ima2-gen 2.0.1 → 2.0.3

package/node_modules/qs/test/parse.js

@@ -210,6 +210,9 @@ test('parse()', function (t) {
     t.test('uses original key when depth = 0', function (st) {
         st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: 0 }), { 'a[0]': 'b', 'a[1]': 'c' });
         st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: 0 }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
+        st.deepEqual(qs.parse('a.b=c', { depth: 0, allowDots: true }), { 'a[b]': 'c' }, 'normalizes dots before applying depth-0 behavior');
+        st.deepEqual(qs.parse('toString=foo', { depth: 0 }), {}, 'respects prototype guard at depth 0');
+        st.deepEqual(qs.parse('toString=foo', { depth: 0, allowPrototypes: true }), { toString: 'foo' }, 'allows prototypes at depth 0 when enabled');
         st.end();
     });
 
@@ -263,6 +266,52 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('parses keys with literal [] inside a bracket group (#493)', function (st) {
+        // A bracket pair inside a bracket group should be treated literally as part of the key
+        st.deepEqual(
+            qs.parse('search[withbracket[]]=foobar'),
+            { search: { 'withbracket[]': 'foobar' } },
+            'treats inner [] literally when inside a bracket group'
+        );
+
+        // Single-level variant
+        st.deepEqual(
+            qs.parse('a[b[]]=c'),
+            { a: { 'b[]': 'c' } },
+            'keeps "b[]" as a literal key'
+        );
+
+        // Nested with an array push on the outer level
+        st.deepEqual(
+            qs.parse('list[][x[]]=y'),
+            { list: [{ 'x[]': 'y' }] },
+            'preserves inner [] while still treating outer [] as array push'
+        );
+
+        // Multiple nested bracket pairs: inner [] remains literal as part of the key
+        st.deepEqual(
+            qs.parse('a[b[c[]]]=d'),
+            { a: { 'b[c[]]': 'd' } },
+            'treats "b[c[]]" as a literal key inside the bracket group'
+        );
+
+        // Depth limits with literal brackets: preserve inner [] while limiting bracket-group parsing
+        st.deepEqual(
+            qs.parse('a[b[c[]]][d]=e', { depth: 1 }),
+            { a: { 'b[c[]]': { '[d]': 'e' } } },
+            'respects depth: 1 and preserves literal inner [] in the parsed key'
+        );
+
+        // Unterminated inner bracket group is wrapped as a literal remainder segment
+        st.deepEqual(
+            qs.parse('a[[]b=c'),
+            { a: { '[[]b': 'c' } },
+            'handles unterminated inner bracket groups without throwing'
+        );
+
+        st.end();
+    });
+
     t.test('allows to specify array indices', function (st) {
         st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
         st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });

package/node_modules/qs/test/stringify.js

@@ -651,6 +651,49 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('does not crash on null/undefined entries in arrayFormat=comma with encodeValuesOnly', function (st) {
+        st.doesNotThrow(
+            function () { qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }); },
+            'does not pass a raw null array entry to the encoder'
+        );
+        st.doesNotThrow(
+            function () { qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }); },
+            'does not pass a raw undefined array entry to the encoder'
+        );
+        st.doesNotThrow(
+            function () { qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true }); },
+            'does not crash on a single-null array'
+        );
+
+        st.equal(
+            qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=,b',
+            'null entry joins as empty, comma stays unencoded under encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=,b',
+            'undefined entry joins as empty, comma stays unencoded under encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=',
+            'single-null array stringifies as empty value'
+        );
+        st.equal(
+            qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true, strictNullHandling: true }),
+            'a',
+            'strictNullHandling drops the equals sign for a single-null array'
+        );
+        st.equal(
+            qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true, skipNulls: true }),
+            '',
+            'skipNulls drops a single-null array entirely'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies a null object', { skip: !hasProto }, function (st) {
         st.equal(qs.stringify({ __proto__: null, a: 'b' }), 'a=b');
         st.end();
@@ -825,6 +868,35 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('skips null/undefined entries in filter=array', function (st) {
+        st.doesNotThrow(
+            function () { qs.stringify({ a: 'b', undefined: 'x' }, { filter: ['a', undefined] }); },
+            'does not pass a raw undefined filter entry to the encoder'
+        );
+        st.doesNotThrow(
+            function () { qs.stringify({ a: 'b', 'null': 'x' }, { filter: ['a', null] }); },
+            'does not pass a raw null filter entry to the encoder'
+        );
+
+        st.equal(
+            qs.stringify({ a: 'b', undefined: 'x', c: 'd' }, { filter: ['a', undefined, 'c'] }),
+            'a=b&c=d',
+            'undefined filter entry is skipped, remaining keys are kept'
+        );
+        st.equal(
+            qs.stringify({ a: 'b', 'null': 'x', c: 'd' }, { filter: ['a', null, 'c'] }),
+            'a=b&c=d',
+            'null filter entry is skipped, remaining keys are kept'
+        );
+        st.equal(
+            qs.stringify({ a: 'b', 'null': 'x' }, { filter: [null] }),
+            '',
+            'filter array containing only null yields empty string'
+        );
+
+        st.end();
+    });
+
     t.test('supports custom representations when filter=function', function (st) {
         var calls = 0;
         var obj = { a: 'b', c: 'd', e: { f: new Date(1257894000000) } };
@@ -1111,6 +1183,28 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('strictNullHandling: applies the formatter to the encoded key (RFC1738)', function (st) {
+        st.equal(
+            qs.stringify(
+                { 'a b': null, 'c d': 'e f' },
+                { strictNullHandling: false, format: 'RFC1738' }
+            ),
+            'a+b=&c+d=e+f',
+            'without: as expected'
+        );
+
+        st.equal(
+            qs.stringify(
+                { 'a b': null, 'c d': 'e f' },
+                { strictNullHandling: true, format: 'RFC1738' }
+            ),
+            'a+b&c+d=e+f',
+            'with: as expected'
+        );
+
+        st.end();
+    });
+
     t.test('throws if an invalid charset is specified', function (st) {
         st['throws'](function () {
             qs.stringify({ a: 'b' }, { charset: 'foobar' });
@@ -1146,6 +1240,12 @@ test('stringify()', function (t) {
             'adds the right sentinel when instructed to and the charset is iso-8859-1'
         );
 
+        st.equal(
+            qs.stringify({ a: 1, b: 2 }, { charsetSentinel: true, delimiter: ';' }),
+            'utf8=%E2%9C%93;a=1;b=2',
+            'uses the configured delimiter after the sentinel'
+        );
+
         st.end();
     });
 
@@ -1316,4 +1416,33 @@ test('stringifies empty keys', function (t) {
 
         st.end();
     });
+
+    t.test('round-trips keys containing percent-encoded bracket text', function (st) {
+        var cases = [
+            { 'a%5Bb': 'c' },
+            { 'a%5Db': 'c' },
+            { 'a%255Bb': 'c' },
+            { 'a%255Db': 'c' },
+            { a: { 'b%5Bc': 'd' } },
+            { a: { 'b%255Bc': 'd' } },
+            { 'a%5B%255Bb': 'c' }
+        ];
+        for (var i = 0; i < cases.length; i++) {
+            st.deepEqual(
+                qs.parse(qs.stringify(cases[i])),
+                cases[i],
+                'round-trips ' + JSON.stringify(cases[i])
+            );
+        }
+
+        st.end();
+    });
+
+    t.test('parses input containing percent-encoded bracket text without mangling', function (st) {
+        st.deepEqual(qs.parse('a%25255Bb=c'), { 'a%255Bb': 'c' }, 'a%25255Bb decodes to a%255Bb, not a%5Bb');
+        st.deepEqual(qs.parse('a%25255Db=c'), { 'a%255Db': 'c' }, 'a%25255Db decodes to a%255Db, not a%5Db');
+        st.deepEqual(qs.parse('a%5Bb%25255Bc%5D=d'), { a: { 'b%255Bc': 'd' } }, 'nested %25255B decodes to %255B inside segment, not %5B');
+
+        st.end();
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "description": "Local OAuth image generation studio with classic and node workflows",
   "type": "module",
   "bin": {
@@ -39,6 +39,7 @@
     "cli"
   ],
   "license": "MIT",
+  "homepage": "https://lidge-jun.github.io/ima2-gen/",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lidge-jun/ima2-gen.git"
@@ -57,6 +58,7 @@
     "assets/card-news/templates/",
     ".env.example",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE",
     "server.js",
     "config.js"
@@ -65,6 +67,7 @@
     "node": ">=20"
   },
   "dependencies": {
+    "@openai/codex": "latest",
     "better-sqlite3": "^12.9.0",
     "dotenv": "^17.4.2",
     "express": "^5.1.0",

package/routes/agent.js

@@ -1,5 +1,5 @@
-import { appendAgentTurn, compactAgentSession, createAgentSession, deleteAgentSession, getAgentGenerationSettings, getAgentSession, getAgentWorkspacePayload, renameAgentSession, setAgentCurrentImage, setAgentGenerationSettings, setAgentLocks, setAgentWebSearch, } from "../lib/agentStore.js";
-import { cancelAgentQueueItem, createAgentQueueItem, getAgentQueueItem, listAgentQueueItems, retryAgentQueueItem, } from "../lib/agentQueueStore.js";
+import { appendAgentTurn, compactAgentSession, createAgentSession, deleteAgentSession, getAgentGenerationSettings, getAgentSession, getAgentWorkspacePayload, importAgentImage, renameAgentSession, setAgentCurrentImage, setAgentGenerationSettings, setAgentLocks, setAgentWebSearch, } from "../lib/agentStore.js";
+import { cancelAgentQueueItem, createAgentQueueItem, getAgentGenerationErrors, getAgentQueueItem, listAgentQueueItems, retryAgentQueueItem, } from "../lib/agentQueueStore.js";
 import { ensureAgentQueueWorker, tickAgentQueueWorker } from "../lib/agentQueueWorker.js";
 import { parseAgentSlashCommand, formatAgentQuestionReply, formatAgentSlashHelp } from "../lib/agentCommandParser.js";
 import { requestAgentQuestionAnswer } from "../lib/agentQuestionResponder.js";
@@ -46,6 +46,11 @@ export function registerAgentRoutes(app, ctxRaw) {
             if (Object.prototype.hasOwnProperty.call(body, "generationSettings")) {
                 setAgentGenerationSettings(req.params.sessionId, body.generationSettings);
             }
+            if (Object.prototype.hasOwnProperty.call(body, "currentImage")) {
+                const image = normalizeCurrentImage(body.currentImage);
+                if (image)
+                    importAgentImage(req.params.sessionId, image);
+            }
             if (Object.prototype.hasOwnProperty.call(body, "currentImageId")) {
                 const ok = setAgentCurrentImage(req.params.sessionId, body.currentImageId);
                 if (!ok)
@@ -105,6 +110,18 @@ export function registerAgentRoutes(app, ctxRaw) {
     app.get("/api/agent/queue", (_req, res) => {
         res.json({ queue: listAgentQueueItems() });
     });
+    app.get("/api/agent/sessions/:sessionId/errors", (req, res) => {
+        try {
+            if (!getAgentSession(req.params.sessionId))
+                throw notFound(req.params.sessionId);
+            const limitRaw = Number(req.query.limit);
+            const limit = Number.isFinite(limitRaw) ? limitRaw : 10;
+            res.json({ errors: getAgentGenerationErrors(req.params.sessionId, limit) });
+        }
+        catch (error) {
+            sendError(res, error);
+        }
+    });
     app.get("/api/agent/sessions/:sessionId/queue", (req, res) => {
         if (!getAgentSession(req.params.sessionId))
             return sendError(res, notFound(req.params.sessionId));

package/routes/agy.js

@@ -0,0 +1,48 @@
+import { spawn } from "node:child_process";
+import { buildAgyPathEnv, resolveAgyBin } from "../lib/agyCli.js";
+// Detect whether the Antigravity CLI (`agy`) is installed, using the same
+// spawn-and-catch style as lib/agyImageAdapter.ts (no shell `which`/`where`).
+// Login state cannot be probed — agy has no status command — so we only
+// report installation here.
+function isAgyInstalled() {
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(value);
+        };
+        try {
+            const child = spawn(resolveAgyBin(), ["--version"], {
+                stdio: "ignore",
+                env: { ...process.env, PATH: buildAgyPathEnv() },
+            });
+            child.on("error", () => done(false)); // ENOENT when not on PATH
+            child.on("exit", (code) => done(code === 0));
+            // Safety timeout so a hung binary never blocks the request.
+            setTimeout(() => {
+                try {
+                    if (!child.killed)
+                        child.kill();
+                }
+                catch { /* ignore */ }
+                done(false);
+            }, 3000).unref?.();
+        }
+        catch {
+            done(false);
+        }
+    });
+}
+export function registerAgyRoutes(app) {
+    app.get("/api/agy/status", async (_req, res) => {
+        try {
+            const installed = await isAgyInstalled();
+            res.json({ installed });
+        }
+        catch {
+            res.json({ installed: false });
+        }
+    });
+}

package/routes/auth.js

@@ -2,11 +2,15 @@ import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { writeFileSync, renameSync, mkdirSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 const GROK_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 const GROK_SCOPE = "openid profile email offline_access grok-cli:access api:access";
 const GROK_TOKEN_URL = "https://auth.x.ai/oauth2/token";
 const CODEX_DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+// Bundled @openai/codex binary (npm dependency), resolved relative to this
+// module so device-auth login works even when `codex` is not on the user's PATH.
+const CODEX_BIN = join(dirname(fileURLToPath(import.meta.url)), "..", "node_modules", ".bin", process.platform === "win32" ? "codex.cmd" : "codex");
 const MAX_CONCURRENT_SESSIONS = 20;
 const sessions = new Map();
 function sid() {
@@ -125,7 +129,7 @@ function startCodexDeviceCode() {
         for (const k of ["OPENAI_API_KEY", "XAI_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY", "VERTEX_SERVICE_ACCOUNT_JSON"]) {
             delete childEnv[k];
         }
-        const child = spawn("codex", ["login", "--device-auth"], {
+        const child = spawn(CODEX_BIN, ["login", "--device-auth"], {
             stdio: ["ignore", "pipe", "pipe"],
             env: childEnv,
         });

package/routes/edit.js

@@ -169,6 +169,7 @@ export function registerEditRoutes(app, ctxRaw) {
             let revisedPrompt;
             let webSearchCalls = 0;
             let resultMimeFromProvider;
+            let providerUrl = null;
             if (activeProvider === "gemini-api") {
                 const r = await generateViaGeminiApi(`Edit this image: ${prompt}`, requireRuntimeContext(ctx), {
                     model: imageModel,
@@ -206,6 +207,7 @@ export function registerEditRoutes(app, ctxRaw) {
                     directApiKey,
                 });
                 resultB64 = r.b64;
+                providerUrl = r.providerUrl ?? null;
                 usage = r.usage;
                 revisedPrompt = r.revisedPrompt;
                 webSearchCalls = r.webSearchCalls;
@@ -237,6 +239,7 @@ export function registerEditRoutes(app, ctxRaw) {
             const editFilePath = join(ctx.config.storage.generatedDir, filename);
             await writeFile(editFilePath, editBuffer);
             generateImageThumbnailFromBuffer(editBuffer, editFilePath).catch(() => { });
+            const createdAt = Date.now();
             const meta = {
                 prompt,
                 userPrompt: prompt,
@@ -252,10 +255,11 @@ export function registerEditRoutes(app, ctxRaw) {
                 provider: activeProvider,
                 kind: "edit",
                 requestId,
-                createdAt: Date.now(),
+                createdAt,
                 usage: usage || null,
                 webSearchCalls,
                 webSearchEnabled,
+                ...(providerUrl ? { providerUrl } : {}),
             };
             await safeWriteSidecar(join(ctx.config.storage.generatedDir, filename + ".json"), meta);
             invalidateHistoryIndex();
@@ -281,6 +285,8 @@ export function registerEditRoutes(app, ctxRaw) {
                 promptMode: normalizedPromptMode,
                 webSearchCalls,
                 webSearchEnabled,
+                providerUrl,
+                createdAt,
             });
         }
         catch (e) {

package/routes/events.js

@@ -0,0 +1,78 @@
+import { subscribe, replaySince, hasReplayGap, replayOldestId, MAX_SSE_LISTENERS } from "../lib/eventBus.js";
+let activeConnections = 0;
+function safeWrite(res, chunk) {
+    if (res.writableEnded || res.destroyed)
+        return false;
+    try {
+        res.write(chunk);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function formatSse(ev) {
+    return `id: ${ev.id}\nevent: ${ev.event}\ndata: ${JSON.stringify({ ...ev.data, jobId: ev.jobId })}\n\n`;
+}
+export function registerEventsRoute(app, _ctx) {
+    app.get("/api/events", (req, res) => {
+        if (activeConnections >= MAX_SSE_LISTENERS) {
+            return res.status(503).json({
+                error: { code: "SSE_CAPACITY", message: "Too many event stream connections" },
+            });
+        }
+        res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.setHeader("X-Accel-Buffering", "no");
+        res.flushHeaders?.();
+        activeConnections++;
+        const headerLastId = parseInt(req.headers["last-event-id"], 10);
+        const queryLastId = parseInt(String(req.query.lastEventId ?? ""), 10);
+        const lastId = !Number.isNaN(headerLastId) ? headerLastId : queryLastId;
+        if (!Number.isNaN(lastId)) {
+            if (hasReplayGap(lastId)) {
+                const gapPayload = JSON.stringify({
+                    lastEventId: lastId,
+                    oldestAvailableId: replayOldestId(),
+                });
+                if (!safeWrite(res, `event: replay-gap\ndata: ${gapPayload}\n\n`)) {
+                    activeConnections = Math.max(0, activeConnections - 1);
+                    return;
+                }
+            }
+            for (const ev of replaySince(lastId)) {
+                if (!safeWrite(res, formatSse(ev)))
+                    break;
+            }
+        }
+        let cleaned = false;
+        const unsub = subscribe((ev) => {
+            if (!safeWrite(res, formatSse(ev)))
+                cleanup();
+        });
+        const heartbeat = setInterval(() => {
+            if (!safeWrite(res, ": ping\n\n"))
+                cleanup();
+        }, 15_000);
+        function cleanup() {
+            if (cleaned)
+                return;
+            cleaned = true;
+            unsub();
+            clearInterval(heartbeat);
+            activeConnections = Math.max(0, activeConnections - 1);
+            if (!res.writableEnded && !res.destroyed) {
+                try {
+                    res.end();
+                }
+                catch {
+                    /* socket already torn down */
+                }
+            }
+        }
+        req.on("close", cleanup);
+        res.on("close", cleanup);
+        res.on("error", cleanup);
+    });
+}