ima2-gen 1.1.10 → 1.1.11

package/README.md

@@ -53,7 +53,7 @@ persists, reboot and run the update before starting ima2 again.
 - **Node mode**: branch a good image into multiple directions without losing the original.
 - **Multimode batches**: launch several Classic outputs from one prompt, watch slot-by-slot progress, and continue from the best result.
 - **Canvas Mode**: zoom, pan, annotate, erase, clean backgrounds, keep transparent previews, and export either alpha or matte-backed versions.
-- **Local gallery**: keep generated assets on your machine with session-aware history.
+- **Local gallery**: keep generated assets on your machine with session-aware history. By default the gallery shows the current session and an All Images toggle reveals the full history; the default scope is sticky across sessions.
 - **Reference images**: drag, drop, paste, and attach up to 5 references; large images are compressed before upload.
 - **Prompt library imports**: import local prompt packs, GitHub folders, and curated GPT-image prompt hints into the built-in prompt library.
 - **Mobile shell**: use the app bar, compose sheet, and compact settings toggle on smaller screens.
@@ -196,6 +196,11 @@ environment variables > ~/.ima2/config.json > built-in defaults
 | `IMA2_LOG_LEVEL` | `warn` | Normal serve defaults to `warn`; dev mode defaults to `debug`; supports `debug`, `info`, `warn`, `error`, or `silent` |
 | `IMA2_INFLIGHT_TERMINAL_TTL_MS` | `30000` | Recent terminal job retention for debug views |
 | `OPENAI_API_KEY` | — | API key for the `provider: "api"` Responses API image path and auxiliary API-key features |
+| `IMA2_API_IMAGE_MODEL_DEFAULT` | `gpt-5.4-mini` | Default image model for `provider: "api"` |
+| `IMA2_API_REASONING_EFFORT` | `low` | Default reasoning effort for `provider: "api"` |
+| `IMA2_API_IMAGE_SIZE` | `1024x1024` | Default size for `provider: "api"` |
+| `IMA2_API_ALLOW_WEB_SEARCH` | `true` | Toggle web search for `provider: "api"` |
+| `IMA2_OAUTH_MASKED_EDIT_ENABLED` | `false` | Opt-in feature flag for masked-edit requests on the OAuth path (#31, groundwork only) |
 
 ### Logging modes
 

package/bin/commands/capabilities.js

@@ -0,0 +1,90 @@
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { config } from "../../config.js";
+import { buildIma2Capabilities } from "../../lib/capabilities.js";
+import { parseArgs } from "../lib/args.js";
+import { resolveServer, request } from "../lib/client.js";
+import { color, dieWithError, json, out } from "../lib/output.js";
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const PACKAGE_PATH = join(ROOT, "package.json");
+const HELP = `
+  ima2 capabilities [--json] [--server <url>] [--require-server]
+
+  Print agent-friendly capability metadata.
+
+  Options:
+    --json             Print JSON
+    --server <url>     Query a specific running server
+    --require-server   Fail instead of falling back to local package metadata
+`;
+const FLAGS = {
+    json: { type: "boolean" },
+    server: { type: "string" },
+    "require-server": { type: "boolean" },
+    help: { short: "h", type: "boolean" },
+};
+function packageVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(PACKAGE_PATH, "utf-8"));
+        return pkg.version || "?";
+    }
+    catch {
+        return "?";
+    }
+}
+function localCapabilities() {
+    return buildIma2Capabilities({
+        appConfig: config,
+        packageVersion: packageVersion(),
+        source: "local",
+        server: null,
+    });
+}
+async function readCapabilities(args) {
+    try {
+        const server = await resolveServer({ serverFlag: args.server });
+        return await request(server.base, "/api/capabilities", { timeoutMs: 5000 });
+    }
+    catch (error) {
+        if (args.server || args["require-server"])
+            throw error;
+        return localCapabilities();
+    }
+}
+function printText(capabilities) {
+    out(`ima2 capabilities (${capabilities.source})`);
+    out(`version: ${capabilities.version}`);
+    out(`server: ${capabilities.server || "none"}`);
+    out("");
+    out("defaults:");
+    out(`  oauth model: ${capabilities.defaults?.oauth?.model}`);
+    out(`  oauth reasoning: ${capabilities.defaults?.oauth?.reasoningEffort}`);
+    out(`  api model: ${capabilities.defaults?.api?.model}`);
+    out(`  api reasoning: ${capabilities.defaults?.api?.reasoningEffort}`);
+    out("");
+    out("valid:");
+    out(`  models: ${capabilities.valid?.imageModels?.supported?.join(", ")}`);
+    out(`  reasoning: ${capabilities.valid?.reasoningEfforts?.join(", ")}`);
+    out(`  quality: ${capabilities.valid?.quality?.join(", ")}`);
+    out("");
+    out(`limits: refs=${capabilities.limits?.maxRefCount}, images=${capabilities.limits?.maxGeneratedImages}`);
+    out(color.dim(`maxParallel: ${capabilities.limits?.maxParallel?.value} (${capabilities.limits?.maxParallel?.note})`));
+}
+export default async function capabilitiesCmd(argv) {
+    const args = parseArgs(argv, { flags: FLAGS });
+    if (args.help) {
+        out(HELP);
+        return;
+    }
+    try {
+        const capabilities = await readCapabilities(args);
+        if (args.json)
+            json(capabilities);
+        else
+            printText(capabilities);
+    }
+    catch (error) {
+        dieWithError(error);
+    }
+}

package/bin/commands/capabilities.ts

@@ -0,0 +1,93 @@
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { config } from "../../config.js";
+import { buildIma2Capabilities } from "../../lib/capabilities.js";
+import { parseArgs } from "../lib/args.js";
+import { resolveServer, request } from "../lib/client.js";
+import { color, dieWithError, json, out } from "../lib/output.js";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const PACKAGE_PATH = join(ROOT, "package.json");
+
+const HELP = `
+  ima2 capabilities [--json] [--server <url>] [--require-server]
+
+  Print agent-friendly capability metadata.
+
+  Options:
+    --json             Print JSON
+    --server <url>     Query a specific running server
+    --require-server   Fail instead of falling back to local package metadata
+`;
+
+const FLAGS = {
+  json: { type: "boolean" },
+  server: { type: "string" },
+  "require-server": { type: "boolean" },
+  help: { short: "h", type: "boolean" },
+};
+
+function packageVersion(): string {
+  try {
+    const pkg = JSON.parse(readFileSync(PACKAGE_PATH, "utf-8")) as { version?: string };
+    return pkg.version || "?";
+  } catch {
+    return "?";
+  }
+}
+
+function localCapabilities() {
+  return buildIma2Capabilities({
+    appConfig: config,
+    packageVersion: packageVersion(),
+    source: "local",
+    server: null,
+  });
+}
+
+async function readCapabilities(args: ReturnType<typeof parseArgs>) {
+  try {
+    const server = await resolveServer({ serverFlag: args.server });
+    return await request(server.base, "/api/capabilities", { timeoutMs: 5000 });
+  } catch (error) {
+    if (args.server || args["require-server"]) throw error;
+    return localCapabilities();
+  }
+}
+
+function printText(capabilities: any): void {
+  out(`ima2 capabilities (${capabilities.source})`);
+  out(`version: ${capabilities.version}`);
+  out(`server: ${capabilities.server || "none"}`);
+  out("");
+  out("defaults:");
+  out(`  oauth model: ${capabilities.defaults?.oauth?.model}`);
+  out(`  oauth reasoning: ${capabilities.defaults?.oauth?.reasoningEffort}`);
+  out(`  api model: ${capabilities.defaults?.api?.model}`);
+  out(`  api reasoning: ${capabilities.defaults?.api?.reasoningEffort}`);
+  out("");
+  out("valid:");
+  out(`  models: ${capabilities.valid?.imageModels?.supported?.join(", ")}`);
+  out(`  reasoning: ${capabilities.valid?.reasoningEfforts?.join(", ")}`);
+  out(`  quality: ${capabilities.valid?.quality?.join(", ")}`);
+  out("");
+  out(`limits: refs=${capabilities.limits?.maxRefCount}, images=${capabilities.limits?.maxGeneratedImages}`);
+  out(color.dim(`maxParallel: ${capabilities.limits?.maxParallel?.value} (${capabilities.limits?.maxParallel?.note})`));
+}
+
+export default async function capabilitiesCmd(argv: string[]) {
+  const args = parseArgs(argv, { flags: FLAGS });
+  if (args.help) {
+    out(HELP);
+    return;
+  }
+
+  try {
+    const capabilities = await readCapabilities(args);
+    if (args.json) json(capabilities);
+    else printText(capabilities);
+  } catch (error) {
+    dieWithError(error);
+  }
+}

package/bin/commands/config.js

@@ -1,10 +1,7 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
 import { createInterface } from "readline/promises";
 import { parseArgs } from "../lib/args.js";
 import { out, die, color, json } from "../lib/output.js";
-import { config as runtimeConfig } from "../../config.js";
-const CONFIG_FILE = runtimeConfig.storage.configFile;
-const CONFIG_DIR = runtimeConfig.storage.configDir;
+import { CONFIG_FILE, buildEffectiveConfig, deleteNestedKey, displayPath, envOverrideForKey, getNestedKey, isAuthConfigKey, isSensitiveConfigKey, isWritableConfigKey, loadFileCfg, parseConfigValue, redactValue, restartNotice, saveFileCfg, setNestedKey, } from "../lib/config-store.js";
 const HELP = `
   ima2 config <subcommand> [options]
 
@@ -28,130 +25,6 @@ const FLAGS = {
     yes: { short: "y", type: "boolean" },
     help: { short: "h", type: "boolean" },
 };
-// Keys config set is allowed to write
-const KNOWN_KEYS = new Set([
-    "imageModels.default",
-    "imageModels.reasoningEffort",
-    "log.level",
-    "features.cardNews",
-    "cardNewsPlanner.enabled",
-    "cardNewsPlanner.model",
-    "cardNewsPlanner.timeoutMs",
-    "cardNewsPlanner.deterministicFallback",
-    "comfy.defaultUrl",
-    "comfy.uploadTimeoutMs",
-    "comfy.maxUploadBytes",
-    "storage.generatedDir",
-    "storage.generatedDirName",
-    "server.port",
-    "server.host",
-    "server.bodyLimit",
-    "oauth.proxyPort",
-    "oauth.statusTimeoutMs",
-    "oauth.restartDelayMs",
-    "limits.maxRefCount",
-    "limits.maxParallel",
-    "history.defaultPageSize",
-    "history.maxPageCap",
-]);
-// Auth keys live in the same file but must go through setup/login
-const AUTH_KEYS = new Set(["provider", "apiKey"]);
-const REDACT_PATTERN = /token|secret|apikey|password/i;
-const ALWAYS_REDACT = new Set(["provider", "apiKey", "oauth.token", "oauth.refreshToken"]);
-// Env var that overrides each writable key
-const KEY_TO_ENV = {
-    "imageModels.default": "IMA2_IMAGE_MODEL_DEFAULT",
-    "imageModels.reasoningEffort": "IMA2_REASONING_EFFORT",
-    "log.level": "IMA2_LOG_LEVEL",
-    "features.cardNews": "IMA2_CARD_NEWS",
-    "server.port": "IMA2_PORT",
-    "server.host": "IMA2_HOST",
-    "server.bodyLimit": "IMA2_BODY_LIMIT",
-    "oauth.proxyPort": "IMA2_OAUTH_PROXY_PORT",
-    "storage.generatedDir": "IMA2_GENERATED_DIR",
-    "cardNewsPlanner.enabled": "IMA2_CARD_NEWS_PLANNER",
-    "cardNewsPlanner.model": "IMA2_CARD_NEWS_PLANNER_MODEL",
-    "cardNewsPlanner.timeoutMs": "IMA2_CARD_NEWS_PLANNER_TIMEOUT_MS",
-    "limits.maxParallel": "IMA2_MAX_PARALLEL",
-    "limits.maxRefCount": "IMA2_MAX_REF_COUNT",
-    "history.defaultPageSize": "IMA2_HISTORY_PAGE_SIZE",
-};
-function redactValue(key, value) {
-    if (ALWAYS_REDACT.has(key) || REDACT_PATTERN.test(key)) {
-        return value ? "<redacted>" : value;
-    }
-    return value;
-}
-function loadFileCfg() {
-    if (!existsSync(CONFIG_FILE))
-        return {};
-    try {
-        return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
-    }
-    catch {
-        return {};
-    }
-}
-function saveFileCfg(cfg) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2));
-}
-function getNestedKey(obj, dotKey) {
-    const parts = dotKey.split(".");
-    let cur = obj;
-    for (const p of parts) {
-        if (cur == null || typeof cur !== "object")
-            return undefined;
-        cur = cur[p];
-    }
-    return cur;
-}
-function setNestedKey(obj, dotKey, value) {
-    const parts = dotKey.split(".");
-    let cur = obj;
-    for (let i = 0; i < parts.length - 1; i++) {
-        if (cur[parts[i]] == null || typeof cur[parts[i]] !== "object")
-            cur[parts[i]] = {};
-        cur = cur[parts[i]];
-    }
-    cur[parts[parts.length - 1]] = value;
-}
-function deleteNestedKey(obj, dotKey) {
-    const parts = dotKey.split(".");
-    let cur = obj;
-    for (let i = 0; i < parts.length - 1; i++) {
-        if (cur == null || typeof cur !== "object")
-            return false;
-        cur = cur[parts[i]];
-    }
-    if (cur == null || typeof cur !== "object")
-        return false;
-    const last = parts[parts.length - 1];
-    if (!(last in cur))
-        return false;
-    delete cur[last];
-    return true;
-}
-function stripSets(v) {
-    if (v instanceof Set)
-        return [...v];
-    if (Array.isArray(v))
-        return v.map(stripSets);
-    if (v && typeof v === "object") {
-        const r = {};
-        for (const [k, val] of Object.entries(v))
-            r[k] = stripSets(val);
-        return r;
-    }
-    return v;
-}
-function buildEffectiveConfig() {
-    return stripSets(runtimeConfig);
-}
-function displayPath(p) {
-    const home = process.env.HOME || "";
-    return home && p.startsWith(home) ? p.replace(home, "~") : p;
-}
 async function pathSub(_argv) {
     out(CONFIG_FILE);
 }
@@ -198,26 +71,21 @@ async function setSub(argv) {
     const [key, rawValue] = args.positional;
     if (!key || rawValue === undefined)
         die(2, "usage: config set <key> <value>");
-    if (AUTH_KEYS.has(key)) {
+    if (isAuthConfigKey(key)) {
         die(2, `"${key}" is an auth key. Use 'ima2 setup' or 'ima2 login' to change authentication.`);
     }
-    if (!KNOWN_KEYS.has(key)) {
+    if (!isWritableConfigKey(key)) {
         die(2, `unknown config key: "${key}". Run 'ima2 config ls --effective' to see the config structure.`);
     }
-    // Parse value: try JSON, fall back to raw string
-    let value = rawValue;
-    try {
-        value = JSON.parse(rawValue);
-    }
-    catch { }
+    const value = parseConfigValue(rawValue);
     // Warn if env var is overriding this key
-    const envVar = KEY_TO_ENV[key];
-    if (envVar && process.env[envVar] !== undefined) {
-        out(color.yellow(`warning: env ${envVar}=${process.env[envVar]} is currently overriding this value.`));
+    const override = envOverrideForKey(key);
+    if (override) {
+        out(color.yellow(`warning: env ${override.envVar}=${override.value} is currently overriding this value.`));
         out(`The file change will only apply after unsetting the env var and restarting the server.`);
     }
     // Confirm if writing a sensitive key
-    if ((ALWAYS_REDACT.has(key) || REDACT_PATTERN.test(key)) && !args.yes) {
+    if (isSensitiveConfigKey(key) && !args.yes) {
         const rl = createInterface({ input: process.stdin, output: process.stdout });
         const ans = await rl.question(`warning: "${key}" is a sensitive credential. Write to config file? [y/N] `);
         rl.close();
@@ -230,14 +98,14 @@ async function setSub(argv) {
     setNestedKey(fileCfg, key, value);
     saveFileCfg(fileCfg);
     out(color.green("✓ ") + `wrote ${key}=${JSON.stringify(value)} to ${displayPath(CONFIG_FILE)}`);
-    out(color.dim("note: server must be restarted to pick up config changes (run `ima2 serve`)"));
+    out(color.dim(restartNotice()));
 }
 async function rmSub(argv) {
     const args = parseArgs(argv, { flags: FLAGS });
     const key = args.positional[0];
     if (!key)
         die(2, "key required. Usage: config rm <key>");
-    if (AUTH_KEYS.has(key)) {
+    if (isAuthConfigKey(key)) {
         die(2, `"${key}" is an auth key. Use 'ima2 setup' or 'ima2 login' to change authentication.`);
     }
     const fileCfg = loadFileCfg();
@@ -248,7 +116,7 @@ async function rmSub(argv) {
     }
     saveFileCfg(fileCfg);
     out(color.green("✓ ") + `removed ${key} from ${displayPath(CONFIG_FILE)}`);
-    out(color.dim("note: server must be restarted to pick up config changes (run `ima2 serve`)"));
+    out(color.dim(restartNotice()));
 }
 const SUB = {
     path: pathSub,

package/bin/commands/config.ts

@@ -1,11 +1,23 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
 import { createInterface } from "readline/promises";
 import { parseArgs } from "../lib/args.js";
 import { out, die, color, json } from "../lib/output.js";
-import { config as runtimeConfig } from "../../config.js";
-
-const CONFIG_FILE = runtimeConfig.storage.configFile;
-const CONFIG_DIR  = runtimeConfig.storage.configDir;
+import {
+  CONFIG_FILE,
+  buildEffectiveConfig,
+  deleteNestedKey,
+  displayPath,
+  envOverrideForKey,
+  getNestedKey,
+  isAuthConfigKey,
+  isSensitiveConfigKey,
+  isWritableConfigKey,
+  loadFileCfg,
+  parseConfigValue,
+  redactValue,
+  restartNotice,
+  saveFileCfg,
+  setNestedKey,
+} from "../lib/config-store.js";
 
 const HELP = `
   ima2 config <subcommand> [options]
@@ -32,130 +44,6 @@ const FLAGS = {
   help:      { short: "h", type: "boolean" },
 };
 
-// Keys config set is allowed to write
-const KNOWN_KEYS = new Set([
-  "imageModels.default",
-  "imageModels.reasoningEffort",
-  "log.level",
-  "features.cardNews",
-  "cardNewsPlanner.enabled",
-  "cardNewsPlanner.model",
-  "cardNewsPlanner.timeoutMs",
-  "cardNewsPlanner.deterministicFallback",
-  "comfy.defaultUrl",
-  "comfy.uploadTimeoutMs",
-  "comfy.maxUploadBytes",
-  "storage.generatedDir",
-  "storage.generatedDirName",
-  "server.port",
-  "server.host",
-  "server.bodyLimit",
-  "oauth.proxyPort",
-  "oauth.statusTimeoutMs",
-  "oauth.restartDelayMs",
-  "limits.maxRefCount",
-  "limits.maxParallel",
-  "history.defaultPageSize",
-  "history.maxPageCap",
-]);
-
-// Auth keys live in the same file but must go through setup/login
-const AUTH_KEYS = new Set(["provider", "apiKey"]);
-
-const REDACT_PATTERN = /token|secret|apikey|password/i;
-const ALWAYS_REDACT  = new Set(["provider", "apiKey", "oauth.token", "oauth.refreshToken"]);
-
-// Env var that overrides each writable key
-const KEY_TO_ENV: Record<string, string> = {
-  "imageModels.default":              "IMA2_IMAGE_MODEL_DEFAULT",
-  "imageModels.reasoningEffort":      "IMA2_REASONING_EFFORT",
-  "log.level":                        "IMA2_LOG_LEVEL",
-  "features.cardNews":                "IMA2_CARD_NEWS",
-  "server.port":                      "IMA2_PORT",
-  "server.host":                      "IMA2_HOST",
-  "server.bodyLimit":                 "IMA2_BODY_LIMIT",
-  "oauth.proxyPort":                  "IMA2_OAUTH_PROXY_PORT",
-  "storage.generatedDir":             "IMA2_GENERATED_DIR",
-  "cardNewsPlanner.enabled":          "IMA2_CARD_NEWS_PLANNER",
-  "cardNewsPlanner.model":            "IMA2_CARD_NEWS_PLANNER_MODEL",
-  "cardNewsPlanner.timeoutMs":        "IMA2_CARD_NEWS_PLANNER_TIMEOUT_MS",
-  "limits.maxParallel":               "IMA2_MAX_PARALLEL",
-  "limits.maxRefCount":               "IMA2_MAX_REF_COUNT",
-  "history.defaultPageSize":          "IMA2_HISTORY_PAGE_SIZE",
-};
-
-function redactValue(key: string, value: any): any {
-  if (ALWAYS_REDACT.has(key) || REDACT_PATTERN.test(key)) {
-    return value ? "<redacted>" : value;
-  }
-  return value;
-}
-
-function loadFileCfg(): Record<string, any> {
-  if (!existsSync(CONFIG_FILE)) return {};
-  try { return JSON.parse(readFileSync(CONFIG_FILE, "utf-8")); }
-  catch { return {}; }
-}
-
-function saveFileCfg(cfg: Record<string, any>) {
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2));
-}
-
-function getNestedKey(obj: any, dotKey: string): any {
-  const parts = dotKey.split(".");
-  let cur = obj;
-  for (const p of parts) {
-    if (cur == null || typeof cur !== "object") return undefined;
-    cur = cur[p];
-  }
-  return cur;
-}
-
-function setNestedKey(obj: any, dotKey: string, value: any): void {
-  const parts = dotKey.split(".");
-  let cur = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    if (cur[parts[i]] == null || typeof cur[parts[i]] !== "object") cur[parts[i]] = {};
-    cur = cur[parts[i]];
-  }
-  cur[parts[parts.length - 1]] = value;
-}
-
-function deleteNestedKey(obj: any, dotKey: string): boolean {
-  const parts = dotKey.split(".");
-  let cur = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    if (cur == null || typeof cur !== "object") return false;
-    cur = cur[parts[i]];
-  }
-  if (cur == null || typeof cur !== "object") return false;
-  const last = parts[parts.length - 1];
-  if (!(last in cur)) return false;
-  delete cur[last];
-  return true;
-}
-
-function stripSets(v: any): any {
-  if (v instanceof Set)  return [...v];
-  if (Array.isArray(v))  return v.map(stripSets);
-  if (v && typeof v === "object") {
-    const r: any = {};
-    for (const [k, val] of Object.entries(v)) r[k] = stripSets(val);
-    return r;
-  }
-  return v;
-}
-
-function buildEffectiveConfig(): Record<string, any> {
-  return stripSets(runtimeConfig);
-}
-
-function displayPath(p: string): string {
-  const home = process.env.HOME || "";
-  return home && p.startsWith(home) ? p.replace(home, "~") : p;
-}
-
 async function pathSub(_argv: string[]) {
   out(CONFIG_FILE);
 }
@@ -193,26 +81,24 @@ async function setSub(argv: string[]) {
   const [key, rawValue] = args.positional;
   if (!key || rawValue === undefined) die(2, "usage: config set <key> <value>");
 
-  if (AUTH_KEYS.has(key)) {
+  if (isAuthConfigKey(key)) {
     die(2, `"${key}" is an auth key. Use 'ima2 setup' or 'ima2 login' to change authentication.`);
   }
-  if (!KNOWN_KEYS.has(key)) {
+  if (!isWritableConfigKey(key)) {
     die(2, `unknown config key: "${key}". Run 'ima2 config ls --effective' to see the config structure.`);
   }
 
-  // Parse value: try JSON, fall back to raw string
-  let value: any = rawValue;
-  try { value = JSON.parse(rawValue); } catch {}
+  const value = parseConfigValue(rawValue);
 
   // Warn if env var is overriding this key
-  const envVar = KEY_TO_ENV[key];
-  if (envVar && process.env[envVar] !== undefined) {
-    out(color.yellow(`warning: env ${envVar}=${process.env[envVar]} is currently overriding this value.`));
+  const override = envOverrideForKey(key);
+  if (override) {
+    out(color.yellow(`warning: env ${override.envVar}=${override.value} is currently overriding this value.`));
     out(`The file change will only apply after unsetting the env var and restarting the server.`);
   }
 
   // Confirm if writing a sensitive key
-  if ((ALWAYS_REDACT.has(key) || REDACT_PATTERN.test(key)) && !args.yes) {
+  if (isSensitiveConfigKey(key) && !args.yes) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     const ans = await rl.question(`warning: "${key}" is a sensitive credential. Write to config file? [y/N] `);
     rl.close();
@@ -224,7 +110,7 @@ async function setSub(argv: string[]) {
   saveFileCfg(fileCfg);
 
   out(color.green("✓ ") + `wrote ${key}=${JSON.stringify(value)} to ${displayPath(CONFIG_FILE)}`);
-  out(color.dim("note: server must be restarted to pick up config changes (run `ima2 serve`)"));
+  out(color.dim(restartNotice()));
 }
 
 async function rmSub(argv: string[]) {
@@ -232,7 +118,7 @@ async function rmSub(argv: string[]) {
   const key = args.positional[0];
   if (!key) die(2, "key required. Usage: config rm <key>");
 
-  if (AUTH_KEYS.has(key)) {
+  if (isAuthConfigKey(key)) {
     die(2, `"${key}" is an auth key. Use 'ima2 setup' or 'ima2 login' to change authentication.`);
   }
 
@@ -244,7 +130,7 @@ async function rmSub(argv: string[]) {
   }
   saveFileCfg(fileCfg);
   out(color.green("✓ ") + `removed ${key} from ${displayPath(CONFIG_FILE)}`);
-  out(color.dim("note: server must be restarted to pick up config changes (run `ima2 serve`)"));
+  out(color.dim(restartNotice()));
 }
 
 type Sub = (argv: any[]) => Promise<void>;