@scalequality/cli 0.4.22 → 0.4.24

package/dist/connect.build.json

@@ -1,5 +1,5 @@
 {
   "sdkVersion": "0.3.281",
-  "sha256": "46fe6b09a8c69a92a0f54cc420a3596c6f13b82177d3aec1d46456ae508a4517",
-  "sourceCommit": "2e2e401c42e98d17e1c0dd8286bdc6d15e44f77b"
+  "sha256": "56fec662ea9898b810790ac0362ca07038e58a4de77d5acff3ad1797a34436d0",
+  "sourceCommit": "774041e55e6d33ce8fd785e6a36d9b913df3f077"
 }

package/dist/connect.cjs

@@ -1122,7 +1122,9 @@ var SQ_MCP_PREFIX = `mcp__${SQ_MCP_SERVER}__`;
 var DENIED_TOOLS = ["WebSearch", "RemoteTrigger", "CronCreate", "CronDelete", "CronList", "ScheduleWakeup", "PushNotification", "EnterWorktree", "ExitWorktree", "Artifact", "Workflow", "SendFeedback", "ClaudeDesign", "Projects"];
 var READ_TOOLS = { Read: "file_path", Glob: "path", Grep: "path", LS: "path" };
 var WRITE_TOOLS = { Write: "file_path", Edit: "file_path", MultiEdit: "file_path", NotebookEdit: "notebook_path" };
-var WRITE_TOOL_PATHS = WRITE_TOOLS;
+var IMAGE_TOOL = "generate_image";
+var IMAGE_EXTENSIONS = /* @__PURE__ */ new Set([".png", ".jpg", ".jpeg", ".webp"]);
+var WRITE_TOOL_PATHS = { ...WRITE_TOOLS, [`mcp__${"scalequality"}__${IMAGE_TOOL}`]: "file_path" };
 var HARMLESS = /* @__PURE__ */ new Set(["TodoWrite", "BashOutput", "KillShell", "TaskStop", "TaskOutput", "Skill"]);
 var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
 var SQ_READ_ONLY = /* @__PURE__ */ new Set([
@@ -1244,6 +1246,18 @@ function readOnlyCommand(command) {
     return READ_ONLY_PROGRAMS.has(program);
   });
 }
+async function imageToolDecision(input, ctx) {
+  const raw = input.file_path;
+  if (typeof raw !== "string" || !raw.trim()) return { behavior: "deny", message: "generate_image needs file_path: where to save the image in the folder (for example images/hero.png)." };
+  if (!IMAGE_EXTENSIONS.has((0, import_path3.extname)(raw).toLowerCase())) return { behavior: "deny", message: "generate_image saves .png, .jpg or .webp files: give file_path one of these extensions." };
+  if (ctx.protections?.secretFiles) {
+    const why = secretFileToolDenial("Write", { file_path: raw });
+    if (why) return { behavior: "deny", message: why, reason: "PROTECTION_SECRET_FILE" };
+  }
+  const decided = await decideToolUse("Write", { file_path: raw }, { ...ctx, plan: false, planDir: void 0 });
+  if (decided.behavior !== "allow") return decided;
+  return { behavior: "allow", updatedInput: { ...input, file_path: (0, import_path3.resolve)(ctx.root, raw.trim()) } };
+}
 async function decideToolUse(toolName, input, ctx) {
   if (toolName.startsWith("mcp__") && ctx.orgMcpTools?.all.has(toolName)) {
     if (ctx.plan && !ctx.orgMcpTools.readOnly.has(toolName)) return { behavior: "deny", message: PLAN_ONLY_READS };
@@ -1252,6 +1266,7 @@ async function decideToolUse(toolName, input, ctx) {
   if (toolName.startsWith("mcp__")) {
     if (!toolName.startsWith(SQ_MCP_PREFIX)) return { behavior: "deny", message: "Only ScaleQuality tools and the MCP servers your organization approved are available in this workspace." };
     if (ctx.plan && !SQ_READ_ONLY.has(toolName.slice(SQ_MCP_PREFIX.length))) return { behavior: "deny", message: PLAN_ONLY_READS };
+    if (toolName === SQ_MCP_PREFIX + IMAGE_TOOL) return imageToolDecision(input, ctx);
     return { behavior: "allow", updatedInput: input };
   }
   if (HARMLESS.has(toolName)) return { behavior: "allow", updatedInput: input };
@@ -2103,6 +2118,15 @@ var HttpSessionTransport = class {
     const boot = toSessionBootstrap({ session: { model: raw?.model, reasoning: raw?.reasoning }, runtime: raw?.runtime, repository: null });
     return { model: boot.model, runtime: boot.runtime, reasoning: boot.reasoning ?? null };
   }
+  /** One image created by the API for this session (generate_image); an image takes up to a few minutes. */
+  async generateImage(req) {
+    const raw = await this.post("/images", req, 24e4);
+    if (typeof raw?.error?.code === "string") return { refused: raw.error.code.slice(0, 100) };
+    const image = raw?.image;
+    if (!image || typeof image.dataBase64 !== "string" || typeof image.mimeType !== "string" || typeof image.name !== "string")
+      throw new TransportError("invalid image response", 502, false);
+    return { name: image.name, mimeType: image.mimeType, sizeBytes: Number(image.sizeBytes) || 0, dataBase64: image.dataBase64 };
+  }
   /** The organization's protections in force now (read at the start of each turn); throws when the API does not say. */
   async protections() {
     const raw = await this.post("/protections", {}, 5e3);
@@ -2254,6 +2278,7 @@ function toSessionBootstrap(raw) {
     workspaceKind: session.workspaceKind === "LOCAL" ? "LOCAL" : "CLOUD",
     projectName: typeof session.projectName === "string" ? session.projectName : typeof raw?.project?.name === "string" ? raw.project.name : null,
     folderLink: typeof session.folderLink?.projectId === "string" && session.folderLink.projectId ? { projectId: session.folderLink.projectId } : null,
+    imageGeneration: raw?.imageGeneration === true,
     transcript: transcriptOf(raw?.transcript),
     baseMeasurements: raw?.baseMeasurements && typeof raw.baseMeasurements === "object" && !Array.isArray(raw.baseMeasurements) ? raw.baseMeasurements : {},
     pullRequests: pullRequestsOf(raw?.pullRequests),
@@ -9479,6 +9504,19 @@ function buildScaleQualityServer(sdk, host) {
       async (args) => host.openPullRequest(String(args.title ?? ""), String(args.body ?? ""), typeof args.repoFullName === "string" ? args.repoFullName : void 0)
     )
   );
+  if (host.generateImage) {
+    const generate = host.generateImage.bind(host);
+    tools.push(sdk.tool(
+      IMAGE_TOOL,
+      "Create an image with an image generation model and save it in the workspace folder; then show it to the user in your answer as a Markdown image with its path. Use it whenever the user asks for an image, picture, illustration, concept art, character sheet, sprite, mockup or any other visual. It may spend credit, like any model call.",
+      {
+        prompt: external_exports.string().min(1).max(4e3).describe("A detailed description of the image in English: subject, style, composition, colours, lighting and any text to render."),
+        file_path: external_exports.string().min(1).max(500).describe("Where to save it in the workspace, ending in .png, .jpg or .webp (for example images/hero.png)."),
+        edit_image_path: external_exports.string().min(1).max(500).optional().describe("An image already in the workspace to change, instead of starting a new one.")
+      },
+      async (args) => generate({ prompt: String(args.prompt ?? ""), filePath: String(args.file_path ?? ""), ...typeof args.edit_image_path === "string" ? { editPath: args.edit_image_path } : {} })
+    ));
+  }
   return sdk.createSdkMcpServer({
     name: SQ_MCP_SERVER,
     version: "1.0.0",
@@ -9559,6 +9597,7 @@ var SQ_TOOL_LABELS = {
   list_repositories: { kind: "tool", label: "Listing the repositories of the session" },
   open_repository: { kind: "tool", label: "Opening a repository" },
   measure_change: { kind: "measure", label: "Measuring the change" },
+  generate_image: { kind: "tool", label: "Creating an image" },
   open_pull_request: { kind: "tool", label: "Opening the pull request" }
 };
 function clip(s, n) {
@@ -10327,7 +10366,9 @@ function buildSystemAppend(c) {
     "- The screen already shows every command you ran and every file you edited, with their output and diff. Do not list them again, and do not restate test counts or tool results the user can open; mention one only when it matters for what comes next (a test that still fails, a risk that remains).",
     "- Keep it short, like a colleague reporting in a chat: a few lines for most turns, no headings, a short list only when there are several separate items. Never repeat the same fact in two places.",
     "- End with at most one question or one suggested next step, never a menu of options. When there is an obvious next step, say it in one line.",
-    "- To show the user an image (a screenshot, a design, a reference board, a chart), write it as a Markdown image with its path in the workspace, for example `![Login screen](docs/login.png)`: the screen displays it in the conversation, and the user can open it larger. An https image address works the same way. Never say you cannot show an image; read it yourself first when you need to know what it shows."
+    "- To show the user an image (a screenshot, a design, a reference board, a chart), write it as a Markdown image with its path in the workspace, for example `![Login screen](docs/login.png)`: the screen displays it in the conversation, and the user can open it larger. An https image address works the same way. Never say you cannot show an image; read it yourself first when you need to know what it shows.",
+    "- To show the user a page you built (a prototype, a screen, a mockup, a chart, a small game, an HTML report), save it as an .html file in the workspace and write it as a Markdown image with that path, for example `![Battle HUD](prototype/hud.html)`: the screen runs the page in the conversation, with its code one click away. Stylesheets, scripts and images it links from the workspace go with it; scripts from a CDN load only from cdn.jsdelivr.net, cdnjs.cloudflare.com, unpkg.com or cdn.tailwindcss.com, and it calls no other address. Never say the conversation cannot show a page or a preview, and never offer to open it on the user's computer instead.",
+    ...c.imageGeneration ? ["- To create a new image (a character sheet, concept art, a sprite, an icon, a mockup, a reference board), call generate_image with a detailed prompt and where to save it, then show it from that path. Never say you cannot create images, and never answer an image request with only a prompt for another tool."] : []
   ].join("\n");
 }
 
@@ -10971,6 +11012,7 @@ function editPreview(tool, input) {
   else if (tool === "MultiEdit" && Array.isArray(input.edits)) {
     for (const e of input.edits.slice(0, 5)) out2.push(...lines2(e?.old_string, "-"), ...lines2(e?.new_string, "+"), "");
   } else if (tool === "NotebookEdit") out2.push(...lines2(input.new_source, "+"));
+  else if (tool.endsWith("__generate_image")) out2.push(...lines2(input.prompt, "+"));
   return out2.join("\n").slice(0, 4e3);
 }
 function turnOffering(raw, loaded) {
@@ -11888,7 +11930,8 @@ ${String(item.content)}` : String(item.content);
       })),
       onDemand: !!this.deps.clone && !this.local,
       layout: this.promptLayout(),
-      scopeBrief: this.scopeBrief
+      scopeBrief: this.scopeBrief,
+      imageGeneration: !!this.boot?.imageGeneration && !!this.deps.transport.generateImage
     });
     const conventions = await readConventions([...this.repos.values()].filter((r) => !r.dormant).flatMap((r) => {
       const label = r.repoFullName ?? r.localId ?? (0, import_path15.basename)(r.root);
@@ -13277,9 +13320,48 @@ ${patch}`;
       measureChange: (repo2) => this.measureChange(repo2),
       openPullRequest: (title, body, repo2) => this.openPullRequest(title, body, repo2),
       openRepository: (repo2) => this.openRepository(repo2),
-      listRepositories: async () => this.listRepositories()
+      listRepositories: async () => this.listRepositories(),
+      // Offered only when the API creates images for this session (an older API never gets the call).
+      ...this.boot?.imageGeneration && this.deps.transport.generateImage ? { generateImage: (a) => this.generateImage(a) } : {}
     };
   }
+  /**
+   * generate_image (Erik, 20/10/2026: Code and Chat both create images): the API creates it as the "Create image" mode
+   * does, for the session's owner and metered to that person; the engine saves it where the model asked, inside the
+   * folder (the policy fenced the path and the person's mode already allowed the write), and the conversation shows it
+   * from there. A refusal or failure goes back to the model to tell, and nothing is retried.
+   */
+  async generateImage(args) {
+    const transport = this.deps.transport, root = this.deps.root;
+    if (!transport.generateImage) return text("Creating images is not available in this session. Tell the user plainly.", true);
+    const target = await resolveInside(root, args.filePath).catch(() => null);
+    if (!target) return text(`generate_image saves only inside the workspace (${root}). Nothing was created.`, true);
+    let reference;
+    if (args.editPath) {
+      try {
+        const image = await readImageFile(root, await insideRelative(args.editPath, [root]), this.deps.privateDirs ?? []);
+        if (!["image/png", "image/jpeg", "image/webp"].includes(image.mime)) return text(`${args.editPath} is not a PNG, JPEG or WebP image, so it cannot be changed. Nothing was created.`, true);
+        reference = { name: (0, import_path15.basename)(image.path), mimeType: image.mime, sizeBytes: image.size, dataBase64: image.data };
+      } catch (e) {
+        return text(`Could not read ${args.editPath} to change it (${e instanceof FileRequestError ? e.code : "UNREADABLE"}). Nothing was created.`, true);
+      }
+    }
+    let created;
+    try {
+      created = await transport.generateImage({ prompt: args.prompt.slice(0, 4e3), ...reference ? { reference } : {}, idempotencyKey: (0, import_crypto8.randomUUID)() });
+    } catch (e) {
+      const why = e instanceof SessionGoneError ? `refused (${e.status})` : e instanceof TransportError && e.status ? `failed (${e.status})` : "failed";
+      return text(`The image could not be created: ScaleQuality ${why}. Tell the user plainly in one sentence; do not claim an image was made and do not offer a prompt for another tool instead.`, true);
+    }
+    if ("refused" in created) return text(`The image could not be created (${created.refused}). Tell the user plainly in one sentence; do not claim an image was made and do not offer a prompt for another tool instead.`, true);
+    const bytes = Buffer.from(created.dataBase64, "base64");
+    if (!bytes.length || !imageMime(bytes)) return text("The image model returned something that is not an image. Nothing was saved.", true);
+    await (0, import_promises14.mkdir)((0, import_path15.dirname)(target), { recursive: true });
+    await (0, import_promises14.writeFile)(target, bytes);
+    this.scheduleDiff();
+    const rel = (0, import_path15.relative)(await (0, import_promises14.realpath)(root).catch(() => root), target).split(import_path15.sep).join("/");
+    return text(`Saved the image to ${rel}. Show it to the user in your answer as ![short description](${rel}) and say in one or two sentences what you made.`);
+  }
   listRepositories() {
     const open2 = [...this.repos.values()];
     const data = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/cli",
-  "version": "0.4.22",
+  "version": "0.4.24",
   "description": "ScaleQuality CLI. Connect your computer to the ScaleQuality AI Workspace (`scalequality login`), run its coding engine in any folder of your computer, and import your Claude Code and Codex conversations.",
   "type": "module",
   "bin": {