johns-harness 2026.9.13 → 2026.9.15

package/README.md

@@ -55,7 +55,12 @@ Expired ChatGPT credentials trigger an owner notice with the `/login` recovery c
 
 <!-- JOHNNESS_PATCH_DEFAULTS_61 -->
 ### Batteries included
-The harness ships the current model catalog and the short aliases `opus`, `sonnet`, `fable`, `astra`, `sol`, `luna`, `terra`, and `gpt`, so `/model opus` works on a fresh install with no `models.providers` block. Channels you configure load without a `plugins.allow` list; only an explicit `enabled: false` or `plugins.deny` turns one off. Updating the harness updates the catalog and aliases for every agent.
+The harness ships the current model catalog and the short aliases `opus`, `sonnet`, `fable`, `astra`, `sol`, `luna`, `terra`, `gpt`, `flash`, `banana`, and `image`, so `/model opus` works on a fresh install with no `models.providers` block. Channels you configure load without a `plugins.allow` list; only an explicit `enabled: false` or `plugins.deny` turns one off. Updating the harness updates the catalog and aliases for every agent. Image generation and editing use GPT Image 2 through the `image_generate` tool: `openai-codex/gpt-image-2` on the ChatGPT subscription first, `openai/gpt-image-2` on the API key second (`agents.defaults.imageGenerationModel`). Nano Banana Pro (`google/gemini-3-pro-image-preview`) ships in the catalog as a selectable image model, reachable with `model: "nano-banana"` and its own `aspectRatio` option; the default stays GPT Image 2 because the subscription path costs nothing.
+
+**The alias contract.** Every shipped alias points at the newest model in its line, so an install or an `/update` moves every agent forward with zero per-instance config. Your own `agents.defaults.models[*].alias` entries are still consulted first and still win. Every catalog bump must move the matching alias; the verifier fails the release if it does not.
+
+### Updating from chat
+Send `/update` to install the newest `johns-harness` on the machine the gateway runs on and restart into it; `/update 2026.9.14` pins an exact version. Owner only. The reply names the current and target versions, a second `/update` while one is running is refused, and the first message after the restart confirms the running version. On a writable host the package is reinstalled into the existing global prefix. On an immutable image with a persistent volume (Fly), it is installed into `$JOHNNESS_STATE_DIR/runtime/johnness` and the entrypoint prefers that runtime when it is newer than the image: `exec node "$(node /opt/johnness/lib/node_modules/johns-harness/dist/runtime-path.js)" gateway run`. `JOHNNESS_UPDATE_PREFIX` overrides the target. On failure the reply carries the last lines of npm output and the one command that fixes it.
 
 ### From source
 
@@ -68,8 +73,8 @@ node johnness.mjs --help
 ### Verify
 
 ```bash
-npm test                        # 701 tests against the installed dependency tree
-bash scripts/verify-patches.sh  # 258 checks across every patch family
+npm test                        # 767 tests against the installed dependency tree
+bash scripts/verify-patches.sh  # 360 checks across every patch family
 ```
 
 ## Launch a swarm with one command
@@ -115,7 +120,7 @@ Coding agents today run as isolated processes. Two agents on the same repository
 - **Memory built for production.** Tiered recall that traces from consolidated reflections down to the verbatim record, surviving compaction and shared across the swarm. Installed and enabled by default.
 - **Production authority per commit.** Promotion is granted to an exact SHA, never to a branch name, so one worker's authorization never covers another worker's commits.
 - **An append-only action log.** Agents record every consequential action to `ACTION_LOG.md` and read it before acting.
-- **A fixed runtime surface.** The core does not grow on a schedule. New mechanisms enter only to solve a demonstrated production failure, one narrow, tested, reversible patch at a time: 59 patch families, each with a regression test and a rollback path.
+- **A fixed runtime surface.** The core does not grow on a schedule. New mechanisms enter only to solve a demonstrated production failure, one narrow, tested, reversible patch at a time: 62 patch families, each with a regression test and a rollback path.
 - **Reliability with a definition.** Bounded retries, explicit failure states, exact-once continuation, context-pressure recovery, durable delivery, and supervised gateway recovery.
 - **Coding first, phone optional.** Direct the work at a high level from a chat channel while agents plan, implement, test, coordinate, and stage releases unattended.
 - **Local voice.** Optional native Whisper transcription of inbound audio, entirely on your machine. Off by default. [Setup](docs/NATIVE-WHISPER-MUSE.md).
@@ -182,7 +187,7 @@ The log is a [`RULES.md`](RULES.md) workspace convention enforced through the ac
 
 ## Patch families
 
-The runtime carries 59 patch families. Each is a production fix applied at the source with a regression test, a durable patch marker, and a rollback path. A verifier runs 258 checks against the package tree and installed dependencies, and 701 tests run against the installed dependency tree.
+The runtime carries 62 patch families. Each is a production fix applied at the source with a regression test, a durable patch marker, and a rollback path. A verifier runs 360 checks against the package tree and installed dependencies, and 767 tests run against the installed dependency tree.
 
 Every family follows the same six steps: reproduce the failure, trace the exact runtime path, make the smallest source-level change that restores the invariant, add a regression test and a patch marker, run the verifier, and retain rollback artifacts. The full index: [`docs/PATCHES.md`](docs/PATCHES.md).
 
@@ -199,7 +204,7 @@ Every family follows the same six steps: reproduce the failure, trace the exact
 ## Documentation
 
 - [`docs/index.md`](docs/index.md): runtime docs, from gateway and channels to plugins, nodes, and CLI reference.
-- [`docs/PATCHES.md`](docs/PATCHES.md): the 59 patch families, one record each.
+- [`docs/PATCHES.md`](docs/PATCHES.md): the 62 patch families, one record each.
 - [`docs/NATIVE-WHISPER-MUSE.md`](docs/NATIVE-WHISPER-MUSE.md): local Whisper transcription setup.
 - [`RULES.md`](RULES.md): the default operating rules, including Rule Zero on production authorization.
 

package/dist/auth-profiles-5CHn7vq1.js

@@ -5111,6 +5111,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,
@@ -6443,6 +6459,17 @@ function applyLegacyAudioTranscriptionModel(params) {
 	params.changes.push(params.alreadySetMessage);
 }
 const LEGACY_CONFIG_MIGRATIONS_PART_2 = [
+	{
+		id: "agent.image-generation-model-v1",
+		describe: "Migrate agents.defaults.imageGenerationModel string to primary/fallbacks",
+		apply: (raw, changes) => {
+			const defaults = getRecord(getRecord(raw.agents)?.defaults);
+			if (!defaults || typeof defaults.imageGenerationModel !== "string") return;
+			const primary = defaults.imageGenerationModel.trim();
+			defaults.imageGenerationModel = primary ? { primary, fallbacks: [] } : void 0;
+			changes.push("Migrated agents.defaults.imageGenerationModel string to primary/fallbacks");
+		}
+	}, // JOHNNESS_PATCH_GPT_IMAGE_62
 	{
 		id: "agent.model-config-v2",
 		describe: "Migrate legacy agent.model/allowedModels/modelAliases/modelFallbacks/imageModelFallbacks to agent.models + model lists",
@@ -10876,6 +10903,7 @@ function isValidNonNegativeByteSizeString(value) {
 const AgentDefaultsSchema = z.object({
 	model: AgentModelSchema.optional(),
 	imageModel: AgentModelSchema.optional(),
+	imageGenerationModel: AgentModelSchema.optional(), // JOHNNESS_PATCH_GPT_IMAGE_62
 	pdfModel: AgentModelSchema.optional(),
 	pdfMaxBytesMb: z.number().positive().optional(),
 	pdfMaxPages: z.number().int().positive().optional(),

package/dist/commands-registry-C78-tPS3.js

@@ -1,3 +1,4 @@
+// JOHNNESS_PATCH_UPDATE_COMMAND_62
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
 // JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { l as escapeRegExp } from "./utils-DC4zYvW0.js";
@@ -181,6 +182,19 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "update",
+			nativeName: "update",
+			description: "Install the newest johns-harness and restart (owner only).",
+			textAlias: "/update",
+			category: "management",
+			args: [{
+				name: "version",
+				description: "Exact version to install (default latest)",
+				type: "string",
+				required: false
+			}]
+		}),
 		defineChatCommand({
 			key: "login",
 			nativeName: "login",

package/dist/commands-registry-D0Jkz-Sn.js

@@ -1,3 +1,4 @@
+// JOHNNESS_PATCH_UPDATE_COMMAND_62
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
 // JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { D as isPlainObject, u as escapeRegExp } from "./logger-Bj0Xl6pn.js";
@@ -218,6 +219,19 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "update",
+			nativeName: "update",
+			description: "Install the newest johns-harness and restart (owner only).",
+			textAlias: "/update",
+			category: "management",
+			args: [{
+				name: "version",
+				description: "Exact version to install (default latest)",
+				type: "string",
+				required: false
+			}]
+		}),
 		defineChatCommand({
 			key: "login",
 			nativeName: "login",

package/dist/commands-registry-DJWLO-6B.js

@@ -1,3 +1,4 @@
+// JOHNNESS_PATCH_UPDATE_COMMAND_62
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
 // JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { D as isPlainObject, u as escapeRegExp } from "./logger-BW8uLq6f.js";
@@ -218,6 +219,19 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "update",
+			nativeName: "update",
+			description: "Install the newest johns-harness and restart (owner only).",
+			textAlias: "/update",
+			category: "management",
+			args: [{
+				name: "version",
+				description: "Exact version to install (default latest)",
+				type: "string",
+				required: false
+			}]
+		}),
 		defineChatCommand({
 			key: "login",
 			nativeName: "login",

package/dist/commands-registry-l51VuG0m.js

@@ -1,3 +1,4 @@
+// JOHNNESS_PATCH_UPDATE_COMMAND_62
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
 // JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { Bi as DEFAULT_PROVIDER, Or as resolveConfiguredModelRef, zi as DEFAULT_MODEL } from "./auth-profiles-5CHn7vq1.js";
@@ -181,6 +182,19 @@ function buildChatCommands() {
 				captureRemaining: true
 			}]
 		}),
+		defineChatCommand({
+			key: "update",
+			nativeName: "update",
+			description: "Install the newest johns-harness and restart (owner only).",
+			textAlias: "/update",
+			category: "management",
+			args: [{
+				name: "version",
+				description: "Exact version to install (default latest)",
+				type: "string",
+				required: false
+			}]
+		}),
 		defineChatCommand({
 			key: "login",
 			nativeName: "login",

package/dist/compact-B247y5Qt.js

@@ -1,3 +1,5 @@
+import { createImageGenerateTool } from "./image-generate.js";
+import { handleUpdateCommand } from "./update-command.js";
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
 // JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { handleDeviceLoginCommand } from "./codex-oauth-device.js";
@@ -11283,6 +11285,7 @@ const TRUSTED_TOOL_RESULT_MEDIA = new Set([
 	"exec",
 	"gateway",
 	"image",
+	"image_generate",
 	"memory_get",
 	"memory_search",
 	"message",
@@ -15583,7 +15586,8 @@ function buildAgentSystemPrompt(params) {
 		sessions_spawn: acpSpawnRuntimeEnabled ? "Spawn an isolated sub-agent or ACP coding session (runtime=\"acp\" requires `agentId` unless `acp.defaultAgent` is configured; ACP harness ids follow acp.allowedAgents, not agents_list)" : "Spawn an isolated sub-agent session",
 		subagents: "List, steer, or kill sub-agent runs for this requester session",
 		session_status: "Show a /status-equivalent status card (usage + time + Reasoning/Verbose/Elevated); use for model-use questions (📊 session_status); optional per-session model override",
-		image: "Analyze an image with the configured image model"
+		image: "Analyze an image with the configured image model",
+		image_generate: "Generate or edit images with GPT Image 2 (subscription first, API key second)"
 	};
 	const toolOrder = [
 		"read",
@@ -15610,7 +15614,8 @@ function buildAgentSystemPrompt(params) {
 		"sessions_send",
 		"subagents",
 		"session_status",
-		"image"
+		"image",
+		"image_generate"
 	];
 	const canonicalToolNames = (params.toolNames ?? []).map((tool) => tool.trim()).filter(Boolean);
 	const canonicalByNormalized = /* @__PURE__ */ new Map();
@@ -40979,6 +40984,8 @@ function resolveSessionEntryForHookSessionKey(sessionStore, sessionKey) {
 async function handleCommands(params) {
 	const deviceLoginReply = await handleDeviceLoginCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway });
 	if (deviceLoginReply) return deviceLoginReply;
+	const updateReply = await handleUpdateCommand(params, shouldHandleTextCommands({ cfg: params.cfg, surface: params.command.surface, commandSource: params.ctx.CommandSource }), { routeReply, callGateway, writeRestartSentinel, extractDeliveryInfo, restart: () => scheduleGatewaySigusr1Restart({ reason: "/update" }) }); // JOHNNESS_PATCH_UPDATE_COMMAND_62
+	if (updateReply) return updateReply;
 	if (HANDLERS === null) HANDLERS = [
 		handlePluginCommand,
 		handleBashCommand,
@@ -55646,6 +55653,16 @@ function createJohnnessTools(options) {
 		fsPolicy: options?.fsPolicy,
 		modelHasVision: options?.modelHasVision
 	}) : null;
+	const imageGenerateTool = options?.agentDir?.trim() ? createImageGenerateTool({
+		config: options?.config,
+		agentDir: options.agentDir,
+		workspaceDir,
+		sandbox: options?.sandboxRoot && options?.sandboxFsBridge ? { root: options.sandboxRoot, bridge: options.sandboxFsBridge } : void 0
+	}, {
+		resolveApiKeyForProvider,
+		loadWebMedia,
+		localRoots: resolveMediaToolLocalRoots(workspaceDir, { workspaceOnly: options?.fsPolicy?.workspaceOnly === true })
+	}) : null; // JOHNNESS_PATCH_GPT_IMAGE_62
 	const pdfTool = options?.agentDir?.trim() ? createPdfTool({
 		config: options?.config,
 		agentDir: options.agentDir,
@@ -55765,6 +55782,7 @@ function createJohnnessTools(options) {
 		...webSearchTool ? [webSearchTool] : [],
 		...webFetchTool ? [webFetchTool] : [],
 		...imageTool ? [imageTool] : [],
+		...imageGenerateTool ? [imageGenerateTool] : [],
 		...pdfTool ? [pdfTool] : []
 	];
 	const pluginTools = resolvePluginTools({

package/dist/config-koj5M_EO.js

@@ -1808,6 +1808,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,
@@ -3132,6 +3148,17 @@ function applyLegacyAudioTranscriptionModel(params) {
 	params.changes.push(params.alreadySetMessage);
 }
 const LEGACY_CONFIG_MIGRATIONS_PART_2 = [
+	{
+		id: "agent.image-generation-model-v1",
+		describe: "Migrate agents.defaults.imageGenerationModel string to primary/fallbacks",
+		apply: (raw, changes) => {
+			const defaults = getRecord(getRecord(raw.agents)?.defaults);
+			if (!defaults || typeof defaults.imageGenerationModel !== "string") return;
+			const primary = defaults.imageGenerationModel.trim();
+			defaults.imageGenerationModel = primary ? { primary, fallbacks: [] } : void 0;
+			changes.push("Migrated agents.defaults.imageGenerationModel string to primary/fallbacks");
+		}
+	}, // JOHNNESS_PATCH_GPT_IMAGE_62
 	{
 		id: "agent.model-config-v2",
 		describe: "Migrate legacy agent.model/allowedModels/modelAliases/modelFallbacks/imageModelFallbacks to agent.models + model lists",
@@ -6762,6 +6789,7 @@ function isValidNonNegativeByteSizeString(value) {
 const AgentDefaultsSchema = z.object({
 	model: AgentModelSchema.optional(),
 	imageModel: AgentModelSchema.optional(),
+	imageGenerationModel: AgentModelSchema.optional(), // JOHNNESS_PATCH_GPT_IMAGE_62
 	pdfModel: AgentModelSchema.optional(),
 	pdfMaxBytesMb: z.number().positive().optional(),
 	pdfMaxPages: z.number().int().positive().optional(),

package/dist/daemon-cli.js

@@ -4959,6 +4959,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,
@@ -6112,6 +6128,17 @@ function applyLegacyAudioTranscriptionModel(params) {
 	params.changes.push(params.alreadySetMessage);
 }
 const LEGACY_CONFIG_MIGRATIONS_PART_2 = [
+	{
+		id: "agent.image-generation-model-v1",
+		describe: "Migrate agents.defaults.imageGenerationModel string to primary/fallbacks",
+		apply: (raw, changes) => {
+			const defaults = getRecord(getRecord(raw.agents)?.defaults);
+			if (!defaults || typeof defaults.imageGenerationModel !== "string") return;
+			const primary = defaults.imageGenerationModel.trim();
+			defaults.imageGenerationModel = primary ? { primary, fallbacks: [] } : void 0;
+			changes.push("Migrated agents.defaults.imageGenerationModel string to primary/fallbacks");
+		}
+	}, // JOHNNESS_PATCH_GPT_IMAGE_62
 	{
 		id: "agent.model-config-v2",
 		describe: "Migrate legacy agent.model/allowedModels/modelAliases/modelFallbacks/imageModelFallbacks to agent.models + model lists",
@@ -9694,6 +9721,7 @@ function isValidNonNegativeByteSizeString(value) {
 const AgentDefaultsSchema = z.object({
 	model: AgentModelSchema.optional(),
 	imageModel: AgentModelSchema.optional(),
+	imageGenerationModel: AgentModelSchema.optional(), // JOHNNESS_PATCH_GPT_IMAGE_62
 	pdfModel: AgentModelSchema.optional(),
 	pdfMaxBytesMb: z.number().positive().optional(),
 	pdfMaxPages: z.number().int().positive().optional(),