crosscheck-mcp 0.2.29 → 0.2.30

package/dist/embed.d.cts

@@ -1,4 +1,5 @@
-import { C as ChatMessage } from './types-BcprisDl.cjs';
+import { C as ChatMessage, I as ImagePart, S as SendArgs } from './types-HA3W47O4.cjs';
+export { a as IMAGE_MEDIA_TYPES } from './types-HA3W47O4.cjs';
 
 /**
  * A record of which engine processes are alive, and what they are RUNNING.
@@ -98,6 +99,30 @@ declare const DEFAULT_FALLBACKS: Readonly<Record<string, readonly string[]>>;
  */
 declare const DEFAULT_EXCLUDED_PROVIDERS: readonly string[];
 
+/**
+ * The super lineup, as ORDERED CHAINS: index 0 is the model we want, the rest
+ * are fallbacks tried only on a model-access failure (never on auth, rate
+ * limit, or a 500 — a different model doesn't fix a bad key).
+ *
+ * Chains rather than single ids for one specific reason: it lets us name a
+ * model that hasn't shipped yet. `gpt-6-astra` is not in OpenAI's model list
+ * as of 2026-09-04 — verified against the live endpoint, no `gpt-6*` exists —
+ * so it 404s today and the chain silently serves gpt-5.6 instead. The day
+ * Astra becomes available it starts being used with no release on our side.
+ *
+ * The cost of that convenience, stated plainly: until Astra ships, an OpenAI
+ * seat in super mode pays one extra failed round trip per process per 5
+ * minutes (dead-models.ts caches the 404 for that long). A model-not-found is
+ * an immediate error rather than a timeout, so it's a few hundred ms, not a
+ * hang. If that ever becomes annoying, drop "gpt-6-astra" from the chain —
+ * nothing else depends on it.
+ *
+ * anthropic stays FIRST: resolveProviders preserves key order into `selected`,
+ * and debate's moderator / coordinate's proposer default to `selected[0]`.
+ * Reordering this object silently moves those seats to another provider.
+ */
+declare const SUPER_MODELS: Readonly<Record<string, readonly string[]>>;
+
 /**
  * Embedded host entrypoint — the API Crosscheck Desktop runs panels through.
  *
@@ -259,6 +284,14 @@ type EngineEvent =
 /** How much of each model reply an activity event carries. Enough to read
  *  the back-and-forth; the full text is in the envelope. */
 declare const ACTIVITY_TEXT_CAP = 8000;
+/** Providers whose models can see images (vault ids). Everyone else is told
+ *  an image exists that it can't see, rather than being sent one it would
+ *  reject — or silently answering as if there were none. */
+declare const VISION_PROVIDERS: readonly string[];
+declare const MAX_RUN_IMAGES = 8;
+/** Put the run's images on the newest user message — or, for a provider
+ *  that can't see images, a plain note saying they exist. */
+declare function withRunImages(args: SendArgs, provider: string, images: readonly ImagePart[] | undefined): SendArgs;
 type EngineEventSink = (event: EngineEvent) => void;
 interface EmbeddedEngineOptions {
     /** Vault provider id → raw API key. Only providers present here are built.
@@ -267,6 +300,9 @@ interface EmbeddedEngineOptions {
     /** Vault provider id → pinned model. Omit a provider to take the engine
      *  default. Mirrors what `/account/models` and `crosscheck models set` do. */
     models?: Readonly<Record<string, string>>;
+    /** Vault provider id → pinned SUPER-tier model (what `confer super` uses).
+     *  Omit a provider to take the engine's super lineup (SUPER_MODELS). */
+    superModels?: Readonly<Record<string, string>>;
     /** Default moderator/synthesis provider. */
     moderator?: string;
     /** Explicit pricing.json path. Defaults to the copy bundled in `dist/`. */
@@ -278,6 +314,10 @@ interface RunOptions {
     /** Stop waiting on any single model call after this long (ms). The run
      *  continues with the answers already in. Off when 0/undefined. */
     callTimeoutMs?: number;
+    /** Images for this run (base64, png/jpeg/webp/gif; at most 8). Sent with
+     *  the question to every provider that can see images; the others are
+     *  told they exist. Embed-only — the MCP tools don't take images. */
+    images?: ImagePart[];
 }
 interface AskOptions {
     /** Vault id ("grok", not "xai"). Must be a provider this engine built. */
@@ -351,4 +391,4 @@ declare const __test_internals: {
     vaultId: typeof vaultId;
 };
 
-export { ACTIVITY_TEXT_CAP, type AskOptions, type AskResult, DEFAULT_EXCLUDED_PROVIDERS, DEFAULT_FALLBACKS, DEFAULT_MODELS, type EmbeddedEngine, type EmbeddedEngineOptions, type EngineEvent, type EngineEventSink, type EventUsage, type ProcRecord, type ProcStatus, type RunOptions, KEY_ENV as __KEY_ENV, MODEL_ENV as __MODEL_ENV, __test_internals, createEmbeddedEngine, isAlive, listProcesses, processRegistryPath };
+export { ACTIVITY_TEXT_CAP, type AskOptions, type AskResult, DEFAULT_EXCLUDED_PROVIDERS, DEFAULT_FALLBACKS, DEFAULT_MODELS, type EmbeddedEngine, type EmbeddedEngineOptions, type EngineEvent, type EngineEventSink, type EventUsage, ImagePart, MAX_RUN_IMAGES, type ProcRecord, type ProcStatus, type RunOptions, SUPER_MODELS, VISION_PROVIDERS, KEY_ENV as __KEY_ENV, MODEL_ENV as __MODEL_ENV, __test_internals, createEmbeddedEngine, isAlive, listProcesses, processRegistryPath, withRunImages };

package/dist/embed.d.ts

@@ -1,4 +1,5 @@
-import { C as ChatMessage } from './types-BcprisDl.js';
+import { C as ChatMessage, I as ImagePart, S as SendArgs } from './types-HA3W47O4.js';
+export { a as IMAGE_MEDIA_TYPES } from './types-HA3W47O4.js';
 
 /**
  * A record of which engine processes are alive, and what they are RUNNING.
@@ -98,6 +99,30 @@ declare const DEFAULT_FALLBACKS: Readonly<Record<string, readonly string[]>>;
  */
 declare const DEFAULT_EXCLUDED_PROVIDERS: readonly string[];
 
+/**
+ * The super lineup, as ORDERED CHAINS: index 0 is the model we want, the rest
+ * are fallbacks tried only on a model-access failure (never on auth, rate
+ * limit, or a 500 — a different model doesn't fix a bad key).
+ *
+ * Chains rather than single ids for one specific reason: it lets us name a
+ * model that hasn't shipped yet. `gpt-6-astra` is not in OpenAI's model list
+ * as of 2026-09-04 — verified against the live endpoint, no `gpt-6*` exists —
+ * so it 404s today and the chain silently serves gpt-5.6 instead. The day
+ * Astra becomes available it starts being used with no release on our side.
+ *
+ * The cost of that convenience, stated plainly: until Astra ships, an OpenAI
+ * seat in super mode pays one extra failed round trip per process per 5
+ * minutes (dead-models.ts caches the 404 for that long). A model-not-found is
+ * an immediate error rather than a timeout, so it's a few hundred ms, not a
+ * hang. If that ever becomes annoying, drop "gpt-6-astra" from the chain —
+ * nothing else depends on it.
+ *
+ * anthropic stays FIRST: resolveProviders preserves key order into `selected`,
+ * and debate's moderator / coordinate's proposer default to `selected[0]`.
+ * Reordering this object silently moves those seats to another provider.
+ */
+declare const SUPER_MODELS: Readonly<Record<string, readonly string[]>>;
+
 /**
  * Embedded host entrypoint — the API Crosscheck Desktop runs panels through.
  *
@@ -259,6 +284,14 @@ type EngineEvent =
 /** How much of each model reply an activity event carries. Enough to read
  *  the back-and-forth; the full text is in the envelope. */
 declare const ACTIVITY_TEXT_CAP = 8000;
+/** Providers whose models can see images (vault ids). Everyone else is told
+ *  an image exists that it can't see, rather than being sent one it would
+ *  reject — or silently answering as if there were none. */
+declare const VISION_PROVIDERS: readonly string[];
+declare const MAX_RUN_IMAGES = 8;
+/** Put the run's images on the newest user message — or, for a provider
+ *  that can't see images, a plain note saying they exist. */
+declare function withRunImages(args: SendArgs, provider: string, images: readonly ImagePart[] | undefined): SendArgs;
 type EngineEventSink = (event: EngineEvent) => void;
 interface EmbeddedEngineOptions {
     /** Vault provider id → raw API key. Only providers present here are built.
@@ -267,6 +300,9 @@ interface EmbeddedEngineOptions {
     /** Vault provider id → pinned model. Omit a provider to take the engine
      *  default. Mirrors what `/account/models` and `crosscheck models set` do. */
     models?: Readonly<Record<string, string>>;
+    /** Vault provider id → pinned SUPER-tier model (what `confer super` uses).
+     *  Omit a provider to take the engine's super lineup (SUPER_MODELS). */
+    superModels?: Readonly<Record<string, string>>;
     /** Default moderator/synthesis provider. */
     moderator?: string;
     /** Explicit pricing.json path. Defaults to the copy bundled in `dist/`. */
@@ -278,6 +314,10 @@ interface RunOptions {
     /** Stop waiting on any single model call after this long (ms). The run
      *  continues with the answers already in. Off when 0/undefined. */
     callTimeoutMs?: number;
+    /** Images for this run (base64, png/jpeg/webp/gif; at most 8). Sent with
+     *  the question to every provider that can see images; the others are
+     *  told they exist. Embed-only — the MCP tools don't take images. */
+    images?: ImagePart[];
 }
 interface AskOptions {
     /** Vault id ("grok", not "xai"). Must be a provider this engine built. */
@@ -351,4 +391,4 @@ declare const __test_internals: {
     vaultId: typeof vaultId;
 };
 
-export { ACTIVITY_TEXT_CAP, type AskOptions, type AskResult, DEFAULT_EXCLUDED_PROVIDERS, DEFAULT_FALLBACKS, DEFAULT_MODELS, type EmbeddedEngine, type EmbeddedEngineOptions, type EngineEvent, type EngineEventSink, type EventUsage, type ProcRecord, type ProcStatus, type RunOptions, KEY_ENV as __KEY_ENV, MODEL_ENV as __MODEL_ENV, __test_internals, createEmbeddedEngine, isAlive, listProcesses, processRegistryPath };
+export { ACTIVITY_TEXT_CAP, type AskOptions, type AskResult, DEFAULT_EXCLUDED_PROVIDERS, DEFAULT_FALLBACKS, DEFAULT_MODELS, type EmbeddedEngine, type EmbeddedEngineOptions, type EngineEvent, type EngineEventSink, type EventUsage, ImagePart, MAX_RUN_IMAGES, type ProcRecord, type ProcStatus, type RunOptions, SUPER_MODELS, VISION_PROVIDERS, KEY_ENV as __KEY_ENV, MODEL_ENV as __MODEL_ENV, __test_internals, createEmbeddedEngine, isAlive, listProcesses, processRegistryPath, withRunImages };

package/dist/embed.js

@@ -7,7 +7,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/entrypoints/embed.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 import { existsSync as existsSync11 } from "fs";
 import path12 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -179,6 +179,11 @@ function reasoningSharesOutputBudget(provider) {
 }
 
 // src/providers/types.ts
+var IMAGE_MEDIA_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+function imagesOf(m) {
+  if (m.role !== "user" || !Array.isArray(m.images)) return [];
+  return m.images.filter((i) => Boolean(i) && typeof i.data === "string" && i.data.length > 0 && IMAGE_MEDIA_TYPES.includes(i.mediaType));
+}
 var ProviderError = class extends Error {
   name = "ProviderError";
   kind;
@@ -567,7 +572,12 @@ function buildAnthropicRequest(opts) {
       }
       continue;
     }
-    convo.push({ role: m.role, content: typeof m.content === "string" ? m.content : "" });
+    const text = typeof m.content === "string" ? m.content : "";
+    const images = imagesOf(m);
+    convo.push(images.length ? { role: m.role, content: [
+      ...images.map((i) => ({ type: "image", source: { type: "base64", media_type: i.mediaType, data: i.data } })),
+      { type: "text", text }
+    ] } : { role: m.role, content: text });
   }
   const body = {
     model: opts.model,
@@ -807,7 +817,10 @@ function buildGeminiRequest(opts) {
     const role = m.role === "user" ? "user" : "model";
     contents.push({
       role,
-      parts: [{ text: typeof m.content === "string" ? m.content : "" }]
+      parts: [
+        ...imagesOf(m).map((i) => ({ inline_data: { mime_type: i.mediaType, data: i.data } })),
+        { text: typeof m.content === "string" ? m.content : "" }
+      ]
     });
   }
   const body = {
@@ -975,10 +988,11 @@ function supportsNativeJsonSchema(provider, model) {
   return true;
 }
 function buildOpenAICompatibleRequest(opts) {
-  const msgs = opts.messages.map((m) => ({
-    role: m.role,
-    content: typeof m.content === "string" ? m.content : ""
-  }));
+  const msgs = opts.messages.map((m) => {
+    const text = typeof m.content === "string" ? m.content : "";
+    const images = imagesOf(m);
+    return images.length ? { role: m.role, content: [{ type: "text", text }, ...images.map((i) => ({ type: "image_url", image_url: { url: `data:${i.mediaType};base64,${i.data}` } }))] } : { role: m.role, content: text };
+  });
   const body = {
     model: opts.model,
     messages: msgs
@@ -1291,7 +1305,7 @@ import { z } from "zod";
 
 // src/server-meta.ts
 var SERVER_NAME = "crosscheck-agent";
-var SERVER_VERSION = true ? "0.2.29" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.2.30" : "0.0.0-dev";
 
 // src/tools/audit.ts
 import { readdirSync, readFileSync as readFileSync3, statSync } from "fs";
@@ -4255,6 +4269,7 @@ async function pickAutoPanel(storage, purpose, n, providers, allowlist) {
 }
 
 // src/core/super-mode.ts
+import { AsyncLocalStorage } from "async_hooks";
 var SUPER_MODELS = {
   // Fable 5.1 verified present on the account; 5 as the fallback for accounts
   // that haven't been granted 5.1 yet.
@@ -4297,7 +4312,12 @@ function parseChain(v) {
   }
   return out;
 }
-function superChainFor(provider, env = process.env) {
+var superEnvStore = new AsyncLocalStorage();
+function withSuperEnv(env, fn) {
+  return superEnvStore.run(env, fn);
+}
+var currentEnv = () => superEnvStore.getStore() ?? process.env;
+function superChainFor(provider, env = currentEnv()) {
   const varName = SUPER_ENV_VARS[provider];
   const user = varName ? parseChain(env[varName]) : [];
   if (user.length > 0) {
@@ -4306,14 +4326,14 @@ function superChainFor(provider, env = process.env) {
   }
   return SUPER_MODELS[provider] ?? [];
 }
-function superPrimary(provider, env = process.env) {
+function superPrimary(provider, env = currentEnv()) {
   return superChainFor(provider, env)[0];
 }
 var SUPER_PROVIDER_NAMES = Object.keys(SUPER_MODELS);
 function isSuperRequested(args) {
   return args["super"] === true;
 }
-function retargetForSuper(p, env = process.env) {
+function retargetForSuper(p, env = currentEnv()) {
   const chain = superChainFor(p.name, env);
   if (chain.length === 0) return p;
   const [primary, ...fallbacks] = chain;
@@ -6391,9 +6411,9 @@ import path6 from "path";
 import { performance as performance7 } from "perf_hooks";
 
 // src/core/progress.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import { performance as performance6 } from "perf_hooks";
-var progressStorage = new AsyncLocalStorage();
+var progressStorage = new AsyncLocalStorage2();
 async function withProgress(token, sendNotification, fn) {
   if (token === void 0 || token === null) {
     return fn();
@@ -11674,7 +11694,7 @@ var CHECK_INTERVAL_SECONDS = 3 * 24 * 60 * 60;
 var DEFAULT_PACKAGE = "crosscheck-cli";
 var FETCH_TIMEOUT_MS = 3e3;
 function engineVersion() {
-  return true ? "0.2.29" : "0.0.0-dev";
+  return true ? "0.2.30" : "0.0.0-dev";
 }
 function defaultUpdateCachePath() {
   const base = process.env["CROSSCHECK_DATA_DIR"] || path9.join(os.homedir() || os.tmpdir(), ".crosscheck");
@@ -13467,7 +13487,33 @@ function vaultId(engineName) {
 }
 var ACTIVITY_TEXT_CAP = 8e3;
 var ASKED_CAP = 280;
-var runContext = new AsyncLocalStorage2();
+var VISION_PROVIDERS = ["anthropic", "openai", "gemini", "grok"];
+var NO_IMAGE_PURPOSES = /* @__PURE__ */ new Set(["early_stop", "extract", "canary", "classify"]);
+var MAX_RUN_IMAGES = 8;
+function withRunImages(args, provider, images) {
+  if (!images?.length || NO_IMAGE_PURPOSES.has(args.purpose ?? "")) return args;
+  const msgs = [...args.messages];
+  let idx = -1;
+  for (let i = msgs.length - 1; i >= 0; i--) if (msgs[i]?.role === "user") {
+    idx = i;
+    break;
+  }
+  if (idx < 0) return args;
+  const m = msgs[idx];
+  if (VISION_PROVIDERS.includes(provider)) {
+    msgs[idx] = { ...m, images: [...m.images ?? [], ...images] };
+  } else {
+    const n = images.length;
+    msgs[idx] = {
+      ...m,
+      content: `${m.content}
+
+[The user also attached ${n} image${n === 1 ? "" : "s"} that this model can't see. Don't guess at ${n === 1 ? "its" : "their"} contents \u2014 work from the text, and say so if the answer depends on ${n === 1 ? "it" : "them"}.]`
+    };
+  }
+  return { ...args, messages: msgs };
+}
+var runContext = new AsyncLocalStorage3();
 var SYNTHESIS_PURPOSES = /* @__PURE__ */ new Set(["synth", "moderator", "recombine", "judge", "unify"]);
 function exemptFromSkip(ctx, provider, purpose) {
   return provider === ctx.moderator && SYNTHESIS_PURPOSES.has(purpose);
@@ -13522,7 +13568,7 @@ function withActivity(p) {
         if (!stopped && controller.signal.reason === "skip") stopped = "user";
       }, { once: true });
       try {
-        const res = await send({ ...args, signal: controller.signal });
+        const res = await send({ ...withRunImages(args, provider, ctx.images), signal: controller.signal });
         const text = typeof res.text === "string" ? res.text : "";
         ctx.emit({
           type: "call.done",
@@ -13617,6 +13663,12 @@ function createEmbeddedEngine(opts) {
     const varName = MODEL_ENV[provider.trim().toLowerCase()];
     if (varName && model) env[varName] = model;
   }
+  const superEnv = {};
+  for (const [provider, model] of Object.entries(opts.superModels ?? {})) {
+    const p = provider.trim().toLowerCase();
+    const varName = SUPER_ENV_VARS[p === "grok" ? "xai" : p];
+    if (varName && model) superEnv[varName] = model;
+  }
   const pricingPath = [opts.pricingPath, bundledPricingPath()].find(
     (p) => Boolean(p) && existsSync11(p)
   );
@@ -13657,13 +13709,14 @@ function createEmbeddedEngine(opts) {
       skipped: /* @__PURE__ */ new Set(),
       inflight: /* @__PURE__ */ new Map(),
       moderator: vaultId(moderator),
-      ...runOpts.callTimeoutMs && runOpts.callTimeoutMs > 0 ? { callTimeoutMs: runOpts.callTimeoutMs } : {}
+      ...runOpts.callTimeoutMs && runOpts.callTimeoutMs > 0 ? { callTimeoutMs: runOpts.callTimeoutMs } : {},
+      ...runOpts.images?.length ? { images: runOpts.images.filter((i) => IMAGE_MEDIA_TYPES.includes(i.mediaType) && typeof i.data === "string" && i.data.length > 0).slice(0, MAX_RUN_IMAGES) } : {}
     };
     liveRuns.set(runId, ctx);
     try {
       return await runContext.run(ctx, () => withProgress(runId, (n) => {
         if (n.params.message) emit({ type: "progress", runId, at: Date.now(), message: n.params.message });
-      }, () => runInner(name, args, runId, started, emit)));
+      }, () => withSuperEnv(superEnv, () => runInner(name, args, runId, started, emit))));
     } finally {
       liveRuns.delete(runId);
     }
@@ -13821,12 +13874,17 @@ export {
   DEFAULT_EXCLUDED_PROVIDERS,
   DEFAULT_FALLBACKS,
   DEFAULT_MODELS,
+  IMAGE_MEDIA_TYPES,
+  MAX_RUN_IMAGES,
+  SUPER_MODELS,
+  VISION_PROVIDERS,
   KEY_ENV as __KEY_ENV,
   MODEL_ENV as __MODEL_ENV,
   __test_internals,
   createEmbeddedEngine,
   isAlive,
   listProcesses,
-  processRegistryPath
+  processRegistryPath,
+  withRunImages
 };
 //# sourceMappingURL=embed.js.map