ima2-gen 2.0.2 → 2.0.3

package/node_modules/qs/lib/parse.js

@@ -214,9 +214,12 @@ var parseObject = function (chain, val, options, valuesParsed) {
     return leaf;
 };
 
-var splitKeyIntoSegments = function splitKeyIntoSegments(givenKey, options) {
-    var key = options.allowDots ? givenKey.replace(/\.([^.[]+)/g, '[$1]') : givenKey;
+// Split a key like "a[b][c[]]" into ['a', '[b]', '[c[]]'] while preserving
+// qs parse semantics for depth/prototype guards.
+var splitKeyIntoSegments = function splitKeyIntoSegments(originalKey, options) {
+    var key = options.allowDots ? originalKey.replace(/\.([^.[]+)/g, '[$1]') : originalKey;
 
+    // depth <= 0 keeps the whole key as one segment
     if (options.depth <= 0) {
         if (!options.plainObjects && has.call(Object.prototype, key)) {
             if (!options.allowPrototypes) {
@@ -227,14 +230,11 @@ var splitKeyIntoSegments = function splitKeyIntoSegments(givenKey, options) {
         return [key];
     }
 
-    var brackets = /(\[[^[\]]*])/;
-    var child = /(\[[^[\]]*])/g;
-
-    var segment = brackets.exec(key);
-    var parent = segment ? key.slice(0, segment.index) : key;
-
-    var keys = [];
+    var segments = [];
 
+    // parent before the first '[' (may be empty if key starts with '[')
+    var first = key.indexOf('[');
+    var parent = first >= 0 ? key.slice(0, first) : key;
     if (parent) {
         if (!options.plainObjects && has.call(Object.prototype, parent)) {
             if (!options.allowPrototypes) {
@@ -242,32 +242,62 @@ var splitKeyIntoSegments = function splitKeyIntoSegments(givenKey, options) {
             }
         }
 
-        keys[keys.length] = parent;
+        segments[segments.length] = parent;
     }
 
-    var i = 0;
-    while ((segment = child.exec(key)) !== null && i < options.depth) {
-        i += 1;
-
-        var segmentContent = segment[1].slice(1, -1);
-        if (!options.plainObjects && has.call(Object.prototype, segmentContent)) {
-            if (!options.allowPrototypes) {
-                return;
+    var n = key.length;
+    var open = first;
+    var collected = 0;
+
+    while (open >= 0 && collected < options.depth) {
+        var level = 1;
+        var i = open + 1;
+        var close = -1;
+
+        // balance nested '[' and ']' inside this bracket group using a nesting level counter
+        while (i < n && close < 0) {
+            var cu = key.charCodeAt(i);
+            if (cu === 0x5B) { // '['
+                level += 1;
+            } else if (cu === 0x5D) { // ']'
+                level -= 1;
+                if (level === 0) {
+                    close = i; // found matching close; loop will exit by condition
+                }
             }
+            i += 1;
         }
 
-        keys[keys.length] = segment[1];
+        if (close < 0) {
+            // Unterminated group: wrap the raw remainder in one bracket pair so it stays
+            // a single literal segment (e.g. "[[]b" -> "[[]b]"); we do not infer missing ']'.
+            segments[segments.length] = '[' + key.slice(open) + ']';
+            return segments;
+        }
+
+        var seg = key.slice(open, close + 1);
+        // prototype guard for the content of this group
+        var content = seg.slice(1, -1);
+        if (!options.plainObjects && has.call(Object.prototype, content) && !options.allowPrototypes) {
+            return;
+        }
+
+        segments[segments.length] = seg;
+        collected += 1;
+
+        // find the next '[' after this balanced group
+        open = key.indexOf('[', close + 1);
     }
 
-    if (segment) {
+    if (open >= 0) {
         if (options.strictDepth === true) {
             throw new RangeError('Input depth exceeded depth option of ' + options.depth + ' and strictDepth is true');
         }
 
-        keys[keys.length] = '[' + key.slice(segment.index) + ']';
+        segments[segments.length] = '[' + key.slice(open) + ']';
     }
 
-    return keys;
+    return segments;
 };
 
 var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {

package/node_modules/qs/lib/stringify.js

@@ -118,7 +118,7 @@ var stringify = function stringify(
 
     if (obj === null) {
         if (strictNullHandling) {
-            return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, 'key', format) : prefix;
+            return formatter(encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, 'key', format) : prefix);
         }
 
         obj = '';
@@ -142,7 +142,9 @@ var stringify = function stringify(
     if (generateArrayPrefix === 'comma' && isArray(obj)) {
         // we need to join elements in
         if (encodeValuesOnly && encoder) {
-            obj = utils.maybeMap(obj, encoder);
+            obj = utils.maybeMap(obj, function (v) {
+                return v == null ? v : encoder(v);
+            });
         }
         objKeys = [{ value: obj.length > 0 ? obj.join(',') || null : void undefined }];
     } else if (isArray(filter)) {
@@ -312,6 +314,11 @@ module.exports = function (object, opts) {
     var sideChannel = getSideChannel();
     for (var i = 0; i < objKeys.length; ++i) {
         var key = objKeys[i];
+
+        if (typeof key === 'undefined' || key === null) {
+            continue;
+        }
+
         var value = obj[key];
 
         if (options.skipNulls && value === null) {
@@ -345,10 +352,10 @@ module.exports = function (object, opts) {
     if (options.charsetSentinel) {
         if (options.charset === 'iso-8859-1') {
             // encodeURIComponent('&#10003;'), the "numeric entity" representation of a checkmark
-            prefix += 'utf8=%26%2310003%3B&';
+            prefix += 'utf8=%26%2310003%3B' + options.delimiter;
         } else {
             // encodeURIComponent('✓')
-            prefix += 'utf8=%E2%9C%93&';
+            prefix += 'utf8=%E2%9C%93' + options.delimiter;
         }
     }
 

package/node_modules/qs/package.json

@@ -2,7 +2,7 @@
     "name": "qs",
     "description": "A querystring parser that supports nesting and arrays, with a depth limit",
     "homepage": "https://github.com/ljharb/qs",
-    "version": "6.15.1",
+    "version": "6.15.2",
     "repository": {
         "type": "git",
         "url": "https://github.com/ljharb/qs.git"
@@ -36,7 +36,7 @@
     "devDependencies": {
         "@browserify/envify": "^6.0.0",
         "@browserify/uglifyify": "^6.0.0",
-        "@ljharb/eslint-config": "^22.2.2",
+        "@ljharb/eslint-config": "^22.2.3",
         "browserify": "^16.5.2",
         "bundle-collapser": "^1.4.0",
         "common-shakeify": "~1.0.0",

package/node_modules/qs/test/parse.js

@@ -210,6 +210,9 @@ test('parse()', function (t) {
     t.test('uses original key when depth = 0', function (st) {
         st.deepEqual(qs.parse('a[0]=b&a[1]=c', { depth: 0 }), { 'a[0]': 'b', 'a[1]': 'c' });
         st.deepEqual(qs.parse('a[0][0]=b&a[0][1]=c&a[1]=d&e=2', { depth: 0 }), { 'a[0][0]': 'b', 'a[0][1]': 'c', 'a[1]': 'd', e: '2' });
+        st.deepEqual(qs.parse('a.b=c', { depth: 0, allowDots: true }), { 'a[b]': 'c' }, 'normalizes dots before applying depth-0 behavior');
+        st.deepEqual(qs.parse('toString=foo', { depth: 0 }), {}, 'respects prototype guard at depth 0');
+        st.deepEqual(qs.parse('toString=foo', { depth: 0, allowPrototypes: true }), { toString: 'foo' }, 'allows prototypes at depth 0 when enabled');
         st.end();
     });
 
@@ -263,6 +266,52 @@ test('parse()', function (t) {
         st.end();
     });
 
+    t.test('parses keys with literal [] inside a bracket group (#493)', function (st) {
+        // A bracket pair inside a bracket group should be treated literally as part of the key
+        st.deepEqual(
+            qs.parse('search[withbracket[]]=foobar'),
+            { search: { 'withbracket[]': 'foobar' } },
+            'treats inner [] literally when inside a bracket group'
+        );
+
+        // Single-level variant
+        st.deepEqual(
+            qs.parse('a[b[]]=c'),
+            { a: { 'b[]': 'c' } },
+            'keeps "b[]" as a literal key'
+        );
+
+        // Nested with an array push on the outer level
+        st.deepEqual(
+            qs.parse('list[][x[]]=y'),
+            { list: [{ 'x[]': 'y' }] },
+            'preserves inner [] while still treating outer [] as array push'
+        );
+
+        // Multiple nested bracket pairs: inner [] remains literal as part of the key
+        st.deepEqual(
+            qs.parse('a[b[c[]]]=d'),
+            { a: { 'b[c[]]': 'd' } },
+            'treats "b[c[]]" as a literal key inside the bracket group'
+        );
+
+        // Depth limits with literal brackets: preserve inner [] while limiting bracket-group parsing
+        st.deepEqual(
+            qs.parse('a[b[c[]]][d]=e', { depth: 1 }),
+            { a: { 'b[c[]]': { '[d]': 'e' } } },
+            'respects depth: 1 and preserves literal inner [] in the parsed key'
+        );
+
+        // Unterminated inner bracket group is wrapped as a literal remainder segment
+        st.deepEqual(
+            qs.parse('a[[]b=c'),
+            { a: { '[[]b': 'c' } },
+            'handles unterminated inner bracket groups without throwing'
+        );
+
+        st.end();
+    });
+
     t.test('allows to specify array indices', function (st) {
         st.deepEqual(qs.parse('a[1]=c&a[0]=b&a[2]=d'), { a: ['b', 'c', 'd'] });
         st.deepEqual(qs.parse('a[1]=c&a[0]=b'), { a: ['b', 'c'] });

package/node_modules/qs/test/stringify.js

@@ -651,6 +651,49 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('does not crash on null/undefined entries in arrayFormat=comma with encodeValuesOnly', function (st) {
+        st.doesNotThrow(
+            function () { qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }); },
+            'does not pass a raw null array entry to the encoder'
+        );
+        st.doesNotThrow(
+            function () { qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }); },
+            'does not pass a raw undefined array entry to the encoder'
+        );
+        st.doesNotThrow(
+            function () { qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true }); },
+            'does not crash on a single-null array'
+        );
+
+        st.equal(
+            qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=,b',
+            'null entry joins as empty, comma stays unencoded under encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=,b',
+            'undefined entry joins as empty, comma stays unencoded under encodeValuesOnly'
+        );
+        st.equal(
+            qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true }),
+            'a=',
+            'single-null array stringifies as empty value'
+        );
+        st.equal(
+            qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true, strictNullHandling: true }),
+            'a',
+            'strictNullHandling drops the equals sign for a single-null array'
+        );
+        st.equal(
+            qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true, skipNulls: true }),
+            '',
+            'skipNulls drops a single-null array entirely'
+        );
+
+        st.end();
+    });
+
     t.test('stringifies a null object', { skip: !hasProto }, function (st) {
         st.equal(qs.stringify({ __proto__: null, a: 'b' }), 'a=b');
         st.end();
@@ -825,6 +868,35 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('skips null/undefined entries in filter=array', function (st) {
+        st.doesNotThrow(
+            function () { qs.stringify({ a: 'b', undefined: 'x' }, { filter: ['a', undefined] }); },
+            'does not pass a raw undefined filter entry to the encoder'
+        );
+        st.doesNotThrow(
+            function () { qs.stringify({ a: 'b', 'null': 'x' }, { filter: ['a', null] }); },
+            'does not pass a raw null filter entry to the encoder'
+        );
+
+        st.equal(
+            qs.stringify({ a: 'b', undefined: 'x', c: 'd' }, { filter: ['a', undefined, 'c'] }),
+            'a=b&c=d',
+            'undefined filter entry is skipped, remaining keys are kept'
+        );
+        st.equal(
+            qs.stringify({ a: 'b', 'null': 'x', c: 'd' }, { filter: ['a', null, 'c'] }),
+            'a=b&c=d',
+            'null filter entry is skipped, remaining keys are kept'
+        );
+        st.equal(
+            qs.stringify({ a: 'b', 'null': 'x' }, { filter: [null] }),
+            '',
+            'filter array containing only null yields empty string'
+        );
+
+        st.end();
+    });
+
     t.test('supports custom representations when filter=function', function (st) {
         var calls = 0;
         var obj = { a: 'b', c: 'd', e: { f: new Date(1257894000000) } };
@@ -1111,6 +1183,28 @@ test('stringify()', function (t) {
         st.end();
     });
 
+    t.test('strictNullHandling: applies the formatter to the encoded key (RFC1738)', function (st) {
+        st.equal(
+            qs.stringify(
+                { 'a b': null, 'c d': 'e f' },
+                { strictNullHandling: false, format: 'RFC1738' }
+            ),
+            'a+b=&c+d=e+f',
+            'without: as expected'
+        );
+
+        st.equal(
+            qs.stringify(
+                { 'a b': null, 'c d': 'e f' },
+                { strictNullHandling: true, format: 'RFC1738' }
+            ),
+            'a+b&c+d=e+f',
+            'with: as expected'
+        );
+
+        st.end();
+    });
+
     t.test('throws if an invalid charset is specified', function (st) {
         st['throws'](function () {
             qs.stringify({ a: 'b' }, { charset: 'foobar' });
@@ -1146,6 +1240,12 @@ test('stringify()', function (t) {
             'adds the right sentinel when instructed to and the charset is iso-8859-1'
         );
 
+        st.equal(
+            qs.stringify({ a: 1, b: 2 }, { charsetSentinel: true, delimiter: ';' }),
+            'utf8=%E2%9C%93;a=1;b=2',
+            'uses the configured delimiter after the sentinel'
+        );
+
         st.end();
     });
 
@@ -1316,4 +1416,33 @@ test('stringifies empty keys', function (t) {
 
         st.end();
     });
+
+    t.test('round-trips keys containing percent-encoded bracket text', function (st) {
+        var cases = [
+            { 'a%5Bb': 'c' },
+            { 'a%5Db': 'c' },
+            { 'a%255Bb': 'c' },
+            { 'a%255Db': 'c' },
+            { a: { 'b%5Bc': 'd' } },
+            { a: { 'b%255Bc': 'd' } },
+            { 'a%5B%255Bb': 'c' }
+        ];
+        for (var i = 0; i < cases.length; i++) {
+            st.deepEqual(
+                qs.parse(qs.stringify(cases[i])),
+                cases[i],
+                'round-trips ' + JSON.stringify(cases[i])
+            );
+        }
+
+        st.end();
+    });
+
+    t.test('parses input containing percent-encoded bracket text without mangling', function (st) {
+        st.deepEqual(qs.parse('a%25255Bb=c'), { 'a%255Bb': 'c' }, 'a%25255Bb decodes to a%255Bb, not a%5Bb');
+        st.deepEqual(qs.parse('a%25255Db=c'), { 'a%255Db': 'c' }, 'a%25255Db decodes to a%255Db, not a%5Db');
+        st.deepEqual(qs.parse('a%5Bb%25255Bc%5D=d'), { a: { 'b%255Bc': 'd' } }, 'nested %25255B decodes to %255B inside segment, not %5B');
+
+        st.end();
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Local OAuth image generation studio with classic and node workflows",
   "type": "module",
   "bin": {

package/routes/agent.js

@@ -1,5 +1,5 @@
-import { appendAgentTurn, compactAgentSession, createAgentSession, deleteAgentSession, getAgentGenerationSettings, getAgentSession, getAgentWorkspacePayload, renameAgentSession, setAgentCurrentImage, setAgentGenerationSettings, setAgentLocks, setAgentWebSearch, } from "../lib/agentStore.js";
-import { cancelAgentQueueItem, createAgentQueueItem, getAgentQueueItem, listAgentQueueItems, retryAgentQueueItem, } from "../lib/agentQueueStore.js";
+import { appendAgentTurn, compactAgentSession, createAgentSession, deleteAgentSession, getAgentGenerationSettings, getAgentSession, getAgentWorkspacePayload, importAgentImage, renameAgentSession, setAgentCurrentImage, setAgentGenerationSettings, setAgentLocks, setAgentWebSearch, } from "../lib/agentStore.js";
+import { cancelAgentQueueItem, createAgentQueueItem, getAgentGenerationErrors, getAgentQueueItem, listAgentQueueItems, retryAgentQueueItem, } from "../lib/agentQueueStore.js";
 import { ensureAgentQueueWorker, tickAgentQueueWorker } from "../lib/agentQueueWorker.js";
 import { parseAgentSlashCommand, formatAgentQuestionReply, formatAgentSlashHelp } from "../lib/agentCommandParser.js";
 import { requestAgentQuestionAnswer } from "../lib/agentQuestionResponder.js";
@@ -46,6 +46,11 @@ export function registerAgentRoutes(app, ctxRaw) {
             if (Object.prototype.hasOwnProperty.call(body, "generationSettings")) {
                 setAgentGenerationSettings(req.params.sessionId, body.generationSettings);
             }
+            if (Object.prototype.hasOwnProperty.call(body, "currentImage")) {
+                const image = normalizeCurrentImage(body.currentImage);
+                if (image)
+                    importAgentImage(req.params.sessionId, image);
+            }
             if (Object.prototype.hasOwnProperty.call(body, "currentImageId")) {
                 const ok = setAgentCurrentImage(req.params.sessionId, body.currentImageId);
                 if (!ok)
@@ -105,6 +110,18 @@ export function registerAgentRoutes(app, ctxRaw) {
     app.get("/api/agent/queue", (_req, res) => {
         res.json({ queue: listAgentQueueItems() });
     });
+    app.get("/api/agent/sessions/:sessionId/errors", (req, res) => {
+        try {
+            if (!getAgentSession(req.params.sessionId))
+                throw notFound(req.params.sessionId);
+            const limitRaw = Number(req.query.limit);
+            const limit = Number.isFinite(limitRaw) ? limitRaw : 10;
+            res.json({ errors: getAgentGenerationErrors(req.params.sessionId, limit) });
+        }
+        catch (error) {
+            sendError(res, error);
+        }
+    });
     app.get("/api/agent/sessions/:sessionId/queue", (req, res) => {
         if (!getAgentSession(req.params.sessionId))
             return sendError(res, notFound(req.params.sessionId));

package/routes/agy.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { buildAgyPathEnv, resolveAgyBin } from "../lib/agyCli.js";
 // Detect whether the Antigravity CLI (`agy`) is installed, using the same
 // spawn-and-catch style as lib/agyImageAdapter.ts (no shell `which`/`where`).
 // Login state cannot be probed — agy has no status command — so we only
@@ -13,7 +14,10 @@ function isAgyInstalled() {
             resolve(value);
         };
         try {
-            const child = spawn("agy", ["--version"], { stdio: "ignore" });
+            const child = spawn(resolveAgyBin(), ["--version"], {
+                stdio: "ignore",
+                env: { ...process.env, PATH: buildAgyPathEnv() },
+            });
             child.on("error", () => done(false)); // ENOENT when not on PATH
             child.on("exit", (code) => done(code === 0));
             // Safety timeout so a hung binary never blocks the request.

package/routes/generate.js

@@ -5,6 +5,7 @@ import { randomBytes } from "crypto";
 import { detectImageMimeFromB64, summarizeReferencePayload, validateAndNormalizeRefs } from "../lib/refs.js";
 import { generateImageThumbnailFromBuffer } from "../lib/imageThumb.js";
 import { classifyUpstreamError } from "../lib/errorClassify.js";
+import { appendGenerationRequestLog } from "../lib/generationRequestLog.js";
 import { normalizeOAuthParams } from "../lib/oauthNormalize.js";
 import { resolveProviderOptions } from "../lib/providerOptions.js";
 import { generateViaResponses } from "../lib/responsesImageAdapter.js";
@@ -83,7 +84,8 @@ export function registerGenerateRoutes(app, ctxRaw) {
             const moderationCheck = validateModeration(ctx, moderation);
             if (moderationCheck.error)
                 return fail(400, { error: moderationCheck.error });
-            const count = Math.min(Math.max(parseInt(n) || 1, 1), 8);
+            const maxGeneratedImages = Math.max(1, Math.trunc(Number(ctx.config.limits.maxGeneratedImages) || 1));
+            const count = Math.min(Math.max(parseInt(n) || 1, 1), maxGeneratedImages);
             const referencePayload = summarizeReferencePayload(references);
             const refCheckResult = validateAndNormalizeRefs(references);
             if (refCheckResult.error) {
@@ -469,6 +471,15 @@ export function registerGenerateRoutes(app, ctxRaw) {
                 errorCode: finishErrorCode,
                 meta: finishMeta,
             });
+            appendGenerationRequestLog(ctx.config.storage.generationRequestLogFile, {
+                id: randomBytes(8).toString("hex"),
+                requestId,
+                createdAt: Date.now(),
+                prompt: typeof req.body?.prompt === "string" ? req.body.prompt : "",
+                requested: parseInt(req.body?.n) || 1,
+                succeeded: finishStatus === "completed" ? (finishMeta.imageCount ?? 1) : 0,
+                error: finishStatus === "error" ? (finishErrorCode ?? "unknown") : null,
+            }).catch(() => { });
         }
     });
 }

package/routes/generationRequestLog.js

@@ -0,0 +1,16 @@
+import { listGenerationRequestLog } from "../lib/generationRequestLog.js";
+import { requireRuntimeContext } from "../lib/runtimeContext.js";
+export function registerGenerationRequestLogRoutes(app, ctxRaw) {
+    const ctx = requireRuntimeContext(ctxRaw);
+    app.get("/api/generation-requests", async (_req, res) => {
+        try {
+            const items = await listGenerationRequestLog(ctx.config.storage.generationRequestLogFile);
+            res.json({ items });
+        }
+        catch (error) {
+            res.status(500).json({
+                error: error instanceof Error ? error.message : "Could not read generation request log",
+            });
+        }
+    });
+}

package/routes/index.js

@@ -25,6 +25,7 @@ import { registerVideoExtendedRoutes } from "./videoExtended.js";
 import { registerQuotaRoutes } from "./quota.js";
 import { registerAuthRoutes } from "./auth.js";
 import { mountKeyRoutes } from "./keys.js";
+import { registerGenerationRequestLogRoutes } from "./generationRequestLog.js";
 import { requireRuntimeContext } from "../lib/runtimeContext.js";
 export function configureRoutes(app, ctxRaw) {
     const ctx = requireRuntimeContext(ctxRaw);
@@ -56,4 +57,5 @@ export function configureRoutes(app, ctxRaw) {
     registerQuotaRoutes(app, ctx);
     registerAuthRoutes(app);
     mountKeyRoutes(app, ctx);
+    registerGenerationRequestLogRoutes(app, ctx);
 }

package/routes/keys.js

@@ -62,8 +62,28 @@ export function mountKeyRoutes(app, ctx) {
             valid: !!vertexJson,
             maskedKey: ctx.vertexProjectId ? `project: ${ctx.vertexProjectId}` : null,
         };
+        status.geminiAuthMode = ctx.geminiAuthMode
+            || (vertexJson && !ctx.geminiApiKey ? "vertex" : "apikey");
         res.json(status);
     });
+    // Persist the Gemini auth mode chosen in the settings dropdown, so reopening
+    // settings (or restarting the server) keeps the user's selection.
+    app.put("/api/keys/gemini-auth-mode", async (req, res) => {
+        const { mode } = req.body;
+        if (mode !== "apikey" && mode !== "vertex") {
+            return res.status(400).json({ ok: false, error: "mode must be apikey|vertex", code: "INVALID_MODE" });
+        }
+        const cfgPath = ctx.config.storage.configFile;
+        let existing = {};
+        try {
+            existing = JSON.parse(await readFile(cfgPath, "utf-8"));
+        }
+        catch { /* new file */ }
+        existing.geminiAuthMode = mode;
+        await writeConfigAtomic(cfgPath, existing);
+        ctx.geminiAuthMode = mode;
+        return res.json({ ok: true, geminiAuthMode: mode });
+    });
     // Vertex JSON — dedicated route (before generic :provider)
     app.put("/api/keys/vertex", async (req, res) => {
         const { serviceAccountJson } = req.body;
@@ -187,6 +207,8 @@ export function mountKeyRoutes(app, ctx) {
         }
         catch { /* new file */ }
         existing[CONFIG_KEY_MAP[provider]] = trimmed;
+        if (provider === "gemini")
+            existing.geminiAuthMode = "apikey";
         await writeConfigAtomic(cfgPath, existing);
         // Hot-update runtime context
         if (provider === "openai") {
@@ -209,8 +231,6 @@ export function mountKeyRoutes(app, ctx) {
             ctx.geminiApiKeySource = "config";
             ctx.hasGeminiApiKey = true;
             ctx.geminiAuthMode = "apikey";
-            existing[CONFIG_KEY_MAP[provider]] = trimmed;
-            existing.geminiAuthMode = "apikey";
         }
         return res.json({ ok: true, provider, source: "config", valid: true });
     });

package/routes/multimode.js

@@ -82,7 +82,7 @@ export function registerMultimodeRoutes(app, ctxRaw) {
             const { prompt, quality: rawQuality = "medium", size = "1024x1024", format = "png", moderation = "low", provider = "auto", references = [], mode: promptMode = "auto", model: rawModel, reasoningEffort: rawReasoningEffort, webSearchEnabled: rawWebSearchEnabled = true, } = req.body;
             const composerPrompt = normalizeComposerPrompt(req.body?.composerPrompt);
             const composerInsertedPrompts = normalizeComposerInsertedPrompts(req.body?.composerInsertedPrompts);
-            const maxImages = normalizeMaxImages(req.body?.maxImages);
+            const maxImages = normalizeMaxImages(req.body?.maxImages, ctx.config.limits.maxGeneratedImages);
             const normalizedPromptMode = promptMode === "direct" ? "direct" : "auto";
             const { quality, warnings: qualityWarnings } = normalizeOAuthParams({ provider, quality: rawQuality });
             const providerOptions = resolveProviderOptions(ctx, {

package/routes/nodes.js

@@ -204,9 +204,9 @@ export function registerNodeRoutes(app, ctxRaw) {
             let b64, usage, webSearchCalls = 0, revisedPrompt = null;
             const grokDirectApiKey = activeProvider === "grok-api" ? ctx.xaiApiKey : undefined;
             let resultFormat = activeProvider === "grok" || activeProvider === "agy" || activeProvider === "grok-api" || activeProvider === "gemini-api" ? "jpeg" : format;
-            const MAX_RETRIES = 1;
+            const maxAttempts = inputImageCount > 0 ? 1 : 2;
             let lastErr = null;
-            for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+            for (let attempt = 0; attempt < maxAttempts; attempt++) {
                 try {
                     logEvent("node", "attempt", {
                         requestId,
@@ -297,7 +297,7 @@ export function registerNodeRoutes(app, ctxRaw) {
                     if (isNonRetryableGenerationError(lastErr))
                         break;
                 }
-                if (attempt < MAX_RETRIES) {
+                if (attempt + 1 < maxAttempts) {
                     logEvent("node", "retry", {
                         requestId,
                         attempt: attempt + 1,
@@ -312,7 +312,7 @@ export function registerNodeRoutes(app, ctxRaw) {
             }
             if (!b64) {
                 const finalErr = normalizeGenerationFailure(lastErr, {
-                    safetyMessage: lastErr?.message || "Empty response after retry",
+                    safetyMessage: lastErr?.message || "Empty response after generation attempt",
                 });
                 finishStatus = "error";
                 finishHttpStatus = finalErr.status || 500;
@@ -327,7 +327,7 @@ export function registerNodeRoutes(app, ctxRaw) {
                     diagnosticReason: lastErr?.diagnosticReason,
                     retryKind: lastErr?.retryKind,
                     referencesDroppedOnRetry: lastErr?.referencesDroppedOnRetry,
-                    attempts: MAX_RETRIES + 1,
+                    attempts: maxAttempts,
                     outerHttpAlreadyCommitted: res.headersSent,
                     sseErrorSent: streamResponse,
                 });