@scalequality/cli 0.4.21 → 0.4.23

package/dist/connect.build.json

@@ -1,5 +1,5 @@
 {
   "sdkVersion": "0.3.281",
-  "sha256": "64b584e7f307f8bed9bee151ca7dd57c5fe8e54c8adf6e9fd76ba11dbfba93c1",
-  "sourceCommit": "a4093e270f574ff0830763c574a17585cf269fe6"
+  "sha256": "73abecf4dfd9ae9523b7b024af7979b0047893e02b842bfddd8e3d9e6d30d3ab",
+  "sourceCommit": "3ddf22e4f5c3cb9757011873fcedc57b914f6b29"
 }

package/dist/connect.cjs

@@ -563,10 +563,15 @@ async function writeScrubbedTranscript(source, target) {
 
 // src/application/services/workspaceSandbox/backgroundService.ts
 var import_child_process2 = require("child_process");
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 var import_fs5 = require("fs");
 var import_path6 = require("path");
 
+// src/application/services/workspaceSandbox/HttpSessionTransport.ts
+var import_crypto2 = require("crypto");
+var import_util2 = require("util");
+var import_zlib = require("zlib");
+
 // src/application/services/workspaceSandbox/reasoning.ts
 var REASONING_LEVELS = ["off", "low", "medium", "high", "xhigh", "max"];
 function isReasoningLevel(value) {
@@ -729,6 +734,15 @@ function serializeCheckpoints(map) {
   }
   return Object.keys(repos).length ? JSON.stringify({ version: CHECKPOINT_MAP_VERSION, repos }) : "";
 }
+var CHECKPOINT_INLINE_MAX_BYTES = 6 * 1024 * 1024;
+var CHECKPOINT_PART_BYTES = 4 * 1024 * 1024;
+var CHECKPOINT_MAX_PARTS = 32;
+function checkpointPartsOf(raw) {
+  const p = raw;
+  if (!p || typeof p !== "object" || typeof p.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(p.sha256)) return null;
+  if (!Number.isInteger(p.count) || p.count < 1 || p.count > CHECKPOINT_MAX_PARTS || !Number.isInteger(p.bytes) || p.bytes < 1) return null;
+  return { sha256: p.sha256, count: p.count, bytes: p.bytes };
+}
 
 // src/application/services/workspaceSandbox/workspaceGit.ts
 var run = (0, import_util.promisify)(import_child_process.execFile);
@@ -856,11 +870,36 @@ async function computeDiff(root, base, caps = DIFF_CAPS, scope) {
 async function worktreeTreeId(root, scope) {
   return withWorktreeIndex(root, async (env) => (await git(["write-tree"], { cwd: root, env })).trim(), scope);
 }
-async function checkpointPatch(root, base, scope) {
+var CHECKPOINT_KEPT_HEADER = "ScaleQuality-Kept:";
+var CHECKPOINT_KEPT_TEXT = { bytes: 1024 * 1024, lines: 2e4 };
+async function checkpointPatch(root, base, scope, opts = {}) {
   return withWorktreeIndex(root, async (env) => {
-    const patch = await git(["diff", "--cached", "--no-renames", "--binary", base, ...scopeSpec(scope)], { cwd: root, env, maxBuffer: 512 * 1024 * 1024 });
-    return patch ? `${CHECKPOINT_BASE_HEADER} ${base}
-${patch}` : "";
+    const head = `${CHECKPOINT_BASE_HEADER} ${base}
+`;
+    const whole = async () => {
+      const patch2 = await git(["diff", "--cached", "--no-renames", "--binary", base, ...scopeSpec(scope)], { cwd: root, env, maxBuffer: 512 * 1024 * 1024 });
+      return patch2 ? head + patch2 : "";
+    };
+    if (!opts.keepInFolder) return whole();
+    const changes = await listChangesWithEnv(root, base, env, scope);
+    const kept = [];
+    const carried = [];
+    for (const c of changes) {
+      const size = c.binary || c.status === "deleted" ? 0 : (await (0, import_promises2.stat)((0, import_path2.join)(root, c.path)).catch(() => null))?.size ?? 0;
+      const large = size > CHECKPOINT_KEPT_TEXT.bytes || c.additions + c.deletions > CHECKPOINT_KEPT_TEXT.lines;
+      if (c.binary || large) kept.push(c);
+      else carried.push(c.path);
+    }
+    if (!kept.length) return whole();
+    let patch = "";
+    for (let i = 0; i < carried.length; i += 200) {
+      patch += await git(
+        ["diff", "--cached", "--no-renames", "--binary", base, "--", ...carried.slice(i, i + 200)],
+        { cwd: root, env: { ...env, GIT_LITERAL_PATHSPECS: "1" }, maxBuffer: 512 * 1024 * 1024 }
+      );
+    }
+    return head + kept.map((c) => `${CHECKPOINT_KEPT_HEADER} ${c.status} ${JSON.stringify(c.path)}
+`).join("") + patch;
   }, scope);
 }
 var PR_FILE_MAX_BYTES = 2 * 1024 * 1024;
@@ -1083,7 +1122,9 @@ var SQ_MCP_PREFIX = `mcp__${SQ_MCP_SERVER}__`;
 var DENIED_TOOLS = ["WebSearch", "RemoteTrigger", "CronCreate", "CronDelete", "CronList", "ScheduleWakeup", "PushNotification", "EnterWorktree", "ExitWorktree", "Artifact", "Workflow", "SendFeedback", "ClaudeDesign", "Projects"];
 var READ_TOOLS = { Read: "file_path", Glob: "path", Grep: "path", LS: "path" };
 var WRITE_TOOLS = { Write: "file_path", Edit: "file_path", MultiEdit: "file_path", NotebookEdit: "notebook_path" };
-var WRITE_TOOL_PATHS = WRITE_TOOLS;
+var IMAGE_TOOL = "generate_image";
+var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".webp"]);
+var WRITE_TOOL_PATHS = { ...WRITE_TOOLS, [`mcp__${"scalequality"}__${IMAGE_TOOL}`]: "file_path" };
 var HARMLESS = /* @__PURE__ */ new Set(["TodoWrite", "BashOutput", "KillShell", "TaskStop", "TaskOutput", "Skill"]);
 var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
 var SQ_READ_ONLY = /* @__PURE__ */ new Set([
@@ -1205,6 +1246,18 @@ function readOnlyCommand(command) {
     return READ_ONLY_PROGRAMS.has(program);
   });
 }
+async function imageToolDecision(input, ctx) {
+  const raw = input.file_path;
+  if (typeof raw !== "string" || !raw.trim()) return { behavior: "deny", message: "generate_image needs file_path: where to save the image in the folder (for example images/hero.png)." };
+  if (!IMAGE_EXTENSIONS.has((0, import_path3.extname)(raw).toLowerCase())) return { behavior: "deny", message: "generate_image saves .png, .jpg or .webp files: give file_path one of these extensions." };
+  if (ctx.protections?.secretFiles) {
+    const why = secretFileToolDenial("Write", { file_path: raw });
+    if (why) return { behavior: "deny", message: why, reason: "PROTECTION_SECRET_FILE" };
+  }
+  const decided = await decideToolUse("Write", { file_path: raw }, { ...ctx, plan: false, planDir: void 0 });
+  if (decided.behavior !== "allow") return decided;
+  return { behavior: "allow", updatedInput: { ...input, file_path: (0, import_path3.resolve)(ctx.root, raw.trim()) } };
+}
 async function decideToolUse(toolName, input, ctx) {
   if (toolName.startsWith("mcp__") && ctx.orgMcpTools?.all.has(toolName)) {
     if (ctx.plan && !ctx.orgMcpTools.readOnly.has(toolName)) return { behavior: "deny", message: PLAN_ONLY_READS };
@@ -1213,6 +1266,7 @@ async function decideToolUse(toolName, input, ctx) {
   if (toolName.startsWith("mcp__")) {
     if (!toolName.startsWith(SQ_MCP_PREFIX)) return { behavior: "deny", message: "Only ScaleQuality tools and the MCP servers your organization approved are available in this workspace." };
     if (ctx.plan && !SQ_READ_ONLY.has(toolName.slice(SQ_MCP_PREFIX.length))) return { behavior: "deny", message: PLAN_ONLY_READS };
+    if (toolName === SQ_MCP_PREFIX + IMAGE_TOOL) return imageToolDecision(input, ctx);
     return { behavior: "allow", updatedInput: input };
   }
   if (HARMLESS.has(toolName)) return { behavior: "allow", updatedInput: input };
@@ -1931,6 +1985,8 @@ var TransportError = class extends Error {
 };
 
 // src/application/services/workspaceSandbox/HttpSessionTransport.ts
+var gzipAsync = (0, import_util2.promisify)(import_zlib.gzip);
+var gunzipAsync = (0, import_util2.promisify)(import_zlib.gunzip);
 var GONE = [401, 403, 404, 410];
 var HttpSessionTransport = class {
   constructor(opts) {
@@ -1946,6 +2002,8 @@ var HttpSessionTransport = class {
   gone;
   async bootstrap() {
     const raw = await this.get(`/bootstrap?features=${ENGINE_FEATURES.join(",")}`, this.opts.requestTimeoutMs ?? 3e4);
+    const parts = checkpointPartsOf(raw?.checkpointParts);
+    if (parts && typeof raw?.checkpointPatch !== "string") raw.checkpointPatch = await this.checkpointFromParts(parts);
     return toSessionBootstrap(raw);
   }
   async pollCommands(waitSeconds, signal) {
@@ -1972,7 +2030,31 @@ var HttpSessionTransport = class {
     return this.post("/pull-request", req, this.opts.toolTimeoutMs ?? 18e4);
   }
   async checkpoint(req) {
-    await this.post("/checkpoint", req, this.opts.requestTimeoutMs ?? 6e4);
+    const timeout = this.opts.requestTimeoutMs ?? 6e4;
+    if (Buffer.byteLength(JSON.stringify(req), "utf8") <= CHECKPOINT_INLINE_MAX_BYTES) {
+      await this.post("/checkpoint", req, timeout);
+      return;
+    }
+    const packed = await gzipAsync(Buffer.from(req.patch, "utf8"));
+    const sha256 = (0, import_crypto2.createHash)("sha256").update(req.patch, "utf8").digest("hex");
+    const count = Math.ceil(packed.length / CHECKPOINT_PART_BYTES);
+    if (count > CHECKPOINT_MAX_PARTS) throw new TransportError(`checkpoint of ${packed.length} compressed bytes is over the limit`, 413, false);
+    for (let index = 0; index < count; index++) {
+      const data = packed.subarray(index * CHECKPOINT_PART_BYTES, (index + 1) * CHECKPOINT_PART_BYTES).toString("base64");
+      await this.post("/checkpoint/parts", { sha256, index, count, data }, timeout);
+    }
+    await this.post("/checkpoint", { parts: { sha256, count, bytes: packed.length }, sdkSessionId: req.sdkSessionId }, timeout);
+  }
+  async checkpointFromParts(parts) {
+    const chunks = [];
+    for (let index = 0; index < parts.count; index++) {
+      const r = await this.get(`/checkpoint/parts/${index}`, this.opts.requestTimeoutMs ?? 6e4);
+      if (r?.sha256 !== parts.sha256 || typeof r.data !== "string") throw new TransportError("checkpoint part does not match", 502, false);
+      chunks.push(Buffer.from(r.data, "base64"));
+    }
+    const patch = (await gunzipAsync(Buffer.concat(chunks)).catch(() => Buffer.alloc(0))).toString("utf8");
+    if ((0, import_crypto2.createHash)("sha256").update(patch, "utf8").digest("hex") !== parts.sha256) throw new TransportError("checkpoint parts do not match", 502, false);
+    return patch;
   }
   async openRepository(repoFullName) {
     const raw = await this.post("/repositories/open", { repoFullName }, this.opts.requestTimeoutMs ?? 3e4);
@@ -2036,6 +2118,15 @@ var HttpSessionTransport = class {
     const boot = toSessionBootstrap({ session: { model: raw?.model, reasoning: raw?.reasoning }, runtime: raw?.runtime, repository: null });
     return { model: boot.model, runtime: boot.runtime, reasoning: boot.reasoning ?? null };
   }
+  /** One image created by the API for this session (generate_image); an image takes up to a few minutes. */
+  async generateImage(req) {
+    const raw = await this.post("/images", req, 24e4);
+    if (typeof raw?.error?.code === "string") return { refused: raw.error.code.slice(0, 100) };
+    const image = raw?.image;
+    if (!image || typeof image.dataBase64 !== "string" || typeof image.mimeType !== "string" || typeof image.name !== "string")
+      throw new TransportError("invalid image response", 502, false);
+    return { name: image.name, mimeType: image.mimeType, sizeBytes: Number(image.sizeBytes) || 0, dataBase64: image.dataBase64 };
+  }
   /** The organization's protections in force now (read at the start of each turn); throws when the API does not say. */
   async protections() {
     const raw = await this.post("/protections", {}, 5e3);
@@ -2187,6 +2278,7 @@ function toSessionBootstrap(raw) {
     workspaceKind: session.workspaceKind === "LOCAL" ? "LOCAL" : "CLOUD",
     projectName: typeof session.projectName === "string" ? session.projectName : typeof raw?.project?.name === "string" ? raw.project.name : null,
     folderLink: typeof session.folderLink?.projectId === "string" && session.folderLink.projectId ? { projectId: session.folderLink.projectId } : null,
+    imageGeneration: raw?.imageGeneration === true,
     transcript: transcriptOf(raw?.transcript),
     baseMeasurements: raw?.baseMeasurements && typeof raw.baseMeasurements === "object" && !Array.isArray(raw.baseMeasurements) ? raw.baseMeasurements : {},
     pullRequests: pullRequestsOf(raw?.pullRequests),
@@ -2277,7 +2369,7 @@ var import_os3 = require("os");
 var import_path5 = require("path");
 
 // src/application/services/workspaceSandbox/localTracking.ts
-var import_crypto2 = require("crypto");
+var import_crypto3 = require("crypto");
 var import_fs4 = require("fs");
 var import_promises5 = require("fs/promises");
 var import_os2 = require("os");
@@ -2305,7 +2397,7 @@ function gitTracker(root, base, prefix) {
     },
     snapshot: () => worktreeTreeId(root, scope),
     restore: (tree) => restoreTree(root, tree, scope),
-    checkpoint: () => checkpointPatch(root, base, scope),
+    checkpoint: (opts) => checkpointPatch(root, base, scope, opts),
     prFiles: (published) => filesForPullRequest(root, base, published, scope),
     treeId: () => worktreeTreeId(root, scope)
   };
@@ -2389,7 +2481,7 @@ async function mapLimit(items, n, fn) {
 async function repoFingerprint(root) {
   const head = (await git(["rev-parse", "-q", "--verify", "HEAD"], { cwd: root }).catch(() => "")).trim();
   const status = await git(["--no-optional-locks", "status", "--porcelain", "-z", "--untracked-files=all"], { cwd: root, timeoutMs: 6e4 }).catch(() => "?");
-  const h = (0, import_crypto2.createHash)("sha256").update(head).update("\0").update(status);
+  const h = (0, import_crypto3.createHash)("sha256").update(head).update("\0").update(status);
   const recs = status.split("\0");
   let n = 0;
   for (let i = 0; i < recs.length && n < 2e3; i++) {
@@ -2561,10 +2653,10 @@ var LooseFileTracker = class {
     }
     await restoreTree(this.o.root, target, this.scope());
   }
-  async checkpoint() {
+  async checkpoint(opts) {
     await this.chain;
     if (!this.entries.length) return "";
-    return checkpointPatch(this.o.root, await this.baseTree(), this.scope());
+    return checkpointPatch(this.o.root, await this.baseTree(), this.scope(), opts);
   }
   async prFiles(published) {
     await this.chain;
@@ -3530,7 +3622,7 @@ function serviceSlug(api) {
   } catch {
   }
   const slug = host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "custom";
-  return `${slug}-${(0, import_crypto3.createHash)("sha256").update(api).digest("hex").slice(0, 6)}`;
+  return `${slug}-${(0, import_crypto4.createHash)("sha256").update(api).digest("hex").slice(0, 6)}`;
 }
 function serviceNames(api) {
   const slug = serviceSlug(api);
@@ -3669,7 +3761,7 @@ function installStableCopy(o) {
   const bundle = (0, import_path6.join)(o.packageRoot, "dist", "connect.cjs");
   const bin = (dir2) => (0, import_path6.join)(dir2, "node_modules", "@scalequality", "cli", "bin", "scalequality.mjs");
   if (!(0, import_fs5.existsSync)(bundle)) throw new ServiceError("NOT_AN_INSTALLED_CLI", "This installation of @scalequality/cli is incomplete (dist/connect.cjs is missing).");
-  const sha = (0, import_crypto3.createHash)("sha256").update((0, import_fs5.readFileSync)(bundle)).digest("hex");
+  const sha = (0, import_crypto4.createHash)("sha256").update((0, import_fs5.readFileSync)(bundle)).digest("hex");
   const base = (0, import_path6.join)(sqHome(o.home), "cli");
   const dir = (0, import_path6.join)(base, pkg.version);
   if (inside2(dir, o.packageRoot)) return { dir, bin: bin(dir), version: pkg.version, reused: true };
@@ -4817,7 +4909,7 @@ async function addFolder(credentials2, api, path, home) {
 var import_child_process3 = require("child_process");
 var import_promises14 = require("fs/promises");
 var import_fs9 = require("fs");
-var import_crypto7 = require("crypto");
+var import_crypto8 = require("crypto");
 var import_path15 = require("path");
 
 // src/application/services/execution/LanguageAdapter.ts
@@ -5261,7 +5353,7 @@ function limitInEngineText(text3) {
 }
 
 // src/application/services/workspaceSandbox/scalequalityTools.ts
-var import_crypto4 = require("crypto");
+var import_crypto5 = require("crypto");
 
 // node_modules/zod/v3/external.js
 var external_exports = {};
@@ -9381,7 +9473,7 @@ function buildScaleQualityServer(sdk, host) {
   const tools = REMOTE_TOOLS.map(
     (spec) => sdk.tool(spec.name, spec.description, spec.shape, async (args) => {
       const a = { ...args ?? {} };
-      if (spec.idempotent && typeof a.idempotencyKey !== "string") a.idempotencyKey = (0, import_crypto4.randomUUID)();
+      if (spec.idempotent && typeof a.idempotencyKey !== "string") a.idempotencyKey = (0, import_crypto5.randomUUID)();
       return callScaleQualityTool(host, spec.name, a);
     })
   );
@@ -9412,6 +9504,19 @@ function buildScaleQualityServer(sdk, host) {
       async (args) => host.openPullRequest(String(args.title ?? ""), String(args.body ?? ""), typeof args.repoFullName === "string" ? args.repoFullName : void 0)
     )
   );
+  if (host.generateImage) {
+    const generate = host.generateImage.bind(host);
+    tools.push(sdk.tool(
+      IMAGE_TOOL,
+      "Create an image with an image generation model and save it in the workspace folder; then show it to the user in your answer as a Markdown image with its path. Use it whenever the user asks for an image, picture, illustration, concept art, character sheet, sprite, mockup or any other visual. It may spend credit, like any model call.",
+      {
+        prompt: external_exports.string().min(1).max(4e3).describe("A detailed description of the image in English: subject, style, composition, colours, lighting and any text to render."),
+        file_path: external_exports.string().min(1).max(500).describe("Where to save it in the workspace, ending in .png, .jpg or .webp (for example images/hero.png)."),
+        edit_image_path: external_exports.string().min(1).max(500).optional().describe("An image already in the workspace to change, instead of starting a new one.")
+      },
+      async (args) => generate({ prompt: String(args.prompt ?? ""), filePath: String(args.file_path ?? ""), ...typeof args.edit_image_path === "string" ? { editPath: args.edit_image_path } : {} })
+    ));
+  }
   return sdk.createSdkMcpServer({
     name: SQ_MCP_SERVER,
     version: "1.0.0",
@@ -9492,6 +9597,7 @@ var SQ_TOOL_LABELS = {
   list_repositories: { kind: "tool", label: "Listing the repositories of the session" },
   open_repository: { kind: "tool", label: "Opening a repository" },
   measure_change: { kind: "measure", label: "Measuring the change" },
+  generate_image: { kind: "tool", label: "Creating an image" },
   open_pull_request: { kind: "tool", label: "Opening the pull request" }
 };
 function clip(s, n) {
@@ -9956,7 +10062,7 @@ function blockText(content) {
 }
 
 // src/application/services/workspaceSandbox/inputChannel.ts
-var import_crypto5 = require("crypto");
+var import_crypto6 = require("crypto");
 var InputChannel = class {
   buffer = [];
   waiting = null;
@@ -10014,7 +10120,7 @@ var InputChannel = class {
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function messageUuid(id) {
   if (UUID.test(id)) return id.toLowerCase();
-  const h = (0, import_crypto5.createHash)("sha256").update(`sq-message:${id}`).digest("hex");
+  const h = (0, import_crypto6.createHash)("sha256").update(`sq-message:${id}`).digest("hex");
   return `${h.slice(0, 8)}-${h.slice(8, 12)}-5${h.slice(13, 16)}-${(parseInt(h[16], 16) & 3 | 8).toString(16)}${h.slice(17, 20)}-${h.slice(20, 32)}`;
 }
 function userMessage(text3, images, uuid2, priority) {
@@ -10260,7 +10366,8 @@ function buildSystemAppend(c) {
     "- The screen already shows every command you ran and every file you edited, with their output and diff. Do not list them again, and do not restate test counts or tool results the user can open; mention one only when it matters for what comes next (a test that still fails, a risk that remains).",
     "- Keep it short, like a colleague reporting in a chat: a few lines for most turns, no headings, a short list only when there are several separate items. Never repeat the same fact in two places.",
     "- End with at most one question or one suggested next step, never a menu of options. When there is an obvious next step, say it in one line.",
-    "- To show the user an image (a screenshot, a design, a reference board, a chart), write it as a Markdown image with its path in the workspace, for example `![Login screen](docs/login.png)`: the screen displays it in the conversation, and the user can open it larger. An https image address works the same way. Never say you cannot show an image; read it yourself first when you need to know what it shows."
+    "- To show the user an image (a screenshot, a design, a reference board, a chart), write it as a Markdown image with its path in the workspace, for example `![Login screen](docs/login.png)`: the screen displays it in the conversation, and the user can open it larger. An https image address works the same way. Never say you cannot show an image; read it yourself first when you need to know what it shows.",
+    ...c.imageGeneration ? ["- To create a new image (a character sheet, concept art, a sprite, an icon, a mockup, a reference board), call generate_image with a detailed prompt and where to save it, then show it from that path. Never say you cannot create images, and never answer an image request with only a prompt for another tool."] : []
   ].join("\n");
 }
 
@@ -10346,11 +10453,11 @@ async function detectTestCommandFromManifests(dir) {
 }
 
 // src/application/services/workspaceSandbox/transcript.ts
-var import_crypto6 = require("crypto");
+var import_crypto7 = require("crypto");
 var import_fs8 = require("fs");
 var import_promises11 = require("fs/promises");
 var import_path12 = require("path");
-var import_zlib = require("zlib");
+var import_zlib2 = require("zlib");
 var TRANSCRIPT_CAPS = { maxRawBytes: 64 * 1024 * 1024, maxCompressedBytes: 4 * 1024 * 1024 };
 function engineProjectDir(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
@@ -10389,10 +10496,10 @@ async function packTranscript(configDir, sessionId, redactor, caps = TRANSCRIPT_
   }
   const text3 = lines2.length ? `${lines2.join("\n")}
 ` : "";
-  const zipped = (0, import_zlib.gzipSync)(Buffer.from(text3, "utf8"), { level: 9 });
+  const zipped = (0, import_zlib2.gzipSync)(Buffer.from(text3, "utf8"), { level: 9 });
   if (zipped.length > caps.maxCompressedBytes) return { tooLarge: true, bytes: zipped.length };
   return {
-    payload: { sdkSessionId: sessionId, encoding: "gzip-base64", data: zipped.toString("base64"), bytes: Buffer.byteLength(text3), sha256: (0, import_crypto6.createHash)("sha256").update(text3).digest("hex") },
+    payload: { sdkSessionId: sessionId, encoding: "gzip-base64", data: zipped.toString("base64"), bytes: Buffer.byteLength(text3), sha256: (0, import_crypto7.createHash)("sha256").update(text3).digest("hex") },
     secretsRemoved: removed
   };
 }
@@ -10401,11 +10508,11 @@ async function restoreTranscript(configDir, cwd, t) {
   if (await findTranscript(configDir, t.sdkSessionId)) return true;
   let text3;
   try {
-    text3 = (0, import_zlib.gunzipSync)(Buffer.from(t.data, "base64"), { maxOutputLength: TRANSCRIPT_CAPS.maxRawBytes });
+    text3 = (0, import_zlib2.gunzipSync)(Buffer.from(t.data, "base64"), { maxOutputLength: TRANSCRIPT_CAPS.maxRawBytes });
   } catch {
     return false;
   }
-  if (t.sha256 && (0, import_crypto6.createHash)("sha256").update(text3).digest("hex") !== t.sha256) return false;
+  if (t.sha256 && (0, import_crypto7.createHash)("sha256").update(text3).digest("hex") !== t.sha256) return false;
   const dir = (0, import_path12.join)(configDir, "projects", engineProjectDir(cwd));
   await (0, import_promises11.mkdir)(dir, { recursive: true, mode: 448 });
   const target = (0, import_path12.join)(dir, `${t.sdkSessionId}.jsonl`);
@@ -10904,6 +11011,7 @@ function editPreview(tool, input) {
   else if (tool === "MultiEdit" && Array.isArray(input.edits)) {
     for (const e of input.edits.slice(0, 5)) out2.push(...lines2(e?.old_string, "-"), ...lines2(e?.new_string, "+"), "");
   } else if (tool === "NotebookEdit") out2.push(...lines2(input.new_source, "+"));
+  else if (tool.endsWith("__generate_image")) out2.push(...lines2(input.prompt, "+"));
   return out2.join("\n").slice(0, 4e3);
 }
 function turnOffering(raw, loaded) {
@@ -11821,7 +11929,8 @@ ${String(item.content)}` : String(item.content);
       })),
       onDemand: !!this.deps.clone && !this.local,
       layout: this.promptLayout(),
-      scopeBrief: this.scopeBrief
+      scopeBrief: this.scopeBrief,
+      imageGeneration: !!this.boot?.imageGeneration && !!this.deps.transport.generateImage
     });
     const conventions = await readConventions([...this.repos.values()].filter((r) => !r.dormant).flatMap((r) => {
       const label = r.repoFullName ?? r.localId ?? (0, import_path15.basename)(r.root);
@@ -12014,7 +12123,7 @@ ${String(item.content)}` : String(item.content);
     if (files === "unavailable") this.error("REWIND_FAILED", { turnId });
     this.emit({ type: "rewind", data: { turnId, files, conversation, ...untouched.length ? { untouched } : {} } });
     await this.diffNow();
-    await this.saveCheckpoint().catch(() => void 0);
+    await this.saveCheckpoint().catch((e) => this.deps.log.warn("checkpoint failed", { error: this.redactor.text(e.message) }));
     this.setState("READY", "REWOUND");
     await this.sink.flush();
   }
@@ -12575,7 +12684,7 @@ ${text3}`;
       this.turnWatch = null;
       this.previousTrouble = stopped || !watch ? null : watch.errored ? "follows a request that ended with an error" : watch.lastExit !== null && watch.lastExit !== 0 ? "follows a failed verification" : null;
       await this.diffNow();
-      await this.saveCheckpoint().catch(() => void 0);
+      await this.saveCheckpoint().catch((e) => this.deps.log.warn("checkpoint failed", { error: this.redactor.text(e.message) }));
       this.setState("READY", stopped ? "STOPPED" : void 0);
       await this.sink.flush();
     }
@@ -12960,9 +13069,18 @@ ${text3}`;
    * The checkpoint: every open repository's change against its base, plus the
    * saved changes of repositories not open in this run, as one map. In the
    * cloud workspace the engine's transcript goes with it (v4), so a resumed
-   * session continues the same conversation.
+   * session continues the same conversation. On the person's computer the
+   * folder keeps its binary and very large files, which the map only names.
+   * The transcript is kept even when the change could not be.
    */
   async saveCheckpoint() {
+    try {
+      await this.saveChange();
+    } finally {
+      await this.saveTranscript().catch((e) => this.deps.log.warn("transcript not kept", { error: e.message }));
+    }
+  }
+  async saveChange() {
     const map = new Map(this.pendingCheckpoints);
     for (const repo2 of this.repos.values()) {
       const key2 = repo2.repoFullName ?? repo2.localId ?? LOCAL_FOLDER_KEY;
@@ -12970,7 +13088,7 @@ ${text3}`;
         if (repo2.unsaved) map.set(key2, repo2.unsaved);
         continue;
       }
-      const patch2 = await repo2.tracker.checkpoint();
+      const patch2 = await repo2.tracker.checkpoint(this.local ? { keepInFolder: true } : void 0);
       if (patch2) map.set(key2, patch2);
       else if (repo2.unsaved) map.set(key2, repo2.unsaved);
       else map.delete(key2);
@@ -12982,7 +13100,6 @@ ${patch}`;
       await this.deps.transport.checkpoint({ patch, sdkSessionId: this.sdkSessionId });
       this.lastCheckpoint = key;
     }
-    await this.saveTranscript().catch((e) => this.deps.log.warn("transcript not kept", { error: e.message }));
   }
   /** The engine conversation, without secrets, kept by the API (only when it changed). */
   async saveTranscript() {
@@ -13027,8 +13144,7 @@ ${patch}`;
     if (running) await Promise.race([running, new Promise((r) => setTimeout(r, 2e4))]);
     if (opts.checkpoint) {
       await this.saveCheckpoint().catch((e) => {
-        this.deps.log.warn("checkpoint failed", { error: e.message });
-        this.error("CHECKPOINT_FAILED");
+        this.deps.log.warn("checkpoint failed", { error: this.redactor.text(e.message) });
       });
     }
     if (reason === "shutdown" && this.state && this.state !== "FAILED") this.setState("PAUSED", pausedCode);
@@ -13060,7 +13176,7 @@ ${patch}`;
       this.pendingCheckpoints.delete(repo2.localId);
       repo2.dormant = !repo2.unsaved;
     }
-    const stateDir = this.deps.stateDir ?? (0, import_path15.join)(this.deps.scratch, `folder-${(0, import_crypto7.createHash)("sha256").update(local.root).digest("hex").slice(0, 16)}`);
+    const stateDir = this.deps.stateDir ?? (0, import_path15.join)(this.deps.scratch, `folder-${(0, import_crypto8.createHash)("sha256").update(local.root).digest("hex").slice(0, 16)}`);
     const tracker = new LooseFileTracker({ root: local.root, stateDir, excluded: () => local.repos.map((r) => r.root) });
     const tracked = local.gitAvailable && await tracker.init().then(() => true, (e) => {
       this.deps.log.warn("loose files not tracked", { error: e.message });
@@ -13203,9 +13319,48 @@ ${patch}`;
       measureChange: (repo2) => this.measureChange(repo2),
       openPullRequest: (title, body, repo2) => this.openPullRequest(title, body, repo2),
       openRepository: (repo2) => this.openRepository(repo2),
-      listRepositories: async () => this.listRepositories()
+      listRepositories: async () => this.listRepositories(),
+      // Offered only when the API creates images for this session (an older API never gets the call).
+      ...this.boot?.imageGeneration && this.deps.transport.generateImage ? { generateImage: (a) => this.generateImage(a) } : {}
     };
   }
+  /**
+   * generate_image (Erik, 20/10/2026: Code and Chat both create images): the API creates it as the "Create image" mode
+   * does, for the session's owner and metered to that person; the engine saves it where the model asked, inside the
+   * folder (the policy fenced the path and the person's mode already allowed the write), and the conversation shows it
+   * from there. A refusal or failure goes back to the model to tell, and nothing is retried.
+   */
+  async generateImage(args) {
+    const transport = this.deps.transport, root = this.deps.root;
+    if (!transport.generateImage) return text("Creating images is not available in this session. Tell the user plainly.", true);
+    const target = await resolveInside(root, args.filePath).catch(() => null);
+    if (!target) return text(`generate_image saves only inside the workspace (${root}). Nothing was created.`, true);
+    let reference;
+    if (args.editPath) {
+      try {
+        const image = await readImageFile(root, await insideRelative(args.editPath, [root]), this.deps.privateDirs ?? []);
+        if (!["image/png", "image/jpeg", "image/webp"].includes(image.mime)) return text(`${args.editPath} is not a PNG, JPEG or WebP image, so it cannot be changed. Nothing was created.`, true);
+        reference = { name: (0, import_path15.basename)(image.path), mimeType: image.mime, sizeBytes: image.size, dataBase64: image.data };
+      } catch (e) {
+        return text(`Could not read ${args.editPath} to change it (${e instanceof FileRequestError ? e.code : "UNREADABLE"}). Nothing was created.`, true);
+      }
+    }
+    let created;
+    try {
+      created = await transport.generateImage({ prompt: args.prompt.slice(0, 4e3), ...reference ? { reference } : {}, idempotencyKey: (0, import_crypto8.randomUUID)() });
+    } catch (e) {
+      const why = e instanceof SessionGoneError ? `refused (${e.status})` : e instanceof TransportError && e.status ? `failed (${e.status})` : "failed";
+      return text(`The image could not be created: ScaleQuality ${why}. Tell the user plainly in one sentence; do not claim an image was made and do not offer a prompt for another tool instead.`, true);
+    }
+    if ("refused" in created) return text(`The image could not be created (${created.refused}). Tell the user plainly in one sentence; do not claim an image was made and do not offer a prompt for another tool instead.`, true);
+    const bytes = Buffer.from(created.dataBase64, "base64");
+    if (!bytes.length || !imageMime(bytes)) return text("The image model returned something that is not an image. Nothing was saved.", true);
+    await (0, import_promises14.mkdir)((0, import_path15.dirname)(target), { recursive: true });
+    await (0, import_promises14.writeFile)(target, bytes);
+    this.scheduleDiff();
+    const rel = (0, import_path15.relative)(await (0, import_promises14.realpath)(root).catch(() => root), target).split(import_path15.sep).join("/");
+    return text(`Saved the image to ${rel}. Show it to the user in your answer as ![short description](${rel}) and say in one or two sentences what you made.`);
+  }
   listRepositories() {
     const open2 = [...this.repos.values()];
     const data = {
@@ -13677,7 +13832,7 @@ function buildQueryOptions(o) {
 }
 function spawnKey(i) {
   const { orgMcpServers, ...data } = i;
-  return (0, import_crypto7.createHash)("sha256").update(JSON.stringify({ ...data, orgMcpServers: Object.keys(orgMcpServers).sort() })).digest("hex");
+  return (0, import_crypto8.createHash)("sha256").update(JSON.stringify({ ...data, orgMcpServers: Object.keys(orgMcpServers).sort() })).digest("hex");
 }
 function timedGate(gate, took) {
   const timed = async (run2) => {
@@ -13703,7 +13858,7 @@ async function hasLocalTranscript(configDir, sessionId) {
 }
 
 // src/application/services/workspaceSandbox/selfUpdate.ts
-var import_crypto8 = require("crypto");
+var import_crypto9 = require("crypto");
 var import_fs10 = require("fs");
 var import_path16 = require("path");
 var REGISTRY_LATEST = "https://registry.npmjs.org/@scalequality%2fcli/latest";
@@ -13886,7 +14041,7 @@ async function installVersion(o) {
     if (pkg?.name !== "@scalequality/cli" || pkg?.version !== o.version) throw new UpdateError("WRONG_PACKAGE", `npm installed ${String(pkg?.name)}@${String(pkg?.version)} instead of ${o.version}.`);
     const build = readJson2((0, import_path16.join)(root, "dist", "connect.build.json"));
     const bundle = (0, import_path16.join)(root, "dist", "connect.cjs");
-    const sha = (0, import_fs10.existsSync)(bundle) ? (0, import_crypto8.createHash)("sha256").update((0, import_fs10.readFileSync)(bundle)).digest("hex") : null;
+    const sha = (0, import_fs10.existsSync)(bundle) ? (0, import_crypto9.createHash)("sha256").update((0, import_fs10.readFileSync)(bundle)).digest("hex") : null;
     if (!sha || typeof build?.sha256 !== "string" || build.sha256 !== sha) throw new UpdateError("BUNDLE_MISMATCH", `The engine of ${o.version} does not match the sha256 it declares.`);
     let copy;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/cli",
-  "version": "0.4.21",
+  "version": "0.4.23",
   "description": "ScaleQuality CLI. Connect your computer to the ScaleQuality AI Workspace (`scalequality login`), run its coding engine in any folder of your computer, and import your Claude Code and Codex conversations.",
   "type": "module",
   "bin": {