johns-harness 2026.9.14 → 2026.9.16

package/README.md

@@ -55,7 +55,9 @@ Expired ChatGPT credentials trigger an owner notice with the `/login` recovery c
 
 <!-- JOHNNESS_PATCH_DEFAULTS_61 -->
 ### Batteries included
-The harness ships the current model catalog and the short aliases `opus`, `sonnet`, `fable`, `astra`, `sol`, `luna`, `terra`, and `gpt`, so `/model opus` works on a fresh install with no `models.providers` block. Channels you configure load without a `plugins.allow` list; only an explicit `enabled: false` or `plugins.deny` turns one off. Updating the harness updates the catalog and aliases for every agent. Image generation and editing use GPT Image 2 through the `image_generate` tool: `openai-codex/gpt-image-2` on the ChatGPT subscription first, `openai/gpt-image-2` on the API key second (`agents.defaults.imageGenerationModel`).
+The harness ships the current model catalog and the short aliases `opus`, `sonnet`, `fable`, `astra`, `sol`, `luna`, `terra`, `gpt`, `flash`, `banana`, and `image`, so `/model opus` works on a fresh install with no `models.providers` block. Channels you configure load without a `plugins.allow` list; only an explicit `enabled: false` or `plugins.deny` turns one off. Updating the harness updates the catalog and aliases for every agent. Any `openai-codex/<model>` primary that hits its ChatGPT usage limit fails over to `openai/<model>` on the API key first, then to your configured fallbacks, with no config (the sibling is skipped when no OpenAI API key is present). Image generation and editing use GPT Image 2 through the `image_generate` tool: `openai-codex/gpt-image-2` on the ChatGPT subscription first, `openai/gpt-image-2` on the API key second (`agents.defaults.imageGenerationModel`). Nano Banana Pro (`google/gemini-3-pro-image-preview`) ships in the catalog as a selectable image model, reachable with `model: "nano-banana"` and its own `aspectRatio` option; the default stays GPT Image 2 because the subscription path costs nothing.
+
+**The alias contract.** Every shipped alias points at the newest model in its line, so an install or an `/update` moves every agent forward with zero per-instance config. Your own `agents.defaults.models[*].alias` entries are still consulted first and still win. Every catalog bump must move the matching alias; the verifier fails the release if it does not.
 
 ### Updating from chat
 Send `/update` to install the newest `johns-harness` on the machine the gateway runs on and restart into it; `/update 2026.9.14` pins an exact version. Owner only. The reply names the current and target versions, a second `/update` while one is running is refused, and the first message after the restart confirms the running version. On a writable host the package is reinstalled into the existing global prefix. On an immutable image with a persistent volume (Fly), it is installed into `$JOHNNESS_STATE_DIR/runtime/johnness` and the entrypoint prefers that runtime when it is newer than the image: `exec node "$(node /opt/johnness/lib/node_modules/johns-harness/dist/runtime-path.js)" gateway run`. `JOHNNESS_UPDATE_PREFIX` overrides the target. On failure the reply carries the last lines of npm output and the one command that fixes it.
@@ -72,7 +74,7 @@ node johnness.mjs --help
 
 ```bash
 npm test                        # 767 tests against the installed dependency tree
-bash scripts/verify-patches.sh  # 360 checks across every patch family
+bash scripts/verify-patches.sh  # 395 checks across every patch family
 ```
 
 ## Launch a swarm with one command
@@ -118,7 +120,7 @@ Coding agents today run as isolated processes. Two agents on the same repository
 - **Memory built for production.** Tiered recall that traces from consolidated reflections down to the verbatim record, surviving compaction and shared across the swarm. Installed and enabled by default.
 - **Production authority per commit.** Promotion is granted to an exact SHA, never to a branch name, so one worker's authorization never covers another worker's commits.
 - **An append-only action log.** Agents record every consequential action to `ACTION_LOG.md` and read it before acting.
-- **A fixed runtime surface.** The core does not grow on a schedule. New mechanisms enter only to solve a demonstrated production failure, one narrow, tested, reversible patch at a time: 62 patch families, each with a regression test and a rollback path.
+- **A fixed runtime surface.** The core does not grow on a schedule. New mechanisms enter only to solve a demonstrated production failure, one narrow, tested, reversible patch at a time: 64 patch families, each with a regression test and a rollback path.
 - **Reliability with a definition.** Bounded retries, explicit failure states, exact-once continuation, context-pressure recovery, durable delivery, and supervised gateway recovery.
 - **Coding first, phone optional.** Direct the work at a high level from a chat channel while agents plan, implement, test, coordinate, and stage releases unattended.
 - **Local voice.** Optional native Whisper transcription of inbound audio, entirely on your machine. Off by default. [Setup](docs/NATIVE-WHISPER-MUSE.md).
@@ -185,7 +187,7 @@ The log is a [`RULES.md`](RULES.md) workspace convention enforced through the ac
 
 ## Patch families
 
-The runtime carries 62 patch families. Each is a production fix applied at the source with a regression test, a durable patch marker, and a rollback path. A verifier runs 360 checks against the package tree and installed dependencies, and 767 tests run against the installed dependency tree.
+The runtime carries 64 patch families. Each is a production fix applied at the source with a regression test, a durable patch marker, and a rollback path. A verifier runs 395 checks against the package tree and installed dependencies, and 767 tests run against the installed dependency tree.
 
 Every family follows the same six steps: reproduce the failure, trace the exact runtime path, make the smallest source-level change that restores the invariant, add a regression test and a patch marker, run the verifier, and retain rollback artifacts. The full index: [`docs/PATCHES.md`](docs/PATCHES.md).
 
@@ -202,7 +204,7 @@ Every family follows the same six steps: reproduce the failure, trace the exact
 ## Documentation
 
 - [`docs/index.md`](docs/index.md): runtime docs, from gateway and channels to plugins, nodes, and CLI reference.
-- [`docs/PATCHES.md`](docs/PATCHES.md): the 62 patch families, one record each.
+- [`docs/PATCHES.md`](docs/PATCHES.md): the 64 patch families, one record each.
 - [`docs/NATIVE-WHISPER-MUSE.md`](docs/NATIVE-WHISPER-MUSE.md): local Whisper transcription setup.
 - [`RULES.md`](RULES.md): the default operating rules, including Rule Zero on production authorization.
 

package/dist/auth-profiles-5CHn7vq1.js

@@ -5111,6 +5111,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,

package/dist/compact-B247y5Qt.js

@@ -127,6 +127,7 @@ import JSON5 from "json5";
 import { inspect } from "node:util";
 import fs$1, { appendFile, mkdir } from "node:fs/promises";
 import { complete, completeSimple, createAssistantMessageEventStream, getApiProvider, registerApiProvider, streamSimple } from "@mariozechner/pi-ai";
+import { getModel as getShippedCatalogModel } from "@mariozechner/pi-ai"; // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
 import crypto, { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { CURRENT_SESSION_VERSION, DefaultResourceLoader, SessionManager, SettingsManager, codingTools, createAgentSession, createEditTool, createReadTool, createWriteTool, estimateTokens, generateSummary, readTool } from "@mariozechner/pi-coding-agent";
 import { EdgeTTS } from "node-edge-tts";
@@ -18322,7 +18323,12 @@ async function runEmbeddedPiAgent(params) {
 			cfg: params.config,
 			agentId: params.agentId,
 			sessionKey: params.sessionKey
-		});
+		}) || hasCodexApiSiblingFallback({
+			provider,
+			model: modelId,
+			cfg: params.config,
+			agentDir
+		}); // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
 		await ensureJohnnessModelsJson(params.config, agentDir);
 		let modelResolveOverride;
 		let legacyBeforeAgentStartResult;
@@ -46838,6 +46844,34 @@ function resolveImageFallbackCandidates(params) {
 	for (const raw of imageFallbacks) addRaw(raw);
 	return candidates;
 }
+/* JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64 (family 64): any openai-codex/<model> primary automatically fails
+   over to openai/<model>, the same model id on the API-key provider, before any configured
+   fallback. The sibling exists only when it is a real entry in the shipped catalog and the
+   openai provider has credentials on this install (auth profile, OPENAI_API_KEY, or
+   models.providers.openai.apiKey); otherwise nothing is added and behavior is unchanged.
+   It is added through addExplicitCandidate, which bypasses the agents.defaults.models
+   allowlist on purpose: the allowlist governs what a user may select, and this candidate is
+   the model the user already selected, reached through a different billing path. */
+const CODEX_API_SIBLING_PROVIDER = "openai";
+function resolveCodexApiSiblingCandidate(params) {
+	const provider = normalizeProviderId(String(params.provider ?? ""));
+	const model = String(params.model ?? "").trim();
+	if (provider !== "openai-codex" || !model) return null;
+	try {
+		if (!getShippedCatalogModel(CODEX_API_SIBLING_PROVIDER, model)) return null;
+		const store = params.store ?? ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
+		if (resolveModelAuthMode(CODEX_API_SIBLING_PROVIDER, params.cfg, store) === "unknown") return null;
+	} catch {
+		return null;
+	}
+	return {
+		provider: CODEX_API_SIBLING_PROVIDER,
+		model
+	};
+}
+function hasCodexApiSiblingFallback(params) {
+	return resolveCodexApiSiblingCandidate(params) !== null;
+}
 function resolveFallbackCandidates(params) {
 	const primary = params.cfg ? resolveConfiguredModelRef({
 		cfg: params.cfg,
@@ -46857,6 +46891,14 @@ function resolveFallbackCandidates(params) {
 		defaultProvider
 	}));
 	addExplicitCandidate(normalizedPrimary);
+	const codexApiSibling = resolveCodexApiSiblingCandidate({
+		provider: normalizedPrimary.provider,
+		model: normalizedPrimary.model,
+		cfg: params.cfg,
+		agentDir: params.agentDir,
+		store: params.authStore
+	}); // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
+	if (codexApiSibling) addExplicitCandidate(codexApiSibling);
 	const modelFallbacks = (() => {
 		if (params.fallbacksOverride !== void 0) return params.fallbacksOverride;
 		const configuredFallbacks = resolveAgentModelFallbackValues(params.cfg?.agents?.defaults?.model);
@@ -46932,13 +46974,15 @@ function resolveCooldownDecision(params) {
 	};
 }
 async function runWithModelFallback(params) {
+	const authStore = params.cfg ? ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }) : null;
 	const candidates = resolveFallbackCandidates({
 		cfg: params.cfg,
 		provider: params.provider,
 		model: params.model,
-		fallbacksOverride: params.fallbacksOverride
+		fallbacksOverride: params.fallbacksOverride,
+		agentDir: params.agentDir, // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
+		authStore: authStore ?? void 0
 	});
-	const authStore = params.cfg ? ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }) : null;
 	const attempts = [];
 	let lastError;
 	const hasFallbackCandidates = candidates.length > 1;

package/dist/config-koj5M_EO.js

@@ -1808,6 +1808,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,

package/dist/daemon-cli.js

@@ -4959,6 +4959,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,

package/dist/image-generate.js

@@ -1,3 +1,4 @@
+// JOHNNESS_PATCH_NANO_BANANA_63
 // JOHNNESS_PATCH_GPT_IMAGE_62
 // First-class `image_generate` agent tool: OpenAI Images API (generations when no input
 // image, edits when one is given) with the model from `agents.defaults.imageGenerationModel`.
@@ -23,6 +24,35 @@ const SIZES = new Set(["1024x1024", "1536x1024", "1024x1536", "auto"]);
 const DEFAULT_MAX_INPUT_BYTES = 20 * 1024 * 1024;
 const JWT_CLAIM_PATH = "https://api.openai.com/auth";
 
+// JOHNNESS_PATCH_NANO_BANANA_63: Nano Banana Pro (google/gemini-3-pro-image-preview) is a
+// selectable image model, not a default. The default chain stays subscription first
+// (openai-codex/gpt-image-2, then openai/gpt-image-2); Gemini is API-key billed, so it is
+// reached only through the tool's `model` param or agents.defaults.imageGenerationModel.
+export const GOOGLE_BASE = "https://generativelanguage.googleapis.com/v1beta";
+export const NANO_BANANA_MODEL_ID = "gemini-3-pro-image-preview";
+export const NANO_BANANA_REF = `google/${NANO_BANANA_MODEL_ID}`;
+/** Aspect ratios Nano Banana Pro accepts. Ignored by the OpenAI providers, which use `size`. */
+export const ASPECT_RATIOS = Object.freeze(["1:1", "2:3", "3:2", "3:4", "4:3", "4:5", "5:4", "9:16", "16:9", "21:9"]);
+/** Bare names the `model` param accepts, resolved to catalog refs before provider routing. */
+export const IMAGE_MODEL_ALIASES = Object.freeze({
+  "nano-banana": NANO_BANANA_REF,
+  banana: NANO_BANANA_REF,
+  "nano-banana-pro": NANO_BANANA_REF,
+  "gemini-3-pro-image-preview": NANO_BANANA_REF,
+  image: "openai-codex/gpt-image-2",
+  "gpt-image-2": "openai-codex/gpt-image-2",
+});
+
+/** Resolve an alias or a provider/model ref to a full provider/model ref. */
+export function resolveImageModelRef(raw) {
+  const value = String(raw ?? "").trim();
+  if (!value) return null;
+  const alias = IMAGE_MODEL_ALIASES[value.toLowerCase()];
+  if (alias) return alias;
+  if (value.includes("/")) return value;
+  throw new Error(`Unknown image model "${value}". Use provider/model, or one of: ${Object.keys(IMAGE_MODEL_ALIASES).join(", ")}.`);
+}
+
 export function coerceImageGenerationModelConfig(cfg) {
   const raw = cfg?.agents?.defaults?.imageGenerationModel;
   if (typeof raw === "string" && raw.trim()) return { primary: raw.trim(), fallbacks: [] };
@@ -56,7 +86,15 @@ export function codexAccountIdFromToken(token) {
 }
 
 /** Endpoint + headers for one provider. Same OAuth transport shape as openai-codex-responses. */
-export function buildProviderRequest({ provider, apiKey, edit, userAgent = "johnness" }) {
+export function buildProviderRequest({ provider, apiKey, edit, userAgent = "johnness", model = NANO_BANANA_MODEL_ID }) {
+  if (provider === "google") {
+    // JOHNNESS_PATCH_NANO_BANANA_63: Gemini generateContent, API key in x-goog-api-key.
+    // One endpoint for both generations and edits; edits inline the inputs as parts.
+    return {
+      url: `${GOOGLE_BASE}/models/${model}:generateContent`,
+      headers: { "x-goog-api-key": apiKey, "content-type": "application/json", "User-Agent": userAgent },
+    };
+  }
   if (provider === "openai-codex") {
     const accountId = codexAccountIdFromToken(apiKey);
     if (!accountId) throw new ProviderUnsupported("codex token has no chatgpt_account_id");
@@ -92,10 +130,14 @@ function sanitizeName(input, fallback) {
   return base || fallback;
 }
 
-export function resolveOutputPath({ workspaceDir, output, index = 0, count = 1 }) {
+// JOHNNESS_PATCH_NANO_BANANA_63: `ext` defaults to png, which is what the OpenAI Images API
+// returns and what family 62 shipped. Nano Banana Pro answers with image/jpeg, so the caller
+// passes the extension the returned bytes actually are rather than mislabeling a JPEG .png.
+export function resolveOutputPath({ workspaceDir, output, index = 0, count = 1, ext = "png" }) {
   const root = path.resolve(workspaceDir);
   const mediaDir = path.join(root, "media", "generated");
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const suffix = String(ext || "png").replace(/^\.+/, "").toLowerCase().replace(/[^a-z0-9]/g, "") || "png";
   let target;
   if (output && String(output).trim()) {
     const raw = String(output).trim();
@@ -103,13 +145,21 @@ export function resolveOutputPath({ workspaceDir, output, index = 0, count = 1 }
     const resolved = path.isAbsolute(raw) ? path.resolve(raw) : path.resolve(root, raw);
     const rel = path.relative(root, resolved);
     if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`output must stay inside the workspace: ${raw}`);
-    target = count > 1 ? path.join(path.dirname(resolved), `${sanitizeName(path.basename(resolved), "image")}-${index + 1}.png`) : resolved.replace(/\.[a-z0-9]+$/i, "") + ".png";
+    target = count > 1 ? path.join(path.dirname(resolved), `${sanitizeName(path.basename(resolved), "image")}-${index + 1}.${suffix}`) : resolved.replace(/\.[a-z0-9]+$/i, "") + "." + suffix;
   } else {
-    target = path.join(mediaDir, `gpt-image-${stamp}${count > 1 ? `-${index + 1}` : ""}.png`);
+    target = path.join(mediaDir, `gpt-image-${stamp}${count > 1 ? `-${index + 1}` : ""}.${suffix}`);
   }
   return target;
 }
 
+/** File extension for the bytes a provider returned. JOHNNESS_PATCH_NANO_BANANA_63 */
+export function extensionForMimeType(mimeType) {
+  const value = String(mimeType ?? "").toLowerCase();
+  if (value.includes("jpeg") || value.includes("jpg")) return "jpg";
+  if (value.includes("webp")) return "webp";
+  return "png";
+}
+
 export function validateParams(args) {
   const record = args && typeof args === "object" ? args : {};
   const prompt = typeof record.prompt === "string" ? record.prompt.trim() : "";
@@ -125,12 +175,58 @@ export function validateParams(args) {
   const countRaw = typeof record.count === "number" ? Math.floor(record.count) : 1;
   if (!Number.isFinite(countRaw) || countRaw < 1 || countRaw > 4) throw new Error("count must be 1..4");
   const quality = typeof record.quality === "string" && ["low", "medium", "high", "auto"].includes(record.quality) ? record.quality : void 0;
-  return { prompt, inputs, mask, size, count: countRaw, quality, output: typeof record.output === "string" ? record.output : void 0, model: typeof record.model === "string" && record.model.trim() ? record.model.trim() : void 0 };
+  // JOHNNESS_PATCH_NANO_BANANA_63: aliases resolve to catalog refs; aspectRatio is Gemini only.
+  const model = typeof record.model === "string" && record.model.trim() ? resolveImageModelRef(record.model) : void 0;
+  const aspectRatio = typeof record.aspectRatio === "string" && record.aspectRatio.trim() ? record.aspectRatio.trim() : void 0;
+  if (aspectRatio && !ASPECT_RATIOS.includes(aspectRatio)) throw new Error(`aspectRatio must be one of ${ASPECT_RATIOS.join(", ")}`);
+  return { prompt, inputs, mask, size, count: countRaw, quality, aspectRatio, output: typeof record.output === "string" ? record.output : void 0, model };
+}
+
+/**
+ * JOHNNESS_PATCH_NANO_BANANA_63: Gemini generateContent branch.
+ * Generations send the prompt alone; edits send the prompt plus one inlineData part per input
+ * image. `aspectRatio` rides generationConfig.imageConfig. Failure classification is shared with
+ * the OpenAI branches (isUnsupportedStatus) so fallback chaining behaves identically.
+ */
+async function callGoogleProvider({ candidate, apiKey, params, images, fetchImpl, userAgent }) {
+  const edit = images.length > 0;
+  const { url, headers } = buildProviderRequest({ provider: candidate.provider, apiKey, edit, userAgent, model: candidate.model });
+  const parts = [{ text: params.prompt }];
+  for (const img of images) parts.push({ inlineData: { mimeType: img.mimeType, data: Buffer.from(img.buffer).toString("base64") } });
+  const generationConfig = { responseModalities: ["IMAGE"] };
+  if (params.aspectRatio) generationConfig.imageConfig = { aspectRatio: params.aspectRatio };
+  const res = await fetchImpl(url, { method: "POST", headers, body: JSON.stringify({ contents: [{ role: "user", parts }], generationConfig }) });
+  const text = await res.text();
+  if (!res.ok) {
+    if (isUnsupportedStatus(res.status, text)) throw new ProviderUnsupported(`${candidate.provider} ${res.status}: ${redact(text)}`, res.status);
+    throw new Error(`${candidate.provider} ${res.status}: ${redact(text)}`);
+  }
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error(`${candidate.provider}: non-JSON response`);
+  }
+  const buffers = [];
+  let mimeType = "image/png";
+  for (const candidateOut of Array.isArray(json?.candidates) ? json.candidates : []) {
+    for (const part of Array.isArray(candidateOut?.content?.parts) ? candidateOut.content.parts : []) {
+      const inline = part?.inlineData ?? part?.inline_data;
+      const data = inline?.data;
+      if (typeof data === "string" && data) {
+        buffers.push(Buffer.from(data, "base64"));
+        if (inline?.mimeType || inline?.mime_type) mimeType = inline.mimeType ?? inline.mime_type;
+      }
+    }
+  }
+  if (buffers.length === 0) throw new Error(`${candidate.provider}: response carried no image data`);
+  return { buffers, usage: json?.usageMetadata ?? null, mode: edit ? "edit" : "generate", mimeType };
 }
 
 async function callProvider({ candidate, apiKey, params, images, mask, fetchImpl, userAgent }) {
+  if (candidate.provider === "google") return callGoogleProvider({ candidate, apiKey, params, images, fetchImpl, userAgent }); // JOHNNESS_PATCH_NANO_BANANA_63
   const edit = images.length > 0;
-  const { url, headers } = buildProviderRequest({ provider: candidate.provider, apiKey, edit, userAgent });
+  const { url, headers } = buildProviderRequest({ provider: candidate.provider, apiKey, edit, userAgent, model: candidate.model });
   let body;
   if (edit) {
     body = new FormData();
@@ -168,7 +264,7 @@ async function callProvider({ candidate, apiKey, params, images, mask, fetchImpl
     }
   }
   if (buffers.length === 0) throw new Error(`${candidate.provider}: response carried no image data`);
-  return { buffers, usage: json?.usage ?? null, mode: edit ? "edit" : "generate" };
+  return { buffers, usage: json?.usage ?? null, mode: edit ? "edit" : "generate", mimeType: "image/png" };
 }
 
 /**
@@ -217,7 +313,7 @@ export function createImageGenerateTool(options, deps) {
   return {
     label: "Image Generate",
     name: "image_generate",
-    description: "Generate or edit images with GPT Image 2 (default openai-codex/gpt-image-2, then openai/gpt-image-2). Give a prompt; add image (or images, up to 4) to edit, and an optional mask PNG. Writes PNG files under the workspace media/generated folder and returns their paths; send them with the message tool.",
+    description: "Generate or edit images with GPT Image 2 (default openai-codex/gpt-image-2, then openai/gpt-image-2) or Nano Banana Pro (model: nano-banana). Give a prompt; add image (or images, up to 4) to edit, and an optional mask PNG. Writes PNG files under the workspace media/generated folder and returns their paths; send them with the message tool.",
     parameters: Type.Object({
       prompt: Type.String({ description: "What to draw or how to change the input image." }),
       image: Type.Optional(Type.String({ description: "Input image path to edit (workspace or allowed local root)." })),
@@ -227,7 +323,8 @@ export function createImageGenerateTool(options, deps) {
       count: Type.Optional(Type.Number({ description: "Number of images, 1..4 (default 1)." })),
       quality: Type.Optional(Type.String({ description: "low, medium, high, or auto." })),
       output: Type.Optional(Type.String({ description: "Output path inside the workspace (default media/generated/gpt-image-<timestamp>.png)." })),
-      model: Type.Optional(Type.String({ description: "Override provider/model, for example openai/gpt-image-2." })),
+      model: Type.Optional(Type.String({ description: "Override provider/model, for example openai/gpt-image-2, or an alias: nano-banana (Nano Banana Pro), banana, image." })),
+      aspectRatio: Type.Optional(Type.String({ description: "Nano Banana Pro only: 1:1, 2:3, 3:2, 3:4, 4:3, 4:5, 5:4, 9:16, 16:9, or 21:9. Ignored by the GPT Image 2 providers." })),
     }),
     execute: async (_toolCallId, args) => {
       const params = validateParams(args);
@@ -242,7 +339,9 @@ export function createImageGenerateTool(options, deps) {
       const images = [];
       for (const ref of params.inputs) images.push(await load(ref));
       const mask = params.mask ? await load(params.mask) : void 0;
-      const outputs = Array.from({ length: params.count }, (_, i) => resolveOutputPath({ workspaceDir, output: params.output, index: i, count: params.count }));
+      // Validate the output path before spending a call, then resolve it again once the
+      // provider has told us what the bytes actually are. JOHNNESS_PATCH_NANO_BANANA_63
+      resolveOutputPath({ workspaceDir, output: params.output, index: 0, count: params.count });
       const result = await generateWithFallback({
         cfg: options?.config,
         params,
@@ -252,6 +351,8 @@ export function createImageGenerateTool(options, deps) {
         userAgent: deps.userAgent,
         resolveAuth: ({ provider }) => deps.resolveApiKeyForProvider({ provider, cfg: options?.config, agentDir }),
       });
+      const ext = extensionForMimeType(result.mimeType);
+      const outputs = Array.from({ length: params.count }, (_, i) => resolveOutputPath({ workspaceDir, output: params.output, index: i, count: params.count, ext }));
       const written = [];
       for (let i = 0; i < result.buffers.length && i < outputs.length; i++) {
         await fs.mkdir(path.dirname(outputs[i]), { recursive: true });

package/dist/model-selection-BGlGpPgM.js

@@ -1665,6 +1665,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,

package/dist/model-selection-BU6wl1le.js

@@ -1640,6 +1640,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,

package/dist/model-selection-L7RMwsG-.js

@@ -1571,6 +1571,22 @@ const DEFAULT_MODEL_ALIASES = {
 	"gemini-flash": "google/gemini-3-flash-preview",
 	"gemini-flash-lite": "google/gemini-3.1-flash-lite-preview"
 };
+// JOHNNESS_PATCH_NANO_BANANA_63: the shipped alias contract. Every alias resolves to the newest model
+// in its line that exists in the shipped catalog, so a fresh install or an /update moves
+// every agent forward with no per-instance config. This block carries only the aliases
+// family 63 moves or adds; the rest are already current in the literal above, and later
+// keys win. A user alias in agents.defaults.models[*].alias is consulted first and still
+// overrides. Adding a newer model to the catalog without moving its alias fails the
+// verifier (63.20, scripts/check-alias-contract.mjs).
+Object.assign(DEFAULT_MODEL_ALIASES, {
+	gpt: "openai-codex/gpt-5.6-sol",
+	flash: "google/gemini-3.8-flash",
+	"gemini-flash": "google/gemini-3.8-flash",
+	"gemini-flash-lite": "google/gemini-2.5-flash-lite",
+	banana: "google/gemini-3-pro-image-preview",
+	"nano-banana": "google/gemini-3-pro-image-preview",
+	image: "openai-codex/gpt-image-2"
+});
 const DEFAULT_MODEL_COST = {
 	input: 0,
 	output: 0,

package/dist/pi-embedded-C6ITuRXf.js

@@ -73,6 +73,7 @@ import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import crypto, { X509Certificate, createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { complete, completeSimple, createAssistantMessageEventStream, getApiProvider, registerApiProvider, streamSimple } from "@mariozechner/pi-ai";
+import { getModel as getShippedCatalogModel } from "@mariozechner/pi-ai"; // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
 import { CURRENT_SESSION_VERSION, DefaultResourceLoader, SessionManager, SettingsManager, codingTools, createAgentSession, createEditTool, createReadTool, createWriteTool, estimateTokens, generateSummary, readTool } from "@mariozechner/pi-coding-agent";
 import { EdgeTTS } from "node-edge-tts";
 import * as net$1 from "node:net";
@@ -39963,6 +39964,34 @@ function resolveImageFallbackCandidates(params) {
 	for (const raw of imageFallbacks) addRaw(raw);
 	return candidates;
 }
+/* JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64 (family 64): any openai-codex/<model> primary automatically fails
+   over to openai/<model>, the same model id on the API-key provider, before any configured
+   fallback. The sibling exists only when it is a real entry in the shipped catalog and the
+   openai provider has credentials on this install (auth profile, OPENAI_API_KEY, or
+   models.providers.openai.apiKey); otherwise nothing is added and behavior is unchanged.
+   It is added through addExplicitCandidate, which bypasses the agents.defaults.models
+   allowlist on purpose: the allowlist governs what a user may select, and this candidate is
+   the model the user already selected, reached through a different billing path. */
+const CODEX_API_SIBLING_PROVIDER = "openai";
+function resolveCodexApiSiblingCandidate(params) {
+	const provider = normalizeProviderId(String(params.provider ?? ""));
+	const model = String(params.model ?? "").trim();
+	if (provider !== "openai-codex" || !model) return null;
+	try {
+		if (!getShippedCatalogModel(CODEX_API_SIBLING_PROVIDER, model)) return null;
+		const store = params.store ?? ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false });
+		if (resolveModelAuthMode(CODEX_API_SIBLING_PROVIDER, params.cfg, store) === "unknown") return null;
+	} catch {
+		return null;
+	}
+	return {
+		provider: CODEX_API_SIBLING_PROVIDER,
+		model
+	};
+}
+function hasCodexApiSiblingFallback(params) {
+	return resolveCodexApiSiblingCandidate(params) !== null;
+}
 function resolveFallbackCandidates(params) {
 	const primary = params.cfg ? resolveConfiguredModelRef({
 		cfg: params.cfg,
@@ -39982,6 +40011,14 @@ function resolveFallbackCandidates(params) {
 		defaultProvider
 	}));
 	addExplicitCandidate(normalizedPrimary);
+	const codexApiSibling = resolveCodexApiSiblingCandidate({
+		provider: normalizedPrimary.provider,
+		model: normalizedPrimary.model,
+		cfg: params.cfg,
+		agentDir: params.agentDir,
+		store: params.authStore
+	}); // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
+	if (codexApiSibling) addExplicitCandidate(codexApiSibling);
 	const modelFallbacks = (() => {
 		if (params.fallbacksOverride !== void 0) return params.fallbacksOverride;
 		const configuredFallbacks = resolveAgentModelFallbackValues(params.cfg?.agents?.defaults?.model);
@@ -40057,13 +40094,15 @@ function resolveCooldownDecision(params) {
 	};
 }
 async function runWithModelFallback(params) {
+	const authStore = params.cfg ? ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }) : null;
 	const candidates = resolveFallbackCandidates({
 		cfg: params.cfg,
 		provider: params.provider,
 		model: params.model,
-		fallbacksOverride: params.fallbacksOverride
+		fallbacksOverride: params.fallbacksOverride,
+		agentDir: params.agentDir, // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
+		authStore: authStore ?? void 0
 	});
-	const authStore = params.cfg ? ensureAuthProfileStore(params.agentDir, { allowKeychainPrompt: false }) : null;
 	const attempts = [];
 	let lastError;
 	const hasFallbackCandidates = candidates.length > 1;
@@ -103926,7 +103965,12 @@ async function runEmbeddedPiAgent(params) {
 			cfg: params.config,
 			agentId: params.agentId,
 			sessionKey: params.sessionKey
-		});
+		}) || hasCodexApiSiblingFallback({
+			provider,
+			model: modelId,
+			cfg: params.config,
+			agentDir
+		}); // JOHNNESS_PATCH_CODEX_API_SIBLING_FALLBACK_64
 		await ensureJohnnessModelsJson(params.config, agentDir);
 		let modelResolveOverride;
 		let legacyBeforeAgentStartResult;