ima2-gen 3.26.1 → 3.26.2

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.26.2] - 2026-10-04
+
+### Added
+
+- **Video sound instructions** — composer presets add one prompt chip for music, ambience, effects or no dialogue. Selection can be replaced, toggled or cleared, persists across model changes/reload, and uses localized labels. The picker fits narrow screens and stays hidden in Node mode, whose prompts are independent. (#364, #371)
+
+### Fixed
+
+- **One OAuth time budget across retries** — readiness, planning, rendering and rate-limit waits share a job deadline, while prepared executions retain the remaining budget across caller retries and concurrent calls. Expiry is `504 OAUTH_IMAGE_TIMEOUT`; explicit cancellation remains `499`. Completed images and local persistence callbacks are preserved. (#351, #370)
+- **Composer audio feedback** — unsupported audio drops now explain the limitation instead of suggesting an audio reference was attached. Image attachment and existing video CLI guidance remain available. (#364, #371)
+- **Dry-run release safety** — `--dry-run` refuses when dev needs promotion, including when combined with `--promote --approve --yes`. Already-promoted main can still dispatch hosted validation without publishing branches, tags or packages.
+
+### Changed
+
+- Updated the reviewed runtime, lint, node-canvas and CodeQL dependency pins, including MCP SDK, Codex, OpenAI, sharp and XYFlow. (#369)
+
+### Security
+
+- Pinned the browser PPTX dependency tree to `image-size` 2.0.4 and removed its obsolete audit exceptions. The root braces advisory [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm) retains one evidence-backed exception through 2026-10-17: the inspected application path disables glob parsing, with real-package and dependency-path regression guards. This is not a claim that the vulnerable dependency was removed.
+
 ## [3.26.1] - 2026-10-02
 
 ### Fixed

package/docs/migration/runtime-test-inventory.md

@@ -4,7 +4,7 @@ Generated by `npm run test:inventory` (script: `scripts/classify-tests.mjs`).
 
 _Tests considered "runtime-importing" if they import from `../lib/`, `../routes/`, `../bin/`, `../server`, or `../config`._
 
-Total: 545 (runtime: 247, contract: 298)
+Total: 552 (runtime: 251, contract: 301)
 
 ## Runtime-importing tests
 - `tests/advertise-payload-contract.test.ts`
@@ -162,6 +162,8 @@ Total: 545 (runtime: 247, contract: 298)
 - `tests/node-template-portable.test.ts`
 - `tests/node-validation-error-contract.test.ts`
 - `tests/oauth-cli-dependencies.test.ts`
+- `tests/oauth-execution-deadline.test.ts`
+- `tests/oauth-job-timeout.test.ts`
 - `tests/oauth-normalize.test.ts`
 - `tests/oauth-proxy-error-safety.test.ts`
 - `tests/oauth-rate-limit-lane.test.ts`
@@ -196,6 +198,7 @@ Total: 545 (runtime: 247, contract: 298)
 - `tests/refs-size.test.ts`
 - `tests/request-logging.test.ts`
 - `tests/responses-adapter-safety.test.ts`
+- `tests/responses-api-abort-compat.test.ts`
 - `tests/responses-empty-taxonomy.test.ts`
 - `tests/responses-parse-diagnostics.test.ts`
 - `tests/runtime-context-normalize.test.ts`
@@ -226,6 +229,7 @@ Total: 545 (runtime: 247, contract: 298)
 - `tests/storage-migration.test.ts`
 - `tests/structured-filename-pipelines.test.ts`
 - `tests/style-sheet.test.ts`
+- `tests/system-trash-glob-safety.test.ts`
 - `tests/terminal-jobs-restart.test.ts`
 - `tests/thumb-backfill.test.ts`
 - `tests/transparent-alpha-verification.test.ts`
@@ -282,6 +286,7 @@ Total: 545 (runtime: 247, contract: 298)
 - `tests/async-capacity-retry-contract.test.ts`
 - `tests/async-stream-subscribe-order.test.ts`
 - `tests/audit-gate-contract.test.ts`
+- `tests/audit-trash-graph-contract.test.ts`
 - `tests/backend-hardening-contract.test.ts`
 - `tests/background-cleanup-brush-rasterize.test.ts`
 - `tests/background-cleanup-mask-compose.test.ts`
@@ -550,6 +555,8 @@ Total: 545 (runtime: 247, contract: 298)
 - `tests/video-frame-local-file.test.ts`
 - `tests/video-gallery-refresh-contract.test.ts`
 - `tests/video-inflight-kind-contract.test.ts`
+- `tests/video-sound-intent-contract.test.ts`
+- `tests/video-sound-intent-ui-contract.test.ts`
 - `tests/video-ui-source-count.test.ts`
 - `tests/vite-dev-port-contract.test.ts`
 - `tests/wand-erase.test.ts`

package/lib/oauthImages.js

@@ -11,6 +11,8 @@
  * The result keeps ParsedResponsesResult's shape so routes, SSE, history and error
  * diagnostics stay unchanged.
  */
+import { config } from "../config.js";
+import { createOAuthJobDeadline, throwIfOAuthAborted } from "./oauthJobDeadline.js";
 import { logEvent } from "./logger.js";
 import { postOAuthImages, postResponses } from "./responsesTransport.js";
 import { createOAuthRateLimitBudget, oauthRateLimitRetryConfig, withOAuthRateLimitRetry, } from "./oauthRateLimit.js";
@@ -129,13 +131,6 @@ export function renderFields(job) {
 function extensionFor(mime) {
     return mime === "image/jpeg" ? "jpg" : mime === "image/webp" ? "webp" : "png";
 }
-/**
- * One retry budget per job: the plan and every render draw from the same retry count and total
- * wait, and no wait may run past the job's generation timeout.
- */
-function rateLimitBudgetFor(job) {
-    return createOAuthRateLimitBudget(job.ctx?.config?.oauth?.generationTimeoutMs ?? 400 * 1000);
-}
 /** Replay a call the backend rejected with a per-minute rate limit; log every wait. */
 function withRateLimitBackoff(job, budget, stage, request) {
     return withOAuthRateLimitRetry(request, {
@@ -211,45 +206,34 @@ async function plan(job, budget) {
     }
     return { result, prompts };
 }
-export async function runOAuthImageJob(job) {
-    // Direct mode renders the user's prompt verbatim, but a multi-image request still needs one
-    // prompt per stage, so it goes through the planner (its user text already carries the
-    // sequence instructions and the Direct fidelity rule).
-    const direct = job.mode === "direct" && job.maxImages <= 1;
-    const budget = rateLimitBudgetFor(job);
-    const planned = direct
-        ? { result: null, prompts: Array.from({ length: Math.max(1, job.maxImages) }, () => job.directPrompt) }
-        : await plan(job, budget);
-    const base = planned.result;
-    const usage = {};
-    addUsage(usage, base?.usage);
-    const eventTypes = { ...(base?.eventTypes ?? {}) };
-    const diagnostics = base?.diagnostics ? { ...base.diagnostics } : emptyDiagnostics();
-    const kind = job.images.length ? "images.edits" : "images.generations";
-    logEvent(job.scope, "plan_done", { requestId: job.requestId, direct, prompts: planned.prompts.length });
-    const slots = planned.prompts.map(() => {
+function startRenders(job, budget, prompts) {
+    const slots = prompts.map(() => {
         let resolve;
         const promise = new Promise((r) => { resolve = r; });
         return { promise, resolve };
     });
     let cursor = 0;
     const worker = async () => {
-        while (cursor < planned.prompts.length) {
+        while (cursor < prompts.length) {
             const index = cursor++;
             try {
-                slots[index]?.resolve({ status: "done", value: await renderOne(job, budget, planned.prompts[index]) });
+                slots[index]?.resolve({ status: "done", value: await renderOne(job, budget, prompts[index]) });
             }
             catch (error) {
                 slots[index]?.resolve({ status: "failed", error });
             }
         }
     };
-    const workers = Array.from({ length: Math.min(RENDER_CONCURRENCY, planned.prompts.length) }, () => worker());
+    const workers = Array.from({ length: Math.min(RENDER_CONCURRENCY, prompts.length) }, () => worker());
+    return { slots, workers };
+}
+async function collectRenders(job, batch, context) {
+    const { prompts, direct, eventTypes, usage, kind } = context;
     const images = [];
     const originalIndexes = [];
     let firstError;
     // Deliver in stage order so sequences persist and stream in the order the planner wrote them.
-    for (const [index, slot] of slots.entries()) {
+    for (const [index, slot] of batch.slots.entries()) {
         const settled = await slot.promise;
         eventTypes[kind] = (eventTypes[kind] ?? 0) + 1;
         if (settled.status === "failed") {
@@ -261,12 +245,33 @@ export async function runOAuthImageJob(job) {
         const b64 = settled.value.images[0]?.b64;
         if (!b64)
             continue;
-        const image = { b64, revisedPrompt: direct ? null : planned.prompts[index] };
+        const image = { b64, revisedPrompt: direct ? null : prompts[index] };
         images.push(image);
         originalIndexes.push(index);
         await job.onFinalImage?.(image, index);
     }
-    await Promise.all(workers);
+    await Promise.all(batch.workers);
+    return { images, originalIndexes, firstError };
+}
+async function runOAuthImageJobWithinDeadline(job, budget) {
+    // Direct mode renders the user's prompt verbatim, but a multi-image request still needs one
+    // prompt per stage, so it goes through the planner (its user text already carries the
+    // sequence instructions and the Direct fidelity rule).
+    const direct = job.mode === "direct" && job.maxImages <= 1;
+    const planned = direct
+        ? { result: null, prompts: Array.from({ length: Math.max(1, job.maxImages) }, () => job.directPrompt) }
+        : await plan(job, budget);
+    const base = planned.result;
+    const usage = {};
+    addUsage(usage, base?.usage);
+    const eventTypes = { ...(base?.eventTypes ?? {}) };
+    const diagnostics = base?.diagnostics ? { ...base.diagnostics } : emptyDiagnostics();
+    const kind = job.images.length ? "images.edits" : "images.generations";
+    logEvent(job.scope, "plan_done", { requestId: job.requestId, direct, prompts: planned.prompts.length });
+    const batch = startRenders(job, budget, planned.prompts);
+    const { images, originalIndexes, firstError } = await collectRenders(job, batch, {
+        prompts: planned.prompts, direct, eventTypes, usage, kind,
+    });
     // A single render has no partial result to return: surface its own error.
     if (planned.prompts.length === 1 && firstError !== undefined)
         throw firstError;
@@ -289,3 +294,13 @@ export async function runOAuthImageJob(job) {
         ...(firstError !== undefined ? { error: firstError } : {}),
     };
 }
+export async function runOAuthImageJob(job) {
+    const lifetime = createOAuthJobDeadline(job.ctx.config?.oauth?.generationTimeoutMs ?? config.oauth.generationTimeoutMs, job.signal);
+    try {
+        throwIfOAuthAborted(lifetime.signal);
+        return await runOAuthImageJobWithinDeadline({ ...job, signal: lifetime.signal }, createOAuthRateLimitBudget(lifetime.timeoutMs));
+    }
+    finally {
+        lifetime.dispose();
+    }
+}

package/lib/oauthJobDeadline.js

@@ -0,0 +1,70 @@
+/** One OAuth image job owns its deadline; reasons are safe to surface to clients. */
+export class OAuthJobAbort extends Error {
+    name = "AbortError";
+    status;
+    code;
+    constructor(kind) {
+        super(kind !== "cancel" ? "OAuth image generation timed out" : "Generation canceled");
+        this.status = kind === "cancel" ? 499 : 504;
+        this.code = kind === "cancel" ? "GENERATION_CANCELED"
+            : kind === "job-timeout" ? "OAUTH_IMAGE_TIMEOUT" : "RESPONSES_IMAGE_TIMEOUT";
+    }
+}
+export function normalizeOAuthTimeout(value) {
+    return Number.isFinite(value) && value > 0 ? Math.max(1, Math.ceil(value)) : 0;
+}
+export function oauthAbortError(signal) {
+    return signal?.reason instanceof OAuthJobAbort ? signal.reason : new OAuthJobAbort("cancel");
+}
+export function throwIfOAuthAborted(signal) {
+    if (signal?.aborted)
+        throw oauthAbortError(signal);
+}
+function createDeadline(timeoutMs, parent, kind) {
+    const controller = new AbortController();
+    const onCancel = () => controller.abort(oauthAbortError(parent));
+    if (parent?.aborted)
+        onCancel();
+    else
+        parent?.addEventListener("abort", onCancel, { once: true });
+    const duration = normalizeOAuthTimeout(timeoutMs);
+    const timer = duration && !controller.signal.aborted
+        ? setTimeout(() => controller.abort(new OAuthJobAbort(kind)), duration)
+        : undefined;
+    return {
+        signal: controller.signal,
+        timeoutMs: duration,
+        dispose() {
+            clearTimeout(timer);
+            parent?.removeEventListener("abort", onCancel);
+        },
+    };
+}
+export function createOAuthJobDeadline(timeoutMs, parent) {
+    return createDeadline(timeoutMs, parent, "job-timeout");
+}
+export function createOAuthRequestDeadline(timeoutMs, parent) {
+    return createDeadline(timeoutMs, parent, "request-timeout");
+}
+/** Observe late settlement even when abort wins; do not race irreversible local writes. */
+export async function withOAuthAbort(run, signal) {
+    throwIfOAuthAborted(signal);
+    if (!signal)
+        return run();
+    let onAbort = () => { };
+    const aborted = new Promise((_resolve, reject) => {
+        onAbort = () => reject(oauthAbortError(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+        if (signal.aborted)
+            onAbort();
+    });
+    try {
+        return await Promise.race([
+            Promise.resolve().then(() => { throwIfOAuthAborted(signal); return run(); }),
+            aborted,
+        ]);
+    }
+    finally {
+        signal.removeEventListener("abort", onAbort);
+    }
+}

package/lib/oauthProxy/runtime.js

@@ -1,3 +1,4 @@
+import { throwIfOAuthAborted, withOAuthAbort } from "../oauthJobDeadline.js";
 import { config } from "../../config.js";
 import { logEvent } from "../logger.js";
 import { isAbortError, makeOAuthError } from "./errors.js";
@@ -52,7 +53,8 @@ export function createOAuthGenerationTimeout(ctx = {}, requestId = null, scope =
         isTimeoutError: (err) => timedOut && isAbortError(err),
     };
 }
-export async function waitForOAuthReady(ctx = {}) {
+export async function waitForOAuthReady(ctx = {}, signal) {
+    throwIfOAuthAborted(signal);
     if (!ctx || ctx.oauthReadyState === undefined)
         return;
     // A new login may have landed since the proxy started (or gave up), possibly from a CLI that
@@ -66,11 +68,19 @@ export async function waitForOAuthReady(ctx = {}) {
     }
     const timeoutMs = ctx.config?.oauth?.statusTimeoutMs ?? config.oauth.statusTimeoutMs;
     if (ctx.oauthReadyPromise) {
-        await Promise.race([
-            ctx.oauthReadyPromise,
-            new Promise((resolve) => setTimeout(resolve, timeoutMs)),
-        ]);
+        const ready = ctx.oauthReadyPromise;
+        let timer;
+        try {
+            await withOAuthAbort(() => Promise.race([
+                ready,
+                new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); }),
+            ]), signal);
+        }
+        finally {
+            clearTimeout(timer);
+        }
     }
+    throwIfOAuthAborted(signal);
     const finalState = ctx.oauthReadyState;
     if (finalState !== "ready" && finalState !== "disabled") {
         throw makeOAuthError("OAuth proxy is not ready yet", { code: "OAUTH_UNAVAILABLE", status: 503 });

package/lib/oauthRateLimit.js

@@ -14,8 +14,9 @@
  * One job (a plan plus its renders) spends one retry budget: a retry count, a total wait and
  * the job's generation deadline, so a burst never stretches a job past its timeout.
  *
- * MUST stay a leaf module: it only borrows the abortable sleep, jitter and Retry-After parsing.
+ * MUST stay a leaf module: only retry primitives and the dependency-free job abort helper.
  */
+import { oauthAbortError, throwIfOAuthAborted } from "./oauthJobDeadline.js";
 import { jitterDelayMs, retryAfterDelayMs, sleepWithAbort } from "./grokUpstreamRetry.js";
 /**
  * Caps that no short wait can clear. Checked first so mixed wording never retries. A bare
@@ -96,9 +97,6 @@ function retryAfterOf(error) {
     const value = error?.retryAfterMs;
     return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
-function canceledError(cause) {
-    return Object.assign(new Error("Generation canceled"), { status: 499, code: "GENERATION_CANCELED", cause });
-}
 export function createOAuthRateLimitBudget(timeoutMs, now = Date.now) {
     const bounded = typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0;
     return { retries: 0, totalWaitMs: 0, deadlineAt: bounded ? now() + timeoutMs : undefined };
@@ -121,6 +119,7 @@ export async function withOAuthRateLimitRetry(request, options = {}) {
     const now = options.now ?? Date.now;
     const signal = options.signal ?? undefined;
     for (let attempt = 1;; attempt++) {
+        throwIfOAuthAborted(signal);
         try {
             return await request();
         }
@@ -129,7 +128,7 @@ export async function withOAuthRateLimitRetry(request, options = {}) {
                 throw error;
             // A job canceled while its request was being rate limited ends as a cancel, not a 429.
             if (signal?.aborted)
-                throw canceledError(signal.reason ?? error);
+                throw oauthAbortError(signal);
             const waitMs = oauthRateLimitDelayMs(attempt, retryAfterOf(error), config, options.random);
             const reason = budgetShortfall(budget, config, waitMs, now());
             if (reason) {
@@ -144,11 +143,11 @@ export async function withOAuthRateLimitRetry(request, options = {}) {
             }
             catch (sleepError) {
                 if (signal?.aborted)
-                    throw canceledError(sleepError);
+                    throw oauthAbortError(signal);
                 throw sleepError;
             }
             if (signal?.aborted)
-                throw canceledError(signal.reason);
+                throw oauthAbortError(signal);
         }
     }
 }

package/lib/providers/adapters/openaiExecution.js

@@ -1,15 +1,41 @@
+import { config } from "../../../config.js";
+import { createOAuthJobDeadline, normalizeOAuthTimeout, OAuthJobAbort, throwIfOAuthAborted } from "../../oauthJobDeadline.js";
 import { isNonRetryableGenerationError, normalizeGenerationFailure } from "../../generationErrors.js";
 import { throwIfJobCanceled } from "../../generationCancel.js";
 import { logEvent } from "../../logger.js";
 import { generateViaResponses, editViaResponses, generateMultimodeViaResponses } from "./openaiOperations.js";
+/** One prepared OAuth operation owns its remaining budget across caller retries. */
+function withPreparedOAuthBudget(ctx, request, run) {
+    if (request.provider === "api")
+        return () => run(request.signal);
+    let deadlineAt;
+    return async () => {
+        throwIfOAuthAborted(request.signal);
+        if (deadlineAt === undefined) {
+            const duration = normalizeOAuthTimeout(ctx.config?.oauth?.generationTimeoutMs ?? config.oauth.generationTimeoutMs);
+            deadlineAt = duration > 0 ? performance.now() + duration : Infinity;
+        }
+        const remaining = deadlineAt - performance.now();
+        if (remaining <= 0)
+            throw new OAuthJobAbort("job-timeout");
+        const lifetime = createOAuthJobDeadline(remaining, request.signal);
+        try {
+            return await run(lifetime.signal);
+        }
+        finally {
+            lifetime.dispose();
+        }
+    };
+}
 export function isOpenaiRequest(request) {
     return request.provider === "oauth" || request.provider === "api";
 }
 function prepareOpenaiClassic(ctx, request, _progress) {
     const { provider: activeProvider, prompt: generationPrompt, requestId, background: backgroundParams } = request;
     const { model: imageModel, imageToolModel, quality, size: effectiveSize, moderation, mode: normalizedPromptMode, reasoningEffort, webSearchEnabled } = request.options;
-    // Scalars are captured at prepare; references, signal and ctx stay live per attempt.
-    const generateOne = async () => {
+    // Scalars are captured at prepare; references and ctx stay live per attempt.
+    // API keeps the caller signal live; OAuth uses the invocation deadline signal.
+    const generateOne = async (signal) => {
         const MAX_RETRIES = 1;
         let lastErr;
         for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
@@ -18,7 +44,7 @@ function prepareOpenaiClassic(ctx, request, _progress) {
                     model: imageModel, imageToolModel,
                     reasoningEffort,
                     webSearchEnabled,
-                    signal: request.signal,
+                    signal: activeProvider === "api" ? request.signal : signal,
                     allowPromptOnlyOAuthFallback: activeProvider !== "api",
                     ...(backgroundParams ? { background: backgroundParams.background } : {}),
                     ...(backgroundParams?.outputFormat ? { outputFormat: backgroundParams.outputFormat } : {}),
@@ -44,9 +70,9 @@ function prepareOpenaiClassic(ctx, request, _progress) {
             safetyMessage: "Content generation refused after retries",
         });
     };
-    return { execute: async () => {
-            return { kind: "single", value: await generateOne() };
-        } };
+    return { execute: withPreparedOAuthBudget(ctx, request, async (signal) => {
+            return { kind: "single", value: await generateOne(signal) };
+        }) };
 }
 async function executeOpenaiNode(ctx, request, progress) {
     const { provider, sourceImage: parentB64, prompt: generationPrompt, references, requestId, signal, searchMode, options } = request;
@@ -80,14 +106,14 @@ async function executeOpenaiMultimode(ctx, request, progress) {
 export async function prepareOpenaiExecution(ctx, request, progress = {}) {
     switch (request.surface) {
         case "classic": return prepareOpenaiClassic(ctx, request, progress);
-        case "node": return { execute: async () => {
-                return { kind: "single", value: await executeOpenaiNode(ctx, request, progress) };
-            } };
-        case "edit": return { execute: async () => {
-                return { kind: "single", value: await executeOpenaiEdit(ctx, request) };
-            } };
-        case "multimode": return { execute: async () => {
-                return { kind: "sequence", value: await executeOpenaiMultimode(ctx, request, progress) };
-            } };
+        case "node": return { execute: withPreparedOAuthBudget(ctx, request, async (signal) => {
+                return { kind: "single", value: await executeOpenaiNode(ctx, { ...request, signal }, progress) };
+            }) };
+        case "edit": return { execute: withPreparedOAuthBudget(ctx, request, async (signal) => {
+                return { kind: "single", value: await executeOpenaiEdit(ctx, { ...request, signal }) };
+            }) };
+        case "multimode": return { execute: withPreparedOAuthBudget(ctx, request, async (signal) => {
+                return { kind: "sequence", value: await executeOpenaiMultimode(ctx, { ...request, signal }, progress) };
+            }) };
     }
 }