bazilion 0.21.0 → 0.22.0

package/dist/daemon.js

@@ -742,9 +742,9 @@ function floatSafeRemainder(val, step) {
     return 0;
   return ratio - roundedRatio;
 }
-function defineLazy(object5, key3, getter) {
+function defineLazy(object6, key3, getter) {
   let value = void 0;
-  Object.defineProperty(object5, key3, {
+  Object.defineProperty(object6, key3, {
     get() {
       if (value === EVALUATING) {
         return void 0;
@@ -756,7 +756,7 @@ function defineLazy(object5, key3, getter) {
       return value;
     },
     set(v2) {
-      Object.defineProperty(object5, key3, {
+      Object.defineProperty(object6, key3, {
         value: v2
         // configurable: true,
       });
@@ -5251,7 +5251,7 @@ function never(params) {
 function array(element, params) {
   return _array(ZodArray, element, params);
 }
-function object3(shape, params) {
+function object4(shape, params) {
   const def = {
     type: "object",
     shape: shape ?? {},
@@ -6196,10 +6196,10 @@ var init_types = __esm({
        */
       pollInterval: number2().optional()
     });
-    TaskMetadataSchema = object3({
+    TaskMetadataSchema = object4({
       ttl: number2().optional()
     });
-    RelatedTaskMetadataSchema = object3({
+    RelatedTaskMetadataSchema = object4({
       taskId: string3()
     });
     RequestMetaSchema = looseObject({
@@ -6212,7 +6212,7 @@ var init_types = __esm({
        */
       [RELATED_TASK_META_KEY]: RelatedTaskMetadataSchema.optional()
     });
-    BaseRequestParamsSchema = object3({
+    BaseRequestParamsSchema = object4({
       /**
        * See [General fields: `_meta`](/specification/draft/basic/index#meta) for notes on `_meta` usage.
        */
@@ -6230,18 +6230,18 @@ var init_types = __esm({
       task: TaskMetadataSchema.optional()
     });
     isTaskAugmentedRequestParams = (value) => TaskAugmentedRequestParamsSchema.safeParse(value).success;
-    RequestSchema = object3({
+    RequestSchema = object4({
       method: string3(),
       params: BaseRequestParamsSchema.loose().optional()
     });
-    NotificationsParamsSchema = object3({
+    NotificationsParamsSchema = object4({
       /**
        * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
        * for notes on _meta usage.
        */
       _meta: RequestMetaSchema.optional()
     });
-    NotificationSchema = object3({
+    NotificationSchema = object4({
       method: string3(),
       params: NotificationsParamsSchema.loose().optional()
     });
@@ -6253,18 +6253,18 @@ var init_types = __esm({
       _meta: RequestMetaSchema.optional()
     });
     RequestIdSchema = union([string3(), number2().int()]);
-    JSONRPCRequestSchema = object3({
+    JSONRPCRequestSchema = object4({
       jsonrpc: literal(JSONRPC_VERSION),
       id: RequestIdSchema,
       ...RequestSchema.shape
     }).strict();
     isJSONRPCRequest = (value) => JSONRPCRequestSchema.safeParse(value).success;
-    JSONRPCNotificationSchema = object3({
+    JSONRPCNotificationSchema = object4({
       jsonrpc: literal(JSONRPC_VERSION),
       ...NotificationSchema.shape
     }).strict();
     isJSONRPCNotification = (value) => JSONRPCNotificationSchema.safeParse(value).success;
-    JSONRPCResultResponseSchema = object3({
+    JSONRPCResultResponseSchema = object4({
       jsonrpc: literal(JSONRPC_VERSION),
       id: RequestIdSchema,
       result: ResultSchema
@@ -6280,10 +6280,10 @@ var init_types = __esm({
       ErrorCode2[ErrorCode2["InternalError"] = -32603] = "InternalError";
       ErrorCode2[ErrorCode2["UrlElicitationRequired"] = -32042] = "UrlElicitationRequired";
     })(ErrorCode || (ErrorCode = {}));
-    JSONRPCErrorResponseSchema = object3({
+    JSONRPCErrorResponseSchema = object4({
       jsonrpc: literal(JSONRPC_VERSION),
       id: RequestIdSchema.optional(),
-      error: object3({
+      error: object4({
         /**
          * The error type that occurred.
          */
@@ -6323,7 +6323,7 @@ var init_types = __esm({
       method: literal("notifications/cancelled"),
       params: CancelledNotificationParamsSchema
     });
-    IconSchema = object3({
+    IconSchema = object4({
       /**
        * URL or data URI for the icon.
        */
@@ -6348,7 +6348,7 @@ var init_types = __esm({
        */
       theme: _enum(["light", "dark"]).optional()
     });
-    IconsSchema = object3({
+    IconsSchema = object4({
       /**
        * Optional set of sized icons that the client can display in a user interface.
        *
@@ -6362,7 +6362,7 @@ var init_types = __esm({
        */
       icons: array(IconSchema).optional()
     });
-    BaseMetadataSchema = object3({
+    BaseMetadataSchema = object4({
       /** Intended for programmatic or logical use, but used as a display name in past specs or fallback */
       name: string3(),
       /**
@@ -6392,7 +6392,7 @@ var init_types = __esm({
        */
       description: string3().optional()
     });
-    FormElicitationCapabilitySchema = intersection(object3({
+    FormElicitationCapabilitySchema = intersection(object4({
       applyDefaults: boolean2().optional()
     }), record2(string3(), unknown()));
     ElicitationCapabilitySchema = preprocess((value) => {
@@ -6402,7 +6402,7 @@ var init_types = __esm({
         }
       }
       return value;
-    }, intersection(object3({
+    }, intersection(object4({
       form: FormElicitationCapabilitySchema.optional(),
       url: AssertObjectSchema.optional()
     }), record2(string3(), unknown()).optional()));
@@ -6454,7 +6454,7 @@ var init_types = __esm({
         }).optional()
       }).optional()
     });
-    ClientCapabilitiesSchema = object3({
+    ClientCapabilitiesSchema = object4({
       /**
        * Experimental, non-standard capabilities that the client supports.
        */
@@ -6462,7 +6462,7 @@ var init_types = __esm({
       /**
        * Present if the client supports sampling from an LLM.
        */
-      sampling: object3({
+      sampling: object4({
         /**
          * Present if the client supports context inclusion via includeContext parameter.
          * If not declared, servers SHOULD only use `includeContext: "none"` (or omit it).
@@ -6480,7 +6480,7 @@ var init_types = __esm({
       /**
        * Present if the client supports listing roots.
        */
-      roots: object3({
+      roots: object4({
         /**
          * Whether the client supports issuing notifications for changes to the roots list.
          */
@@ -6507,7 +6507,7 @@ var init_types = __esm({
       method: literal("initialize"),
       params: InitializeRequestParamsSchema
     });
-    ServerCapabilitiesSchema = object3({
+    ServerCapabilitiesSchema = object4({
       /**
        * Experimental, non-standard capabilities that the server supports.
        */
@@ -6523,7 +6523,7 @@ var init_types = __esm({
       /**
        * Present if the server offers any prompt templates.
        */
-      prompts: object3({
+      prompts: object4({
         /**
          * Whether this server supports issuing notifications for changes to the prompt list.
          */
@@ -6532,7 +6532,7 @@ var init_types = __esm({
       /**
        * Present if the server offers any resources to read.
        */
-      resources: object3({
+      resources: object4({
         /**
          * Whether this server supports clients subscribing to resource updates.
          */
@@ -6545,7 +6545,7 @@ var init_types = __esm({
       /**
        * Present if the server offers any tools to call.
        */
-      tools: object3({
+      tools: object4({
         /**
          * Whether this server supports issuing notifications for changes to the tool list.
          */
@@ -6583,7 +6583,7 @@ var init_types = __esm({
       method: literal("ping"),
       params: BaseRequestParamsSchema.optional()
     });
-    ProgressSchema = object3({
+    ProgressSchema = object4({
       /**
        * The progress thus far. This should increase every time progress is made, even if the total is unknown.
        */
@@ -6597,7 +6597,7 @@ var init_types = __esm({
        */
       message: optional(string3())
     });
-    ProgressNotificationParamsSchema = object3({
+    ProgressNotificationParamsSchema = object4({
       ...NotificationsParamsSchema.shape,
       ...ProgressSchema.shape,
       /**
@@ -6627,7 +6627,7 @@ var init_types = __esm({
       nextCursor: CursorSchema.optional()
     });
     TaskStatusSchema = _enum(["working", "input_required", "completed", "failed", "cancelled"]);
-    TaskSchema = object3({
+    TaskSchema = object4({
       taskId: string3(),
       status: TaskStatusSchema,
       /**
@@ -6684,7 +6684,7 @@ var init_types = __esm({
       })
     });
     CancelTaskResultSchema = ResultSchema.merge(TaskSchema);
-    ResourceContentsSchema = object3({
+    ResourceContentsSchema = object4({
       /**
        * The URI of this resource.
        */
@@ -6720,7 +6720,7 @@ var init_types = __esm({
       blob: Base64Schema
     });
     RoleSchema = _enum(["user", "assistant"]);
-    AnnotationsSchema = object3({
+    AnnotationsSchema = object4({
       /**
        * Intended audience(s) for the resource.
        */
@@ -6734,7 +6734,7 @@ var init_types = __esm({
        */
       lastModified: iso_exports.datetime({ offset: true }).optional()
     });
-    ResourceSchema = object3({
+    ResourceSchema = object4({
       ...BaseMetadataSchema.shape,
       ...IconsSchema.shape,
       /**
@@ -6767,7 +6767,7 @@ var init_types = __esm({
        */
       _meta: optional(looseObject({}))
     });
-    ResourceTemplateSchema = object3({
+    ResourceTemplateSchema = object4({
       ...BaseMetadataSchema.shape,
       ...IconsSchema.shape,
       /**
@@ -6846,7 +6846,7 @@ var init_types = __esm({
       method: literal("notifications/resources/updated"),
       params: ResourceUpdatedNotificationParamsSchema
     });
-    PromptArgumentSchema = object3({
+    PromptArgumentSchema = object4({
       /**
        * The name of the argument.
        */
@@ -6860,7 +6860,7 @@ var init_types = __esm({
        */
       required: optional(boolean2())
     });
-    PromptSchema = object3({
+    PromptSchema = object4({
       ...BaseMetadataSchema.shape,
       ...IconsSchema.shape,
       /**
@@ -6897,7 +6897,7 @@ var init_types = __esm({
       method: literal("prompts/get"),
       params: GetPromptRequestParamsSchema
     });
-    TextContentSchema = object3({
+    TextContentSchema = object4({
       type: literal("text"),
       /**
        * The text content of the message.
@@ -6913,7 +6913,7 @@ var init_types = __esm({
        */
       _meta: record2(string3(), unknown()).optional()
     });
-    ImageContentSchema = object3({
+    ImageContentSchema = object4({
       type: literal("image"),
       /**
        * The base64-encoded image data.
@@ -6933,7 +6933,7 @@ var init_types = __esm({
        */
       _meta: record2(string3(), unknown()).optional()
     });
-    AudioContentSchema = object3({
+    AudioContentSchema = object4({
       type: literal("audio"),
       /**
        * The base64-encoded audio data.
@@ -6953,7 +6953,7 @@ var init_types = __esm({
        */
       _meta: record2(string3(), unknown()).optional()
     });
-    ToolUseContentSchema = object3({
+    ToolUseContentSchema = object4({
       type: literal("tool_use"),
       /**
        * The name of the tool to invoke.
@@ -6976,7 +6976,7 @@ var init_types = __esm({
        */
       _meta: record2(string3(), unknown()).optional()
     });
-    EmbeddedResourceSchema = object3({
+    EmbeddedResourceSchema = object4({
       type: literal("resource"),
       resource: union([TextResourceContentsSchema, BlobResourceContentsSchema]),
       /**
@@ -6999,7 +6999,7 @@ var init_types = __esm({
       ResourceLinkSchema,
       EmbeddedResourceSchema
     ]);
-    PromptMessageSchema = object3({
+    PromptMessageSchema = object4({
       role: RoleSchema,
       content: ContentBlockSchema
     });
@@ -7014,7 +7014,7 @@ var init_types = __esm({
       method: literal("notifications/prompts/list_changed"),
       params: NotificationsParamsSchema.optional()
     });
-    ToolAnnotationsSchema = object3({
+    ToolAnnotationsSchema = object4({
       /**
        * A human-readable title for the tool.
        */
@@ -7053,7 +7053,7 @@ var init_types = __esm({
        */
       openWorldHint: boolean2().optional()
     });
-    ToolExecutionSchema = object3({
+    ToolExecutionSchema = object4({
       /**
        * Indicates the tool's preference for task-augmented execution.
        * - "required": Clients MUST invoke the tool as a task
@@ -7064,7 +7064,7 @@ var init_types = __esm({
        */
       taskSupport: _enum(["required", "optional", "forbidden"]).optional()
     });
-    ToolSchema = object3({
+    ToolSchema = object4({
       ...BaseMetadataSchema.shape,
       ...IconsSchema.shape,
       /**
@@ -7075,7 +7075,7 @@ var init_types = __esm({
        * A JSON Schema 2020-12 object defining the expected parameters for the tool.
        * Must have type: 'object' at the root level per MCP spec.
        */
-      inputSchema: object3({
+      inputSchema: object4({
         type: literal("object"),
         properties: record2(string3(), AssertObjectSchema).optional(),
         required: array(string3()).optional()
@@ -7085,7 +7085,7 @@ var init_types = __esm({
        * returned in the structuredContent field of a CallToolResult.
        * Must have type: 'object' at the root level per MCP spec.
        */
-      outputSchema: object3({
+      outputSchema: object4({
         type: literal("object"),
         properties: record2(string3(), AssertObjectSchema).optional(),
         required: array(string3()).optional()
@@ -7161,7 +7161,7 @@ var init_types = __esm({
       method: literal("notifications/tools/list_changed"),
       params: NotificationsParamsSchema.optional()
     });
-    ListChangedOptionsBaseSchema = object3({
+    ListChangedOptionsBaseSchema = object4({
       /**
        * If true, the list will be refreshed automatically when a list changed notification is received.
        * The callback will be called with the updated list.
@@ -7210,13 +7210,13 @@ var init_types = __esm({
       method: literal("notifications/message"),
       params: LoggingMessageNotificationParamsSchema
     });
-    ModelHintSchema = object3({
+    ModelHintSchema = object4({
       /**
        * A hint for a model name.
        */
       name: string3().optional()
     });
-    ModelPreferencesSchema = object3({
+    ModelPreferencesSchema = object4({
       /**
        * Optional hints to use for model selection.
        */
@@ -7234,7 +7234,7 @@ var init_types = __esm({
        */
       intelligencePriority: number2().min(0).max(1).optional()
     });
-    ToolChoiceSchema = object3({
+    ToolChoiceSchema = object4({
       /**
        * Controls when tools are used:
        * - "auto": Model decides whether to use tools (default)
@@ -7243,11 +7243,11 @@ var init_types = __esm({
        */
       mode: _enum(["auto", "required", "none"]).optional()
     });
-    ToolResultContentSchema = object3({
+    ToolResultContentSchema = object4({
       type: literal("tool_result"),
       toolUseId: string3().describe("The unique identifier for the corresponding tool call."),
       content: array(ContentBlockSchema).default([]),
-      structuredContent: object3({}).loose().optional(),
+      structuredContent: object4({}).loose().optional(),
       isError: boolean2().optional(),
       /**
        * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
@@ -7263,7 +7263,7 @@ var init_types = __esm({
       ToolUseContentSchema,
       ToolResultContentSchema
     ]);
-    SamplingMessageSchema = object3({
+    SamplingMessageSchema = object4({
       role: RoleSchema,
       content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
       /**
@@ -7363,13 +7363,13 @@ var init_types = __esm({
        */
       content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)])
     });
-    BooleanSchemaSchema = object3({
+    BooleanSchemaSchema = object4({
       type: literal("boolean"),
       title: string3().optional(),
       description: string3().optional(),
       default: boolean2().optional()
     });
-    StringSchemaSchema = object3({
+    StringSchemaSchema = object4({
       type: literal("string"),
       title: string3().optional(),
       description: string3().optional(),
@@ -7378,7 +7378,7 @@ var init_types = __esm({
       format: _enum(["email", "uri", "date", "date-time"]).optional(),
       default: string3().optional()
     });
-    NumberSchemaSchema = object3({
+    NumberSchemaSchema = object4({
       type: _enum(["number", "integer"]),
       title: string3().optional(),
       description: string3().optional(),
@@ -7386,24 +7386,24 @@ var init_types = __esm({
       maximum: number2().optional(),
       default: number2().optional()
     });
-    UntitledSingleSelectEnumSchemaSchema = object3({
+    UntitledSingleSelectEnumSchemaSchema = object4({
       type: literal("string"),
       title: string3().optional(),
       description: string3().optional(),
       enum: array(string3()),
       default: string3().optional()
     });
-    TitledSingleSelectEnumSchemaSchema = object3({
+    TitledSingleSelectEnumSchemaSchema = object4({
       type: literal("string"),
       title: string3().optional(),
       description: string3().optional(),
-      oneOf: array(object3({
+      oneOf: array(object4({
         const: string3(),
         title: string3()
       })),
       default: string3().optional()
     });
-    LegacyTitledEnumSchemaSchema = object3({
+    LegacyTitledEnumSchemaSchema = object4({
       type: literal("string"),
       title: string3().optional(),
       description: string3().optional(),
@@ -7412,26 +7412,26 @@ var init_types = __esm({
       default: string3().optional()
     });
     SingleSelectEnumSchemaSchema = union([UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema]);
-    UntitledMultiSelectEnumSchemaSchema = object3({
+    UntitledMultiSelectEnumSchemaSchema = object4({
       type: literal("array"),
       title: string3().optional(),
       description: string3().optional(),
       minItems: number2().optional(),
       maxItems: number2().optional(),
-      items: object3({
+      items: object4({
         type: literal("string"),
         enum: array(string3())
       }),
       default: array(string3()).optional()
     });
-    TitledMultiSelectEnumSchemaSchema = object3({
+    TitledMultiSelectEnumSchemaSchema = object4({
       type: literal("array"),
       title: string3().optional(),
       description: string3().optional(),
       minItems: number2().optional(),
       maxItems: number2().optional(),
-      items: object3({
-        anyOf: array(object3({
+      items: object4({
+        anyOf: array(object4({
           const: string3(),
           title: string3()
         }))
@@ -7456,7 +7456,7 @@ var init_types = __esm({
        * A restricted subset of JSON Schema.
        * Only top-level properties are allowed, without nesting.
        */
-      requestedSchema: object3({
+      requestedSchema: object4({
         type: literal("object"),
         properties: record2(string3(), PrimitiveSchemaDefinitionSchema),
         required: array(string3()).optional()
@@ -7512,14 +7512,14 @@ var init_types = __esm({
        */
       content: preprocess((val) => val === null ? void 0 : val, record2(string3(), union([string3(), number2(), boolean2(), array(string3())])).optional())
     });
-    ResourceTemplateReferenceSchema = object3({
+    ResourceTemplateReferenceSchema = object4({
       type: literal("ref/resource"),
       /**
        * The URI or URI template of the resource.
        */
       uri: string3()
     });
-    PromptReferenceSchema = object3({
+    PromptReferenceSchema = object4({
       type: literal("ref/prompt"),
       /**
        * The name of the prompt or prompt template
@@ -7531,7 +7531,7 @@ var init_types = __esm({
       /**
        * The argument's information
        */
-      argument: object3({
+      argument: object4({
         /**
          * The name of the argument
          */
@@ -7541,7 +7541,7 @@ var init_types = __esm({
          */
         value: string3()
       }),
-      context: object3({
+      context: object4({
         /**
          * Previously-resolved variables in a URI template or prompt.
          */
@@ -7568,7 +7568,7 @@ var init_types = __esm({
         hasMore: optional(boolean2())
       })
     });
-    RootSchema = object3({
+    RootSchema = object4({
       /**
        * The URI identifying the root. This *must* start with file:// for now.
        */
@@ -8089,13 +8089,13 @@ var init_auth = __esm({
       op_tos_uri: SafeUrlSchema.optional(),
       client_id_metadata_document_supported: boolean2().optional()
     });
-    OpenIdProviderDiscoveryMetadataSchema = object3({
+    OpenIdProviderDiscoveryMetadataSchema = object4({
       ...OpenIdProviderMetadataSchema.shape,
       ...OAuthMetadataSchema.pick({
         code_challenge_methods_supported: true
       }).shape
     });
-    OAuthTokensSchema = object3({
+    OAuthTokensSchema = object4({
       access_token: string3(),
       id_token: string3().optional(),
       // Optional for OAuth 2.1, but necessary in OpenID Connect
@@ -8104,13 +8104,13 @@ var init_auth = __esm({
       scope: string3().optional(),
       refresh_token: string3().optional()
     }).strip();
-    OAuthErrorResponseSchema = object3({
+    OAuthErrorResponseSchema = object4({
       error: string3(),
       error_description: string3().optional(),
       error_uri: string3().optional()
     });
     OptionalSafeUrlSchema = SafeUrlSchema.optional().or(literal("").transform(() => void 0));
-    OAuthClientMetadataSchema = object3({
+    OAuthClientMetadataSchema = object4({
       redirect_uris: array(SafeUrlSchema),
       token_endpoint_auth_method: string3().optional(),
       grant_types: array(string3()).optional(),
@@ -8128,18 +8128,18 @@ var init_auth = __esm({
       software_version: string3().optional(),
       software_statement: string3().optional()
     }).strip();
-    OAuthClientInformationSchema = object3({
+    OAuthClientInformationSchema = object4({
       client_id: string3(),
       client_secret: string3().optional(),
       client_id_issued_at: number2().optional(),
       client_secret_expires_at: number2().optional()
     }).strip();
     OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
-    OAuthClientRegistrationErrorSchema = object3({
+    OAuthClientRegistrationErrorSchema = object4({
       error: string3(),
       error_description: string3().optional()
     }).strip();
-    OAuthTokenRevocationRequestSchema = object3({
+    OAuthTokenRevocationRequestSchema = object4({
       token: string3(),
       token_type_hint: string3().optional()
     }).strip();
@@ -22318,6 +22318,85 @@ function finishDelivery(db, id, ok, actor, error2, now = Date.now()) {
   })();
 }
 
+// ../daemon/src/core/image-generation-config.ts
+var OPENROUTER_IMAGE_MODELS = [
+  "google/gemini-3.1-flash-image",
+  "openai/gpt-image-2"
+];
+var IMAGE_MODELS = [
+  ...OPENROUTER_IMAGE_MODELS,
+  "openai:gpt-image-2",
+  "openai-codex:gpt-image-2"
+];
+var IMAGE_MODEL_CHOICES = ["auto", ...IMAGE_MODELS];
+function imageTurnEnv(env, chatModel) {
+  const copy = { ...env };
+  if (!chatModel.startsWith("openrouter:")) delete copy.OPENROUTER_API_KEY;
+  if (!chatModel.startsWith("openai:")) delete copy.OPENAI_API_KEY;
+  return copy;
+}
+function imageGenerationConfig(env, codexConnected = false, text3) {
+  if (env.BAZILION_IMAGE_GENERATION !== "on") {
+    return { ready: false, status: "Image generation is off." };
+  }
+  let model = env.BAZILION_IMAGE_MODEL || "auto";
+  const automatic = model === "auto";
+  if (automatic) {
+    const enabled = ["openai", "openai-codex"].filter(
+      (id) => text3?.enabledProviders.has(id)
+    );
+    const chatProvider = text3?.chatModel?.split(":")[0];
+    let provider2;
+    if (chatProvider === "openai" || chatProvider === "openai-codex") {
+      if (!enabled.includes(chatProvider)) {
+        return {
+          ready: false,
+          status: "Automatic images require the Agent\u2019s OpenAI/ChatGPT text provider to be enabled. No switch to another billing route."
+        };
+      }
+      provider2 = chatProvider;
+    } else if (enabled.length === 1 && enabled[0]) {
+      provider2 = enabled[0];
+    } else {
+      return {
+        ready: false,
+        status: enabled.length === 0 ? "Automatic images: enable OpenAI API key or ChatGPT/Codex for text first. Stored credentials alone do not enable a route; OpenRouter requires an explicit image choice." : "Automatic images: both OpenAI text providers are enabled. OpenAI/ChatGPT Agents follow their own text provider; other Agents require an explicit image route. No credential fallback."
+      };
+    }
+    model = `${provider2}:gpt-image-2`;
+  }
+  const selectionNote = automatic ? " Automatic selection follows enabled text providers, never provider failures." : "";
+  if (!IMAGE_MODELS.some((id) => id === model)) {
+    return { ready: false, status: "Select a supported image model before generating images." };
+  }
+  if (model === "openai-codex:gpt-image-2") {
+    return codexConnected ? {
+      ready: true,
+      model,
+      provider: "openai-codex",
+      status: "Ready: gpt-image-2 via ChatGPT/Codex login (subscription limits apply; image entitlement is not yet tested). No API-key fallback." + selectionNote
+    } : {
+      ready: false,
+      status: "Connect ChatGPT on /config or run bazilion auth openai login. Image access depends on your account; no API-key fallback."
+    };
+  }
+  const provider = model === "openai:gpt-image-2" ? "openai" : "openrouter";
+  const key3 = provider === "openai" ? "OPENAI_API_KEY" : "OPENROUTER_API_KEY";
+  const apiKey = env[key3]?.trim();
+  if (!apiKey)
+    return {
+      ready: false,
+      status: `Set ${key3} in the ${provider === "openai" ? "OpenAI" : "OpenRouter"} provider settings. No credential fallback.`
+    };
+  return {
+    ready: true,
+    model,
+    provider,
+    apiKey,
+    status: `Ready: ${model} via ${provider === "openai" ? "OpenAI API key" : "OpenRouter"} (paid API requests; account access is not yet tested).${selectionNote}`
+  };
+}
+
 // ../daemon/src/core/services.ts
 var SERVICES = [
   // --- LLM providers (configured via API keys / URLs) ---
@@ -22583,6 +22662,20 @@ var SERVICES = [
     hint: "GLM coding endpoint \xB7 open.bigmodel.cn",
     fields: [{ envVar: "ZAI_CODING_CN_API_KEY", kind: "secret", label: "API key" }]
   },
+  {
+    id: "meta",
+    displayName: "Meta",
+    category: "provider",
+    hint: "Meta model API \xB7 api.meta.ai",
+    fields: [{ envVar: "META_API_KEY", kind: "secret", label: "API key" }]
+  },
+  {
+    id: "radius",
+    displayName: "Radius",
+    category: "provider",
+    hint: "Radius gateway \xB7 radius.pi.dev",
+    fields: [{ envVar: "RADIUS_API_KEY", kind: "secret", label: "API key" }]
+  },
   {
     id: "huggingface",
     displayName: "Hugging Face",
@@ -22707,6 +22800,36 @@ var SERVICES = [
     ]
   },
   // --- Ancillary services (web search, etc) ---
+  {
+    id: "image-generation",
+    displayName: "Image generation",
+    category: "service",
+    team: "Content tools",
+    hint: "Automatic (default) follows your enabled OpenAI text providers: API key \u2192 separate API billing; ChatGPT/Codex login \u2192 subscription usage. If both are enabled, OpenAI/ChatGPT Agents use their own text provider; other Agents need an explicit image choice. Saved credentials alone never select a route. OpenRouter is explicit only. Provider failures never switch billing routes. Image generation still requires the separate on switch. Four requests/turn, one in flight/home; environment variables override saved settings.",
+    fields: [
+      {
+        envVar: "BAZILION_IMAGE_MODEL",
+        kind: "config",
+        label: "Default image route / model",
+        options: IMAGE_MODEL_CHOICES,
+        optionLabels: {
+          auto: "Automatic \xB7 follow enabled OpenAI text providers",
+          "google/gemini-3.1-flash-image": "OpenRouter \xB7 Gemini 3.1 Flash Image",
+          "openai/gpt-image-2": "OpenRouter \xB7 GPT Image 2",
+          "openai:gpt-image-2": "OpenAI API key \xB7 GPT Image 2",
+          "openai-codex:gpt-image-2": "ChatGPT/Codex login \xB7 GPT Image 2 (requested)"
+        },
+        description: "Unset or Automatic follows enabled text providers. Explicit selections override automatic routing. API-key routes incur API charges; ChatGPT image entitlement is account-dependent and not tested by saving settings."
+      },
+      {
+        envVar: "BAZILION_IMAGE_GENERATION",
+        kind: "config",
+        label: "Image generation",
+        options: ["off", "on"],
+        description: "Off by default. Enabling permits image requests (API charges or subscription usage) from normal Agent turns, including background turns."
+      }
+    ]
+  },
   {
     id: "firecrawl",
     displayName: "Firecrawl",
@@ -23725,6 +23848,15 @@ var REASONING_LEVELS = [
 var DEVICE_TOKEN_SCOPES = ["read", "write", "approvals", "admin"];
 var ALL_DEVICE_TOKEN_SCOPES = DEVICE_TOKEN_SCOPES;
 
+// ../../packages/api-types/src/image-generation.ts
+function imageGenerationRouteLabel(model) {
+  if (model === "openai:gpt-image-2") return "OpenAI API key";
+  if (model === "openai-codex:gpt-image-2") return "ChatGPT/Codex login";
+  if (model === "google/gemini-3.1-flash-image" || model === "openai/gpt-image-2")
+    return "OpenRouter";
+  return "Unknown image route";
+}
+
 // ../../packages/api-types/src/git-review.ts
 var REVIEW_LIMITS = {
   files: 1e3,
@@ -27549,15 +27681,15 @@ function codingRelativePath(value, field = "cwd") {
 }
 function validateCodingEnvironmentConfig(input) {
   const config2 = object(input, ["image", "cwd", "env"], "configuration");
-  const image = text(config2.image, 512, "image");
-  if (!/^[A-Za-z0-9][A-Za-z0-9._/:@-]*$/.test(image)) invalid2("image");
+  const image2 = text(config2.image, 512, "image");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/:@-]*$/.test(image2)) invalid2("image");
   const cwd = codingRelativePath(config2.cwd);
   const env = object(config2.env, ["CI", "NO_COLOR", "TZ"], "environment values");
   for (const [key3, value] of Object.entries(env)) {
     const allowed = key3 === "CI" ? ["true", "false"] : key3 === "NO_COLOR" ? ["0", "1"] : ["UTC"];
     if (typeof value !== "string" || !allowed.includes(value)) invalid2("environment values");
   }
-  return { image, cwd, env };
+  return { image: image2, cwd, env };
 }
 function validateCodingCommand(input) {
   const value = object(input, ["command", "cwd", "purpose", "timeoutSeconds"], "command");
@@ -28180,13 +28312,13 @@ function validateDockerExecutableIdentity(identity2) {
   }
 }
 function createDockerBashOperations(options) {
-  const image = options.image;
+  const image2 = options.image;
   const env = { ...options.env };
   const dockerPath = options.dockerPath ?? "docker";
   const configuredReadOnlyMounts = options.readOnlyMounts ?? [];
   const hostEnv = { ...options.hostEnv ?? process.env };
   validateDockerPath(dockerPath);
-  validateImage(image);
+  validateImage(image2);
   return {
     async exec(command, cwd, { onData, signal, timeout }) {
       const timeoutMs = resolveTimeoutMs(timeout);
@@ -28206,11 +28338,11 @@ function createDockerBashOperations(options) {
       if (signal?.aborted) throw new Error("aborted");
       const { uid, gid } = hostIdentity();
       const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
-      const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
+      const resolvedImage = await inspectSandboxImage(dockerPath, image2, dockerClientEnv);
       if (signal?.aborted) throw new Error("aborted");
       const containerName = options.lifecycle?.name("bash") ?? `bazilion-bash-${process.pid}-${randomUUID25().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
-        image,
+        image: image2,
         env,
         dockerPath,
         command,
@@ -28443,25 +28575,25 @@ async function inspectDockerEndpoint(dockerPath, processEnv) {
     );
   }
 }
-async function inspectSandboxImage(dockerPath, image, processEnv) {
+async function inspectSandboxImage(dockerPath, image2, processEnv) {
   let raw2;
   try {
     raw2 = await runDockerInspection(
       dockerPath,
-      ["image", "inspect", "--format", '{{json .Id}}	{{json (index .Config "Volumes")}}', image],
+      ["image", "inspect", "--format", '{{json .Id}}	{{json (index .Config "Volumes")}}', image2],
       processEnv,
-      `local image ${JSON.stringify(image)}`
+      `local image ${JSON.stringify(image2)}`
     );
   } catch (error2) {
     const detail3 = error2 instanceof Error ? error2.message : String(error2);
     if (/no such image|unable to find image|manifest unknown/i.test(detail3)) {
-      throw new Error(`Docker sandbox image "${image}" is unavailable: ${detail3}`);
+      throw new Error(`Docker sandbox image "${image2}" is unavailable: ${detail3}`);
     }
     throw error2;
   }
   const separator = raw2.indexOf("	");
   if (separator < 0) {
-    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image2}"`);
   }
   let id;
   let volumes;
@@ -28469,18 +28601,18 @@ async function inspectSandboxImage(dockerPath, image, processEnv) {
     id = JSON.parse(raw2.slice(0, separator));
     volumes = JSON.parse(raw2.slice(separator + 1));
   } catch {
-    throw new Error(`Docker sandbox received an invalid inspection result for image "${image}"`);
+    throw new Error(`Docker sandbox received an invalid inspection result for image "${image2}"`);
   }
   if (typeof id !== "string" || !id.startsWith("sha256:")) {
-    throw new Error(`Docker sandbox received an invalid image id for "${image}"`);
+    throw new Error(`Docker sandbox received an invalid image id for "${image2}"`);
   }
   if (volumes !== null && typeof volumes === "object" && Object.keys(volumes).length > 0) {
     throw new Error(
-      `Docker sandbox image "${image}" declares writable volumes (${Object.keys(volumes).sort().join(", ")}); use an image without VOLUME declarations`
+      `Docker sandbox image "${image2}" declares writable volumes (${Object.keys(volumes).sort().join(", ")}); use an image without VOLUME declarations`
     );
   }
   if (volumes !== null && (typeof volumes !== "object" || Array.isArray(volumes))) {
-    throw new Error(`Docker sandbox received invalid volume metadata for image "${image}"`);
+    throw new Error(`Docker sandbox received invalid volume metadata for image "${image2}"`);
   }
   return id;
 }
@@ -28543,12 +28675,12 @@ function validateDockerPath(dockerPath) {
   if (dockerPath.includes("\0"))
     throw new Error("Docker sandbox executable path contains a NUL byte");
 }
-function validateImage(image) {
-  if (!image.trim()) throw new Error("Docker sandbox image is required");
-  if (image.startsWith("-")) {
-    throw new Error(`Docker sandbox image cannot start with "-": ${JSON.stringify(image)}`);
+function validateImage(image2) {
+  if (!image2.trim()) throw new Error("Docker sandbox image is required");
+  if (image2.startsWith("-")) {
+    throw new Error(`Docker sandbox image cannot start with "-": ${JSON.stringify(image2)}`);
   }
-  if (image.includes("\0")) throw new Error("Docker sandbox image contains a NUL byte");
+  if (image2.includes("\0")) throw new Error("Docker sandbox image contains a NUL byte");
 }
 function validateContainerName(containerName) {
   if (!CONTAINER_NAME.test(containerName)) {
@@ -30124,6 +30256,7 @@ function piMessagesToProviderView(messages, questionResultVisible) {
           toolCallId: tr.toolCallId,
           toolName: tr.toolName,
           result: extractResultReference(m2),
+          results: extractResultReferences(m2),
           ...images.length > 0 ? { images } : {}
         });
         break;
@@ -30134,6 +30267,15 @@ function piMessagesToProviderView(messages, questionResultVisible) {
   }
   return out;
 }
+function extractResultReferences(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const refs = value.details?.results;
+  if (!Array.isArray(refs) || refs.length > 4) return void 0;
+  return refs.flatMap((ref) => {
+    const parsed = extractResultReference({ details: { result: ref } });
+    return parsed ? [parsed] : [];
+  });
+}
 function extractResultReference(value) {
   if (!value || typeof value !== "object") return void 0;
   const details = value.details;
@@ -31051,6 +31193,8 @@ var PROTECTED_PROVIDER_NAMES = [
   "opencode",
   "opencode-go",
   "zai-coding-cn",
+  "meta",
+  "radius",
   "github-copilot",
   "cloudflare-ai-gateway",
   "cloudflare-workers-ai",
@@ -31101,6 +31245,8 @@ var PROVIDER_API_KEY_ENV = {
   opencode: ["OPENCODE_API_KEY"],
   "opencode-go": ["OPENCODE_GO_API_KEY"],
   "zai-coding-cn": ["ZAI_CODING_CN_API_KEY"],
+  meta: ["META_API_KEY"],
+  radius: ["RADIUS_API_KEY"],
   "github-copilot": ["COPILOT_GITHUB_TOKEN"],
   "cloudflare-ai-gateway": ["CLOUDFLARE_API_KEY"],
   "cloudflare-workers-ai": ["CLOUDFLARE_API_KEY"],
@@ -31644,6 +31790,8 @@ function loadProviderConfigFromEnv(env = process.env, oauth) {
   if (env.OPENCODE_API_KEY) config2.opencode = { apiKey: env.OPENCODE_API_KEY };
   if (env.OPENCODE_GO_API_KEY) config2.opencodeGo = { apiKey: env.OPENCODE_GO_API_KEY };
   if (env.ZAI_CODING_CN_API_KEY) config2.zaiCodingCn = { apiKey: env.ZAI_CODING_CN_API_KEY };
+  if (env.META_API_KEY) config2.meta = { apiKey: env.META_API_KEY };
+  if (env.RADIUS_API_KEY) config2.radius = { apiKey: env.RADIUS_API_KEY };
   if (env.COPILOT_GITHUB_TOKEN) config2.githubCopilot = { apiKey: env.COPILOT_GITHUB_TOKEN };
   if (env.CLOUDFLARE_API_KEY && env.CLOUDFLARE_ACCOUNT_ID) {
     config2.cloudflareWorkersAi = {
@@ -31991,6 +32139,24 @@ var PROVIDERS = {
     }),
     hint: "ZAI_CODING_CN_API_KEY"
   },
+  meta: {
+    configured: (c) => !!c.meta,
+    build: (c) => piProvider({
+      providerName: "meta",
+      apiKey: c.meta?.apiKey,
+      baseUrl: c.meta?.baseURL
+    }),
+    hint: "META_API_KEY"
+  },
+  radius: {
+    configured: (c) => !!c.radius,
+    build: (c) => piProvider({
+      providerName: "radius",
+      apiKey: c.radius?.apiKey,
+      baseUrl: c.radius?.baseURL
+    }),
+    hint: "RADIUS_API_KEY"
+  },
   "github-copilot": {
     configured: (c) => !!c.githubCopilot,
     build: (c) => piProvider({
@@ -32458,6 +32624,8 @@ var REASONING_LEVELS2 = /* @__PURE__ */ new Set([
 var CONFIGURED_KEYS = /* @__PURE__ */ new Set([
   "containerNamespace",
   "configuredDocker",
+  "imageGenerationEnabled",
+  "webSearchEnabled",
   "repositoryContext",
   "questionEnabled",
   "conversation",
@@ -32485,6 +32653,7 @@ var CONFIGURED_REQUIRED_KEYS = /* @__PURE__ */ new Set([
   "bashApprovalMode"
 ]);
 var PROTECTED_KEYS = /* @__PURE__ */ new Set([
+  "imageGenerationEnabled",
   "containerNamespace",
   "repositoryContext",
   "questionEnabled",
@@ -32499,12 +32668,13 @@ var PROTECTED_KEYS = /* @__PURE__ */ new Set([
   "paths",
   "docker",
   "webFetchEnabled",
+  "webSearchEnabled",
   "apiKeyRefreshEnabled",
   "scratch"
 ]);
 var PROTECTED_REQUIRED_KEYS = new Set(
   [...PROTECTED_KEYS].filter(
-    (key3) => key3 !== "images" && key3 !== "questionEnabled" && key3 !== "containerNamespace"
+    (key3) => key3 !== "images" && key3 !== "questionEnabled" && key3 !== "containerNamespace" && key3 !== "imageGenerationEnabled" && key3 !== "webSearchEnabled"
   )
 );
 var STATIC_REVIEW_KEYS = /* @__PURE__ */ new Set([
@@ -32599,6 +32769,10 @@ function parseWorkerInput(value) {
   const kind = input.kind;
   if (input.containerNamespace !== void 0 && (typeof input.containerNamespace !== "string" || !/^[a-f0-9-]{36}$/.test(input.containerNamespace)))
     throw new Error("Invalid container namespace");
+  if (input.imageGenerationEnabled !== void 0 && typeof input.imageGenerationEnabled !== "boolean")
+    throw new Error("Invalid worker image capability");
+  if (input.webSearchEnabled !== void 0 && typeof input.webSearchEnabled !== "boolean")
+    throw new Error("Invalid worker web search capability");
   if (input.questionEnabled !== void 0 && typeof input.questionEnabled !== "boolean")
     throw new Error("Invalid worker question capability");
   if (kind === "configured_operator_http") {
@@ -33716,6 +33890,53 @@ function rejectExistingSymlinkOrNonFile(path) {
   }
 }
 
+// ../daemon/src/runtime/tools/image-generate.ts
+function imageGenerateTool(generate, sessionId) {
+  return {
+    def: {
+      name: "image_generate",
+      description: "Generate original images from a text prompt using the operator-selected image route/model (API billing or ChatGPT subscription usage). Saved Results are delivered subject to Team Policy. Rework is a new generation, not a pixel edit. Do not automatically retry a failed or uncertain request; it may already have been billed. No social publication.",
+      parameters: {
+        type: "object",
+        properties: {
+          prompt: {
+            type: "string",
+            description: "Describe the desired image. Maximum 8 KiB UTF-8."
+          },
+          name: {
+            type: "string",
+            description: "Optional display filename, not a path (ASCII, maximum 120 characters)."
+          }
+        },
+        required: ["prompt"],
+        additionalProperties: false
+      }
+    },
+    async invoke(args, context) {
+      if (!context?.toolCallId || !sessionId)
+        throw new Error("image_generate: missing source operation");
+      if (typeof args.prompt !== "string" || args.name !== void 0 && typeof args.name !== "string" || Object.keys(args).some((key3) => !["prompt", "name"].includes(key3))) {
+        throw new Error("image_generate: invalid arguments");
+      }
+      const output = await generate({
+        sessionId,
+        toolCallId: context.toolCallId,
+        prompt: args.prompt,
+        ...args.name === void 0 ? {} : { name: args.name }
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Saved ${output.files.length} image(s) via ${imageGenerationRouteLabel(output.model)} (selected: ${output.model}). Delivery is subject to Team Policy. ${output.files.map((file) => `${file.name}: ${file.result.resultId}`).join("; ")}`
+          }
+        ],
+        results: output.files.map((file) => file.result)
+      };
+    }
+  };
+}
+
 // ../daemon/src/runtime/tools/mcp.ts
 function mcpProxyTools(host2, tools) {
   return tools.map((t) => ({
@@ -34806,7 +35027,7 @@ function ourToolToPiTool(h) {
       const out = await h.invoke(params, { toolCallId });
       return {
         content: toPiContent(out),
-        details: typeof out === "object" && !Array.isArray(out) ? "result" in out ? { result: out.result } : { questionReceipt: out.questionReceipt } : {}
+        details: typeof out === "object" && !Array.isArray(out) ? "result" in out ? { result: out.result } : "results" in out ? { results: out.results } : { questionReceipt: out.questionReceipt } : {}
       };
     }
   };
@@ -34839,6 +35060,14 @@ function createBazilionCustomTools(opts) {
   if (opts.fileSink) {
     handlers.push(deliverFileTool(opts.agent.team.path, opts.fileSink, opts.sessionId));
   }
+  if (opts.imageGenerationHost) {
+    handlers.push(
+      imageGenerateTool(
+        opts.imageGenerationHost.generate.bind(opts.imageGenerationHost),
+        opts.sessionId ?? ""
+      )
+    );
+  }
   if (opts.verificationRequestHost) {
     handlers.push(verificationRequestTool(opts.verificationRequestHost));
   }
@@ -34940,6 +35169,7 @@ async function createBazilionSession(opts) {
     mcpHost,
     mcpTools,
     fileSink,
+    imageGenerationHost: opts.imageGenerationHost,
     askUser,
     sessionId: sessionManager.getSessionId(),
     env,
@@ -35552,6 +35782,9 @@ function isRestrictedWorkerKind(spec) {
 }
 function assertSpawnCombination(spec, opts) {
   const record3 = opts;
+  if (!isRestrictedWorkerKind(spec) && (Boolean(spec.imageGenerationEnabled) !== Boolean(record3.imageGenerationHost) || record3.imageGenerationHost && !hostHasMethods(record3.imageGenerationHost, ["generate"]))) {
+    throw new Error("Image generation capability requires its bound host");
+  }
   if (!isRestrictedWorkerKind(spec) && (Boolean(spec.questionEnabled) !== Boolean(record3.questionHost) || record3.questionHost && !hostHasMethods(record3.questionHost, ["ask", "close", "subscribe", "consumed"])))
     throw new Error("Question capability requires its bound host");
   if (spec.kind === "configured_operator_http") {
@@ -35591,6 +35824,7 @@ function assertSpawnCombination(spec, opts) {
       "containerHost",
       "repositoryContextHost",
       "resultHost",
+      "imageGenerationHost",
       "resourceLifecycle",
       // Not just "a restricted turn has no reason to ask": the requester capability captures a
       // snapshot and writes a request, so handing it to any restricted kind would give that turn a
@@ -35645,6 +35879,8 @@ function spawnHosts(spec, opts, signal, onBashApproval, onQuestion, onApiKeyRefr
     codingHost: restricted ? void 0 : opts.codingHost,
     repositoryContextHost: restricted ? void 0 : opts.repositoryContextHost,
     resultHost: restricted ? void 0 : opts.resultHost,
+    imageGenerationHost: restricted ? void 0 : opts.imageGenerationHost,
+    webSearchHost: restricted ? void 0 : opts.webSearchHost,
     // A verification turn reads its request and runs captured checks; it does not message peers,
     // edit USER.md, drive a browser or call MCP. Cleared here rather than trusting the caller.
     messagingHost: restricted ? void 0 : configuredOpts?.messagingHost ?? protectedOpts?.messagingHost,
@@ -35749,6 +35985,20 @@ async function dispatch(req, hosts) {
         );
         break;
       }
+      case "generateImages":
+        hosts.ipcSignal?.throwIfAborted();
+        result = await require2(hosts.imageGenerationHost, "image generation", req.method).generate(
+          req.args
+        );
+        break;
+      case "webSearch": {
+        hosts.ipcSignal?.throwIfAborted();
+        const args = req.args;
+        if (!args || typeof args.query !== "string" || args.query.length > 512 || args.count !== void 0 && (!Number.isInteger(args.count) || args.count < 1 || args.count > 8))
+          throw new Error("Invalid web search IPC request");
+        result = await require2(hosts.webSearchHost, "web search", req.method).search(args);
+        break;
+      }
       case "publishResult":
         hosts.ipcSignal?.throwIfAborted();
         result = await require2(hosts.resultHost, "result", req.method).publish(req.args);
@@ -37020,7 +37270,8 @@ var MAX_RETAINED_RESULT_BYTES = 1024 * 1024 * 1024;
 var columns2 = `id, team_id AS teamId, agent_id AS agentId, source_kind AS sourceKind,
   session_id AS sessionId, tool_call_id AS toolCallId, review_packet_id AS reviewPacketId,
   review_revision AS reviewRevision, name, mime_type AS mimeType, byte_length AS byteLength,
-  sha256, created_at AS createdAt, released_at AS releasedAt, deleted_at AS deletedAt`;
+  sha256, created_at AS createdAt, released_at AS releasedAt, deleted_at AS deletedAt,
+  source_index AS sourceIndex, image_model AS imageModel`;
 function validIdentity(value) {
   return typeof value === "string" && /^[A-Za-z0-9._:-]{1,256}$/.test(value);
 }
@@ -37048,20 +37299,24 @@ function publish(db, input) {
   if (!(input.bytes instanceof Uint8Array) || input.bytes.byteLength > MAX_RESULT_BYTES) {
     throw new Error("Result exceeds the 25 MiB per-file limit");
   }
+  const sourceIndex = input.sourceIndex ?? 0;
+  if (!Number.isInteger(sourceIndex) || sourceIndex < 0 || sourceIndex > 3) {
+    throw new Error("Invalid result source index");
+  }
   const bytes = Buffer.from(input.bytes);
   const sha256 = createHash10("sha256").update(bytes).digest("hex");
   return db.raw.transaction(() => {
     const existing = source === "session_tool" ? db.raw.query(
       `SELECT ${columns2} FROM agent_results
-               WHERE agent_id = ? AND source_kind = 'session_tool' AND session_id = ? AND tool_call_id = ?`
-    ).get(input.agentId, input.sessionId, input.toolCallId) : db.raw.query(
+               WHERE agent_id = ? AND source_kind = 'session_tool' AND session_id = ? AND tool_call_id = ? AND source_index = ?`
+    ).get(input.agentId, input.sessionId, input.toolCallId, sourceIndex) : db.raw.query(
       `SELECT ${columns2} FROM agent_results
                WHERE agent_id = ? AND source_kind = 'review_packet' AND review_packet_id = ?
                  AND review_revision = ?`
     ).get(input.agentId, input.reviewPacketId, input.reviewRevision);
     if (existing) {
       if (existing.deletedAt !== null) throw new Error("Captured result was deleted");
-      if (existing.teamId !== input.teamId || existing.sha256 !== sha256 || existing.name !== input.name || existing.mimeType !== input.mimeType) {
+      if (existing.teamId !== input.teamId || existing.sha256 !== sha256 || existing.name !== input.name || existing.mimeType !== input.mimeType || existing.imageModel !== (input.imageModel ?? null)) {
         throw new Error("Result publication retry does not match the captured operation");
       }
       return existing;
@@ -37081,8 +37336,8 @@ function publish(db, input) {
     db.raw.run(
       `INSERT INTO agent_results
       (id, team_id, agent_id, source_kind, session_id, tool_call_id, review_packet_id, review_revision,
-       name, mime_type, byte_length, sha256, created_at, bytes)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       name, mime_type, byte_length, sha256, created_at, bytes, source_index, image_model)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
         input.teamId,
@@ -37097,7 +37352,9 @@ function publish(db, input) {
         bytes.byteLength,
         sha256,
         Date.now(),
-        bytes
+        bytes,
+        sourceIndex,
+        input.imageModel ?? null
       ]
     );
     const result = getReceipt(db, id);
@@ -39281,6 +39538,467 @@ function createCodingHost(input) {
   };
 }
 
+// ../daemon/src/lib/image-generation.ts
+import { createHash as createHash12 } from "crypto";
+import { createImagesModels } from "@earendil-works/pi-ai";
+import { openrouterImagesProvider } from "@earendil-works/pi-ai/providers/openrouter-images";
+
+// ../daemon/src/core/repos/image-generations.ts
+function admit2(db, op) {
+  return db.raw.transaction(() => {
+    const previous = db.raw.query(`SELECT team_id, request_sha256, model, outcome FROM image_generations
+      WHERE agent_id = ? AND session_id = ? AND tool_call_id = ?`).get(op.agentId, op.sessionId, op.toolCallId);
+    if (previous) {
+      if (previous.team_id !== op.teamId || previous.request_sha256 !== op.requestSha256 || previous.model !== op.model) {
+        throw new Error("Image operation retry does not match its captured request");
+      }
+      if (previous.outcome === "completed") return "completed";
+      throw new Error(
+        `Image operation is ${previous.outcome}; it will not be automatically regenerated. It may have been billed.`
+      );
+    }
+    const uncertain = db.raw.query(
+      "SELECT count(*) AS n FROM image_generations WHERE turn_id = ? AND outcome = 'uncertain'"
+    ).get(op.turnId)?.n ?? 0;
+    if (uncertain > 0)
+      throw new Error(
+        "A previous image request is uncertain. Generation is blocked for the rest of this turn; inspect Results before starting a new turn."
+      );
+    const count3 = db.raw.query(
+      "SELECT count(*) AS n FROM image_generations WHERE turn_id = ?"
+    ).get(op.turnId)?.n ?? 0;
+    if (count3 >= 4) throw new Error("Image generation limit reached (four requests per turn)");
+    db.raw.run(
+      `INSERT INTO image_generations
+      (agent_id, team_id, session_id, tool_call_id, turn_id, request_sha256, model, outcome, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, 'uncertain', ?)`,
+      [
+        op.agentId,
+        op.teamId,
+        op.sessionId,
+        op.toolCallId,
+        op.turnId,
+        op.requestSha256,
+        op.model,
+        Date.now()
+      ]
+    );
+    return "new";
+  })();
+}
+function settle2(db, op, outcome, responseId2 = null, usage2 = null) {
+  const { changes } = db.raw.run(
+    `UPDATE image_generations
+    SET outcome = ?, response_id = ?, usage_json = ?
+    WHERE agent_id = ? AND session_id = ? AND tool_call_id = ? AND outcome = 'uncertain'`,
+    [outcome, responseId2, usage2, op.agentId, op.sessionId, op.toolCallId]
+  );
+  if (changes !== 1) throw new Error("Image operation is no longer available");
+}
+function resultIds(db, op) {
+  return db.raw.query(`SELECT id FROM agent_results
+    WHERE agent_id = ? AND team_id = ? AND session_id = ? AND tool_call_id = ?
+    AND source_kind = 'session_tool' ORDER BY source_index`).all(op.agentId, op.teamId, op.sessionId, op.toolCallId).map((row2) => row2.id);
+}
+
+// ../daemon/src/lib/image-transport.ts
+var IMAGE_RESPONSE_BYTES = 40 * 1024 * 1024;
+var endpoints = {
+  openrouter: "https://openrouter.ai/api/v1/chat/completions",
+  openai: "https://api.openai.com/v1/images/generations",
+  "openai-codex": "https://chatgpt.com/backend-api/codex/responses"
+};
+function boundedImageFetch(fetcher = fetch, provider = "openrouter") {
+  return async (input, init) => {
+    const url2 = new URL(input instanceof Request ? input.url : String(input));
+    if (url2.href !== endpoints[provider]) throw new Error("Unexpected image provider endpoint");
+    const response = await fetcher(input, { ...init, redirect: "error" });
+    const reader = response.body?.getReader();
+    if (!reader) throw new Error("Image provider returned no response body");
+    const chunks = [];
+    let size = 0;
+    try {
+      if (Number(response.headers.get("content-length")) > IMAGE_RESPONSE_BYTES)
+        throw new Error("Image response exceeds the byte limit");
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > IMAGE_RESPONSE_BYTES) throw new Error("Image response exceeds the byte limit");
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel().catch(() => {
+      });
+      reader.releaseLock();
+    }
+    return new Response(Buffer.concat(chunks), {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+  };
+}
+async function imageAbortable(promise, signal) {
+  let abort = () => {
+  };
+  const cancelled = new Promise((_2, reject2) => {
+    abort = () => reject2(new Error("Image request aborted"));
+    if (signal.aborted) abort();
+    else signal.addEventListener("abort", abort, { once: true });
+  });
+  try {
+    return await Promise.race([promise, cancelled]);
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
+function object3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Malformed image response");
+  return value;
+}
+function usage(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const raw2 = value;
+  const number4 = (key3) => typeof raw2[key3] === "number" && Number.isFinite(raw2[key3]) && raw2[key3] >= 0 ? raw2[key3] : void 0;
+  return {
+    input: number4("input_tokens"),
+    output: number4("output_tokens"),
+    totalTokens: number4("total_tokens")
+  };
+}
+function responseId(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function image(data) {
+  if (typeof data !== "string" || !data) throw new Error("Missing image bytes");
+  return { type: "image", mimeType: "image/png", data };
+}
+async function generateOpenAIImages(opts) {
+  const codex = opts.provider === "openai-codex";
+  opts.signal.throwIfAborted();
+  const response = await boundedImageFetch(opts.fetch, opts.provider)(endpoints[opts.provider], {
+    method: "POST",
+    signal: opts.signal,
+    headers: {
+      Authorization: `Bearer ${opts.apiKey}`,
+      "Content-Type": "application/json",
+      Accept: codex ? "text/event-stream" : "application/json"
+    },
+    body: JSON.stringify(
+      codex ? {
+        model: "gpt-6-astra",
+        instructions: "Generate the requested image using the image generation tool.",
+        input: [{ role: "user", content: [{ type: "input_text", text: opts.prompt }] }],
+        tools: [
+          {
+            type: "image_generation",
+            model: "gpt-image-2",
+            size: "1024x1024",
+            output_format: "png"
+          }
+        ],
+        tool_choice: { type: "image_generation" },
+        stream: true,
+        store: false
+      } : {
+        model: "gpt-image-2",
+        prompt: opts.prompt,
+        n: 1,
+        size: "1024x1024",
+        output_format: "png"
+      }
+    )
+  });
+  if (!response.ok) throw new Error("Image provider rejected the request");
+  if (codex) {
+    if (!response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream"))
+      throw new Error("Expected image event stream");
+    return readCodexImages(await response.text());
+  }
+  const body = object3(await response.json());
+  if (!Array.isArray(body.data) || body.data.length < 1 || body.data.length > 4)
+    throw new Error("Missing or excessive image output");
+  return {
+    stopReason: "stop",
+    output: body.data.map((entry) => image(object3(entry).b64_json)),
+    responseId: responseId(body.id),
+    usage: usage(body.usage)
+  };
+}
+function checkImageId(id, seen) {
+  if (id == null) return;
+  if (typeof id !== "string" || !id || id.length > 256 || seen.has(id))
+    throw new Error("Invalid or duplicate image identity");
+  seen.add(id);
+}
+function readCodexImages(body) {
+  let completed;
+  const done = [];
+  const doneIds = /* @__PURE__ */ new Set();
+  let count3 = 0;
+  for (const frame of body.replace(/\r\n?/g, "\n").split("\n\n")) {
+    const data = frame.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice(5).replace(/^ /, "")).join("\n").trim();
+    if (!data || data === "[DONE]") continue;
+    if (++count3 > 512) throw new Error("Too many image stream events");
+    const event2 = object3(JSON.parse(data));
+    if (["error", "response.failed", "response.incomplete"].includes(String(event2.type)))
+      throw new Error("Image stream failed or was incomplete");
+    if (event2.type === "response.completed") {
+      if (completed) throw new Error("Duplicate image completion");
+      completed = object3(event2.response);
+      if (completed.error != null || completed.status != null && completed.status !== "completed")
+        throw new Error("Image response was not completed");
+    }
+    if (event2.type === "response.output_item.done") {
+      const item = object3(event2.item);
+      if (item.type !== "image_generation_call") continue;
+      checkImageId(item.id, doneIds);
+      done.push(item);
+      if (done.length > 4) throw new Error("Too many images");
+    }
+  }
+  if (!completed) throw new Error("Image stream closed before completion");
+  const output = completed.output === void 0 ? done : completed.output;
+  if (!Array.isArray(output)) throw new Error("Malformed image output");
+  const items = output.map(object3).filter((item) => item.type === "image_generation_call");
+  if (items.length < 1 || items.length > 4) throw new Error("Missing or excessive image output");
+  const ids = /* @__PURE__ */ new Set();
+  const images = items.map((item) => {
+    checkImageId(item.id, ids);
+    if (item.status != null && item.status !== "completed")
+      throw new Error("Image call did not complete");
+    return image(item.result);
+  });
+  return {
+    stopReason: "stop",
+    output: images,
+    responseId: responseId(completed.id),
+    usage: usage(completed.usage)
+  };
+}
+
+// ../daemon/src/lib/image-generation.ts
+var IMAGE_DEADLINE_MS = 18e4;
+var busyHomes = /* @__PURE__ */ new WeakSet();
+var ImageGenerationError = class extends Error {
+};
+function imageCatalogue() {
+  const models = createImagesModels({
+    authContext: { env: async () => void 0, fileExists: async () => false }
+  });
+  models.setProvider(openrouterImagesProvider());
+  return models;
+}
+function validateInput2(input) {
+  if (!input || Object.keys(input).some(
+    (key3) => !["sessionId", "toolCallId", "prompt", "name"].includes(key3)
+  ) || typeof input.sessionId !== "string" || typeof input.toolCallId !== "string" || typeof input.prompt !== "string" || !input.prompt.trim() || Buffer.byteLength(input.prompt) > 8192) {
+    throw new Error("image_generate requires a text prompt of at most 8 KiB and a valid source");
+  }
+  if (input.name !== void 0 && (typeof input.name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9 _.-]{0,119}$/.test(input.name) || /[ .]$/.test(input.name) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:[ .]|$)/i.test(input.name))) {
+    throw new Error("Image name must be a safe display filename (maximum 120 characters)");
+  }
+}
+function decodeImages(response, name) {
+  const images = response.output.filter((part) => part.type === "image");
+  if (images.length === 0 || images.length > 4) {
+    throw new ImageGenerationError(
+      "Image provider returned no images or exceeded the four-image limit"
+    );
+  }
+  return images.map((image2, index) => {
+    if (image2.data.length > Math.ceil(MAX_RESULT_BYTES / 3) * 4 || image2.data.length % 4 !== 0) {
+      throw new Error("Invalid or oversized image bytes");
+    }
+    const bytes = Buffer.from(image2.data, "base64");
+    if (!bytes.length || bytes.length > MAX_RESULT_BYTES || bytes.toString("base64") !== image2.data) {
+      throw new Error("Invalid or oversized image bytes");
+    }
+    const extension = image2.mimeType === "image/png" && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) ? "png" : image2.mimeType === "image/jpeg" && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255 ? "jpg" : image2.mimeType === "image/webp" && bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP" ? "webp" : null;
+    if (!extension)
+      throw new ImageGenerationError(
+        "Image content does not match a supported PNG, JPEG or WebP type"
+      );
+    const stem = name.replace(/\.(png|jpe?g|webp)$/i, "");
+    return {
+      bytes,
+      mimeType: image2.mimeType,
+      name: `${stem}${images.length > 1 ? `-${index + 1}` : ""}.${extension}`
+    };
+  });
+}
+function safeUsage(usage2) {
+  if (!usage2) return null;
+  const counts = Object.fromEntries(
+    ["input", "output", "cacheRead", "cacheWrite", "totalTokens"].map((key3) => {
+      const value = usage2[key3];
+      return [key3, typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null];
+    })
+  );
+  const estimate = usage2.cost?.total;
+  return JSON.stringify({
+    ...counts,
+    estimatedCost: typeof estimate === "number" && Number.isFinite(estimate) && estimate >= 0 ? estimate : null
+  });
+}
+function createImageGenerationHost(opts) {
+  const { db } = opts;
+  const models = opts.models ?? imageCatalogue();
+  const resolveConfig = () => imageGenerationConfig(opts.env(), opts.codex?.connected(), {
+    enabledProviders: listEnabled(db),
+    chatModel: opts.chatModel
+  });
+  const assertActive = () => {
+    opts.signal.throwIfAborted();
+    opts.assertActive();
+    const owner = db.raw.query(
+      "SELECT team_id, status FROM agents WHERE id = ?"
+    ).get(opts.agentId);
+    if (owner?.team_id !== opts.teamId || owner.status === "archived") {
+      throw new Error("Image generation Agent is no longer active in this Team");
+    }
+  };
+  const capturedOutput = (op) => {
+    const ids = resultIds(db, op);
+    if (!ids.length)
+      throw new Error(
+        "Generated results are unavailable; they will not be regenerated automatically"
+      );
+    return {
+      model: op.model,
+      files: ids.map((id) => {
+        const receipt = getReceipt(db, id);
+        if (!receipt || receipt.deletedAt !== null)
+          throw new Error("Generated result was deleted; it will not be regenerated");
+        return {
+          name: receipt.name,
+          mimeType: receipt.mimeType,
+          data: readCaptured(db, id).toString("base64"),
+          result: { resultId: id }
+        };
+      })
+    };
+  };
+  return {
+    async generate(input) {
+      validateInput2(input);
+      assertActive();
+      const source = opts.source(input.sessionId, input.toolCallId);
+      if (source.prompt !== input.prompt || source.name !== input.name || Object.keys(source).some((key3) => !["prompt", "name"].includes(key3))) {
+        throw new Error("Image request does not match the canonical tool call");
+      }
+      const config2 = resolveConfig();
+      if (!config2.ready) throw new Error(config2.status);
+      const model = config2.provider === "openrouter" ? models.getModel("openrouter", config2.model) : void 0;
+      if (config2.provider === "openrouter" && (model?.provider !== "openrouter" || model.api !== "openrouter-images" || model.baseUrl !== "https://openrouter.ai/api/v1" || !model.output.includes("image"))) {
+        throw new Error("Selected Pi image model is unavailable; no fallback was attempted");
+      }
+      if (busyHomes.has(db))
+        throw new Error("Image generation is busy; only one request per home may be in flight");
+      const op = {
+        agentId: opts.agentId,
+        teamId: opts.teamId,
+        turnId: opts.turnId,
+        sessionId: input.sessionId,
+        toolCallId: input.toolCallId,
+        model: config2.model,
+        requestSha256: createHash12("sha256").update(JSON.stringify([input.prompt, input.name ?? null])).digest("hex")
+      };
+      if (admit2(db, op) === "completed") return capturedOutput(op);
+      busyHomes.add(db);
+      const deadline = new AbortController();
+      const timer = setTimeout(() => deadline.abort(), opts.deadlineMs ?? IMAGE_DEADLINE_MS);
+      const signal = AbortSignal.any([opts.signal, deadline.signal]);
+      try {
+        let apiKey = config2.apiKey;
+        if (config2.provider === "openai-codex") {
+          try {
+            if (!opts.codex) throw new Error("Missing login");
+            apiKey = await imageAbortable(opts.codex.accessToken(), signal);
+          } catch {
+            throw new ImageGenerationError(
+              "ChatGPT credentials unavailable. Reconnect ChatGPT on /config or run bazilion auth openai login. No API-key fallback or automatic retry."
+            );
+          }
+        }
+        signal.throwIfAborted();
+        assertActive();
+        const current = resolveConfig();
+        if (!current.ready || current.model !== config2.model) {
+          throw new ImageGenerationError(
+            "Image configuration changed before dispatch. No image request was sent; inspect settings before starting a new turn. No billing-route fallback."
+          );
+        }
+        if (!apiKey) throw new Error("Missing image credential");
+        let pending;
+        if (config2.provider === "openrouter") {
+          if (!model) throw new Error("Selected Pi image model unavailable");
+          pending = models.generateImages(
+            model,
+            { input: [{ type: "text", text: input.prompt }] },
+            {
+              apiKey,
+              signal,
+              timeoutMs: opts.deadlineMs ?? IMAGE_DEADLINE_MS,
+              maxRetries: 0,
+              fetch: boundedImageFetch(opts.fetch)
+            }
+          );
+        } else {
+          pending = generateOpenAIImages({
+            provider: config2.provider,
+            apiKey,
+            prompt: input.prompt,
+            signal,
+            fetch: opts.fetch
+          });
+        }
+        const response = await imageAbortable(pending, signal);
+        signal.throwIfAborted();
+        assertActive();
+        if (response.stopReason !== "stop") {
+          throw new ImageGenerationError(
+            "Image provider failed or refused the request. Check OpenRouter access/quota; billing may have occurred. No automatic retry."
+          );
+        }
+        const images = decodeImages(response, input.name ?? "generated-image");
+        const responseId2 = typeof response.responseId === "string" && /^[A-Za-z0-9._:-]{1,256}$/.test(response.responseId) && !response.responseId.includes(apiKey) ? response.responseId : null;
+        db.raw.transaction(() => {
+          images.forEach((image2, sourceIndex) => {
+            publish(db, {
+              teamId: opts.teamId,
+              agentId: opts.agentId,
+              sessionId: input.sessionId,
+              toolCallId: input.toolCallId,
+              sourceIndex,
+              imageModel: config2.model,
+              ...image2
+            });
+          });
+          settle2(db, op, "completed", responseId2, safeUsage(response.usage));
+        })();
+        return capturedOutput(op);
+      } catch (error2) {
+        if (signal.aborted)
+          throw new Error(
+            "Image generation cancelled or timed out; billing or account usage may have occurred. No automatic retry."
+          );
+        if (error2 instanceof ImageGenerationError) {
+          throw error2;
+        }
+        throw new Error(
+          "Image generation failed; billing or account usage may have occurred. No automatic retry or credential fallback. Check account access/quota (reconnect ChatGPT if selected), configuration and saved Results."
+        );
+      } finally {
+        clearTimeout(timer);
+        busyHomes.delete(db);
+      }
+    }
+  };
+}
+
 // ../daemon/src/lib/mcp/pool.ts
 function sanitizeName(name) {
   return name.replace(/[^a-zA-Z0-9_]/g, "_");
@@ -39546,9 +40264,9 @@ function verifyQuestionConsumption(paths2, question, target, turnStartEntry = 1)
 }
 
 // ../daemon/src/lib/question-receipt.ts
-import { createHash as createHash12, createHmac, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash13, createHmac, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
-var hash4 = (text3) => createHash12("sha256").update(text3).digest("hex");
+var hash4 = (text3) => createHash13("sha256").update(text3).digest("hex");
 function key(db, create8) {
   if (create8)
     db.raw.run("INSERT OR IGNORE INTO question_receipt_key (singleton, key) VALUES (1, ?)", [
@@ -39671,7 +40389,7 @@ var QuestionWaiters = class {
 };
 
 // ../daemon/src/lib/telegram/question-transport.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 
 // ../daemon/src/lib/telegram/outbound-queue.ts
 var DEFAULT_MIN_INTERVAL_MS = Number(process.env.BAZILION_TELEGRAM_SEND_INTERVAL_MS ?? 200);
@@ -39728,7 +40446,7 @@ function sleep(ms) {
 }
 
 // ../daemon/src/lib/telegram/queue-binding.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 
 // ../daemon/src/lib/telegram/ingress-attempt.ts
 function isTelegramIngressPayload(value) {
@@ -39814,7 +40532,7 @@ function captureTelegramQueueBinding(db, authToken, authorization, transportBotT
     teamId: agent.team_id,
     ownerGrantId: owner.grant_id,
     topicBindingId: agent.telegram_binding_id,
-    botDigest: createHash13("sha256").update(JSON.stringify([botToken, credential?.envelope ?? null])).digest("hex")
+    botDigest: createHash14("sha256").update(JSON.stringify([botToken, credential?.envelope ?? null])).digest("hex")
   };
 }
 function requireTelegramQueueBinding(db, authToken, value) {
@@ -39978,7 +40696,7 @@ Reply to THIS message with Other text, or /answer ${question.id} your answer. Cl
   };
 }
 function requestId(identity2) {
-  const hex = createHash14("sha256").update(identity2).digest("hex");
+  const hex = createHash15("sha256").update(identity2).digest("hex");
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 function parseTelegramQuestionReply(db, authToken, update3) {
@@ -40316,7 +41034,7 @@ async function prepareAgentDockerInputs(agent, options = {}) {
     skills,
     homeDocuments
   };
-  let image;
+  let image2;
   let coding;
   try {
     const selection2 = resolveTeamCodingEnvironment(
@@ -40324,7 +41042,7 @@ async function prepareAgentDockerInputs(agent, options = {}) {
       agent.team.id,
       mergeSecretsIntoEnv(db, authToken)
     );
-    image = selection2.image;
+    image2 = selection2.image;
     coding = selection2.coding;
   } catch {
     throw new ProtectedExecutionUnavailableError(
@@ -40343,7 +41061,7 @@ async function prepareAgentDockerInputs(agent, options = {}) {
   let docker;
   try {
     docker = await preflightProtectedDockerRuntime({
-      image,
+      image: image2,
       lifecycle: options.dockerLifecycle,
       ...coding ? { coding } : {},
       workspaceDir: agent.team.path,
@@ -43424,11 +44142,41 @@ function mirrorTypingStop(agentId) {
   }
 }
 
+// ../daemon/src/lib/turn-tool-source.ts
+function createTurnToolSource(paths2, agent, conversation, name) {
+  const initialHead = loadSessionHead(agent, paths2, conversation);
+  return (sessionId, toolCallId) => {
+    if (sessionId !== conversation.id || !/^[A-Za-z0-9._:-]{1,256}$/.test(toolCallId)) {
+      throw new Error("Tool source does not match admitted conversation");
+    }
+    const head = loadSessionHead(agent, paths2, conversation);
+    if (!head.file || head.size > 64 * 1024 * 1024) {
+      throw new Error("Tool source session is unavailable or too large");
+    }
+    const entries = readResultSession(
+      paths2,
+      agent.agent.id,
+      head.file,
+      sessionId,
+      initialHead.file === head.file ? initialHead.size : 0
+    );
+    for (const entry of entries) {
+      if (entry.type !== "message" || entry.message?.role !== "assistant") continue;
+      for (const block of entry.message.content) {
+        if (block.type === "toolCall" && block.id === toolCallId && block.name === name) {
+          return block.arguments;
+        }
+      }
+    }
+    throw new Error("Tool call is not in this turn of the canonical transcript");
+  };
+}
+
 // ../daemon/src/lib/user-md-host.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 var USER_MD_MAX_BYTES = 12e3;
 function computeEtag(content) {
-  return createHash15("sha256").update(content, "utf8").digest("hex").slice(0, 16);
+  return createHash16("sha256").update(content, "utf8").digest("hex").slice(0, 16);
 }
 function createDbUserMdHost(db, paths2) {
   return {
@@ -43501,7 +44249,7 @@ function captureVerificationRequest(db, paths2, intent, env = process.env) {
     );
   }
   if (intent.writablePaths && intent.writablePaths.length > 0) {
-    const bounded4 = [];
+    const bounded5 = [];
     for (const path of intent.writablePaths) {
       if (typeof path !== "string" || path.length === 0 || path.length > 1e3) {
         return blocked2("unsupported", "declared writable paths are outside their bounded contract");
@@ -43516,12 +44264,12 @@ function captureVerificationRequest(db, paths2, intent, env = process.env) {
           `declared writable path must be inside the workspace: ${path}`
         );
       }
-      bounded4.push(parts.join("/"));
+      bounded5.push(parts.join("/"));
     }
-    if (bounded4.length > 16) {
+    if (bounded5.length > 16) {
       return blocked2("unsupported", "too many declared writable paths");
     }
-    environment2.writablePaths = bounded4;
+    environment2.writablePaths = bounded5;
   }
   for (const check of intent.checks) {
     try {
@@ -43722,6 +44470,93 @@ function createVerificationRequestHost(input) {
   };
 }
 
+// ../daemon/src/lib/web-search.ts
+var SEARCH_TIMEOUT_MS = 15e3;
+var MAX_QUERY_CHARS = 512;
+var MAX_RESULTS = 8;
+var MAX_TITLE_CHARS = 200;
+var MAX_URL_CHARS = 2048;
+var MAX_SNIPPET_CHARS = 300;
+var WEB_SEARCH_URL_ENV = "BAZILION_WEB_SEARCH_URL";
+function webSearchBaseUrl(env = process.env) {
+  const raw2 = env[WEB_SEARCH_URL_ENV]?.trim();
+  if (!raw2) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw2);
+  } catch {
+    return null;
+  }
+  const loopback = parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost" || parsed.hostname === "::1" || parsed.hostname === "[::1]";
+  if (parsed.protocol === "https:" || parsed.protocol === "http:" && loopback) return raw2;
+  return null;
+}
+function isWebSearchConfigured(env = process.env) {
+  return webSearchBaseUrl(env) !== null;
+}
+var WebSearchConfigError = class extends Error {
+};
+var WebSearchBackendError = class extends Error {
+};
+function bounded3(value, max) {
+  return typeof value === "string" ? value.slice(0, max) : "";
+}
+function createWebSearchHost(opts) {
+  return {
+    async search(args) {
+      const query = typeof args?.query === "string" ? args.query.trim().slice(0, MAX_QUERY_CHARS) : "";
+      if (!query) throw new WebSearchConfigError("web search: a non-empty query is required");
+      const count3 = Math.min(Math.max(Number(args?.count ?? 5), 1), MAX_RESULTS);
+      const baseUrl = webSearchBaseUrl(opts.env());
+      if (!baseUrl) {
+        throw new WebSearchConfigError(
+          `No web search backend is configured. Set ${WEB_SEARCH_URL_ENV} (a self-hosted SearXNG base URL, https or loopback) or disable discovery for this turn.`
+        );
+      }
+      const url2 = `${baseUrl.replace(/\/+$/, "")}/search?${new URLSearchParams({
+        q: query,
+        format: "json"
+      })}`;
+      let response;
+      try {
+        response = await fetch(url2, {
+          headers: { accept: "application/json" },
+          signal: AbortSignal.any([
+            AbortSignal.timeout(SEARCH_TIMEOUT_MS),
+            ...opts.signal ? [opts.signal] : []
+          ])
+        });
+      } catch (error2) {
+        if (opts.signal?.aborted || error2 instanceof Error && error2.name === "AbortError")
+          throw new WebSearchBackendError("Web search was cancelled");
+        throw new WebSearchBackendError("Web search backend is unreachable");
+      }
+      if (!response.ok) {
+        throw new WebSearchBackendError(`Web search backend returned status ${response.status}`);
+      }
+      let data;
+      try {
+        data = await response.json();
+      } catch {
+        throw new WebSearchBackendError("Web search backend returned an invalid response");
+      }
+      const rawResults = data && typeof data === "object" ? data.results : void 0;
+      if (!Array.isArray(rawResults)) {
+        throw new WebSearchBackendError("Web search backend returned an invalid response");
+      }
+      const results = rawResults.slice(0, count3).map((item) => {
+        const row2 = item;
+        return {
+          title: bounded3(row2.title, MAX_TITLE_CHARS),
+          url: bounded3(row2.url, MAX_URL_CHARS),
+          snippet: bounded3(row2.content, MAX_SNIPPET_CHARS)
+        };
+      });
+      return { results, backend: "searxng" };
+    }
+  };
+}
+
 // ../daemon/src/lib/agent-turn.ts
 async function* runAgentTurn(turn) {
   consumePreparedAgentTurn(turn);
@@ -43737,6 +44572,33 @@ async function* runAgentTurn(turn) {
     });
     const userMdHost = createDbUserMdHost(db, paths2);
     const resultHost = createResultHost(db, paths2, agent, turn.controller.signal, turn.conversation);
+    const imageGenerationHost = imageGenerationConfig(
+      mergeSecretsIntoEnv(db, authToken),
+      hasCredentials(db, authToken),
+      { enabledProviders: providerState_exports.listEnabled(db), chatModel: agent.model }
+    ).ready ? createImageGenerationHost({
+      db,
+      agentId: agent.agent.id,
+      teamId: agent.team.id,
+      turnId,
+      chatModel: agent.model,
+      signal: turn.controller.signal,
+      env: () => mergeSecretsIntoEnv(db, authToken),
+      codex: {
+        connected: () => hasCredentials(db, authToken),
+        accessToken: () => loadAccessToken(db, authToken)
+      },
+      source: createTurnToolSource(paths2, agent, turn.conversation, "image_generate"),
+      assertActive: () => {
+        if (!ownsActiveAgent(agent.agent.id, turn.controller))
+          throw new Error("Image generation turn ended");
+      }
+    }) : void 0;
+    const mergedEnvSupplier = () => mergeSecretsIntoEnv(db, authToken);
+    const webSearchHost = isWebSearchConfigured(mergedEnvSupplier()) ? createWebSearchHost({
+      env: () => mergeSecretsIntoEnv(db, authToken),
+      signal: turn.controller.signal
+    }) : void 0;
     let contextBusy = false;
     const repositoryContextHost = async (target) => {
       turn.controller.signal.throwIfAborted();
@@ -43817,7 +44679,8 @@ async function* runAgentTurn(turn) {
       if (invocation.kind !== "operator_http") {
         throw new Error("configured operator surface requires an operator_http invocation");
       }
-      const env = mergeSecretsIntoEnv(db, authToken);
+      const daemonEnv = mergeSecretsIntoEnv(db, authToken);
+      const env = imageGenerationHost ? imageTurnEnv(daemonEnv, agent.model) : daemonEnv;
       const shellConfig = resolveShellSecurityConfig(env);
       const dockerEngine = turn.configuredDocker?.docker ?? (shellConfig.sandboxMode === "docker" ? await preflightProtectedDockerEngine({ image: shellConfig.sandboxImage, hostEnv: env }) : void 0);
       const enabledProviders = Array.from(providerState_exports.listEnabled(db));
@@ -43830,6 +44693,7 @@ async function* runAgentTurn(turn) {
       frames = spawnWorkerTurn(
         {
           kind: "configured_operator_http",
+          imageGenerationEnabled: !!imageGenerationHost,
           containerNamespace,
           ...turn.configuredDocker ? { configuredDocker: turn.configuredDocker } : {},
           repositoryContext,
@@ -43856,6 +44720,7 @@ async function* runAgentTurn(turn) {
           verificationRequestHost,
           reviewRequestHost,
           resultHost,
+          imageGenerationHost,
           userMdHost,
           browserHost,
           mcpHost: mcp?.host,
@@ -43875,6 +44740,8 @@ async function* runAgentTurn(turn) {
       frames = spawnWorkerTurn(
         {
           kind: "protected",
+          imageGenerationEnabled: !!imageGenerationHost,
+          webSearchEnabled: !!webSearchHost,
           containerNamespace,
           repositoryContext,
           agent,
@@ -43899,6 +44766,8 @@ async function* runAgentTurn(turn) {
           verificationRequestHost,
           reviewRequestHost,
           resultHost,
+          imageGenerationHost,
+          webSearchHost,
           userMdHost,
           bashApprovalHost: commandApprovalRegistry,
           ...questionHost ? { questionHost } : {},
@@ -44592,10 +45461,10 @@ function buildReviewDigest(input, options = {}) {
   }
   selected.reverse();
   const firstUserIndex = selected.findIndex((entry) => entry.role === "user");
-  const bounded4 = firstUserIndex >= 0 ? selected.slice(firstUserIndex) : selected;
-  characters = bounded4.reduce((total, entry) => total + entry.text.length, 0);
-  const first = bounded4[0];
-  const last = bounded4.at(-1);
+  const bounded5 = firstUserIndex >= 0 ? selected.slice(firstUserIndex) : selected;
+  characters = bounded5.reduce((total, entry) => total + entry.text.length, 0);
+  const first = bounded5[0];
+  const last = bounded5.at(-1);
   if (!first || !last) return null;
   return {
     sessionId: last.sessionId,
@@ -44603,7 +45472,7 @@ function buildReviewDigest(input, options = {}) {
     endOrdinal: last.ordinal,
     inputCharacters: characters,
     turnsReviewed: userTurns,
-    entries: bounded4
+    entries: bounded5
   };
 }
 
@@ -45485,7 +46354,7 @@ function abandonVerificationAttempt(db, input) {
 }
 
 // ../daemon/src/lib/verification/writes.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { lstat as lstat2, readdir, readFile, readlink } from "fs/promises";
 import { join as join29 } from "path";
 var FINGERPRINT_LIMITS = {
@@ -45504,7 +46373,7 @@ async function fingerprintPath(root, path, digest4) {
     return `link:${(await readlink(absolute)).replaceAll("\\", "/")}`;
   if (!info.isFile()) return `other:${info.mode}`;
   if (!digest4 || info.size > FINGERPRINT_LIMITS.fileBytes) return `size:${info.size}`;
-  return `sha256:${createHash16("sha256").update(await readFile(absolute)).digest("hex")}`;
+  return `sha256:${createHash17("sha256").update(await readFile(absolute)).digest("hex")}`;
 }
 async function fingerprintWorkspace(root) {
   const entries = /* @__PURE__ */ new Map();
@@ -47692,7 +48561,7 @@ function errMsg(e) {
 }
 
 // ../daemon/src/lib/telegram/notification-transport.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 var resolver = null;
 function notificationDestinationAllowed(chat, owner, bot) {
   return chat.type === "supergroup" && chat.is_forum === true && !chat.username && !chat.active_usernames?.length && owner.status !== "left" && owner.status !== "kicked" && (owner.status !== "restricted" || owner.is_member === true) && (bot.status === "creator" || bot.status === "administrator" && bot.can_manage_topics === true);
@@ -47715,8 +48584,8 @@ function capture(db, authToken) {
   const topicId = Number(topic?.value);
   if (!owner || !Number.isSafeInteger(chatId2) || chatId2 >= 0 || !Number.isSafeInteger(topicId) || topicId <= 0 || !env.TELEGRAM_BOT_TOKEN || env.TELEGRAM_BOT_TOKEN !== live2.botToken)
     return null;
-  const botDigest = createHash17("sha256").update(JSON.stringify([live2.botToken, envelope])).digest("hex");
-  const id = createHash17("sha256").update(JSON.stringify([chatId2, topicId, owner.grant_id, botDigest])).digest("hex");
+  const botDigest = createHash18("sha256").update(JSON.stringify([live2.botToken, envelope])).digest("hex");
+  const id = createHash18("sha256").update(JSON.stringify([chatId2, topicId, owner.grant_id, botDigest])).digest("hex");
   return {
     binding: { id, chatId: chatId2, topicId, ownerGrantId: owner.grant_id, botDigest },
     ownerId: owner.user_id,
@@ -51575,7 +52444,7 @@ communicationRouter.post("/evaluate", async (c) => {
 import { Hono as Hono6 } from "hono";
 var configRouter = new Hono6();
 configRouter.get("/providers", async (c) => {
-  const { db, paths: paths2, authToken } = getCtx();
+  const { db, authToken } = getCtx();
   const env = mergeSecretsIntoEnv(db, authToken);
   const registryProviders = listAllProviders(loadProviderConfigFromEnv(env, { db, authToken }));
   const registryByName = new Map(registryProviders.map((p) => [p.name, p]));
@@ -51599,8 +52468,13 @@ configRouter.get("/providers", async (c) => {
           enabled,
           envHint,
           fields: resolveFieldStates(svc, configValues, secretValues),
-          catalog,
-          ...live2 ? { live: live2 } : {},
+          catalog: catalog.filter((model) => !isImageChoice(svc.id, model)),
+          ...live2 ? {
+            live: {
+              ...live2,
+              models: live2.models.filter((model) => !isImageChoice(svc.id, model))
+            }
+          } : {},
           curated: providerModels_exports.list(db, svc.id)
         };
       } finally {
@@ -51615,7 +52489,13 @@ configRouter.get("/services", (c) => {
   const { db, authToken } = getCtx();
   const configValues = readAll(() => openConfig(db).getAll());
   const secretValues = readAll(() => openSecrets(db, authToken).getAll());
+  const imageStatus = imageGenerationConfig(
+    mergeSecretsIntoEnv(db, authToken),
+    hasCredentials(db, authToken),
+    { enabledProviders: providerState_exports.listEnabled(db) }
+  ).status;
   const services3 = servicesByCategory("service").map((svc) => ({
+    ...svc.id === "image-generation" ? { status: imageStatus } : {},
     id: svc.id,
     displayName: svc.displayName,
     ...svc.hint ? { hint: svc.hint } : {},
@@ -51662,6 +52542,12 @@ configRouter.put("/providers/:name/models", async (c) => {
       400
     );
   }
+  if (models.some((model) => isImageChoice(name, model.trim()))) {
+    return c.json(
+      { error: "Configure image models in Services \u2192 Image generation, not as chat models." },
+      400
+    );
+  }
   const { db, paths: paths2 } = getCtx();
   providerModels_exports.replace(db, name, models);
   ensureSetupSeeded(db, paths2);
@@ -51675,6 +52561,9 @@ configRouter.put("/fields/:envVar", async (c) => {
   if (!body || typeof body.value !== "string") {
     return c.json({ error: 'body must be {"value": "<string>"}' }, 400);
   }
+  if (body.value && found.field.options && !found.field.options.includes(body.value)) {
+    return c.json({ error: `Choose one of: ${found.field.options.join(", ")}` }, 400);
+  }
   const { db, authToken } = getCtx();
   if (found.field.kind === "config") {
     const store = openConfig(db);
@@ -51703,6 +52592,9 @@ configRouter.delete("/fields/:envVar", (c) => {
   }
   return c.body(null, 204);
 });
+function isImageChoice(provider, model) {
+  return provider === "openrouter" && OPENROUTER_IMAGE_MODELS.some((id) => id === model) || (provider === "openai" || provider === "openai-codex") && model === "gpt-image-2";
+}
 function mask(value) {
   if (value.length === 0) return "";
   return value.length > 8 ? `${value.slice(0, 6)}\u2026` : "***";
@@ -51716,7 +52608,9 @@ function resolveFieldStates(service2, configValues, secretValues) {
       label: f.label,
       set: val.length > 0,
       ...f.placeholder ? { placeholder: f.placeholder } : {},
-      ...f.description ? { description: f.description } : {}
+      ...f.description ? { description: f.description } : {},
+      ...f.options ? { options: f.options } : {},
+      ...f.optionLabels ? { optionLabels: f.optionLabels } : {}
     };
     if (f.kind === "config") {
       state3.value = val;
@@ -52009,7 +52903,7 @@ import { join as join34 } from "path";
 import { Hono as Hono10 } from "hono";
 
 // ../daemon/src/lib/backup.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 import { mkdtempSync as mkdtempSync5, rmSync as rmSync15 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join32, resolve as resolve7 } from "path";
@@ -52040,7 +52934,7 @@ function assertSnapshotIntegrity(path) {
     }
     for (const row2 of snapshot.prepare("SELECT id, bytes, byte_length, sha256 FROM agent_results WHERE deleted_at IS NULL").iterate()) {
       const bytes = row2.bytes;
-      if (!(bytes instanceof Uint8Array) || bytes.byteLength !== row2.byte_length || createHash18("sha256").update(bytes).digest("hex") !== row2.sha256) {
+      if (!(bytes instanceof Uint8Array) || bytes.byteLength !== row2.byte_length || createHash19("sha256").update(bytes).digest("hex") !== row2.sha256) {
         throw new Error(`Result snapshot integrity verification failed: ${row2.id}`);
       }
     }
@@ -52108,7 +53002,7 @@ function createBackupArchive(paths2, snapshot) {
 }
 
 // ../daemon/src/lib/daemon-liveness.ts
-import { createHash as createHash19, randomUUID as randomUUID42 } from "crypto";
+import { createHash as createHash20, randomUUID as randomUUID42 } from "crypto";
 import {
   chmodSync as chmodSync2,
   closeSync as closeSync10,
@@ -52140,7 +53034,7 @@ function canonicalHomeIdentity(home) {
 }
 function daemonLivenessPath(home) {
   const canonicalHome2 = canonicalHomeIdentity(home);
-  const identity2 = createHash19("sha256").update(canonicalHome2).digest("hex").slice(0, 24);
+  const identity2 = createHash20("sha256").update(canonicalHome2).digest("hex").slice(0, 24);
   return join33(dirname8(canonicalHome2), `.bazilion-runtime-${identity2}.json`);
 }
 var activeInstanceId = null;
@@ -52236,7 +53130,7 @@ function pidIsAlive(pid) {
   }
 }
 function reclaimStaleRecord(path, existing) {
-  const identity2 = createHash19("sha256").update(existing.instanceId ?? existing.raw).update(`\0${existing.stat.dev}\0${existing.stat.ino}`).digest("hex").slice(0, 24);
+  const identity2 = createHash20("sha256").update(existing.instanceId ?? existing.raw).update(`\0${existing.stat.dev}\0${existing.stat.ino}`).digest("hex").slice(0, 24);
   const claim5 = `${path}.reclaim-${identity2}`;
   try {
     mkdirSync11(claim5, { mode: 448 });
@@ -53728,14 +54622,14 @@ resultsRouter.get("/:id/preview", (c) => {
   if (!result) return c.json({ error: "Result not found" }, 404);
   if (result.deletedAt !== null) return c.json({ error: "This result was deleted" }, 410);
   const text3 = ["text/plain", "text/markdown"].includes(result.mimeType);
-  const image = ["image/png", "image/jpeg", "image/gif", "image/webp"].includes(result.mimeType);
-  if (!text3 && !image || result.byteLength > (text3 ? 256 * 1024 : 10 * 1024 * 1024)) {
+  const image2 = ["image/png", "image/jpeg", "image/gif", "image/webp"].includes(result.mimeType);
+  if (!text3 && !image2 || result.byteLength > (text3 ? 256 * 1024 : 10 * 1024 * 1024)) {
     return c.json({ error: "Preview is unavailable for this file. Use Download." }, 415);
   }
   try {
     const bytes = readReleased(db, result.id);
     const magic = result.mimeType === "image/png" ? bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) : result.mimeType === "image/jpeg" ? bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255 : result.mimeType === "image/gif" ? ["GIF87a", "GIF89a"].includes(bytes.subarray(0, 6).toString("ascii")) : result.mimeType === "image/webp" ? bytes.subarray(0, 4).toString("ascii") === "RIFF" && bytes.subarray(8, 12).toString("ascii") === "WEBP" : false;
-    if (image && !magic)
+    if (image2 && !magic)
       return c.json({ error: "File content does not match its image type. Use Download." }, 415);
     c.header("Content-Type", text3 ? "text/plain; charset=utf-8" : result.mimeType);
     c.header("Content-Security-Policy", "default-src 'none'; sandbox");
@@ -54438,7 +55332,7 @@ function resolvePublicationTarget(db, authToken) {
 }
 
 // ../daemon/src/lib/publication/revision-content.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 import { readFileSync as readFileSync15 } from "fs";
 import { join as join37 } from "path";
 function readReviewedRevisionFiles(db, paths2, packet) {
@@ -54498,7 +55392,7 @@ function readReviewedRevisionFiles(db, paths2, packet) {
         detail: `the reviewed content for ${entry.path} can no longer be read`
       };
     }
-    const digest4 = createHash20("sha256").update(content).digest("hex");
+    const digest4 = createHash21("sha256").update(content).digest("hex");
     if (digest4 !== entry.digest) {
       return {
         ok: false,
@@ -54590,7 +55484,7 @@ async function capturePublication(db, paths2, authToken, intent) {
       baseBranch: target.target.baseBranch,
       headBranch,
       baseOid: packet.baseOid,
-      commitMessage: bounded3(commitMessage, PUBLICATION_LIMITS.commitMessage),
+      commitMessage: bounded4(commitMessage, PUBLICATION_LIMITS.commitMessage),
       notifyAgentId: packet.requesterKind === "agent" ? packet.requesterAgentId : null
     });
     return { kind: "captured", publication };
@@ -54604,11 +55498,11 @@ async function capturePublication(db, paths2, authToken, intent) {
 function conclusionTitle(conclusion) {
   return conclusion === "changes_requested" ? "Reviewed change with requested changes" : conclusion === "recommended" ? "Reviewed change" : "Reviewed change (inconclusive review)";
 }
-function bounded3(value, max) {
+function bounded4(value, max) {
   return value.length <= max ? value : `${value.slice(0, max - 1)}\u2026`;
 }
 function refused2(reason, detail3) {
-  return { kind: "refused", reason, detail: bounded3(detail3, PUBLICATION_LIMITS.refusalDetail) };
+  return { kind: "refused", reason, detail: bounded4(detail3, PUBLICATION_LIMITS.refusalDetail) };
 }
 
 // ../daemon/src/lib/publication/git-publish.ts