clauderipple 0.5.1 → 0.7.0

package/dist/cli/src/update.js

@@ -0,0 +1,104 @@
+// `clauderipple update`: bring this installation to the latest published version, the way it
+// was installed.
+//
+// Until now an update meant running the install command again by hand, and the tray could not
+// offer it (#39). What "again" means depends on how ClaudeRipple arrived:
+//   * The install scripts put it under their own prefix (~/.clauderipple by default) with their own
+//     command shims — a wrapper naming the Node they downloaded, and on Windows no .ps1. A plain
+//     `npm install -g` would put npm's default shims back, which find no Node on a machine where
+//     the script's Node is the only one. So a script install is updated by running its script.
+//   * An `npm install -g` is updated by npm, into the same prefix.
+//   * A packaged app or a source checkout is not updated from here.
+// Either way `install` runs afterwards from the new files; it restarts a router still running
+// the old version, which re-running the installer never did before.
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { windowsPowerShellEnv } from "./windows-powershell.js";
+export const PACKAGE = "clauderipple";
+const SCRIPT_BASE = "https://raw.githubusercontent.com/PBJ-2/clauderipple/main/scripts";
+/** Numeric x.y.z comparison; a pre-release suffix is ignored. */
+export function isNewer(latest, current) {
+    const parse = (v) => v.replace(/^v/, "").split("-")[0].split(".").map((n) => Number(n) || 0);
+    const a = parse(latest);
+    const b = parse(current);
+    for (let i = 0; i < 3; i++) {
+        if ((a[i] ?? 0) !== (b[i] ?? 0))
+            return (a[i] ?? 0) > (b[i] ?? 0);
+    }
+    return false;
+}
+/** The default prefix of both install scripts, or the one they were told to use. */
+export function scriptPrefix(env = process.env, home = os.homedir()) {
+    return env.CLAUDERIPPLE_PREFIX || path.join(home, ".clauderipple");
+}
+/**
+ * How the running copy was installed, read from where its files are. A global npm package lives
+ * at <prefix>/lib/node_modules/<name> on macOS and Linux and <prefix>\node_modules\<name> on Windows.
+ */
+export function installKind(rt, opts = {}) {
+    if (rt.packaged)
+        return { kind: "packaged" };
+    if (rt.cli.endsWith(".ts"))
+        return { kind: "checkout" };
+    const p = (opts.platform ?? process.platform) === "win32" ? path.win32 : path.posix;
+    const root = rt.repo;
+    const modules = p.dirname(root);
+    if (p.basename(modules) !== "node_modules")
+        return { kind: "unknown", root };
+    const parent = p.dirname(modules);
+    const prefix = (opts.platform ?? process.platform) === "win32" ? parent : p.basename(parent) === "lib" ? p.dirname(parent) : null;
+    if (!prefix)
+        return { kind: "unknown", root };
+    const same = (a, b) => (opts.platform ?? process.platform) === "win32" ? p.resolve(a).toLowerCase() === p.resolve(b).toLowerCase() : p.resolve(a) === p.resolve(b);
+    return same(prefix, scriptPrefix(opts.env, opts.home)) ? { kind: "script", prefix } : { kind: "npm", prefix };
+}
+/** The version npm would install now. */
+export async function latestVersion(fetchImpl = fetch) {
+    const res = await fetchImpl(`https://registry.npmjs.org/${PACKAGE}/latest`, { signal: AbortSignal.timeout(10_000), headers: { accept: "application/json" } });
+    if (!res.ok)
+        throw new Error(`npm registry answered HTTP ${res.status}`);
+    const version = (await res.json()).version;
+    if (typeof version !== "string")
+        throw new Error("npm registry answered without a version");
+    return version;
+}
+/** The npm that came with the Node running us, as a script that same Node can run. */
+function npmCli() {
+    const candidates = [
+        path.resolve(path.dirname(process.execPath), "../lib/node_modules/npm/bin/npm-cli.js"),
+        path.resolve(path.dirname(process.execPath), "node_modules/npm/bin/npm-cli.js"),
+    ];
+    return candidates.find((candidate) => fs.existsSync(candidate)) ?? null;
+}
+/**
+ * Installs `spec` over this installation and runs `install` from the new files. Output goes to
+ * our stdout as it happens, so the tray's dialog and a terminal show the installer's own lines.
+ */
+export function runUpdate(target, rt, spec) {
+    const env = { ...process.env, CLAUDERIPPLE_PREFIX: target.prefix, CLAUDERIPPLE_PACKAGE: spec };
+    if (target.kind === "script") {
+        // A local path stands in for the published script when checking an update before release.
+        const script = process.env.CLAUDERIPPLE_INSTALLER;
+        const result = process.platform === "win32"
+            ? spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script ? `& ${psQuote(script)}` : `irm ${SCRIPT_BASE}/install.ps1 | iex`], { env: { ...windowsPowerShellEnv(), ...env }, stdio: "inherit", windowsHide: true })
+            : spawnSync("sh", ["-c", script ? `sh ${shQuote(script)}` : `curl -fsSL ${SCRIPT_BASE}/install.sh | sh`], { env, stdio: "inherit" });
+        // The script ends by running `install` itself.
+        return result.status === 0 ? { ok: true, message: "✓ updated" } : { ok: false, message: `the installer exited with ${result.status ?? result.signal}` };
+    }
+    const npm = npmCli();
+    if (!npm)
+        return { ok: false, message: `found no npm next to ${process.execPath}; update with: npm install -g ${PACKAGE}@latest` };
+    const installed = spawnSync(process.execPath, [npm, "install", "--global", "--prefix", target.prefix, "--loglevel", "error", spec], { env, stdio: "inherit" });
+    if (installed.status !== 0)
+        return { ok: false, message: `npm could not install ${spec}` };
+    const setup = spawnSync(rt.node, [rt.cli, "install"], { env: { ...process.env, ...rt.env }, stdio: "inherit" });
+    return setup.status === 0 ? { ok: true, message: "✓ updated" } : { ok: false, message: "the new version is installed, but `clauderipple install` did not finish" };
+}
+function psQuote(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+function shQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/dist/router/src/admin.js

@@ -33,7 +33,10 @@ import { ClaudeOAuthSession } from "./providers/claude-oauth.js";
 import { readClaudeAuthFile } from "./providers/anthropic-token-file.js";
 import { listClaudeAccounts, removeClaudeAccount, renameClaudeAccount } from "./providers/anthropic-accounts.js";
 import { readChatGptAccounts, removeChatGptAccount, summarize as summarizeChatGptAccount, updateChatGptAccount } from "./providers/chatgpt/accounts.js";
+import { IMAGE_ASPECTS, IMAGE_BACKGROUNDS, IMAGE_FORMATS } from "./providers/chatgpt/index.js";
 const MAX_BODY = 1024 * 1024;
+/** `/api/image` carries reference images inline, so it gets more room than a config save. */
+const MAX_IMAGE_BODY = 32 * 1024 * 1024;
 const here = path.dirname(fileURLToPath(import.meta.url));
 const STARTED_AT = new Date().toISOString();
 // packages/router/src → packages/ui in a checkout; dist/router/src → dist/ui in an npm install,
@@ -48,6 +51,32 @@ const MIME = {
     ".png": "image/png",
     ".ico": "image/x-icon",
 };
+/** Claude usage is looked up only where a Claude subscription provider is configured. */
+function hasClaudeSubscription(cfg) {
+    return Object.values(cfg.providers).some((p) => p.type === "anthropic" && p.auth === "claude-code");
+}
+/**
+ * One row per Claude account with a known usage, current login first. Labels only: the status is
+ * polled every few seconds and has no use for an email address.
+ */
+async function claudeAccountUsage(deps) {
+    let usage;
+    try {
+        usage = (await deps.claudeUsage?.()) ?? {};
+    }
+    catch {
+        return [];
+    }
+    const rows = [];
+    if (usage.current)
+        rows.push({ id: "current", label: "Current Claude login", quota: usage.current });
+    for (const account of listClaudeAccounts(homeDir())) {
+        const quota = usage[account.id];
+        if (quota)
+            rows.push({ id: account.id, label: account.label, quota });
+    }
+    return rows;
+}
 const ANTHROPIC_EFFORT_LEVELS = ["low", "medium", "high", "max"];
 const CHATGPT_DEFAULT_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 let chatgptLogin = { running: false };
@@ -317,6 +346,7 @@ async function buildStatus(deps, opts = {}) {
         // `quota` stays one snapshot per provider (the account in use) for the readers that want one
         // number; `accounts` is the per-account view, read after the refresh above so it is as fresh.
         chatgpt: { ...chatgpt, signedIn, accounts: chatgpt.accounts?.() ?? {}, ...(stale ? { stale: true, staleReason: staleReasons } : {}) },
+        ...(deps.claudeUsage && hasClaudeSubscription(cfg) ? { claude: { accounts: await claudeAccountUsage(deps) } } : {}),
         // Only present for providers that declare a pool; a provider with one credential has nothing
         // to report and would only add a row that never changes.
         credentials: deps.credentials?.() ?? {},
@@ -417,13 +447,51 @@ function syncModelSlotsForGui(cfg) {
         return `model slots were not written to settings.json: ${message}`;
     }
 }
-function readBody(req) {
+/**
+ * The body of `POST /api/image`, checked: `{prompt, aspect?, format?, background?, images?}`,
+ * `images` being `data:image/...;base64,` URLs. A string is the reason it was refused.
+ */
+export function parseImageRequest(raw) {
+    if (!raw || typeof raw !== "object")
+        return "expected a JSON object";
+    const body = raw;
+    if (typeof body.prompt !== "string" || !body.prompt.trim())
+        return "prompt is required";
+    const out = { prompt: body.prompt };
+    const pick = (key, allowed) => {
+        const value = body[key];
+        if (value === undefined)
+            return null;
+        if (typeof value !== "string" || !allowed.includes(value))
+            return `${key} must be one of ${allowed.join(", ")}`;
+        out[key] = value;
+        return null;
+    };
+    const refused = pick("aspect", IMAGE_ASPECTS) ?? pick("format", IMAGE_FORMATS) ?? pick("background", IMAGE_BACKGROUNDS);
+    if (refused)
+        return refused;
+    if (body.images !== undefined) {
+        if (!Array.isArray(body.images))
+            return "images must be a list of data: URLs";
+        const images = [];
+        for (const url of body.images) {
+            const m = typeof url === "string" ? /^data:(image\/[a-z0-9.+-]+);base64,([A-Za-z0-9+/=\s]+)$/i.exec(url) : null;
+            if (!m)
+                return "each image must be a data:image/...;base64, URL";
+            images.push({ mediaType: m[1].toLowerCase(), data: m[2].replace(/\s/g, "") });
+        }
+        if (images.length)
+            out.images = images;
+    }
+    return out;
+}
+function readBody(req, limit = MAX_BODY) {
     return new Promise((resolveP, reject) => {
         const chunks = [];
         let n = 0;
         req.on("data", (c) => {
             n += c.length;
-            if (n > MAX_BODY) {
+            if (n > limit) {
                 reject(new Error("body too large"));
                 req.destroy();
                 return;
@@ -1236,9 +1304,12 @@ export function startAdmin(deps) {
             // ClaudeRipple accounts can be renamed or removed by their local opaque id.
             if (pathname === "/api/claude-accounts" && method === "GET") {
                 const source = claudeAuthStore(deps).describeSource();
+                let usage = {};
+                if (hasClaudeSubscription(deps.config()))
+                    usage = (await deps.claudeUsage?.().catch(() => null)) ?? {};
                 sendJson(res, 200, {
-                    current: source ? { id: "current", label: "Current Claude login", source, external: true } : null,
-                    accounts: listClaudeAccounts(homeDir()),
+                    current: source ? { id: "current", label: "Current Claude login", source, external: true, ...(usage.current ? { quota: usage.current } : {}) } : null,
+                    accounts: listClaudeAccounts(homeDir()).map((account) => (usage[account.id] ? { ...account, quota: usage[account.id] } : account)),
                 });
                 return;
             }
@@ -1379,6 +1450,49 @@ export function startAdmin(deps) {
                 sendJson(res, r.ok ? 200 : 500, { ok: r.ok, output: r.output });
                 return;
             }
+            if (pathname === "/api/image" && method === "POST") {
+                // The image itself is the response body, so `curl -o out.png` is the whole client. An error
+                // is JSON with a non-2xx status (`curl --fail-with-body` writes it to the same file).
+                if (!deps.image) {
+                    sendJson(res, 501, { error: "image generation not available" });
+                    return;
+                }
+                let parsed;
+                try {
+                    parsed = parseImageRequest(JSON.parse((await readBody(req, MAX_IMAGE_BODY)).toString("utf8")));
+                }
+                catch (e) {
+                    sendJson(res, 400, { error: /too large/.test(e.message) ? "body too large (reference images over 32 MB)" : "invalid JSON" });
+                    return;
+                }
+                if (typeof parsed === "string") {
+                    sendJson(res, 400, { error: parsed });
+                    return;
+                }
+                // A caller that gives up should not leave the generation running on the subscription.
+                const abort = new AbortController();
+                res.on("close", () => { if (!res.writableFinished)
+                    abort.abort(); });
+                const started = Date.now();
+                try {
+                    const image = await deps.image(parsed, abort.signal);
+                    deps.log.info(`admin: image ${image.size ?? "?"} ${image.quality ?? "?"} ${image.format}, ${parsed.images?.length ?? 0} reference(s), ${image.data.length} bytes in ${Date.now() - started} ms`);
+                    res.writeHead(200, {
+                        "content-type": `image/${image.format}`,
+                        "content-length": String(image.data.length),
+                        ...(image.size ? { "x-image-size": image.size } : {}),
+                        ...(image.quality ? { "x-image-quality": image.quality } : {}),
+                        ...(image.revisedPrompt ? { "x-revised-prompt": encodeURIComponent(image.revisedPrompt) } : {}),
+                    });
+                    res.end(image.data);
+                }
+                catch (e) {
+                    deps.log.warn(`admin: image failed after ${Date.now() - started} ms: ${e.message}`);
+                    if (!res.headersSent)
+                        sendJson(res, 502, { error: e.message });
+                }
+                return;
+            }
             if (pathname === "/api/agent-title" && method === "POST") {
                 // Registers/removes the PreToolUse hook that prefixes subagent titles with the real model.
                 let enabled;

package/dist/router/src/agents.js

@@ -14,6 +14,7 @@ import os from "node:os";
 import path from "node:path";
 import { homeDir } from "./config.js";
 import { declaredBy } from "./routing.js";
+import { adminPort } from "./admin.js";
 /** Where Claude Code's Agent tool reads its worker definitions. */
 export function defaultAgentDir() {
     return path.join(os.homedir(), ".claude", "agents");
@@ -34,6 +35,27 @@ const BODY = [
     "**작업 디렉터리(cwd)에 어떤 파일도 만들지 않는다.** 조사·감사처럼 \"읽기만\" 하는 일이어도 마찬가지다.",
     "임시 파일이 필요하면 `/tmp` 아래에만 만들고, 끝나면 지운다. 사본을 작업 폴더에 떨구지 마라.",
 ].join("\n");
+/**
+ * Added to the body when a ChatGPT provider is configured: how a worker makes an image. A worker has
+ * no image tool, and `clauderipple` is not on PATH for everyone (a checkout runs from source), so
+ * the instruction is the admin endpoint itself, which curl reaches on every platform.
+ */
+function imageLine(port) {
+    return [
+        "이미지가 필요하면 ChatGPT 구독으로 만든다(한 장 30초~수 분):",
+        `\`curl -sS --fail-with-body -o <절대경로>.png -H 'content-type: application/json' -d '{"prompt":"…"}' http://127.0.0.1:${port}/api/image\``,
+        "선택 키: aspect(square·landscape·portrait), background(transparent), format(png·jpeg·webp), images(참고 이미지 data: URL 목록). 해상도·품질은 지정할 수 없다. 실패하면 그 파일에 오류 JSON이 담긴다. 만든 뒤 Read로 확인한다.",
+    ].join("\n");
+}
+/**
+ * The tools a generated worker is given when `cli.limitWorkerTools` is on. Without a `tools:` line a
+ * subagent inherits every tool of the session — each MCP server, plugin agent and deferred-tool name —
+ * and a general worker's first request measured 43,598 tokens (2026-09-20), resent on every turn;
+ * limited, a deepseek worker's first request fell from 32,942 to 8,823 (2026-09-29). A worker reads,
+ * edits, searches, runs commands and uses skills; it does not drive browsers, simulators or mail.
+ * Off by default: a user whose workers do need those tools would otherwise lose them silently.
+ */
+const TOOLS = ["Read", "Write", "Edit", "Glob", "Grep", "Bash", "WebFetch", "WebSearch", "Skill"];
 /**
  * Parsed `*.md` frontmatter per directory, keyed by file mtime so a request never re-reads the whole
  * directory. Only the `---` block's own `key: value` lines are read: no YAML library, because the
@@ -134,10 +156,12 @@ function effortSuffix(provider, modelId) {
     const levels = modelLevels !== undefined ? modelLevels : capsEffortLevels(provider);
     return levels?.includes("medium") ? "@medium" : "";
 }
-function fileContent(name, modelId, provider, suffix) {
+function fileContent(name, modelId, provider, suffix, limitTools, imagePort) {
     const description = `${modelId} via ${provider}. Generated by ClaudeRipple from config.json — edits are overwritten; ` +
         `to customise, copy to another name. Set effort with [[ripple: ${name}@<level>]] on the first line.`;
-    return `---\nname: ${name}\ndescription: ${description}\nmodel: ${modelId}${suffix}\n---\n${BODY}\n`;
+    const tools = limitTools ? `tools: ${TOOLS.join(", ")}\n` : "";
+    const body = imagePort === null ? BODY : `${BODY}\n${imageLine(imagePort)}`;
+    return `---\nname: ${name}\ndescription: ${description}\nmodel: ${modelId}${suffix}\n${tools}---\n${body}\n`;
 }
 function readManifest(file) {
     try {
@@ -199,6 +223,7 @@ export function syncAgentFiles(cfg, dir, log, opts = {}) {
             targets.set(name, { modelId: model.id, provider: providerName, suffix: effortSuffix(provider, model.id) });
         }
     }
+    const imagePort = Object.values(cfg.providers).some((p) => p.type === "chatgpt") ? adminPort(cfg) : null;
     const nextOwned = [];
     for (const [name, t] of targets) {
         if (handNames.has(name)) {
@@ -206,7 +231,7 @@ export function syncAgentFiles(cfg, dir, log, opts = {}) {
             continue;
         }
         const file = path.join(dir, `${name}.md`);
-        const content = fileContent(name, t.modelId, t.provider, t.suffix);
+        const content = fileContent(name, t.modelId, t.provider, t.suffix, cfg.cli.limitWorkerTools === true, imagePort);
         const existing = scanned.get(`${name}.md`);
         if (existing) {
             let current = null;

package/dist/router/src/config.js

@@ -381,6 +381,8 @@ export function validate(c) {
         errors.push("listen.port out of range");
     if (c.cli.agentFiles !== undefined && typeof c.cli.agentFiles !== "boolean")
         errors.push("cli.agentFiles must be true or false");
+    if (c.cli.limitWorkerTools !== undefined && typeof c.cli.limitWorkerTools !== "boolean")
+        errors.push("cli.limitWorkerTools must be true or false");
     if (c.listen.openaiPort !== undefined && !(c.listen.openaiPort >= 0 && c.listen.openaiPort < 65536))
         errors.push("listen.openaiPort out of range");
     return errors;

package/dist/router/src/index.js

@@ -153,6 +153,8 @@ proxy
         credentials: () => proxy.credentialHealth(),
         picker: () => ({ enabled: !!store.get().picker?.enabled, hosts: terminateHosts(store.get()).slice(1), last: proxy.lastPickerInjection }),
         observedClaudeCodeAuth,
+        claudeUsage: () => proxy.claudeUsage.snapshot(),
+        image: (req, signal) => proxy.generateImage(req, signal),
         shutdown: () => beginDrain("shutdown requested"),
     });
     log.info(`clauderipple admin GUI on http://127.0.0.1:${admin.port}/`);

package/dist/router/src/providers/anthropic-usage.js

@@ -0,0 +1,98 @@
+// How much of each Claude subscription account's limits is used, for the dashboard and the tray.
+//
+// Response headers would only describe the account that last answered, so an idle second account
+// would never show a number. Claude Code's own `/usage` asks `GET /api/oauth/usage` with the
+// account's OAuth headers instead, and so does this. Shape measured 2026-09-28 (CLI 2.1.281):
+//   {"five_hour": {"utilization": 14.0, "resets_at": "2026-09-28T08:30:00.581181+00:00", …},
+//    "seven_day": {"utilization": 10.0, "resets_at": "…"}, "seven_day_opus": null, …}
+// `utilization` is a percentage. It is mapped onto the Codex snapshot shape
+// (`rate_limits.primary/secondary` with `used_percent`, `window_minutes`, `reset_at` in seconds)
+// so the GUI and the tray read one format for every account.
+const FIVE_HOURS = 5 * 60;
+const WEEK = 7 * 24 * 60;
+export function claudeUsageFromBody(body) {
+    const b = body;
+    const win = (w, minutes) => {
+        if (!w || typeof w.utilization !== "number" || !Number.isFinite(w.utilization))
+            return null;
+        const out = { used_percent: w.utilization, window_minutes: minutes };
+        const at = typeof w.resets_at === "string" ? Date.parse(w.resets_at) : NaN;
+        if (Number.isFinite(at))
+            out.reset_at = Math.round(at / 1000);
+        return out;
+    };
+    const primary = win(b?.five_hour, FIVE_HOURS);
+    const secondary = win(b?.seven_day, WEEK);
+    if (!primary && !secondary)
+        return null;
+    return { type: "claude.usage", rate_limits: { primary: primary ?? secondary, secondary: primary ? secondary : null }, at: Date.now() };
+}
+/**
+ * Per-account snapshots, fetched at most once per `ttlMs` per account. The GUI polls the status
+ * every five seconds and the tray as often; a limit that moves by a percent in minutes does not
+ * need more. A failed lookup keeps the last good numbers rather than blanking them.
+ */
+export class ClaudeUsage {
+    last = new Map();
+    inFlight = null;
+    fetchedAt = Number.NEGATIVE_INFINITY;
+    source;
+    opts;
+    constructor(source, opts) {
+        this.source = source;
+        this.opts = opts;
+    }
+    /** Snapshots by account owner id ("current" for the Claude Code login). */
+    snapshot() {
+        const now = (this.opts.now ?? Date.now)();
+        if (now - this.fetchedAt < (this.opts.ttlMs ?? 5 * 60_000))
+            return Promise.resolve(Object.fromEntries(this.last));
+        this.inFlight ??= this.fetchAll().finally(() => {
+            this.fetchedAt = (this.opts.now ?? Date.now)();
+            this.inFlight = null;
+        });
+        return this.inFlight;
+    }
+    async fetchAll() {
+        let credentials;
+        try {
+            credentials = await this.source.credentials();
+        }
+        catch (e) {
+            this.opts.warn?.(`claude usage: no credentials: ${e.message}`);
+            return Object.fromEntries(this.last);
+        }
+        await Promise.all(credentials.map(async (credential) => {
+            const owner = credential.ownerId ?? credential.id;
+            const snapshot = await this.fetchOne(credential);
+            if (snapshot)
+                this.last.set(owner, snapshot);
+        }));
+        // An account that was removed must not keep its old numbers on the screen.
+        const owners = new Set(credentials.map((c) => c.ownerId ?? c.id));
+        for (const owner of [...this.last.keys()])
+            if (!owners.has(owner))
+                this.last.delete(owner);
+        return Object.fromEntries(this.last);
+    }
+    async fetchOne(credential) {
+        const owner = (credential.ownerId ?? credential.id).slice(0, 8);
+        try {
+            const res = await (this.opts.fetch ?? fetch)(`https://${this.opts.upstream()}/api/oauth/usage`, {
+                method: "GET",
+                headers: { ...credential.headers, accept: "application/json" },
+                signal: AbortSignal.timeout(this.opts.timeoutMs ?? 5000),
+            });
+            if (!res.ok) {
+                // The status alone: the body of an auth failure is not worth the risk of echoing.
+                this.opts.warn?.(`claude usage ${owner}: HTTP ${res.status}`);
+                return null;
+            }
+            return claudeUsageFromBody(await res.json());
+        }
+        catch (e) {
+            this.opts.warn?.(`claude usage ${owner}: ${e.message}`);
+            return null;
+        }
+    }
+}

package/dist/router/src/providers/chatgpt/index.js

@@ -24,6 +24,17 @@ const USAGE_TIMEOUT_MS = 10_000;
 const MODELS_PATH = "/codex/models";
 const MODELS_TIMEOUT_MS = 15_000;
 const MODELS_CACHE_MS = 60 * 60 * 1000;
+/** One image took about 30 s at low quality (2026-09-29); high quality and references take longer. */
+const IMAGE_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * The shape, asked for in words. The subscription backend accepts the tool's `size` and `quality`
+ * and ignores them — even "999x1" and "bogus" came back 200 as a 1536x1024 image (2026-09-29) —
+ * while the prompt steers it: "square composition" gave 1254x1254. So the shape is a prompt hint,
+ * and quality is the backend's to choose.
+ */
+export const IMAGE_ASPECTS = ["square", "landscape", "portrait"];
+export const IMAGE_FORMATS = ["png", "jpeg", "webp"];
+export const IMAGE_BACKGROUNDS = ["auto", "transparent", "opaque"];
 function anthropicError(status, type, message) {
     return { status, body: JSON.stringify({ type: "error", error: { type, message } }) };
 }
@@ -394,6 +405,107 @@ export class ChatGptAdapter {
         const prose = text.trim();
         return prose ? { hits: selected, text: prose } : { hits: selected };
     }
+    /**
+     * Hosted image generation, the same way `searchWeb` runs a hosted search: one Responses turn with
+     * the `image_generation` tool required. Wire measured 2026-09-29 against the live backend with a
+     * ChatGPT subscription: an `image_generation_call` output item whose `result` is the base64 image,
+     * beside the `size`, `quality` and `output_format` it chose and a `revised_prompt`; about 30 s.
+     */
+    async generateImage(model, req, signal) {
+        const tokens = await this.anyCredential();
+        if (tokens instanceof Error)
+            throw tokens;
+        const id = crypto.randomUUID();
+        const tool = {
+            type: "image_generation",
+            output_format: req.format ?? "png",
+            ...(req.background ? { background: req.background } : {}),
+        };
+        const prompt = req.aspect ? `${req.prompt}\n\nCompose it as a ${req.aspect} image.` : req.prompt;
+        const content = [{ type: "input_text", text: prompt }];
+        for (const image of req.images ?? [])
+            content.push({ type: "input_image", image_url: `data:${image.mediaType};base64,${image.data}` });
+        const body = {
+            model,
+            instructions: "Generate the requested image. Use any attached images as references.",
+            input: [{ type: "message", role: "user", content }],
+            tools: [tool],
+            tool_choice: "required",
+            reasoning: { effort: "low", summary: "auto" },
+            store: false,
+            stream: true,
+            prompt_cache_key: id,
+            client_metadata: { session_id: id, thread_id: id, turn_id: crypto.randomUUID(), "x-codex-window-id": `${id}:0` },
+        };
+        const timeout = AbortSignal.timeout(IMAGE_TIMEOUT_MS);
+        const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+        const res = await fetch(`${(this.cfg.url ?? DEFAULT_BASE).replace(/\/$/, "")}/codex/responses`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "text/event-stream",
+                authorization: `Bearer ${tokens.accessToken}`,
+                "chatgpt-account-id": tokens.accountId,
+                "OpenAI-Beta": "responses=experimental",
+                originator: "codex_cli_rs",
+                "session-id": id,
+                "thread-id": id,
+                "x-client-request-id": id,
+                "x-codex-window-id": `${id}:0`,
+            },
+            body: JSON.stringify(body),
+            signal: requestSignal,
+        });
+        this.noteRateLimits(tokens, rateLimitsFromHeaders(res.headers));
+        if (!res.ok || !res.body) {
+            const text = await res.text().catch(() => "");
+            if (res.status === 401)
+                void this.accounts.forceRefresh(tokens.ownerId);
+            throw new Error(`ChatGPT image generation: HTTP ${res.status}${text ? ` ${redactErrorText(text, [tokens.accessToken], 200)}` : ""}`);
+        }
+        const parser = new SseParser();
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let image;
+        let text = "";
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                for (const event of parser.feed(decoder.decode(value, { stream: true }))) {
+                    if (event.type === "response.output_text.delta")
+                        text += String(event.delta ?? "");
+                    if (event.type === "response.output_item.done") {
+                        const item = event.item;
+                        if (item?.type === "image_generation_call" && typeof item.result === "string" && item.result)
+                            image = item;
+                    }
+                    if (event.type === "error" || event.type === "response.failed") {
+                        const error = (event.error ?? event.response?.error);
+                        throw new Error(`ChatGPT image generation: ${String(error?.message ?? "backend error")}`);
+                    }
+                }
+            }
+        }
+        finally {
+            try {
+                await reader.cancel();
+            }
+            catch { /* already closed */ }
+        }
+        // A refusal comes back as prose and no image; that prose is the only explanation there is.
+        if (!image)
+            throw new Error(`ChatGPT image generation: no image returned${text.trim() ? `: ${text.trim().slice(0, 300)}` : ""}`);
+        const str = (v) => (typeof v === "string" && v ? v : undefined);
+        return {
+            data: Buffer.from(image.result, "base64"),
+            format: str(image.output_format) ?? req.format ?? "png",
+            ...(str(image.size) ? { size: str(image.size) } : {}),
+            ...(str(image.quality) ? { quality: str(image.quality) } : {}),
+            ...(str(image.revised_prompt) ? { revisedPrompt: str(image.revised_prompt) } : {}),
+        };
+    }
     /** One in-flight lookup shared by every caller (the status route and the startup refresh). */
     rateLimitsInFlight = null;
     /**

package/dist/router/src/proxy.js

@@ -35,6 +35,7 @@ import { injectPickerModels, isBootstrapPath } from "./picker.js";
 import { ResponseUsageTap } from "./requestlog.js";
 import { credentialHeaderValues, redactErrorText, redactHeaders } from "./redact.js";
 import { ClaudeAccountAuthPool } from "./providers/anthropic-account-pool.js";
+import { ClaudeUsage } from "./providers/anthropic-usage.js";
 import { dropForeignThinking } from "./thinking.js";
 const MAX_BODY = 64 * 1024 * 1024;
 const HOP_BY_HOP = new Set(["connection", "keep-alive", "proxy-connection", "transfer-encoding", "upgrade", "host", "content-length"]);
@@ -177,6 +178,8 @@ export class Proxy {
     chatgptAdapters = new Map();
     openaiAdapters = new Map();
     claudeAccounts;
+    /** Each Claude subscription account's usage, for the admin status (never a token). */
+    claudeUsage;
     deps;
     /**
      * Cooldowns, quarantines and conversation stickiness for provider credentials. In memory: a
@@ -250,6 +253,20 @@ export class Proxy {
             return this.chatgpt(first[0], first[1]);
         return this.chatgpt("codex-login", { type: "chatgpt", auth: "borrow-codex" });
     }
+    /**
+     * One image for `/api/image`, on the first chatgpt provider and the first model it declares. The
+     * model only runs the tool call — the image comes from the backend's own image model — so which
+     * one it is barely matters.
+     */
+    generateImage(req, signal) {
+        const first = Object.entries(this.deps.config().providers).find(([, p]) => p.type === "chatgpt");
+        if (!first || first[1].type !== "chatgpt")
+            return Promise.reject(new Error("image generation needs a ChatGPT provider; add one in the dashboard"));
+        const model = first[1].models?.[0]?.id;
+        if (!model)
+            return Promise.reject(new Error(`provider ${first[0]} declares no models`));
+        return this.chatgpt(first[0], first[1]).generateImage(model, req, signal);
+    }
     /** Dashboard action: put one resting ChatGPT account back into rotation now. */
     chatgptClearCooldown(ownerId) {
         for (const [name, p] of Object.entries(this.deps.config().providers)) {
@@ -282,6 +299,10 @@ export class Proxy {
             log: deps.log,
             ...(deps.observedClaudeCodeAuth ? { observed: deps.observedClaudeCodeAuth } : {}),
         });
+        this.claudeUsage = new ClaudeUsage(this.claudeAccounts, {
+            upstream: () => this.deps.config().upstream,
+            warn: (message) => deps.log.warn(message),
+        });
         this.httpServer = http.createServer({ maxHeaderSize: 64 * 1024 }, (req, res) => {
             void this.handle(req, res);
         });

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.5.1";
+export const VERSION = "0.7.0";