cli-funnel 0.1.0 → 0.2.0

package/dist/bin/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   createFunnel
-} from "../chunk-2FZ64BNF.js";
+} from "../chunk-CJLAAJHT.js";
 import {
   createHandler,
   serveNode
-} from "../chunk-GF7JASHO.js";
+} from "../chunk-TBSSPWZE.js";
 import {
   ACCESS_LEVELS
-} from "../chunk-YP5V5YEE.js";
+} from "../chunk-KMG3CM2J.js";
 
 // src/bin/cli.ts
 import { createInterface } from "readline/promises";

package/dist/{chunk-2FZ64BNF.js → chunk-CJLAAJHT.js}

@@ -1,7 +1,7 @@
 import {
   ACCESS_LEVELS,
   FunnelError
-} from "./chunk-YP5V5YEE.js";
+} from "./chunk-KMG3CM2J.js";
 
 // src/catalog/manifest.ts
 import { existsSync } from "fs";
@@ -126,7 +126,14 @@ var anthropic = {
       method: "POST",
       signal: input.signal,
       headers: { "x-api-key": key, "anthropic-version": "2023-06-01", "content-type": "application/json" },
-      body: JSON.stringify({ model: input.selection.model, max_tokens: 8192, stream: true, messages })
+      body: JSON.stringify({
+        model: input.selection.model,
+        max_tokens: input.maxOutputTokens ?? 8192,
+        stream: true,
+        ...input.system ? { system: input.system } : {},
+        ...input.responseSchema ? { output_config: { format: { type: "json_schema", schema: input.responseSchema.schema } } } : {},
+        messages
+      })
     });
     if (!res.ok) return yield { type: "error", message: `Anthropic API ${res.status}: ${await res.text()}`, code: "cli-failed" };
     let inTok = 0;
@@ -146,6 +153,13 @@ var anthropic = {
     }
     yield { type: "usage", usage: { inputTokens: inTok, outputTokens: outTok, cachedInputTokens: cached, totalTokens: inTok + outTok } };
     yield { type: "done", text: "", finishReason: stop === "refusal" ? "denied" : "stop" };
+  },
+  userContent(input) {
+    if (!input.attachments?.length) return input.prompt;
+    return [
+      ...input.attachments.map((a) => ({ type: "image", source: { type: "base64", media_type: a.mediaType, data: a.data } })),
+      { type: "text", text: input.prompt }
+    ];
   }
 };
 var openai = {
@@ -164,7 +178,15 @@ var openai = {
       method: "POST",
       signal: input.signal,
       headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
-      body: JSON.stringify({ model: input.selection.model, messages, stream: true, stream_options: { include_usage: true } })
+      body: JSON.stringify({
+        model: input.selection.model,
+        // The system message is sent on every call and never stored in the session history.
+        messages: input.system ? [{ role: "system", content: input.system }, ...messages] : messages,
+        stream: true,
+        stream_options: { include_usage: true },
+        ...input.maxOutputTokens ? { max_completion_tokens: input.maxOutputTokens } : {},
+        ...input.responseSchema ? { response_format: { type: "json_schema", json_schema: { name: input.responseSchema.name ?? "response", schema: input.responseSchema.schema } } } : {}
+      })
     });
     if (!res.ok) return yield { type: "error", message: `OpenAI API ${res.status}: ${await res.text()}`, code: "cli-failed" };
     let usage;
@@ -179,6 +201,13 @@ var openai = {
     }
     if (usage) yield { type: "usage", usage: { inputTokens: usage.prompt_tokens, outputTokens: usage.completion_tokens, totalTokens: usage.total_tokens } };
     yield { type: "done", text: "", finishReason: stop === "content_filter" ? "denied" : "stop" };
+  },
+  userContent(input) {
+    if (!input.attachments?.length) return input.prompt;
+    return [
+      { type: "text", text: input.prompt },
+      ...input.attachments.map((a) => ({ type: "image_url", image_url: { url: `data:${a.mediaType};base64,${a.data}` } }))
+    ];
   }
 };
 var histories = /* @__PURE__ */ new Map();
@@ -192,7 +221,17 @@ function makeApiProvider(spec, getKey) {
     id: spec.id,
     displayName: spec.displayName,
     binary: "fetch",
-    capabilities: { access: [], effort: false, contextWindow: false, fast: false, resume: true, approvals: false },
+    capabilities: {
+      access: [],
+      effort: false,
+      contextWindow: false,
+      fast: false,
+      resume: true,
+      approvals: false,
+      images: true,
+      system: "native",
+      schema: "native"
+    },
     detect: async () => ({ installed: true, testedRange: { min: "0" }, withinTestedRange: true }),
     authStatus: async () => ({ loggedIn: !!(getKey() ?? process.env[spec.envVar]), method: "API key" }),
     login() {
@@ -213,7 +252,7 @@ function makeApiProvider(spec, getKey) {
     models: async () => spec.listModels(key()),
     async *run(input) {
       const sessionId = input.sessionId ?? randomUUID();
-      const messages = [...histories.get(sessionId) ?? [], { role: "user", content: input.prompt }];
+      const messages = [...histories.get(sessionId) ?? [], { role: "user", content: spec.userContent(input) }];
       yield { type: "session", sessionId, model: input.selection.model };
       let text = "";
       for await (const e of spec.stream(key(), input, messages)) {
@@ -267,7 +306,7 @@ var Channel = class {
 import { spawn as spawn2 } from "child_process";
 
 // src/util/process.ts
-import { spawn } from "child_process";
+import { execFileSync, spawn } from "child_process";
 import { existsSync as existsSync3, accessSync, constants } from "fs";
 import { homedir } from "os";
 import { delimiter, join } from "path";
@@ -279,10 +318,35 @@ var EXTRA_DIRS = [
   "/opt/homebrew/bin",
   "/usr/local/bin"
 ];
+var MARK = "__CLI_FUNNEL_ENV__";
+var shellPath;
+function loginShellPath(refresh = false) {
+  if (shellPath && !refresh) return shellPath;
+  shellPath = [];
+  if (process.platform === "win32" || process.env.CLI_FUNNEL_NO_SHELL_PATH === "1") return shellPath;
+  const shell = process.env.SHELL || (process.platform === "darwin" ? "/bin/zsh" : "/bin/sh");
+  try {
+    const out = execFileSync(shell, ["-ilc", `echo ${MARK}; /usr/bin/env; echo ${MARK}`], {
+      encoding: "utf8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const line = out.split(MARK)[1]?.split("\n").find((l) => l.startsWith("PATH="));
+    if (line) shellPath = line.slice(5).split(":").filter(Boolean);
+  } catch {
+  }
+  return shellPath;
+}
+function searchPath() {
+  return [.../* @__PURE__ */ new Set([...(process.env.PATH ?? "").split(delimiter).filter(Boolean), ...loginShellPath(), ...EXTRA_DIRS])];
+}
+function childEnv(extra) {
+  return { ...process.env, PATH: searchPath().join(delimiter), ...extra };
+}
 function resolveBinary(name, envVar) {
   const override = envVar ? process.env[envVar] : void 0;
   if (override && existsSync3(override)) return override;
-  const dirs = [...(process.env.PATH ?? "").split(delimiter), ...EXTRA_DIRS];
+  const dirs = searchPath();
   const exts = process.platform === "win32" ? [".exe", ".cmd", ".bat", ""] : [""];
   for (const dir of dirs) {
     for (const ext of exts) {
@@ -300,7 +364,7 @@ function exec(file, args, opts = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn(file, args, {
       cwd: opts.cwd,
-      env: { ...process.env, ...opts.env },
+      env: childEnv(opts.env),
       stdio: ["pipe", "pipe", "pipe"],
       signal: opts.signal
     });
@@ -325,7 +389,7 @@ function exec(file, args, opts = {}) {
 function spawnStream(file, args, opts = {}) {
   const child = spawn(file, args, {
     cwd: opts.cwd,
-    env: { ...process.env, ...opts.env },
+    env: childEnv(opts.env),
     stdio: ["pipe", "pipe", "pipe"]
   });
   const channel = new Channel();
@@ -397,6 +461,26 @@ function compareVersions(a, b) {
   return 0;
 }
 
+// src/providers/prompt.ts
+function composePrompt(input, opts) {
+  const parts = [];
+  if (opts.system && input.system) parts.push(`<instructions>
+${input.system}
+</instructions>`);
+  parts.push(input.prompt);
+  if (opts.schema && input.responseSchema) {
+    parts.push(
+      "Reply with only a JSON value that matches this JSON Schema. No prose, no code fences.\n" + JSON.stringify(input.responseSchema.schema)
+    );
+  }
+  return parts.join("\n\n");
+}
+function parseJsonAnswer(text) {
+  const trimmed = text.trim();
+  const fenced = /^```(?:json)?\s*\n([\s\S]*?)\n?```$/i.exec(trimmed);
+  return JSON.parse(fenced ? fenced[1] : trimmed);
+}
+
 // src/providers/base.ts
 function binaryEnvVar(binary) {
   return `CLI_FUNNEL_${binary.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_BIN`;
@@ -420,7 +504,7 @@ function spawnLogin(binary, args, readStatus, opts = {}) {
     channel.push({ type: "error", message: `${binary} is not installed.` });
     channel.end();
   } else {
-    child = spawn2(path, args, { env: { ...process.env, ...opts.env }, signal: opts.signal, stdio: ["pipe", "pipe", "pipe"] });
+    child = spawn2(path, args, { env: childEnv(opts.env), signal: opts.signal, stdio: ["pipe", "pipe", "pipe"] });
     child.stdin?.on("error", () => {
     });
     const seen = /* @__PURE__ */ new Set();
@@ -500,6 +584,9 @@ async function collect(events, input) {
       case "usage":
         result.usage = e.usage;
         break;
+      case "structured":
+        result.structured = e.data;
+        break;
       case "done":
         if (e.text) result.text = e.text;
         result.finishReason = e.finishReason;
@@ -509,6 +596,13 @@ async function collect(events, input) {
         throw Object.assign(new Error(e.message), { code: e.code });
     }
   }
+  if (input.responseSchema && result.structured === void 0 && result.finishReason === "stop") {
+    try {
+      result.structured = parseJsonAnswer(result.text);
+    } catch (err) {
+      result.structuredError = `The answer is not JSON: ${err instanceof Error ? err.message : String(err)}`;
+    }
+  }
   return result;
 }
 
@@ -570,6 +664,7 @@ function parseResult(r) {
     };
     events.push({ type: "usage", usage });
   }
+  if (r.structured_output !== void 0) events.push({ type: "structured", data: r.structured_output });
   const denied = Array.isArray(r.permission_denials) && r.permission_denials.length > 0;
   const finishReason = denied ? "denied" : "stop";
   events.push({ type: "done", text, finishReason });
@@ -580,19 +675,25 @@ function parseResult(r) {
 var BIN = "claude";
 var TESTED_RANGE = { min: "2.1.0" };
 var PERMISSION_MODE = {
+  // With every tool removed there is nothing to approve. `manual` keeps it that way if a tool slips in.
+  none: "manual",
   supervised: "manual",
   "accept-edits": "acceptEdits",
   auto: "auto",
   full: "bypassPermissions"
 };
 var capabilities = {
-  access: ["supervised", "accept-edits", "auto", "full"],
+  access: ["none", "supervised", "accept-edits", "auto", "full"],
   effort: true,
   contextWindow: false,
   fast: false,
   resume: true,
-  approvals: true
+  approvals: true,
+  images: true,
+  system: "native",
+  schema: "native"
 };
+var NO_TOOLS = ["--tools", "", "--strict-mcp-config", "--setting-sources", ""];
 function buildArgs(input) {
   const { selection } = input;
   const args = [
@@ -609,10 +710,20 @@ function buildArgs(input) {
     PERMISSION_MODE[selection.access]
   ];
   if (selection.effort) args.push("--effort", selection.effort);
-  if (selection.access !== "full" && input.onApproval) args.push("--permission-prompt-tool", "stdio");
+  if (selection.access === "none") args.push(...NO_TOOLS);
+  if (input.system) args.push(selection.access === "none" ? "--system-prompt" : "--append-system-prompt", input.system);
+  if (input.responseSchema) args.push("--json-schema", JSON.stringify(input.responseSchema.schema));
+  if (selection.access !== "full" && selection.access !== "none" && input.onApproval) args.push("--permission-prompt-tool", "stdio");
   if (input.sessionId) args.push("--resume", input.sessionId);
   return args;
 }
+function userContent(input) {
+  if (!input.attachments?.length) return input.prompt;
+  return [
+    ...input.attachments.map((a) => ({ type: "image", source: { type: "base64", media_type: a.mediaType, data: a.data } })),
+    { type: "text", text: input.prompt }
+  ];
+}
 async function* run(input) {
   const bin = findBinary(BIN);
   if (!bin) throw new FunnelError("Claude Code is not installed.", "not-installed");
@@ -620,7 +731,7 @@ async function* run(input) {
     throw new FunnelError('Access "supervised" needs an onApproval handler.', "invalid-selection");
   }
   const proc = spawnStream(bin, buildArgs(input), { cwd: input.selection.cwd, env: input.env, signal: input.signal, closeStdin: false });
-  proc.write(JSON.stringify({ type: "user", message: { role: "user", content: input.prompt } }));
+  proc.write(JSON.stringify({ type: "user", message: { role: "user", content: userContent(input) } }));
   let finished = false;
   try {
     for await (const raw of proc.lines) {
@@ -683,6 +794,8 @@ var claudeProvider = {
 // src/providers/codex/access.ts
 function planAccess(access) {
   switch (access) {
+    case "none":
+      return { approvalPolicy: "untrusted", sandbox: "read-only", approvalsReviewer: "user", autoAllowFileChanges: false };
     case "supervised":
       return { approvalPolicy: "untrusted", sandbox: "workspace-write", approvalsReviewer: "user", autoAllowFileChanges: false };
     case "accept-edits":
@@ -892,6 +1005,60 @@ var RpcClient = class {
   }
 };
 
+// src/providers/codex/tools.ts
+import { readFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var TOOL_FEATURES = [
+  "shell_tool",
+  "unified_exec",
+  "apps",
+  "plugins",
+  "multi_agent",
+  "multi_agent_v2",
+  "browser_use",
+  "computer_use",
+  "image_generation",
+  "hooks",
+  "skill_search",
+  "tool_suggest",
+  "goals",
+  "sleep_tool",
+  "code_mode_host",
+  "memories",
+  "in_app_browser"
+];
+var SERVER_HEADER = /^\s*\[mcp_servers\.(?:"([^"]+)"|([A-Za-z0-9_-]+))\]\s*$/gm;
+function declaredServers(file) {
+  let text;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch {
+    return [];
+  }
+  return [...text.matchAll(SERVER_HEADER)].map((m) => m[1] ?? m[2]);
+}
+async function configMcpServers(bin, cwd) {
+  const res = await exec(bin, ["mcp", "list", "--json"], { timeoutMs: 2e4 });
+  if (res.code !== 0) throw new Error(`codex mcp list failed: ${(res.stderr || res.stdout).trim().slice(0, 200)}`);
+  const enabled = new Set(
+    JSON.parse(res.stdout).filter((s) => s.enabled !== false).map((s) => s.name)
+  );
+  const home = process.env.CODEX_HOME ?? join2(homedir2(), ".codex");
+  const declared = [...declaredServers(join2(home, "config.toml")), ...declaredServers(join2(cwd, ".codex", "config.toml"))];
+  return [...new Set(declared)].filter((name) => enabled.has(name));
+}
+async function noToolsConfig(bin, cwd) {
+  const servers = await configMcpServers(bin, cwd);
+  return Object.fromEntries([
+    ...TOOL_FEATURES.map((f) => [`features.${f}`, false]),
+    ["web_search", "disabled"],
+    ["include_apply_patch_tool", false],
+    ["tools.view_image", false],
+    ...servers.map((name) => [`mcp_servers.${name}.enabled`, false])
+  ]);
+}
+
 // src/providers/codex/index.ts
 var BINARY = "codex";
 var TESTED_RANGE2 = { min: "0.150.0" };
@@ -935,6 +1102,7 @@ async function* run2(input) {
     proc.child.kill("SIGTERM");
   };
   const decide = async (req) => {
+    if (sel.access === "none") return "deny";
     if (req.method === "item/fileChange/requestApproval" && plan.autoAllowFileChanges) return "allow";
     if (sel.access === "full") return "allow";
     const request = toApprovalRequest(req, translator?.items ?? /* @__PURE__ */ new Map());
@@ -993,7 +1161,9 @@ async function* run2(input) {
         approvalPolicy: plan.approvalPolicy,
         approvalsReviewer: plan.approvalsReviewer,
         sandbox: plan.sandbox,
-        ...sel.fast ? { serviceTier: "priority" } : {}
+        ...sel.fast ? { serviceTier: "priority" } : {},
+        ...input.system ? { developerInstructions: input.system } : {},
+        ...sel.access === "none" ? { config: await noToolsConfig(path, sel.cwd) } : {}
       };
       const started = input.sessionId ? await rpc.request("thread/resume", { threadId: input.sessionId, ...settings }) : await rpc.request("thread/start", settings);
       threadId = started.thread.id;
@@ -1001,8 +1171,12 @@ async function* run2(input) {
       out.push({ type: "session", sessionId: threadId, model: started.model });
       const res = await rpc.request("turn/start", {
         threadId,
-        input: [{ type: "text", text: input.prompt, text_elements: [] }],
-        ...sel.effort ? { effort: sel.effort } : {}
+        input: [
+          ...(input.attachments ?? []).map((a) => ({ type: "image", url: `data:${a.mediaType};base64,${a.data}` })),
+          { type: "text", text: input.prompt, text_elements: [] }
+        ],
+        ...sel.effort ? { effort: sel.effort } : {},
+        ...input.responseSchema ? { outputSchema: input.responseSchema.schema } : {}
       });
       turnId ??= res?.turn?.id;
     } catch (e) {
@@ -1021,12 +1195,15 @@ var codexProvider = {
   displayName: "Codex",
   binary: BINARY,
   capabilities: {
-    access: ["supervised", "accept-edits", "auto", "full"],
+    access: ["none", "supervised", "accept-edits", "auto", "full"],
     effort: true,
     contextWindow: false,
     fast: true,
     resume: true,
-    approvals: true
+    approvals: true,
+    images: true,
+    system: "native",
+    schema: "native"
   },
   detect: () => detectInstallation(BINARY, TESTED_RANGE2),
   authStatus: authStatus2,
@@ -1271,7 +1448,7 @@ function buildArgs2(input, model) {
     ...accessFlags(selection.access),
     ...input.sessionId ? ["--resume", input.sessionId] : [],
     "--",
-    input.prompt
+    composePrompt(input, { system: true, schema: true })
   ];
 }
 async function authStatus3() {
@@ -1314,7 +1491,18 @@ var agentProvider = {
   id: "agent",
   displayName: "Cursor Agent",
   binary: BINARY2,
-  capabilities: { access: ["auto", "full"], effort: true, contextWindow: false, fast: true, resume: true, approvals: false },
+  // No `none`: in testing, `--mode ask` with `--sandbox enabled` still ran shell commands, and only the model's own refusal stopped writes.
+  capabilities: {
+    access: ["auto", "full"],
+    effort: true,
+    contextWindow: false,
+    fast: true,
+    resume: true,
+    approvals: false,
+    images: false,
+    system: "prompt",
+    schema: "prompt"
+  },
   detect: () => detectInstallation(BINARY2, TESTED_RANGE3),
   authStatus: authStatus3,
   login: (options) => spawnLogin(BINARY2, ["login"], authStatus3, {
@@ -1336,8 +1524,8 @@ var agentProvider = {
 
 // src/providers/antigravity/index.ts
 import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 
 // src/providers/antigravity/parser.ts
 var EFFORTS = ["low", "medium", "high", "max"];
@@ -1438,6 +1626,7 @@ function createMapper() {
         });
         const usage = toUsage2(r.usage);
         if (usage) events.push({ type: "usage", usage });
+        if (r.structured_output !== void 0) events.push({ type: "structured", data: r.structured_output });
         const text = r.response ?? "";
         events.push({ type: "done", text, finishReason: denied.length && !text.trim() ? "denied" : "stop" });
         return events;
@@ -1448,7 +1637,7 @@ function createMapper() {
 }
 
 // src/providers/antigravity/index.ts
-var TOKEN_FILE = join2(homedir2(), ".gemini", "antigravity-cli", "antigravity-oauth-token");
+var TOKEN_FILE = join3(homedir3(), ".gemini", "antigravity-cli", "antigravity-oauth-token");
 var TESTED = { min: "1.2.0" };
 function toCliModel2(selection, models2 = []) {
   const info = models2.find((m) => m.id === selection.model);
@@ -1458,7 +1647,8 @@ function toCliModel2(selection, models2 = []) {
 function buildArgs3(input, models2 = []) {
   const { selection } = input;
   const { model, effort } = toCliModel2(selection, models2);
-  const args = ["--print=" + input.prompt, "--output-format", "stream-json", "--model", model];
+  const args = ["--print=" + composePrompt(input, { system: true, schema: false }), "--output-format", "stream-json", "--model", model];
+  if (input.responseSchema) args.push("--json-schema", JSON.stringify(input.responseSchema.schema));
   if (effort) args.push("--effort", effort);
   if (selection.access === "accept-edits") args.push("--mode", "accept-edits");
   if (selection.access === "full") args.push("--dangerously-skip-permissions");
@@ -1527,7 +1717,18 @@ var antigravityProvider = {
   id: "antigravity",
   displayName: "Antigravity",
   binary: "agy",
-  capabilities: { access: ["accept-edits", "full"], effort: true, contextWindow: false, fast: false, resume: true, approvals: false },
+  // No `none`: in testing, `--mode plan` with `--sandbox` still let a shell command write outside the workspace.
+  capabilities: {
+    access: ["accept-edits", "full"],
+    effort: true,
+    contextWindow: false,
+    fast: false,
+    resume: true,
+    approvals: false,
+    images: false,
+    system: "prompt",
+    schema: "native"
+  },
   detect: () => detectInstallation("agy", TESTED),
   authStatus: authStatus4,
   login,
@@ -1575,6 +1776,9 @@ function createFunnel(options = {}) {
     if (input.selection.access === "supervised" && !input.onApproval) {
       throw new FunnelError('access "supervised" needs an onApproval callback.', "invalid-selection");
     }
+    if (input.attachments?.length && !p.capabilities.images) {
+      throw new FunnelError(`${p.displayName} cannot take image attachments.`, "unsupported");
+    }
     return p;
   }
   function stream(input) {

package/dist/{chunk-YP5V5YEE.js → chunk-KMG3CM2J.js}

@@ -1,5 +1,5 @@
 // src/types.ts
-var ACCESS_LEVELS = ["supervised", "accept-edits", "auto", "full"];
+var ACCESS_LEVELS = ["none", "supervised", "accept-edits", "auto", "full"];
 var FunnelError = class extends Error {
   constructor(message, code) {
     super(message);

package/dist/{chunk-GF7JASHO.js → chunk-TBSSPWZE.js}

@@ -1,7 +1,7 @@
 import {
   ACCESS_LEVELS,
   FunnelError
-} from "./chunk-YP5V5YEE.js";
+} from "./chunk-KMG3CM2J.js";
 
 // src/server/handler.ts
 import { timingSafeEqual } from "crypto";
@@ -50,6 +50,15 @@ function sse(items, opts = {}) {
 
 // src/server/openai.ts
 var text = (c) => typeof c === "string" ? c : (c ?? []).map((p) => p.type === "text" ? p.text ?? "" : "").join("");
+var IMAGE_DATA_URL = /^data:(image\/(?:png|jpeg|webp|gif));base64,(.+)$/;
+function toAttachments(messages) {
+  const last = [...messages].reverse().find((m) => m.role === "user");
+  if (!last || typeof last.content === "string" || !last.content) return [];
+  return last.content.flatMap((p) => {
+    const m = p.type === "image_url" && p.image_url ? IMAGE_DATA_URL.exec(p.image_url.url) : null;
+    return m ? [{ type: "image", mediaType: m[1], data: m[2] }] : [];
+  });
+}
 function toPrompt(messages, resumed) {
   if (resumed) return text([...messages].reverse().find((m) => m.role === "user")?.content ?? "");
   if (messages.length === 1) return text(messages[0].content);
@@ -86,7 +95,12 @@ async function handleOpenAI(funnel, req, path, defaults = {}, cwdAllowed = () =>
       cwd,
       access
     },
-    prompt: toPrompt(body.messages, !!body.x_funnel?.sessionId),
+    // System messages become the run's system prompt instead of a line in the flattened chat.
+    prompt: toPrompt(body.messages.filter((m) => m.role !== "system"), !!body.x_funnel?.sessionId),
+    system: body.messages.filter((m) => m.role === "system").map((m) => text(m.content)).join("\n\n") || void 0,
+    attachments: toAttachments(body.messages),
+    responseSchema: body.response_format?.type === "json_schema" && body.response_format.json_schema?.schema ? { name: body.response_format.json_schema.name, schema: body.response_format.json_schema.schema } : void 0,
+    maxOutputTokens: body.max_completion_tokens ?? body.max_tokens,
     sessionId: body.x_funnel?.sessionId,
     signal: req.signal,
     onApproval: () => "deny"
@@ -160,6 +174,10 @@ function createHandler(funnel, options = {}) {
     const input = {
       selection: body.selection,
       prompt: body.prompt,
+      system: body.system,
+      attachments: body.attachments,
+      responseSchema: body.responseSchema,
+      maxOutputTokens: body.maxOutputTokens,
       sessionId: body.sessionId,
       signal: req.signal,
       onApproval: (request) => new Promise((resolveDecision) => {

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import { P as ProviderOverview, a as ProviderId, M as ModelInfo, A as AuthStatus, U as UpdateResult, L as LoginEvent, R as RunInput, S as Selection, F as FunnelEvent, b as ApprovalDecision } from '../funnel-CoOj5wr1.js';
-export { c as ACCESS_LEVELS, d as AccessLevel, e as ApiProviderId, f as ApprovalRequest, C as Capabilities, g as CliProviderId, E as EffortOption, h as FinishReason, i as FunnelError, I as Installation, j as LoginSession, k as Provider, l as RunResult, m as Usage } from '../funnel-CoOj5wr1.js';
+import { P as ProviderOverview, a as ProviderId, M as ModelInfo, A as AuthStatus, U as UpdateResult, L as LoginEvent, R as RunInput, S as Selection, F as FunnelEvent, b as ApprovalDecision } from '../funnel-BZBIXenY.js';
+export { c as ACCESS_LEVELS, d as AccessLevel, e as ApiProviderId, f as ApprovalRequest, g as Attachment, C as Capabilities, h as CliProviderId, E as EffortOption, i as FinishReason, j as FunnelError, I as ImageAttachment, k as Installation, l as LoginSession, m as Provider, n as ResponseSchema, o as RunResult, p as Usage } from '../funnel-BZBIXenY.js';
 
 interface ClientOptions {
     /** Where the handler is mounted, for example "/api/funnel" or "http://localhost:4747". */
@@ -40,7 +40,7 @@ declare function createClient(options: ClientOptions): {
         ok: boolean;
     }>;
     /** Streams run events. The first event is `{ type: "run", runId }`, needed to answer approvals. */
-    run: (input: Pick<RunInput, "prompt" | "sessionId"> & {
+    run: (input: Pick<RunInput, "prompt" | "sessionId" | "system" | "attachments" | "responseSchema" | "maxOutputTokens"> & {
         selection: Selection;
     }, signal?: AbortSignal) => AsyncGenerator<RunEvent, any, any>;
     approve: (runId: string, approvalId: string, decision: ApprovalDecision) => Promise<{

package/dist/client/index.js

@@ -1,7 +1,7 @@
 import {
   ACCESS_LEVELS,
   FunnelError
-} from "../chunk-YP5V5YEE.js";
+} from "../chunk-KMG3CM2J.js";
 
 // src/client/index.ts
 function createClient(options) {

package/dist/{funnel-CoOj5wr1.d.ts → funnel-BZBIXenY.d.ts}

@@ -1,8 +1,11 @@
 type CliProviderId = "claude" | "codex" | "agent" | "antigravity";
 type ApiProviderId = "anthropic-api" | "openai-api";
 type ProviderId = CliProviderId | ApiProviderId;
-/** How much the agent may do on the machine. Providers list the levels they can really enforce. */
-type AccessLevel = "supervised" | "accept-edits" | "auto" | "full";
+/**
+ * How much the agent may do on the machine. Providers list the levels they can really enforce.
+ * `none` is text in, text out: no file writes, no commands, no MCP servers, no approvals.
+ */
+type AccessLevel = "none" | "supervised" | "accept-edits" | "auto" | "full";
 declare const ACCESS_LEVELS: readonly AccessLevel[];
 interface EffortOption {
     /** Value passed to the CLI, for example "high". */
@@ -32,6 +35,12 @@ interface Capabilities {
     fast: boolean;
     resume: boolean;
     approvals: boolean;
+    /** Accepts image attachments. */
+    images: boolean;
+    /** `native` when the CLI or API takes a system prompt. `prompt` means cli-funnel puts it in front of the prompt. */
+    system: "native" | "prompt";
+    /** `native` when the CLI or API enforces `responseSchema`. `prompt` means the schema is only asked for in the prompt. */
+    schema: "native" | "prompt";
 }
 /** The whole UI state in one serializable object. Hardcode it or let the UI produce it. */
 interface Selection {
@@ -53,6 +62,19 @@ interface Usage {
     /** Set only when the CLI reports it. Subscription runs often do not. */
     costUsd?: number;
 }
+/** An image sent with the prompt. `data` is base64 without a `data:` prefix. */
+interface ImageAttachment {
+    type: "image";
+    mediaType: "image/png" | "image/jpeg" | "image/webp" | "image/gif";
+    data: string;
+}
+type Attachment = ImageAttachment;
+/** A JSON Schema for the final answer. Anthropic and Codex need `additionalProperties: false` on every object. */
+interface ResponseSchema {
+    /** Short name, used by APIs that label schemas. Default "response". */
+    name?: string;
+    schema: Record<string, unknown>;
+}
 type FinishReason = "stop" | "cancelled" | "error" | "denied";
 interface ApprovalRequest {
     id: string;
@@ -90,6 +112,11 @@ type FunnelEvent = {
 } | {
     type: "usage";
     usage: Usage;
+}
+/** The parsed answer when the provider reports structured output itself. */
+ | {
+    type: "structured";
+    data: unknown;
 } | {
     type: "done";
     text: string;
@@ -116,10 +143,22 @@ interface RunResult {
     }[];
     /** Tool calls the CLI refused because nobody could approve them. */
     deniedActions: string[];
+    /** The parsed answer when `responseSchema` was set. Not validated against the schema: do that yourself. */
+    structured?: unknown;
+    /** Why `structured` is missing when `responseSchema` was set, for example text that is not JSON. */
+    structuredError?: string;
 }
 interface RunInput {
     selection: Selection;
     prompt: string;
+    /** Instructions for the whole run. See `capabilities.system` for how each provider applies them. */
+    system?: string;
+    /** Images sent with the prompt. Providers without `capabilities.images` refuse the run. */
+    attachments?: Attachment[];
+    /** Ask for a JSON answer that matches this schema. The result carries it in `structured`. */
+    responseSchema?: ResponseSchema;
+    /** Upper bound on output tokens. API providers only. CLIs set their own limit. */
+    maxOutputTokens?: number;
     /** Continue an earlier conversation. Use the `sessionId` from a previous result. */
     sessionId?: string;
     signal?: AbortSignal;
@@ -261,4 +300,4 @@ declare function createFunnel(options?: FunnelOptions): {
 };
 type Funnel = ReturnType<typeof createFunnel>;
 
-export { type AuthStatus as A, type Capabilities as C, type EffortOption as E, type FunnelEvent as F, type Installation as I, type LoginEvent as L, type ModelInfo as M, type ProviderOverview as P, type RunInput as R, type Selection as S, type UpdateResult as U, type ProviderId as a, type ApprovalDecision as b, ACCESS_LEVELS as c, type AccessLevel as d, type ApiProviderId as e, type ApprovalRequest as f, type CliProviderId as g, type FinishReason as h, FunnelError as i, type LoginSession as j, type Provider as k, type RunResult as l, type Usage as m, type Funnel as n, type FunnelOptions as o, type ManifestModel as p, type ModelManifest as q, type RunStream as r, createFunnel as s, loadManifest as t };
+export { type AuthStatus as A, type Capabilities as C, type EffortOption as E, type FunnelEvent as F, type ImageAttachment as I, type LoginEvent as L, type ModelInfo as M, type ProviderOverview as P, type RunInput as R, type Selection as S, type UpdateResult as U, type ProviderId as a, type ApprovalDecision as b, ACCESS_LEVELS as c, type AccessLevel as d, type ApiProviderId as e, type ApprovalRequest as f, type Attachment as g, type CliProviderId as h, type FinishReason as i, FunnelError as j, type Installation as k, type LoginSession as l, type Provider as m, type ResponseSchema as n, type RunResult as o, type Usage as p, type Funnel as q, type FunnelOptions as r, type ManifestModel as s, type ModelManifest as t, type RunStream as u, createFunnel as v, loadManifest as w };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as Selection, k as Provider, M as ModelInfo, a as ProviderId, e as ApiProviderId } from './funnel-CoOj5wr1.js';
-export { c as ACCESS_LEVELS, d as AccessLevel, b as ApprovalDecision, f as ApprovalRequest, A as AuthStatus, C as Capabilities, g as CliProviderId, E as EffortOption, h as FinishReason, n as Funnel, i as FunnelError, F as FunnelEvent, o as FunnelOptions, I as Installation, L as LoginEvent, j as LoginSession, p as ManifestModel, q as ModelManifest, P as ProviderOverview, R as RunInput, l as RunResult, r as RunStream, U as UpdateResult, m as Usage, s as createFunnel, t as loadManifest } from './funnel-CoOj5wr1.js';
+import { S as Selection, m as Provider, M as ModelInfo, a as ProviderId, e as ApiProviderId } from './funnel-BZBIXenY.js';
+export { c as ACCESS_LEVELS, d as AccessLevel, b as ApprovalDecision, f as ApprovalRequest, g as Attachment, A as AuthStatus, C as Capabilities, h as CliProviderId, E as EffortOption, i as FinishReason, q as Funnel, j as FunnelError, F as FunnelEvent, r as FunnelOptions, I as ImageAttachment, k as Installation, L as LoginEvent, l as LoginSession, s as ManifestModel, t as ModelManifest, P as ProviderOverview, n as ResponseSchema, R as RunInput, o as RunResult, u as RunStream, U as UpdateResult, p as Usage, v as createFunnel, w as loadManifest } from './funnel-BZBIXenY.js';
 
 /** Throws FunnelError("invalid-selection") when the selection asks for something the provider cannot do. */
 declare function validateSelection(selection: Selection, provider: Provider, models?: ModelInfo[]): void;

package/dist/index.js

@@ -4,11 +4,11 @@ import {
   createFunnel,
   loadManifest,
   validateSelection
-} from "./chunk-2FZ64BNF.js";
+} from "./chunk-CJLAAJHT.js";
 import {
   ACCESS_LEVELS,
   FunnelError
-} from "./chunk-YP5V5YEE.js";
+} from "./chunk-KMG3CM2J.js";
 export {
   ACCESS_LEVELS,
   FunnelError,

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { d as AccessLevel, n as Funnel } from '../funnel-CoOj5wr1.js';
+import { d as AccessLevel, q as Funnel } from '../funnel-BZBIXenY.js';
 import { Server } from 'node:http';
 
 interface OpenAIDefaults {

package/dist/server/index.js

@@ -1,8 +1,8 @@
 import {
   createHandler,
   serveNode
-} from "../chunk-GF7JASHO.js";
-import "../chunk-YP5V5YEE.js";
+} from "../chunk-TBSSPWZE.js";
+import "../chunk-KMG3CM2J.js";
 export {
   createHandler,
   serveNode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli-funnel",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Use Claude Code, Codex, Cursor Agent and Antigravity CLIs like an API, on your subscription.",
   "license": "MIT",
   "type": "module",