不带名称时依次交互选择已添加的 provider 和 GPT 模型；没有可用 GPT 时提示运行 <code>ai status</code>，不修改配置。</li>
                   <li>自动选择先比较 GPT 数字版本，同版本优先 <code>sol</code>、<code>pro</code>、alias、<code>codex</code>、<code>terra</code>、<code>mini</code>、<code>luna</code>、<code>nano</code>，并优先滚动 alias。API Key 只写入 mode <code>0600</code> 的 <code>auth.json</code>。</li>
+                  <li>写入 <code>config.toml</code> 前会规范化 <code>base_url</code>：末尾没有 <code>/v1</code> 时自动补上，已有时不重复追加。</li>
                   <li>原有 project、MCP、plugin、feature 设置会保留；任一步失败会恢复原 <code>config.toml</code> 和 <code>auth.json</code>。</li>
                   <li>切换自定义 provider 会替换当前 ChatGPT token；切回 ChatGPT 时需重新登录。</li>
                   <li>成功后 macOS 会重启 <code>Codex.app</code> 或当前名称的 <code>ChatGPT.app</code>；无法自动重启时按提示手动操作。</li>
@@ -753,7 +775,7 @@ ai telegram status --all</pre>
                   <li><code>/provider</code> 以按钮列出全部 AI Provider，可编辑名称、Base URL、API Key、默认模型、模式和优先级，二次确认后删除，或从列表底部添加。操作复用 <code>ai provider</code> 的核心 CRUD 和检查逻辑。</li>
                   <li>Provider API Key 在详情中只显示“已配置”，不会写入 Bot 应用日志；输入后 Bot 会尽力立即删除该 Telegram 消息。未完成表单在 Bot 重启后需要重新开始。</li>
                   <li>Telegram Codex 执行会自动走本地 OpenAI 兼容代理记录 provider usage；<code>/usage</code> 有 provider cost 时直接展示，否则按 <code>model-pricing.json</code> 估算。</li>
-                  <li>如果本机不能直连 <code>api.telegram.org</code>，设置 <code>proxyUrl</code> 或环境变量 <code>HTTPS_PROXY</code> / <code>ALL_PROXY</code>。</li>
+                  <li>如果本机不能直连 <code>api.telegram.org</code>，设置 <code>proxyUrl</code> 或环境变量 <code>HTTPS_PROXY</code> / <code>ALL_PROXY</code>。交互式新增或编辑 Bot 时，<code>proxyUrl</code> 输入提示会展示完整 URL 示例；地址请包含协议，例如 <code>http://127.0.0.1:7890</code>。</li>
                 </ul>
               </div>
             </details>
@@ -799,7 +821,7 @@ ai provider list
 ai log
 ai log --print
 ai context</pre>
-                <p><code>status</code> 会刷新 provider 健康度和模型缓存，展示 Claude/Codex 各自实际 baseUrl、兼容模型、token 使用量和使用占比。</p>
+                <p><code>status</code> 会刷新 provider 健康度和模型缓存，展示 Claude/Codex 各自实际 baseUrl、兼容模型、token 使用量和使用占比。CLI 与 Telegram 的 Claude/Codex 新请求只要 provider 返回结构化 usage 都会计入；周统计按 provider 精确名称聚合，同一 provider 的不同模型合并，事件仍保留 model 明细。升级前未经过代理的旧历史不会估算补录。</p>
               </div>
               <div class="note">
                 <h3>诊断与自动修复</h3>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@offerpilot/axiomruntime",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "CLI-first foundation for an enterprise AI Runtime with provider routing and governed execution.",
   "homepage": "https://gitlab.com/linlangli/agent-router",
   "repository": {