ima2-gen 3.20.0 → 3.21.0

package/bin/lib/args.js

@@ -1,13 +1,19 @@
 // Tiny argv parser — no dependencies.
 // Supports: --long, --long=val, --long val, -s, -s val, repeatable flags, positional, --.
+function pushRepeatable(out, name, val) {
+    const list = out[name];
+    if (Array.isArray(list))
+        list.push(val);
+}
 export function parseArgs(argv, spec = {}) {
+    const flags = spec.flags || {};
     const shortMap = {};
-    for (const [name, def] of Object.entries(spec.flags || {})) {
+    for (const [name, def] of Object.entries(flags)) {
         if (def.short)
             shortMap[def.short] = name;
     }
     const out = { positional: [], _unknown: [], _present: [] };
-    for (const [name, def] of Object.entries(spec.flags || {})) {
+    for (const [name, def] of Object.entries(flags)) {
         if (def.repeatable)
             out[name] = [];
         else if ("default" in def)
@@ -32,7 +38,7 @@ export function parseArgs(argv, spec = {}) {
         if (a.startsWith("--")) {
             const eq = a.indexOf("=");
             const name = eq > -1 ? a.slice(2, eq) : a.slice(2);
-            const def = (spec.flags || {})[name];
+            const def = flags[name];
             if (!def) {
                 out._unknown.push(a);
                 i++;
@@ -48,7 +54,7 @@ export function parseArgs(argv, spec = {}) {
                 if (eq === -1)
                     i++;
                 if (def.repeatable)
-                    out[name].push(val);
+                    pushRepeatable(out, name, val);
                 else
                     out[name] = val;
                 i++;
@@ -63,7 +69,9 @@ export function parseArgs(argv, spec = {}) {
                 continue;
             }
             out._present.push(name);
-            const def = spec.flags[name];
+            const def = flags[name];
+            if (!def)
+                break;
             if (def.type === "boolean") {
                 out[name] = true;
                 i++;
@@ -71,7 +79,7 @@ export function parseArgs(argv, spec = {}) {
             else {
                 const val = argv[i + 1];
                 if (def.repeatable)
-                    out[name].push(val);
+                    pushRepeatable(out, name, val);
                 else
                     out[name] = val;
                 i += 2;

package/bin/lib/client.js

@@ -208,6 +208,15 @@ async function selectServer(value) {
         throw error;
     }
 }
+function errorField(json, key) {
+    if (!json || typeof json !== "object")
+        return undefined;
+    const error = json.error;
+    if (!error || typeof error !== "object")
+        return undefined;
+    return error[key];
+}
+// Response bodies are server JSON; callers declare the shape they consume via T.
 export async function request(base, path, { method = "GET", body, headers: extraHeaders, raw = false, timeoutMs = 180_000, } = {}) {
     const baseHeaders = raw
         ? { "X-ima2-client": `cli/${CLI_VERSION}` }
@@ -224,9 +233,7 @@ export async function request(base, path, { method = "GET", body, headers: extra
             method,
             // connection: close — see the health-check note above.
             headers: { connection: "close", ...finalHeaders },
-            body: body === undefined ? undefined
-                : raw ? body
-                    : JSON.stringify(body),
+            ...(body === undefined ? {} : { body: raw ? body : JSON.stringify(body) }),
             signal: controller.signal,
         });
         text = await res.text();
@@ -238,11 +245,13 @@ export async function request(base, path, { method = "GET", body, headers: extra
     try {
         json = JSON.parse(text);
     }
-    catch { }
+    catch { /* best-effort: non-JSON bodies are handled below via the raw text */ }
     if (!res.ok) {
-        const err = new Error(json?.error?.message || json?.error || `HTTP ${res.status}`);
+        const top = json && typeof json === "object" ? json : undefined;
+        const message = errorField(json, "message") || top?.error || `HTTP ${res.status}`;
+        const err = new Error(String(message));
         err.status = res.status;
-        err.code = json?.error?.code || json?.code || null;
+        err.code = errorField(json, "code") || top?.code || null;
         err.body = json || text;
         throw err;
     }

package/bin/lib/doctor-runtime.js

@@ -2,8 +2,8 @@ import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { getUiDistBuildStatus } from "./ui-build.js";
-const RUNTIME_DEPENDENCIES = ["express", "better-sqlite3", "openai", "openai-oauth", "@openai/codex/package.json", "zod"];
-const REQUIRED_BINS = [["openai-oauth", "openai-oauth"], ["@openai/codex", "codex"]];
+const RUNTIME_DEPENDENCIES = ["express", "better-sqlite3", "openai", "@openai/codex/package.json", "zod"];
+const REQUIRED_BINS = [["@openai/codex", "codex"]];
 const line = (code, kind, text) => ({ code, kind, text, evidence: "local" });
 export function parseMinimumNodeMajor(engine) {
     if (typeof engine !== "string" || !/^>=[1-9][0-9]*$/.test(engine))

package/bin/lib/error-hints.js

@@ -1,9 +1,9 @@
 const HINTS = {
     SERVER_UNREACHABLE: "Start `ima2 serve`, or pass `--server <url>`.",
     APIKEY_DISABLED: "API-key generation is supported in current builds; switch providers or update the configured API key.",
-    IMAGE_MODEL_UNSUPPORTED: "This model is visible but cannot generate images here. Use gpt-5.4 or gpt-5.4-mini.",
-    INVALID_IMAGE_MODEL: "Use one of: gpt-5.5, gpt-5.4, gpt-5.4-mini, gpt-5.6-sol, gpt-5.6-terra, gpt-5.6-luna, gpt-6-astra.",
-    OAUTH_UNAVAILABLE: "GPT OAuth proxy is unavailable. Check `ima2 doctor` and restart `ima2 serve`.",
+    IMAGE_MODEL_UNSUPPORTED: "This model is visible but cannot generate images here. Use gpt-6-luna, gpt-6-sol, or gpt-6-astra.",
+    INVALID_IMAGE_MODEL: "GPT OAuth: gpt-6-luna, gpt-6-sol, gpt-6-astra. OpenAI API: see `ima2 models --lane api`.",
+    OAUTH_UNAVAILABLE: "GPT OAuth is unavailable. Check `ima2 doctor` and `ima2 gpt status`.",
     NETWORK_FAILED: "Network/proxy failed. This is not a moderation refusal.",
     SAFETY_REFUSAL: "The image backend refused this generation.",
     MODERATION_REFUSED: "The prompt or image was rejected by moderation.",

package/bin/lib/model-aliases.js

@@ -1,9 +1,7 @@
 export const IMAGE_MODEL_ALIASES = {
-    luna: "gpt-5.6-luna",
+    luna: "gpt-6-luna",
+    sol: "gpt-6-sol",
     astra: "gpt-6-astra",
-    sol: "gpt-5.6-sol",
-    terra: "gpt-5.6-terra",
-    spark: "gpt-5.3-codex-spark",
 };
 export function canonicalizeImageModel(value) {
     if (value === undefined || value === null || value === "")

package/bin/lib/modelResolver.js

@@ -1,5 +1,6 @@
 import { canonicalizeImageModel } from "./model-aliases.js";
 import { deriveProviderIds } from "../../lib/providers/derive.js";
+import { migrateOAuthImageModel } from "../../lib/oauthLegacyModels.js";
 import { listProviders } from "../../lib/mcp/providerRegistry.js";
 const LANES = [
     ...deriveProviderIds(),
@@ -16,16 +17,21 @@ function knownLane(value, catalog) {
 function canonicalModel(kind, model) {
     return kind === "image" ? canonicalizeImageModel(model) ?? model : model;
 }
+/** GPT OAuth keeps only GPT-6; a saved or scripted legacy OAuth id resolves to its GPT-6 tier. */
+function laneModel(lane, kind, model) {
+    return kind === "image" && lane === "oauth" ? migrateOAuthImageModel(model) : model;
+}
 function modelExists(info, kind, model) {
     return info?.models[kind].some((entry) => entry.id === model) ?? false;
 }
 function findModel(info, kind, model) {
     return info?.models[kind].find((entry) => entry.id === model);
 }
-function resolveLaneModel(kind, lane, model, catalog) {
+function resolveLaneModel(kind, lane, requested, catalog) {
     const info = catalog.lanes[lane];
     if (!info)
         return failure("UNKNOWN_LANE", `Unknown lane: ${lane}`);
+    const model = laneModel(lane, kind, requested);
     const entry = findModel(info, kind, model);
     if (!entry) {
         const otherKind = kind === "image" ? "video" : "image";
@@ -88,10 +94,11 @@ function resolveNamespaced(kind, rawModel, provider, catalog) {
 }
 function resolveBare(kind, rawModel, provider, catalog) {
     const model = canonicalModel(kind, rawModel);
+    const existsIn = (lane) => modelExists(catalog.lanes[lane], kind, laneModel(lane, kind, model));
     const lanes = provider
         ? [provider]
-        : LANES.filter((lane) => modelExists(catalog.lanes[lane], kind, model));
-    const matches = lanes.filter((lane) => modelExists(catalog.lanes[lane], kind, model));
+        : LANES.filter(existsIn);
+    const matches = lanes.filter(existsIn);
     if (matches.length > 1) {
         return failure("MODEL_AMBIGUOUS", `${model} exists in multiple lanes; pass --provider <lane>`, {
             candidates: matches.map((lane) => `${lane}/${model}`),

package/bin/lib/platform.js

@@ -3,6 +3,7 @@
 import { spawn, execFileSync, execSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { errInfo } from "../../lib/errInfo.js";
+import { logWarn } from "../../lib/logger.js";
 export const isWin = process.platform === "win32";
 export const isMac = process.platform === "darwin";
 export const isLinux = !isWin && !isMac;
@@ -104,7 +105,9 @@ export function onShutdown(handler) {
                 try {
                     await handler(sig);
                 }
-                catch { }
+                catch (err) {
+                    logWarn("shutdown", "handler_failed", { signal: sig, error: err });
+                }
                 process.exit(0);
             });
         }

package/bin/lib/sse.js

@@ -3,6 +3,10 @@ import { parseEventCursor } from "../../lib/eventsPolicy.js";
 import { fetchServerUrl } from "./client.js";
 let CLI_VERSION = "0.0.0";
 export function setCliVersion(v) { CLI_VERSION = v; }
+/** Field view of an SSE payload; non-object payloads expose no fields. */
+export function sseFields(data) {
+    return data && typeof data === "object" ? data : {};
+}
 function requestHeaders(init) {
     return {
         Accept: "text/event-stream",

package/bin/lib/star-prompt.js

@@ -1,32 +1,12 @@
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { config } from "../../config.js";
+import { STAR_REPO, ghAuthStatusArgs, ghStarWriteArgs, ghVersionArgs, hasBeenPrompted, markPrompted, starPromptStatePath, } from "../../lib/githubStar.js";
 import { isAgentDriven } from "./agent-driven.js";
 import { interactiveConfirm } from "./interactive-confirm.js";
-const REPO = "lidge-jun/ima2-gen";
-export function starPromptStatePath() {
-    return join(config.storage.configDir, "state", "star-prompt.json");
-}
-export async function hasBeenPrompted() {
-    const path = starPromptStatePath();
-    if (!existsSync(path))
-        return false;
-    try {
-        const content = await readFile(path, "utf8");
-        const state = JSON.parse(content);
-        return typeof state.prompted_at === "string";
-    }
-    catch {
-        return false;
-    }
-}
-export async function markPrompted() {
-    const path = starPromptStatePath();
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, JSON.stringify({ prompted_at: new Date().toISOString() }, null, 2));
-}
+// The studio's star dialog (routes/github.ts) shares this state file and these
+// gh commands; the CLI keeps a synchronous spawn because it prompts before the
+// server exists.
+export { hasBeenPrompted, markPrompted, starPromptStatePath };
+const REPO = STAR_REPO;
 /**
  * Whether `gh` is both installed and logged in. Starring goes through the
  * user's own `gh` auth, so an unauthenticated CLI cannot fulfil a "Yes" — in
@@ -34,7 +14,7 @@ export async function markPrompted() {
  * then fail to do.
  */
 export function isGhInstalled(spawnSyncFn = spawnSync) {
-    const version = spawnSyncFn("gh", ["--version"], {
+    const version = spawnSyncFn("gh", ghVersionArgs(), {
         encoding: "utf8",
         stdio: ["ignore", "ignore", "ignore"],
         timeout: 3000,
@@ -42,7 +22,7 @@ export function isGhInstalled(spawnSyncFn = spawnSync) {
     });
     if (version.error || version.status !== 0)
         return false;
-    const auth = spawnSyncFn("gh", ["auth", "status"], {
+    const auth = spawnSyncFn("gh", ghAuthStatusArgs(), {
         encoding: "utf8",
         stdio: ["ignore", "ignore", "ignore"],
         timeout: 5000,
@@ -51,7 +31,7 @@ export function isGhInstalled(spawnSyncFn = spawnSync) {
     return !auth.error && auth.status === 0;
 }
 export function starRepo(spawnSyncFn = spawnSync) {
-    const result = spawnSyncFn("gh", ["api", "-X", "PUT", `/user/starred/${REPO}`], {
+    const result = spawnSyncFn("gh", ghStarWriteArgs(), {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
         timeout: 10000,

package/bin/lib/videoMcp.js

@@ -11,7 +11,7 @@ import { characterElementIdForMcp } from "./characterResolve.js";
 import { resolveTarget } from "./modelResolver.js";
 import { color, die, err, exitCodeForError, fail, json, out } from "./output.js";
 import { createCliRequestId } from "./recover-output.js";
-import { streamSse } from "./sse.js";
+import { streamSse, sseFields } from "./sse.js";
 const VALID_RESOLUTIONS = new Set(["480p", "720p", "1080p"]);
 const VALID_ASPECT_RATIOS = new Set(["1:1", "16:9", "9:16", "4:3", "3:4", "3:2", "2:3", "auto"]);
 // Shared client ceiling (see lib/videoClientTimeouts.ts). Also guards the
@@ -169,14 +169,15 @@ async function consumeCoreSse(url, body, args, requestId) {
     let lastProgress = -1;
     try {
         for await (const event of streamSse(url, { body, signal: controller.signal, headers: { "X-Request-Id": requestId } })) {
+            const data = sseFields(event.data);
             if (event.event === "planning" && !args.json) {
                 out(color.dim("[planning] preparing video generation..."));
             }
             else if (event.event === "submitted" && !args.json) {
-                out(color.dim(`[submitted] xai request: ${event.data.xaiVideoRequestId || "..."}`));
+                out(color.dim(`[submitted] xai request: ${data.xaiVideoRequestId || "..."}`));
             }
             else if (event.event === "progress") {
-                const progress = typeof event.data.progress === "number" ? Math.round(event.data.progress * 100) : null;
+                const progress = typeof data.progress === "number" ? Math.round(data.progress * 100) : null;
                 if (progress !== null && progress !== lastProgress && !args.json) {
                     process.stdout.write(`\r  ${renderBar(progress)} ${progress}%`);
                     lastProgress = progress;
@@ -185,12 +186,12 @@ async function consumeCoreSse(url, body, args, requestId) {
             else if (event.event === "done") {
                 if (!args.json && lastProgress >= 0)
                     process.stdout.write("\n");
-                done = event.data;
+                done = data;
             }
             else if (event.event === "error") {
                 if (!args.json && lastProgress >= 0)
                     process.stdout.write("\n");
-                die(1, `video error: ${event.data.error || event.data}${event.data.guidance ? `\n${event.data.guidance}` : ""}${event.data.code ? ` (${event.data.code})` : ""}`);
+                die(1, `video error: ${data.error || event.data}${data.guidance ? `\n${data.guidance}` : ""}${data.code ? ` (${data.code})` : ""}`);
             }
         }
     }

package/config.js

@@ -16,6 +16,7 @@ import { readFileSync, existsSync } from "node:fs";
 import { parsePublicOrigins } from "./lib/localAccessPolicy.js";
 export { SSE_STREAM_POLICY } from "./lib/eventsPolicy.js";
 import { deriveSupportedImageModels, deriveUnsupportedImageModels } from "./lib/providers/derive.js";
+import { migrateOAuthImageModel } from "./lib/oauthLegacyModels.js";
 import { DEFAULT_PROMPT_BUILDER_MODELS, PROMPT_BUILDER_BACKENDS, PROMPT_BUILDER_MODELS, } from "./lib/promptBuilder/constants.js";
 // 4.6 rewrites prompts in ways that read worse than 4.3 for this planner's job, which
 // is judged by the result rather than a benchmark. 4.6 stays selectable below.
@@ -168,6 +169,11 @@ export const config = {
         proxyPort: pickInt(firstDefined(env.IMA2_OAUTH_PROXY_PORT, env.OAUTH_PORT), fileCfg.oauth?.proxyPort, 10531),
         // IMA2_NO_OAUTH_PROXY=1 disables auto-start; default is auto-start enabled.
         autoStart: !pickBool(env.IMA2_NO_OAUTH_PROXY, fileCfg.oauth?.disableAutoStart, false),
+        // GPT OAuth calls the Codex backend directly (lib/codexBackend). The base URL and client
+        // version are overridable for tests and for pinning a Codex build; the version otherwise
+        // follows the latest published @openai/codex, which gates the model roster.
+        codexBaseUrl: pickStr(env.IMA2_CODEX_BASE_URL, fileCfg.oauth?.codexBaseUrl, "https://chatgpt.com/backend-api/codex"),
+        codexClientVersion: pickStr(env.IMA2_CODEX_CLIENT_VERSION, fileCfg.oauth?.codexClientVersion, ""),
         statusTimeoutMs: pickInt(env.IMA2_OAUTH_STATUS_TIMEOUT_MS, fileCfg.oauth?.statusTimeoutMs, 3000),
         generationTimeoutMs: pickInt(env.IMA2_OAUTH_GENERATION_TIMEOUT_MS, fileCfg.oauth?.generationTimeoutMs, 400 * 1000),
         restartDelayMs: pickInt(env.IMA2_OAUTH_RESTART_DELAY_MS, fileCfg.oauth?.restartDelayMs, 5000),
@@ -231,16 +237,19 @@ export const config = {
     },
     styleSheet: {
         maxPrefix: pickInt(env.IMA2_STYLE_SHEET_MAX_PREFIX, fileCfg.styleSheet?.maxPrefix, 4000),
-        model: pickStr(env.IMA2_STYLE_MODEL, fileCfg.styleSheet?.model, "gpt-5.6-luna"),
+        model: pickStr(env.IMA2_STYLE_MODEL, fileCfg.styleSheet?.model, "gpt-5.6-luna"), // runs on the API-key client (lib/styleSheet.ts)
     },
     imageModels: {
-        default: pickStr(env.IMA2_IMAGE_MODEL_DEFAULT, fileCfg.imageModels?.default, "gpt-5.6-luna"),
+        // A saved pre-GPT-6 default maps onto its GPT-6 tier so every reader sees an id the lane lists.
+        default: migrateOAuthImageModel(pickStr(env.IMA2_IMAGE_MODEL_DEFAULT, fileCfg.imageModels?.default, "gpt-6-luna")),
         valid: deriveSupportedImageModels("oauth"),
         unsupported: deriveUnsupportedImageModels(),
         reasoningEffort: pickStr(env.IMA2_REASONING_EFFORT, fileCfg.imageModels?.reasoningEffort, "medium"),
         validReasoningEfforts: new Set(["none", "low", "medium", "high", "xhigh", "max"]),
     },
     apiProvider: {
+        /** The OpenAI API-key lane's own image models (GPT OAuth keeps only GPT-6). */
+        validImageModels: deriveSupportedImageModels("api"),
         defaultImageModel: pickStr(env.IMA2_API_IMAGE_MODEL_DEFAULT, fileCfg.apiProvider?.defaultImageModel, "gpt-5.6-luna"),
         defaultReasoningEffort: pickStr(env.IMA2_API_REASONING_EFFORT, fileCfg.apiProvider?.defaultReasoningEffort, "low"),
         defaultSize: pickStr(env.IMA2_API_IMAGE_SIZE, fileCfg.apiProvider?.defaultSize, "1024x1024"),
@@ -313,7 +322,7 @@ export const config = {
     },
     cardNewsPlanner: {
         enabled: pickBool(env.IMA2_CARD_NEWS_PLANNER, fileCfg.cardNewsPlanner?.enabled, true),
-        model: pickStr(env.IMA2_CARD_NEWS_PLANNER_MODEL, fileCfg.cardNewsPlanner?.model, "gpt-5.6-luna"),
+        model: pickStr(env.IMA2_CARD_NEWS_PLANNER_MODEL, fileCfg.cardNewsPlanner?.model, "gpt-6-luna"),
         timeoutMs: pickInt(env.IMA2_CARD_NEWS_PLANNER_TIMEOUT_MS, fileCfg.cardNewsPlanner?.timeoutMs, 60_000),
         deterministicFallback: pickBool(env.IMA2_CARD_NEWS_PLANNER_FALLBACK, fileCfg.cardNewsPlanner?.deterministicFallback, false),
     },

package/docs/API.md

@@ -60,7 +60,7 @@ and shares the app API request budget. Respect `Retry-After` on 429; a full
 
 Image generation supports OAuth, API-key, Grok, and Gemini (`agy` and `gemini-api`) providers.
 
-- `provider: "oauth"` uses the local Codex OAuth proxy.
+- `provider: "oauth"` calls ChatGPT's Codex backend from the server: a GPT-6 model plans the prompt and `gpt-image-2` renders it.
 - `provider: "api"` uses the OpenAI Responses API with the hosted `image_generation` tool.
 - `provider: "grok"` calls `https://api.x.ai` directly with the xAI OAuth session in `~/.progrok/auth.json`. Classic, Node and multimode image generation honor `webSearchEnabled: false` (Node also honors `searchMode: "off"`): this skips `/v1/responses` search, not the configured planner's forced `generate_image` call. Planner default is `grok-4.3`; `grok-4.6` and `grok-4.5` remain selectable overrides. References select `/v1/images/edits` instead of `/v1/images/generations`. Agent's omitted-option search default is unchanged.
 - `provider: "agy"` spawns the Antigravity CLI (`agy -p`) to generate images via Google Gemini's `default_api:generate_image` tool. Model is `nano-banana-2`. Output is fixed at 1024×1024 JPEG. Max 3 reference images (i2i). No web search, quality, size, or mask controls. Multimode returns a single image. Video is unsupported (`AGY_VIDEO_UNSUPPORTED`).
@@ -151,7 +151,7 @@ inventing a runtime `lanes` availability result.
 | `GET` | `/api/health` | Server health, version, paths, provider policy; includes `grok: { auth: "oauth" \| "none" }`, mirrored in `~/.ima2/server.json` |
 | `POST` | `/api/admin/stop` | Clean shutdown (local admin only): requires the boot-generated `X-Ima2-Admin-Nonce` from `~/.ima2/server.json`; any request with an `Origin` header is refused (browser drive-by protection). Responds `202` then self-signals SIGTERM |
 | `GET` | `/api/providers` | Provider availability and runtime ports |
-| `GET` | `/api/oauth/status` | OAuth proxy status and visible models, plus `auth` / `grokAuth` login verdicts: `{ provider, loggedIn, health: healthy\|warning\|reauth_required\|not_logged_in, reason?, source?, email?, plan?, accountId (masked), expiresAt?, refreshable, action?, note? }`. A proxy that exited because no session file exists reports `auth_required`. |
+| `GET` | `/api/oauth/status` | GPT OAuth status and visible models, plus `auth` / `grokAuth` login verdicts: `{ provider, loggedIn, health: healthy\|warning\|reauth_required\|not_logged_in, reason?, source?, email?, plan?, accountId (masked), expiresAt?, refreshable, action?, note? }`. A proxy that exited because no session file exists reports `auth_required`. |
 | `GET` | `/api/grok/status` | xAI OAuth session state and visible xAI image models: `ready`, `no_image_model`, `error`, or `offline` with `reason: "login_required"` when no session is stored |
 | `GET` | `/api/billing` | Billing/status probe, including API key source when configured |
 | `GET` | `/api/quota` | Provider quota: returns `{ codex, grok, nai }`. Codex windows are `5h` and `7d`. NovelAI returns a `v5-battery` remaining-charge window when available (`resetsAt` is the ISO ETA for +1%, not full recharge), with Anlas balances in `nai.anlasFixed` / `nai.anlasPurchased`; a missing meter has no window. NovelAI account email is always null. Eligible Grok Build xAI OIDC/external auth returns a `weekly` percentage/reset window from `GET /v1/billing?format=credits`. If unavailable, the legacy endpoint may return a `monthly` window plus `billing: { usedUsd, limitUsd }`. |
@@ -160,10 +160,10 @@ inventing a runtime `lanes` availability result.
 
 | Method | Path | Notes |
 |---|---|---|
-| `POST` | `/api/auth/switch` | Start an OAuth login. Body: `{ "provider": "grok" \| "codex", "flow"?: "browser" \| "device" }`. `codex` defaults to the browser flow (callback on `localhost:1455`, so the browser must be on the server machine); `device` works from any machine. Grok always uses the device code. Returns `{ sessionId, flow, userCode, verificationUrl, expiresIn }`; `userCode` is empty for the browser flow. A completed `codex` login restarts the GPT OAuth proxy. |
+| `POST` | `/api/auth/switch` | Start an OAuth login. Body: `{ "provider": "grok" \| "codex", "flow"?: "browser" \| "device" }`. `codex` defaults to the browser flow (callback on `localhost:1455`, so the browser must be on the server machine); `device` works from any machine. Grok always uses the device code. Returns `{ sessionId, flow, userCode, verificationUrl, expiresIn }`; `userCode` is empty for the browser flow. A completed `codex` login makes GPT OAuth pick up the new session. |
 | `GET` | `/api/auth/switch/:sessionId` | Poll switch-account session status. Returns `{ status }` where status is `pending`, `complete`, `error`, or `expired`. |
 | `DELETE` | `/api/auth/switch/:sessionId` | Cancel a pending login and release its callback port. |
-| `POST` | `/api/oauth/restart` | Respawn the GPT OAuth proxy so it reads the current session file (used by `ima2 login` / `ima2 gpt login` / `ima2 gpt logout`). Returns `{ restarted, reason? }`. |
+| `POST` | `/api/oauth/restart` | Make GPT OAuth pick up the current session file (it re-reads the file on every request; this clears the cached model roster) (used by `ima2 login` / `ima2 gpt login` / `ima2 gpt logout`). Returns `{ restarted, reason? }`. |
 
 The Switch Account flow opens a browser verification URL. Once the user completes the device-code step, the server saves the new credentials (Grok: `~/.progrok/auth.json`; Codex: via `codex login --device-auth`) and the session transitions to `complete`. This endpoint is surfaced as a **Switch Account** button in the Settings QuotaCard for Grok and Codex providers.
 
@@ -347,7 +347,7 @@ Supported moderation values: `auto`, `low`.
 When `storyboard` is `true`, the server prepends storyboard keyframe instructions so image
 generations maintain character and scene continuity for multi-shot video production.
 
-Current app default: `gpt-5.6-luna`. `gpt-5.5` and the other supported GPT image models remain available when callers explicitly select them.
+GPT OAuth default: `gpt-6-luna` (also `gpt-6-sol` and `gpt-6-astra`; legacy OAuth ids map to their GPT-6 tier). API-key default: `gpt-5.6-luna`; `gpt-5.5` and the other API models remain available when callers select them.
 
 When `provider` is `"nai"`, classic, multimode, and node generation accept the
 same 13 provider-native fields: `negativePrompt`, `sampler`, `noiseSchedule`,
@@ -902,6 +902,17 @@ Registered only when `config.features.cardNews` is true (`routes/cardNews.ts`).
 | `POST` | `/api/cardnews/cards/:cardId/regenerate` | Regenerate one card |
 | `POST` | `/api/cardnews/export` | Export completed set assets |
 
+## GitHub Star
+
+The studio's one-time star prompt stars the repository with the user's own `gh` login; ima2 never stores a GitHub token. These routes answer only to this computer (loopback peers); LAN clients get `403 LOCAL_ONLY`. The prompt state file is shared with the CLI prompt (`<configDir>/state/star-prompt.json`).
+
+| Method | Path | Result |
+|---|---|---|
+| `GET` | `/api/github/star` | `{ state: "starred" \| "not-starred" \| "unauthenticated" \| null, prompted, repo, url }` — `unauthenticated` when `gh` is missing or logged out; `null` once `prompted` (gh is no longer asked) |
+| `POST` | `/api/github/star` | Stars via `gh api -X PUT /user/starred/lidge-ai/ima2-gen` and marks prompted; `409 GH_UNAUTHENTICATED`, `502 GH_FAILED` |
+| `POST` | `/api/github/star/dismiss` | Marks prompted without starring |
+
+
 ## Common Error Codes
 
 | Code | Meaning |
@@ -917,7 +928,7 @@ Registered only when `config.features.cardNews` is true (`routes/cardNews.ts`).
 | `AUTH_CHATGPT_EXPIRED` | Codex/ChatGPT OAuth session expired |
 | `AUTH_API_KEY_INVALID` | API key is invalid, revoked, out of quota, or wrong org |
 | `NETWORK_FAILED` | Network, proxy, VPN, or firewall failure |
-| `OAUTH_UNAVAILABLE` | Local OAuth proxy is not available |
+| `OAUTH_UNAVAILABLE` | GPT OAuth is not available |
 | `OPEN_GENERATED_DIR_FAILED` | The server could not open the generated image folder |
 | `GRAPH_VERSION_REQUIRED` | Missing graph `If-Match` header |
 | `GRAPH_VERSION_CONFLICT` | Stale graph version |

package/docs/API.zh-CN.md

@@ -12,7 +12,7 @@ http://localhost:3333
 
 图像生成支持OAuth, API-钥匙，Grok， 和Gemini (`agy`和`gemini-api`) 提供商。
 
-- `provider: "oauth"`使用本地的Codex OAuth代理人。
+- `provider: "oauth"` 由服务器直接调用 ChatGPT 的 Codex 后端：GPT-6 模型规划提示词，`gpt-image-2` 出图。
 - `provider: "api"`使用OpenAI回应API与托管的`image_generation`工具。
 - `provider: "grok"`使用保存在`~/.progrok/auth.json`的xAI OAuth会话直接调用`https://api.x.ai`，不再有本地代理进程。经典、节点和代理生成强制运行xAI网页搜索通过`/v1/responses`，然后运行`grok-4.5`计划员与强制本地人通话`generate_image`函数，那么ima2执行xAI `/v1/images/generations`. `grok-4.3`仍然可以作为显式兼容性覆盖使用。如果附加了参考图像、节点父图像或代理当前图像，则最后一步将切换到xAI `/v1/images/edits`因此图像到图像的上下文被保留。
 - `provider: "agy"`产生Antigravity CLI (`agy -p`）通过Google生成图像Gemini's `default_api:generate_image`工具。型号是`nano-banana-2`。输出固定为1024×1024JPEG。最多 3 个参考图像 (i2i)。没有网络搜索、质量、尺寸或遮罩控制。多模式返回单个图像。不支持视频（`AGY_VIDEO_UNSUPPORTED`).
@@ -32,7 +32,7 @@ Grok视频生成用途`POST /api/video/generate` (SSE）。看视频
 |---|---|---|
 | `GET` | `/api/health` |服务器健康状况、版本、路径、提供商策略；包含`grok: { auth: "oauth" \| "none" }`，同样写入`~/.ima2/server.json`|
 | `GET` | `/api/providers` |提供者可用性和运行时端口|
-| `GET` | `/api/oauth/status` | OAuth代理状态和可见模型|
+| `GET` | `/api/oauth/status` | GPT OAuth 状态和可见模型|
 | `GET` | `/api/grok/status` | xAI OAuth会话状态和可见xAI图像模型。返回`ready`、`no_image_model`、`error`或`offline`；没有会话时原因是`login_required`|
 | `GET` | `/api/billing` |计费/状态探测，包括API配置时的密钥源|
 | `GET` | `/api/quota` |供应商配额：回报`{ codex, grok }`。有资格的Grok建造xAIOIDC/外部身份验证返回`weekly`百分比/重置窗口`GET /v1/billing?format=credits`。如果不可用，旧端点可能会返回`monthly`窗口加`billing: { usedUsd, limitUsd }`. |
@@ -213,7 +213,7 @@ CLI和遗留客户省略`async`并保持原始行为：每个请求SSE在同一
 什么时候`storyboard`是`true`，服务器预先添加情节提要关键帧指令，以便图像
 几代人保持多镜头视频制作的角色和场景连续性。
 
-当前应用程序默认值：`gpt-5.6-luna`. `gpt-5.5`和其他支持的GPT image当调用者明确选择模型时，模型仍然可用。
+GPT OAuth 默认值：`gpt-6-luna`（另有 `gpt-6-sol`、`gpt-6-astra`；旧的 OAuth 模型 ID 会映射到对应的 GPT-6 模型）。API key 默认值：`gpt-5.6-luna`，调用方明确选择时仍可使用 `gpt-5.5` 等其他 API 模型。
 
 什么时候`provider`是`"grok"`，支持的型号有`grok-imagine-image`和
 `grok-imagine-image-quality`。服务器使用`grok-4.5`作为搜索/规划者
@@ -705,6 +705,17 @@ X-Ima2-Tab-Id
 | `POST` | `/api/cardnews/cards/:cardId/regenerate` |重新生成一张卡|
 | `POST` | `/api/cardnews/export` |导出已完成的设定资产|
 
+## GitHub Star
+
+工作室的一次性 Star 提示通过用户自己的 `gh` 登录为仓库加星；ima2 不保存任何 GitHub 令牌。这些路由只响应本机（回环地址）请求，局域网客户端会收到 `403 LOCAL_ONLY`。提示状态文件与 CLI 提示共用（`<configDir>/state/star-prompt.json`）。
+
+| 方法 | 路径 | 结果 |
+|---|---|---|
+| `GET` | `/api/github/star` | `{ state: "starred" \| "not-starred" \| "unauthenticated" \| null, prompted, repo, url }`，未安装或未登录 `gh` 时为 `unauthenticated`；已提示后为 `null`（不再调用 gh） |
+| `POST` | `/api/github/star` | 通过 `gh api -X PUT /user/starred/lidge-ai/ima2-gen` 加星并标记已提示；`409 GH_UNAUTHENTICATED`、`502 GH_FAILED` |
+| `POST` | `/api/github/star/dismiss` | 不加星，仅标记已提示 |
+
+
 ## 常见错误代码
 
 |代码|意义|
@@ -720,7 +731,7 @@ X-Ima2-Tab-Id
 | `AUTH_CHATGPT_EXPIRED` | Codex/ChatGPT OAuth会话已过期|
 | `AUTH_API_KEY_INVALID` | API密钥无效、已撤销、超出配额或组织错误|
 | `NETWORK_FAILED` |网络、代理、VPN 或防火墙故障|
-| `OAUTH_UNAVAILABLE` |当地的OAuth代理不可用|
+| `OAUTH_UNAVAILABLE` |GPT OAuth 不可用|
 | `OPEN_GENERATED_DIR_FAILED` |服务器无法打开生成的图像文件夹|
 | `GRAPH_VERSION_REQUIRED` |缺少图表`If-Match`标头|
 | `GRAPH_VERSION_CONFLICT` |过时的图表版本|

package/docs/API.zh-TW.md

@@ -12,7 +12,7 @@ http://localhost:3333
 
 圖像生成支持OAuth, API-鑰匙，Grok， 和Gemini (`agy`和`gemini-api`) 提供者。
 
-- `provider: "oauth"`使用本地的Codex OAuth代理人。
+- `provider: "oauth"` 由伺服器直接呼叫 ChatGPT 的 Codex 後端：GPT-6 模型規劃提示詞，`gpt-image-2` 出圖。
 - `provider: "api"`使用OpenAI回應API與託管的`image_generation`工具。
 - `provider: "grok"`使用儲存在`~/.progrok/auth.json`的xAI OAuth工作階段直接呼叫`https://api.x.ai`，不再有本機代理程式。經典、節點和代理生成強制運行xAI網頁搜尋透過`/v1/responses`，然後運行`grok-4.5`計劃員與強製本地人通話`generate_image`函數，那麼ima2執行xAI `/v1/images/generations`. `grok-4.3`仍然可以作為顯式相容性覆蓋使用。如果附加了參考影像、節點父映像或代理目前影像，則最後一步將切換到xAI `/v1/images/edits`因此圖像到圖像的上下文被保留。
 - `provider: "agy"`產生Antigravity CLI (`agy -p`）透過Google生成圖像Gemini's `default_api:generate_image`工具。型號是`nano-banana-2`。輸出固定為1024×1024JPEG。最多 3 個參考影像 (i2i)。沒有網路搜尋、品質、尺寸或遮罩控制。多模式返回單一影像。不支援影片（`AGY_VIDEO_UNSUPPORTED`).
@@ -32,7 +32,7 @@ Grok影片生成用途`POST /api/video/generate` (SSE）。看影片
 |---|---|---|
 | `GET` | `/api/health` |伺服器健康狀況、版本、路徑、提供者策略；包含`grok: { auth: "oauth" \| "none" }`，同樣寫入`~/.ima2/server.json`|
 | `GET` | `/api/providers` |提供者可用性和運行時端口|
-| `GET` | `/api/oauth/status` | OAuth代理狀態和可見模型|
+| `GET` | `/api/oauth/status` | GPT OAuth 狀態和可見模型|
 | `GET` | `/api/grok/status` | xAI OAuth工作階段狀態和可見xAI影像模型。回傳`ready`、`no_image_model`、`error`或`offline`；沒有工作階段時原因是`login_required`|
 | `GET` | `/api/billing` |計費/狀態探測，包括API配置時的密鑰來源|
 | `GET` | `/api/quota` |供應商配額：回報`{ codex, grok }`。有資格的Grok建造xAIOIDC/外部身份驗證返回`weekly`百分比/重置視窗`GET /v1/billing?format=credits`。如果不可用，舊端點可能會返回`monthly`視窗加`billing: { usedUsd, limitUsd }`. |
@@ -213,7 +213,7 @@ CLI和遺留客戶省略`async`並保持原始行為：每個請求SSE在同一
 什麼時候`storyboard`是`true`，伺服器預先新增情節提要關鍵影格指令，以便影像
 幾代人保持多鏡頭影片製作的角色和場景連續性。
 
-當前應用程式預設值：`gpt-5.6-luna`. `gpt-5.5`和其他支持的GPT image當呼叫者明確選擇模型時，模型仍然可用。
+GPT OAuth 預設值：`gpt-6-luna`（另有 `gpt-6-sol`、`gpt-6-astra`；舊的 OAuth 模型 ID 會對應到相應的 GPT-6 模型）。API key 預設值：`gpt-5.6-luna`，呼叫端明確選擇時仍可使用 `gpt-5.5` 等其他 API 模型。
 
 什麼時候`provider`是`"grok"`，支援的型號有`grok-imagine-image`和
 `grok-imagine-image-quality`。伺服器使用`grok-4.5`作為搜尋/規劃者
@@ -705,6 +705,17 @@ X-Ima2-Tab-Id
 | `POST` | `/api/cardnews/cards/:cardId/regenerate` |重新生成一張卡|
 | `POST` | `/api/cardnews/export` |匯出已完成的設定資產|
 
+## GitHub Star
+
+工作室的一次性 Star 提示透過使用者自己的 `gh` 登入替儲存庫加星；ima2 不保存任何 GitHub 權杖。這些路由只回應本機（回送位址）請求，區域網路用戶端會收到 `403 LOCAL_ONLY`。提示狀態檔與 CLI 提示共用（`<configDir>/state/star-prompt.json`）。
+
+| 方法 | 路徑 | 結果 |
+|---|---|---|
+| `GET` | `/api/github/star` | `{ state: "starred" \| "not-starred" \| "unauthenticated" \| null, prompted, repo, url }`，未安裝或未登入 `gh` 時為 `unauthenticated`；已提示後為 `null`（不再呼叫 gh） |
+| `POST` | `/api/github/star` | 透過 `gh api -X PUT /user/starred/lidge-ai/ima2-gen` 加星並標記已提示；`409 GH_UNAUTHENTICATED`、`502 GH_FAILED` |
+| `POST` | `/api/github/star/dismiss` | 不加星，只標記已提示 |
+
+
 ## 常見錯誤代碼
 
 |程式碼|意義|
@@ -720,7 +731,7 @@ X-Ima2-Tab-Id
 | `AUTH_CHATGPT_EXPIRED` | Codex/ChatGPT OAuth會話已過期|
 | `AUTH_API_KEY_INVALID` | API金鑰無效、已撤銷、超出配額或組織錯誤|
 | `NETWORK_FAILED` |網路、代理、VPN 或防火牆故障|
-| `OAUTH_UNAVAILABLE` |當地的OAuth代理不可用|
+| `OAUTH_UNAVAILABLE` |GPT OAuth 不可用|
 | `OPEN_GENERATED_DIR_FAILED` |伺服器無法開啟生成的圖像資料夾|
 | `GRAPH_VERSION_REQUIRED` |缺圖表`If-Match`標頭|
 | `GRAPH_VERSION_CONFLICT` |過時的圖表版本|

package/docs/CLI.md

@@ -126,7 +126,7 @@ target applies. Their `--provider` accepts explicit lanes only
 Provider override semantics:
 
 - `api` forces the API-key Responses path and requires a configured API key.
-- `oauth` forces the local OAuth proxy path.
+- `oauth` forces GPT OAuth: the server calls ChatGPT directly, a GPT-6 model plans and `gpt-image-2` renders.
 - `grok` calls `https://api.x.ai` directly with the xAI OAuth session in `~/.progrok/auth.json`. Classic generation first runs mandatory xAI Web Search through Responses API, then asks `grok-4.5` to call ima2's local `generate_image` tool, then ima2 executes xAI `/v1/images/generations`. `grok-4.3` remains available as an explicit compatibility override. If `--ref` images are attached, the final step uses xAI `/v1/images/edits` instead so image-to-image/reference context is preserved. Models: `grok-imagine-image`, `grok-imagine-image-quality`. Size is mapped to xAI `aspect_ratio` and `resolution`; the UI web-search toggle is OpenAI-provider-only because Grok search is always on in this path.
 - `agy` spawns the Antigravity CLI to generate via Google Gemini (`nano-banana-2`). Fixed 1024×1024 JPEG output, max 3 refs. No web search, quality, size, or mask controls. If `agy` is not on the server process PATH, ima2 also checks common user-local installs such as `~/.local/bin/agy`; set `IMA2_AGY_BIN=/absolute/path/to/agy` to force a specific binary.
 - `gemini-api` calls the Google Generative Language API directly. Models: `nano-banana-2` (Gemini 3.1 Flash Image) and `nano-banana-pro` (Gemini 3 Pro Image). Use `--model nano-banana-2` or `--model nano-banana-pro` to select. Supports `--size` for aspect ratio and resolution (512px–4K) on the direct API path; Vertex AI ignores aspect/size. Requires `GEMINI_API_KEY` or a Vertex AI service account (`VERTEX_SERVICE_ACCOUNT_JSON`). Switching from `agy` or `gemini-api` provider auto-selects the corresponding Gemini model; switching away resets to the GPT default.
@@ -197,7 +197,7 @@ documented multi-image editing limit.
 
 ```bash
 ima2 models --kind image
-ima2 defaults set image oauth/gpt-5.6-luna
+ima2 defaults set image oauth/gpt-6-luna
 ima2 gen "a poster of a samurai cat" --model api/gpt-5.4 --reasoning-effort high
 ima2 grok login
 ima2 gen "a cinematic neon city" --model grok/grok-imagine-image-quality
@@ -381,8 +381,8 @@ For GPT OAuth no-image reports, a useful support bundle is:
 ```bash
 ima2 doctor
 ima2 doctor image-probe --json > ima2-image-probe.json
-ima2 gen "고양이" --model oauth/gpt-5.6-luna --no-web-search --json > ima2-cat-no-search.json
-ima2 gen "고양이" --model oauth/gpt-5.6-luna --json > ima2-cat-current.json
+ima2 gen "고양이" --model oauth/gpt-6-luna --no-web-search --json > ima2-cat-no-search.json
+ima2 gen "고양이" --model oauth/gpt-6-luna --json > ima2-cat-current.json
 ```
 
 Do not share ChatGPT cookies, OAuth token files, API keys, prompt history, raw
@@ -479,7 +479,7 @@ Card News requires the server to be started with `IMA2_CARD_NEWS=1` (or `feature
 | `ima2 storage open` | Open the generated dir in the OS file manager (POST) |
 | `ima2 billing` | API usage probe via `/api/billing` (OpenAI/API-key credits when configured). Grok and NovelAI quota are web-UI only via `GET /api/quota`: weekly percentage/reset for current Grok Build xAI auth, with legacy monthly `usedUsd`/`limitUsd` fallback. |
 | `ima2 providers` | Configured providers |
-| `ima2 oauth status` | OAuth proxy state |
+| `ima2 oauth status` | GPT OAuth state |
 | `ima2 grok status` | Stored xAI OAuth session, with `--probe` for image-model visibility |
 | `ima2 ping` | Health-check the running server |