ima2-gen 3.20.0 → 3.21.0

package/docs/migration/runtime-test-inventory.md

@@ -4,7 +4,7 @@ Generated by `npm run test:inventory` (script: `scripts/classify-tests.mjs`).
 
 _Tests considered "runtime-importing" if they import from `../lib/`, `../routes/`, `../bin/`, `../server`, or `../config`._
 
-Total: 508 (runtime: 231, contract: 277)
+Total: 513 (runtime: 233, contract: 280)
 
 ## Runtime-importing tests
 - `tests/advertise-payload-contract.test.ts`
@@ -54,6 +54,8 @@ Total: 508 (runtime: 231, contract: 277)
 - `tests/cli-lib.test.ts`
 - `tests/cli-model-resolver.test.ts`
 - `tests/cli-models-command-contract.test.ts`
+- `tests/codex-backend-session.test.ts`
+- `tests/codex-backend-transport.test.ts`
 - `tests/comfy-bridge-contract.test.ts`
 - `tests/comfy-graph-bind.test.ts`
 - `tests/comfy-provider-contract.test.ts`
@@ -80,6 +82,7 @@ Total: 508 (runtime: 231, contract: 277)
 - `tests/generated-static-privacy.test.ts`
 - `tests/generation-errors.test.ts`
 - `tests/generation-request-log.test.ts`
+- `tests/github-star.test.ts`
 - `tests/google-execution-parity.test.ts`
 - `tests/gpt56-rollout-contract.test.ts`
 - `tests/grok-execution-parity.test.ts`
@@ -159,7 +162,6 @@ Total: 508 (runtime: 231, contract: 277)
 - `tests/oauth-cli-dependencies.test.ts`
 - `tests/oauth-normalize.test.ts`
 - `tests/oauth-proxy-error-safety.test.ts`
-- `tests/oauth-proxy-session-reload.test.ts`
 - `tests/open-directory.test.ts`
 - `tests/openai-execution-parity.test.ts`
 - `tests/openai-transport-parity.test.ts`
@@ -345,6 +347,7 @@ Total: 508 (runtime: 231, contract: 277)
 - `tests/desktop-release-workflow-shell.test.ts`
 - `tests/desktop-sign-extra.test.ts`
 - `tests/desktop-signing-policy.test.ts`
+- `tests/desktop-tray.test.ts`
 - `tests/desktop-updater.test.ts`
 - `tests/direct-mode-visual-contract.test.js`
 - `tests/dropped-media-sorting-contract.test.ts`
@@ -441,6 +444,7 @@ Total: 508 (runtime: 231, contract: 277)
 - `tests/node-session-evaporation-contract.test.js`
 - `tests/node-studio-ui-contract.test.js`
 - `tests/node-ui-contract.test.js`
+- `tests/oauth-image-lane-contract.test.ts`
 - `tests/oauth-masked-edit-contract.test.js`
 - `tests/oauth-proxy-edit-mask-contract.test.js`
 - `tests/package-global-update-smoke-contract.test.ts`
@@ -484,6 +488,7 @@ Total: 508 (runtime: 231, contract: 277)
 - `tests/sprite-curator-ui-contract.test.js`
 - `tests/sprite-recipe-ui-contract.test.js`
 - `tests/sprite-transform-contract.test.ts`
+- `tests/star-prompt-ui-contract.test.ts`
 - `tests/star-surface-controls-contract.test.ts`
 - `tests/storage-open-generated-dir.test.js`
 - `tests/structure-line-counts-contract.test.js`

package/integrations/comfyui/ima2_gen_bridge/nodes.py

@@ -17,7 +17,7 @@ from PIL import Image
 DEFAULT_SERVER_URL = "http://127.0.0.1:3333"
 IMA2_CLIENT_HEADER = "comfyui/bridge"
 ALLOWED_LOOPBACK_HOSTS = {"127.0.0.1", "localhost", "::1"}
-MODEL_OPTIONS = ["", "gpt-5.6-luna", "gpt-6-astra", "gpt-5.6-terra", "gpt-5.6-sol", "gpt-5.5", "gpt-5.4", "gpt-5.4-mini"]
+MODEL_OPTIONS = ["", "gpt-6-luna", "gpt-6-sol", "gpt-6-astra", "gpt-5.6-luna", "gpt-5.6-terra", "gpt-5.6-sol", "gpt-5.5", "gpt-5.4", "gpt-5.4-mini"]
 
 
 class Ima2BridgeError(Exception):

package/lib/agentImageVideoGen.js

@@ -72,7 +72,7 @@ async function generateAgentImage(ctx, sessionId, prompt, manifest, webSearchEna
         rawWebSearchEnabled: webSearchEnabled,
         searchMode: webSearchEnabled ? "on" : "off",
     });
-    if (providerOptions.error) {
+    if (providerOptions.error !== undefined) {
         const err = new Error(providerOptions.error);
         err.code = providerOptions.code;
         err.status = providerOptions.status;

package/lib/agentPlannerModel.js

@@ -7,6 +7,7 @@ import { logEvent } from "./logger.js";
 import { getPlannerConfig } from "./grokImageCore.js";
 import { fetchWithGrokAuth, getGrokEndpoint } from "./grokRuntime.js";
 import { waitForOAuthReady } from "./oauthProxy/runtime.js";
+import { oauthFetch } from "./codexBackend/index.js";
 import { requireRuntimeContext } from "./runtimeContext.js";
 function buildPlannerDeveloperPrompt(hasSourceImage, imageCount) {
     return [
@@ -124,13 +125,13 @@ async function requestResponsesPlan(ctx, developerPrompt, userPrompt, settings,
     }
     else {
         await waitForOAuthReady(ctx);
-        url = `${ctx.oauthUrl}/v1/responses`;
+        url = null; // GPT OAuth: oauthFetch routes to the native Codex client or the proxy
         headers = { "Content-Type": "application/json", Accept: "text/event-stream" };
     }
     // stream:true is required — the bundled OAuth proxy returns an empty
     // `output` array for non-streaming Responses calls, which used to make the
     // planner silently fall back to the regex-derived image plan.
-    const res = await fetch(url, {
+    const init = {
         method: "POST",
         headers,
         signal,
@@ -143,7 +144,8 @@ async function requestResponsesPlan(ctx, developerPrompt, userPrompt, settings,
             reasoning: { effort: "low" },
             stream: true,
         }),
-    });
+    };
+    const res = url ? await fetch(url, init) : await oauthFetch(ctx, "/v1/responses", init);
     if (!res.ok)
         throw plannerHttpError(settings.provider, res.status);
     const payload = await readResponsesTextPayload(res);

package/lib/agentQuestionResponder.js

@@ -1,6 +1,8 @@
 import { errInfo } from "./errInfo.js";
 import { logEvent } from "./logger.js";
 import { waitForOAuthReady } from "./oauthProxy/runtime.js";
+import { oauthFetch } from "./codexBackend/index.js";
+import { migrateOAuthImageModel } from "./oauthLegacyModels.js";
 import { requireRuntimeContext } from "./runtimeContext.js";
 const AGENT_QUESTION_DEVELOPER_PROMPT = [
     "You are the text-only question mode for ima2-gen Agent.",
@@ -18,12 +20,12 @@ export async function requestAgentQuestionAnswer(ctxRaw, question, options = {})
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         const signal = options.signal ? combineSignals([controller.signal, options.signal]) : controller.signal;
         try {
-            const res = await fetch(endpoint.url, {
+            const init = {
                 method: "POST",
                 headers: endpoint.headers,
                 signal,
                 body: JSON.stringify({
-                    model: options.model || ctx.config.imageModels?.default || "gpt-5.6-luna",
+                    model: migrateOAuthImageModel(options.model || ctx.config.imageModels?.default || "gpt-6-luna"),
                     input: [
                         { role: "developer", content: AGENT_QUESTION_DEVELOPER_PROMPT },
                         { role: "user", content: question },
@@ -31,7 +33,8 @@ export async function requestAgentQuestionAnswer(ctxRaw, question, options = {})
                     reasoning: { effort: options.reasoningEffort || "low" },
                     stream: true,
                 }),
-            });
+            };
+            const res = endpoint.url ? await fetch(endpoint.url, init) : await oauthFetch(ctx, "/v1/responses", init);
             logEvent("agent_question", "response", {
                 requestId: options.requestId,
                 provider: options.provider,
@@ -73,7 +76,7 @@ async function resolveQuestionEndpoint(ctx, provider) {
         }
         await waitForOAuthReady(ctx);
         return {
-            url: `${ctx.oauthUrl}/v1/responses`,
+            url: null, // GPT OAuth: oauthFetch routes to the native Codex client or the proxy
             headers: { "Content-Type": "application/json", Accept: "text/event-stream" },
         };
     }

package/lib/agentSettings.js

@@ -1,5 +1,22 @@
 import { config } from "../config.js";
 import { deriveProviderIdSet } from "./providers/derive.js";
+import { API_FALLBACK_IMAGE_MODEL, FALLBACK_IMAGE_MODEL, migrateOAuthImageModel } from "./imageModels.js";
+import { deriveSupportedImageModels } from "./providers/derive.js";
+const OAUTH_IMAGE_MODELS = deriveSupportedImageModels("oauth");
+const API_IMAGE_MODELS = deriveSupportedImageModels("api");
+/**
+ * GPT OAuth keeps only GPT-6 and the API-key lane its own list, so an agent that switches lanes
+ * without naming a model must not carry the other lane's id: a legacy OAuth id moves to its GPT-6
+ * tier, and a GPT-6 id the API lane does not serve falls back to the API default.
+ */
+function modelForLane(provider, model) {
+    if (provider === "oauth")
+        return migrateOAuthImageModel(model);
+    if (provider === "api" && OAUTH_IMAGE_MODELS.has(model) && !API_IMAGE_MODELS.has(model)) {
+        return config.apiProvider?.defaultImageModel || API_FALLBACK_IMAGE_MODEL;
+    }
+    return model;
+}
 const PROVIDERS = deriveProviderIdSet();
 const QUALITIES = new Set(["low", "medium", "high"]);
 const FORMATS = new Set(["png", "jpeg", "webp"]);
@@ -10,7 +27,7 @@ const MAX_AGENT_VARIANTS = Math.max(1, Math.trunc(config.limits.maxGeneratedImag
 const MAX_AGENT_PARALLELISM = Math.max(1, Math.trunc(config.limits.maxParallel));
 export const DEFAULT_AGENT_GENERATION_SETTINGS = {
     provider: "oauth",
-    model: "gpt-5.6-luna",
+    model: FALLBACK_IMAGE_MODEL,
     quality: "medium",
     size: "1024x1024",
     format: "png",
@@ -24,9 +41,10 @@ export const DEFAULT_AGENT_GENERATION_SETTINGS = {
 };
 export function normalizeAgentGenerationSettings(value, fallback = DEFAULT_AGENT_GENERATION_SETTINGS) {
     const input = value && typeof value === "object" ? value : {};
+    const provider = cleanEnum(input.provider, PROVIDERS, fallback.provider);
     return {
-        provider: cleanEnum(input.provider, PROVIDERS, fallback.provider),
-        model: cleanString(input.model, fallback.model),
+        provider,
+        model: modelForLane(provider, cleanString(input.model, fallback.model)),
         quality: cleanEnum(input.quality, QUALITIES, fallback.quality),
         size: cleanSize(input.size, fallback.size),
         format: cleanEnum(input.format, FORMATS, fallback.format),

package/lib/assetLifecycle.js

@@ -1,3 +1,4 @@
+import { thrownFields } from "./errInfo.js";
 import { getDb } from "./db.js";
 import { mkdir, rename, unlink, lstat, realpath } from "fs/promises";
 import { basename, dirname, join, resolve, sep } from "path";
@@ -102,7 +103,8 @@ export async function trashAsset(rootDir, filename) {
         await assertRegularGeneratedPath(src);
     }
     catch (cause) {
-        if (cause?.code !== "ENOENT")
+        const causeFields = thrownFields(cause);
+        if (causeFields.code !== "ENOENT")
             throw cause;
         const err = new Error("Asset not found");
         err.status = 404;
@@ -116,7 +118,8 @@ export async function trashAsset(rootDir, filename) {
         paths.push(sidecar);
     }
     catch (err) {
-        if (err?.code !== "ENOENT")
+        const errFields = thrownFields(err);
+        if (errFields.code !== "ENOENT")
             throw err;
     }
     let trashMethod = "system";
@@ -149,7 +152,8 @@ export async function deleteAssetPermanent(rootDir, filename) {
         await assertRegularGeneratedPath(src);
     }
     catch (cause) {
-        if (cause?.code !== "ENOENT")
+        const causeFields = thrownFields(cause);
+        if (causeFields.code !== "ENOENT")
             throw cause;
         const err = new Error("Asset not found");
         err.status = 404;
@@ -163,7 +167,8 @@ export async function deleteAssetPermanent(rootDir, filename) {
         await unlink(sidecar);
     }
     catch (err) {
-        if (err?.code !== "ENOENT")
+        const errFields = thrownFields(err);
+        if (errFields.code !== "ENOENT")
             throw err;
     }
     const summary = markNodesAssetMissing(filename);

package/lib/cardNewsGenerator.js

@@ -1,7 +1,7 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { ulid } from "ulid";
-import { generateViaOAuth } from "./oauthProxy.js";
+import { generateViaResponses } from "./providers/adapters/openaiOperations.js";
 import { readTemplateBaseB64 } from "./cardNewsTemplateStore.js";
 import { writeCardNewsManifest, writeCardSidecar } from "./cardNewsManifestStore.js";
 import { invalidateHistoryIndex } from "./historyIndex.js";
@@ -101,7 +101,8 @@ export async function generateCardNewsSet(ctxIn, input, options = {}) {
     const size = input.size || template.size || "2048x2048";
     const moderation = input.moderation || "low";
     const model = input.model || ctx.config.imageModels.default;
-    const generateFn = options.generateFn || generateViaOAuth;
+    // GPT OAuth lane (lib/oauthImages.ts): the template image rides along as the edit source.
+    const generateFn = options.generateFn || ((...args) => generateViaResponses("oauth", ...args));
     const generatedCards = await mapLimit(cardsToGenerate, concurrency, async (card, index) => {
         const cardOrder = Number(card.cardOrder || card.order || index + 1);
         const baseFilename = `card-${String(cardOrder).padStart(2, "0")}`;

package/lib/cardNewsManifestStore.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { requireRuntimeContext } from "./runtimeContext.js";
-import { errInfo } from "./errInfo.js";
+import { errInfo, thrownFields } from "./errInfo.js";
 import { assertSafeSetId, resolveCardNewsSetDir } from "./cardNewsPath.js";
 export async function writeCardNewsManifest(generatedDir, manifest) {
     const dir = resolveCardNewsSetDir(generatedDir, manifest.setId);
@@ -56,7 +56,8 @@ export async function readCardNewsManifest(ctxIn, setId) {
         return JSON.parse(raw);
     }
     catch (err) {
-        if (err.code === "CARD_NEWS_SET_NOT_FOUND")
+        const errFields = thrownFields(err);
+        if (errFields.code === "CARD_NEWS_SET_NOT_FOUND")
             throw err;
         const notFound = new Error("Card News set not found");
         notFound.status = 404;

package/lib/cardNewsPlanner.js

@@ -155,6 +155,7 @@ export async function createCardNewsDraft(ctxOrInput = {}, maybeInput = {}) {
         const messages = buildCardNewsPlannerMessages({ ...input, roleTemplate, imageTemplate });
         const raw = await requestCardNewsPlannerJson({ messages }, {
             oauthUrl: ctx.oauthUrl,
+            oauthTransport: ctx.oauthTransport,
             model: planner.model,
             timeoutMs: planner.timeoutMs,
         });

package/lib/cardNewsPlannerClient.js

@@ -1,6 +1,8 @@
 import { config } from "../config.js";
 import { CARD_NEWS_PLANNER_SCHEMA } from "./cardNewsPlannerSchema.js";
 import { logEvent } from "./logger.js";
+import { oauthFetch } from "./codexBackend/index.js";
+import { migrateOAuthImageModel } from "./oauthLegacyModels.js";
 function plannerError(message, code, status = 502) {
     const err = new Error(message);
     err.code = code;
@@ -32,7 +34,7 @@ function extractText(json) {
     }
     return "";
 }
-async function requestJson({ oauthUrl, model, messages, timeoutMs, structured, reasoningEffort }) {
+async function requestJson({ oauthUrl, oauthTransport, model, messages, timeoutMs, structured, reasoningEffort }) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
@@ -54,7 +56,7 @@ async function requestJson({ oauthUrl, model, messages, timeoutMs, structured, r
                 }
                 : { text: { format: { type: "json_object" } } }),
         };
-        const res = await fetch(`${oauthUrl}/v1/responses`, {
+        const res = await oauthFetch({ oauthUrl, oauthTransport }, "/v1/responses", {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             signal: controller.signal,
@@ -75,11 +77,11 @@ async function requestJson({ oauthUrl, model, messages, timeoutMs, structured, r
         clearTimeout(timer);
     }
 }
-async function requestChatJson({ oauthUrl, model, messages, timeoutMs }) {
+async function requestChatJson({ oauthUrl, oauthTransport, model, messages, timeoutMs }) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const res = await fetch(`${oauthUrl}/v1/chat/completions`, {
+        const res = await oauthFetch({ oauthUrl, oauthTransport }, "/v1/chat/completions", {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             signal: controller.signal,
@@ -106,20 +108,22 @@ async function requestChatJson({ oauthUrl, model, messages, timeoutMs }) {
 }
 export async function requestCardNewsPlannerJson(input, options = {}) {
     const oauthUrl = options.oauthUrl || `http://127.0.0.1:${config.oauth.proxyPort}`;
-    const model = options.model || config.cardNewsPlanner.model;
+    const oauthTransport = options.oauthTransport;
+    // A saved pre-GPT-6 planner id runs on its GPT-6 tier, like every other GPT OAuth caller.
+    const model = migrateOAuthImageModel(options.model || config.cardNewsPlanner.model);
     const timeoutMs = options.timeoutMs || config.cardNewsPlanner.timeoutMs;
     const reasoningEffort = options.reasoningEffort || config.imageModels?.reasoningEffort || "medium";
     let text = "";
     let mode = "structured-output";
     try {
-        text = await requestJson({ oauthUrl, model, messages: input.messages, timeoutMs, structured: true, reasoningEffort });
+        text = await requestJson({ oauthUrl, oauthTransport, model, messages: input.messages, timeoutMs, structured: true, reasoningEffort });
     }
     catch (err) {
         const code = err?.code;
         if (code !== "PLANNER_UPSTREAM_FAILED")
             throw err;
         mode = "json-mode";
-        text = await requestChatJson({ oauthUrl, model, messages: input.messages, timeoutMs });
+        text = await requestChatJson({ oauthUrl, oauthTransport, model, messages: input.messages, timeoutMs });
     }
     try {
         return { output: JSON.parse(text), mode, model };

package/lib/chatgptAuth.js

@@ -3,13 +3,13 @@
  *
  * Ported from OpenCodex `src/oauth/chatgpt.ts` (constants, JWT identity helpers) and its
  * store discipline (atomic 0600 writes, 0700 directory). ima2 keeps its own session file so
- * the openai-oauth proxy and the Codex CLI never rotate the same refresh token: a shared
+ * ima2's GPT OAuth client and the Codex CLI never rotate the same refresh token: a shared
  * ~/.codex/auth.json made whichever process refreshed second lose the session
  * (refresh_token_reused), which surfaced as "logged in, but GPT OAuth still says log in".
  *
  * The file keeps the Codex auth.json shape (`tokens.{id_token,access_token,refresh_token,
- * account_id}` + `last_refresh`) because openai-oauth reads it through `--oauth-file` and
- * writes refreshed tokens back into it.
+ * account_id}` + `last_refresh`) because lib/codexBackend/session.ts reads it on every request
+ * and writes refreshed tokens back into it.
  *
  * MUST stay a leaf module: only node:fs, node:crypto, node:os, node:path.
  */

package/lib/codexBackend/client.js

@@ -0,0 +1,127 @@
+/**
+ * Transport to chatgpt.com/backend-api/codex: client version, model catalog, auth headers
+ * and the one-shot 401 recovery: what the openai-oauth proxy used to do for ima2, in process.
+ */
+import { config } from "../../config.js";
+import { createCodexSessionStore } from "./session.js";
+const CODEX_REGISTRY_URL = "https://registry.npmjs.org/@openai/codex/latest";
+/** Lowest Codex client version measured to list the GPT-6 models (2026-09-25). */
+export const CODEX_CLIENT_VERSION_FLOOR = "0.157.0";
+const VERSION_TTL_MS = 60 * 60 * 1000;
+const CATALOG_TTL_MS = 10 * 60 * 1000;
+const CATALOG_FAILURE_TTL_MS = 30 * 1000;
+let versionCache = null;
+let versionInflight = null;
+const catalogCache = new Map();
+let store = null;
+export function codexSessionStore() {
+    store ??= createCodexSessionStore();
+    return store;
+}
+/** Test seam: swap the session store (e.g. a temp config dir and a fake refresher). */
+export function setCodexSessionStoreForTests(next) {
+    store = next;
+    catalogCache.clear();
+    versionCache = null;
+}
+/** Forget cached catalogs so a new login's account roster is read on the next call. */
+export function resetCodexCaches() {
+    catalogCache.clear();
+}
+export function codexBaseUrl() {
+    return config.oauth.codexBaseUrl.replace(/\/+$/, "");
+}
+function compareVersions(a, b) {
+    const pa = a.split(".").map((part) => Number.parseInt(part, 10) || 0);
+    const pb = b.split(".").map((part) => Number.parseInt(part, 10) || 0);
+    for (let i = 0; i < 3; i++)
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) - (pb[i] ?? 0);
+    return 0;
+}
+export async function codexClientVersion() {
+    if (config.oauth.codexClientVersion)
+        return config.oauth.codexClientVersion;
+    if (versionCache && versionCache.expiresAt > Date.now())
+        return versionCache.value;
+    versionInflight ??= (async () => {
+        try {
+            const res = await fetch(CODEX_REGISTRY_URL, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(5000) });
+            const version = res.ok ? String((await res.json()).version ?? "") : "";
+            const value = /^\d+\.\d+\.\d+/.test(version) && compareVersions(version, CODEX_CLIENT_VERSION_FLOOR) >= 0
+                ? version.match(/^\d+\.\d+\.\d+/)?.[0] ?? CODEX_CLIENT_VERSION_FLOOR
+                : CODEX_CLIENT_VERSION_FLOOR;
+            versionCache = { value, expiresAt: Date.now() + VERSION_TTL_MS };
+            return value;
+        }
+        catch {
+            return CODEX_CLIENT_VERSION_FLOOR;
+        }
+        finally {
+            versionInflight = null;
+        }
+    })();
+    return versionInflight;
+}
+export function authHeaders(session, extra) {
+    const headers = new Headers(extra);
+    headers.delete("authorization");
+    headers.set("Authorization", `Bearer ${session.accessToken}`);
+    headers.set("chatgpt-account-id", session.accountId);
+    if (session.isFedRamp)
+        headers.set("X-OpenAI-Fedramp", "true");
+    return headers;
+}
+/**
+ * Authenticated upstream fetch. An upstream 401 triggers one shared refresh and one retry,
+ * as long as the body can be replayed (strings only).
+ */
+export async function codexUpstream(path, init = {}) {
+    const sessions = codexSessionStore();
+    const session = await sessions.get();
+    const url = `${codexBaseUrl()}${path}`;
+    const res = await fetch(url, { ...init, headers: authHeaders(session, init.headers) });
+    if (res.status !== 401 || (init.body != null && typeof init.body !== "string"))
+        return res;
+    let fresh;
+    try {
+        fresh = await sessions.refresh(session.accessToken);
+    }
+    catch {
+        return res;
+    }
+    if (fresh.accessToken === session.accessToken)
+        return res;
+    await res.body?.cancel().catch(() => undefined);
+    return fetch(url, { ...init, headers: authHeaders(fresh, init.headers) });
+}
+/** The account's model roster at the current client version, cached per account. */
+export async function codexCatalog() {
+    const session = await codexSessionStore().get();
+    const cached = catalogCache.get(session.accountId);
+    if (cached && cached.expiresAt > Date.now())
+        return cached.models;
+    try {
+        const version = await codexClientVersion();
+        const res = await codexUpstream(`/models?client_version=${encodeURIComponent(version)}`, { signal: AbortSignal.timeout(10_000) });
+        if (!res.ok)
+            throw new Error(`catalog HTTP ${res.status}`);
+        const body = (await res.json());
+        const models = (body.models ?? [])
+            .filter((row) => typeof row.slug === "string" && row.visibility !== "hide")
+            .map((row) => ({ slug: row.slug, lite: row.use_responses_lite === true }));
+        catalogCache.set(session.accountId, { expiresAt: Date.now() + CATALOG_TTL_MS, models });
+        return models;
+    }
+    catch {
+        catalogCache.set(session.accountId, { expiresAt: Date.now() + CATALOG_FAILURE_TTL_MS, models: cached?.models ?? [] });
+        return cached?.models ?? [];
+    }
+}
+/** GPT-6 and GPT-5.6 are lite on the Codex backend; an unknown catalog falls back to the family rule. */
+export async function isLiteModel(model) {
+    if (typeof model !== "string")
+        return false;
+    const entry = (await codexCatalog()).find((row) => row.slug === model);
+    return entry ? entry.lite : /^gpt-(6|5\.6)(-|$)/.test(model);
+}

package/lib/codexBackend/index.js

@@ -0,0 +1,150 @@
+/**
+ * GPT OAuth transport. \`oauthFetch(ctx, "/v1/…", init)\` is the single entry every GPT OAuth
+ * caller uses:
+ *   - native (default for a running server): ima2 calls chatgpt.com/backend-api/codex itself
+ *     with the ChatGPT session file — no child proxy, no port;
+ *   - proxy: plain HTTP to \`ctx.oauthUrl\` (IMA2_NO_OAUTH_PROXY pointing at an external
+ *     OpenAI-compatible proxy, and every test that stubs the proxy URL).
+ * The native side answers with the same OpenAI-compatible shapes the proxy returned, so callers
+ * keep their parsing code.
+ */
+import { coerceReasoningEffortForModel } from "../imageModels.js";
+import { codexCatalog, codexUpstream, isLiteModel } from "./client.js";
+import { RESPONSES_LITE_HEADER, chatToResponsesBody, collectCompletedResponse, editsFormToJson, normalizeResponsesBody, responsesToChatCompletion, } from "./normalize.js";
+import { CodexSessionError } from "./session.js";
+export { codexCatalog, codexSessionStore, setCodexSessionStoreForTests, codexClientVersion, resetCodexCaches } from "./client.js";
+export { CodexSessionError } from "./session.js";
+export const CODEX_IMAGE_MODEL = "gpt-image-2";
+function jsonResponse(body, status = 200) {
+    return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+function errorResponse(message, status, code) {
+    return jsonResponse({ error: { message, type: status === 401 ? "authentication_error" : "invalid_request_error", code } }, status);
+}
+async function readJsonBody(init) {
+    if (typeof init.body !== "string")
+        return null;
+    try {
+        const parsed = JSON.parse(init.body);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** POST a Responses body upstream; stream it back or collect it into the completed JSON. */
+async function sendResponses(body, wantsStream, signal) {
+    const lite = await isLiteModel(body.model);
+    const reasoning = body.reasoning && typeof body.reasoning === "object" ? { ...body.reasoning } : null;
+    if (reasoning && typeof body.model === "string") {
+        reasoning.effort = coerceReasoningEffortForModel(body.model, reasoning.effort);
+    }
+    const normalized = normalizeResponsesBody(reasoning ? { ...body, reasoning } : body, lite);
+    const headers = { "content-type": "application/json", accept: "text/event-stream" };
+    if (lite)
+        headers[RESPONSES_LITE_HEADER] = "true";
+    const res = await codexUpstream("/responses", { method: "POST", headers, body: JSON.stringify(normalized), ...(signal ? { signal } : {}) });
+    if (!res.ok || !res.body)
+        return res;
+    if (wantsStream) {
+        return new Response(res.body, { status: res.status, headers: { "content-type": "text/event-stream" } });
+    }
+    const { response, error } = await collectCompletedResponse(res.body);
+    if (response)
+        return jsonResponse(response);
+    return jsonResponse({ error: error ?? { message: "Codex response stream ended without a completed response" } }, 502);
+}
+async function routeResponses(init) {
+    const body = await readJsonBody(init);
+    if (!body)
+        return errorResponse("Responses requests need a JSON body.", 400, "invalid_request");
+    return sendResponses(body, body.stream === true, init.signal);
+}
+async function routeChat(init) {
+    const body = await readJsonBody(init);
+    if (!body)
+        return errorResponse("Chat requests need a JSON body.", 400, "invalid_request");
+    if (body.stream === true)
+        return errorResponse("Streaming chat completions are not supported on GPT OAuth.", 400, "invalid_request");
+    const res = await sendResponses(chatToResponsesBody(body), false, init.signal);
+    if (!res.ok)
+        return res;
+    return jsonResponse(responsesToChatCompletion((await res.json())));
+}
+async function routeImages(kind, init) {
+    let body;
+    if (kind === "edits" && typeof FormData !== "undefined" && init.body instanceof FormData) {
+        body = await editsFormToJson(init.body);
+    }
+    else {
+        body = await readJsonBody(init);
+    }
+    if (!body)
+        return errorResponse("Image requests need a JSON or multipart body.", 400, "invalid_request");
+    const { stream: _stream, response_format: _format, ...rest } = body;
+    const payload = { ...rest, model: typeof rest.model === "string" && rest.model ? rest.model : CODEX_IMAGE_MODEL };
+    return codexUpstream(`/images/${kind}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(payload),
+        ...(init.signal ? { signal: init.signal } : {}),
+    });
+}
+async function routeModels() {
+    const models = await codexCatalog();
+    if (!models.length)
+        return errorResponse("Failed to load models from Codex.", 502, "catalog_unavailable");
+    const ids = [...new Set([...models.map((model) => model.slug), CODEX_IMAGE_MODEL])];
+    return jsonResponse({ object: "list", data: ids.map((id) => ({ id, object: "model", created: 0, owned_by: "codex-oauth" })) });
+}
+/** In-process equivalent of the proxy's /v1 surface. */
+export async function codexFetch(path, init = {}) {
+    try {
+        const route = path.split("?")[0];
+        if (route === "/v1/responses")
+            return await routeResponses(init);
+        if (route === "/v1/chat/completions")
+            return await routeChat(init);
+        if (route === "/v1/images/generations")
+            return await routeImages("generations", init);
+        if (route === "/v1/images/edits")
+            return await routeImages("edits", init);
+        if (route === "/v1/models")
+            return await routeModels();
+        return errorResponse(`Unknown GPT OAuth route ${route}`, 404, "not_found");
+    }
+    catch (error) {
+        if (error instanceof CodexSessionError)
+            return errorResponse(error.message, 401, error.code);
+        throw error;
+    }
+}
+export function usesNativeOAuth(ctx) {
+    return ctx?.oauthTransport === "native";
+}
+/** Drop trailing slashes with a linear scan (no regex backtracking on untrusted input). */
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47)
+        end--;
+    return value.slice(0, end);
+}
+/** An external endpoint URL without embedded credentials or a trailing slash. */
+export function safeOAuthBaseUrl(value) {
+    try {
+        const parsed = new URL(value);
+        parsed.username = "";
+        parsed.password = "";
+        return trimTrailingSlashes(parsed.toString());
+    }
+    catch {
+        return trimTrailingSlashes(value);
+    }
+}
+/** The one call every GPT OAuth caller makes. */
+export function oauthFetch(ctx, path, init = {}) {
+    if (usesNativeOAuth(ctx))
+        return codexFetch(path, init);
+    const base = safeOAuthBaseUrl(ctx?.oauthUrl || "http://127.0.0.1:10531");
+    return fetch(`${base}${path}`, init);
+}