libre-webui 0.17.0 → 0.19.0

package/backend/dist/services/pluginService.js

@@ -19,13 +19,17 @@ import path from 'path';
 import { createHash } from 'crypto';
 import sanitize from 'sanitize-filename';
 import axios from 'axios';
+import codexOAuthService, { CODEX_OAUTH_PLUGIN_ID, } from './codexOAuthService.js';
+import { userModel } from '../models/userModel.js';
 import pluginCredentialsService from './pluginCredentialsService.js';
 import pluginVariablesService from './pluginVariablesService.js';
 import pluginActivationService from './pluginActivationService.js';
+import { PluginAudioGenerationService } from './pluginAudioGenerationService.js';
 import { PluginCapabilityRegistryService } from './pluginCapabilityRegistryService.js';
 import { PluginEmbeddingService } from './pluginEmbeddingService.js';
 import { PluginImageGenerationService } from './pluginImageGenerationService.js';
 import { PluginTTSService } from './pluginTTSService.js';
+import { PluginVideoGenerationService } from './pluginVideoGenerationService.js';
 import { applyPluginDefinitionPolicy, buildPluginChatPayload, convertProviderResponse, getOpenAICompatibleSamplingParameters, resolvePluginChatParameters, toOpenAICompatibleMessages, } from '../utils/pluginChatAdapter.js';
 import { streamAnthropicResponse, streamOpenAICompatibleResponse, streamOpenAIResponsesResponse, } from '../utils/pluginStreamAdapter.js';
 import { applyModelEndpointTemplate, assertSafePluginEndpoint, buildPluginAuthHeaders, buildPluginModelDiscoveryHeaders, pluginRequiresApiKey, resolvePluginApiConfig, resolvePluginEndpoint, resolvePluginModelsEndpoint, validatePluginModel, } from '../utils/pluginValidation.js';
@@ -34,6 +38,7 @@ import { resolveBundledPluginsDir } from '../utils/packagePaths.js';
 import { getDatabaseSafe } from '../db.js';
 import { createOpenAIResponsesStateScope, createPluginCredentialFingerprint, OPENAI_RESPONSES_INCOMPLETE_REASON_METADATA_KEY, } from '../utils/openAIResponsesAdapter.js';
 import { getPluginConnectionVariableNames } from '../utils/pluginConnectionVariables.js';
+import pluginUsageService from './pluginUsageService.js';
 import { getPluginDefinitionFingerprint, matchesBundledPluginTrustAnchor, } from '../utils/pluginDefinitionTrust.js';
 const logger = createLogger('plugins');
 const readPositiveIntEnv = (name, fallback) => {
@@ -77,6 +82,7 @@ function getPluginRoutingAuthProjection(plugin) {
         return {
             name,
             endpoint: capability.endpoint ?? null,
+            models_endpoint: capability.models_endpoint ?? null,
             endpoint_variable: config.endpoint_variable ?? capability.endpoint_variable ?? null,
         };
     });
@@ -118,6 +124,10 @@ export class PluginService {
         this.discoveredModelsUpdatedAt = new Map();
         this.discoveryAttemptedAt = new Map();
         this.inflightDiscovery = new Map();
+        this.discoveredCapabilityModelsCache = new Map();
+        this.discoveredCapabilityModelsUpdatedAt = new Map();
+        this.capabilityDiscoveryAttemptedAt = new Map();
+        this.inflightCapabilityDiscovery = new Map();
         this.bundledRoutingProjectionCache = new Map();
         this.bundledPluginsDir = resolveBundledPluginsDir(import.meta.url);
         this.legacyPluginsDir = path.join(process.cwd(), 'plugins');
@@ -134,6 +144,7 @@ export class PluginService {
             getApiKey: (plugin, userId) => this.getApiKey(plugin, userId),
             getPluginVariables: (plugin, userId) => this.getPluginVariables(plugin, userId),
             validateEndpointUrl: endpoint => this.validateEndpointUrl(endpoint),
+            recordUsage: usage => pluginUsageService.record(usage),
         });
         this.ttsService = new PluginTTSService({
             getAllPlugins: userId => this.getActivePlugins(userId),
@@ -141,6 +152,7 @@ export class PluginService {
             getApiKey: (plugin, userId) => this.getApiKey(plugin, userId),
             getPluginVariables: (plugin, userId) => this.getPluginVariables(plugin, userId),
             validateEndpointUrl: endpoint => this.validateEndpointUrl(endpoint),
+            recordUsage: usage => pluginUsageService.record(usage),
         });
         this.imageGenerationService = new PluginImageGenerationService({
             getAllPlugins: userId => this.getActivePlugins(userId),
@@ -148,6 +160,23 @@ export class PluginService {
             getApiKey: (plugin, userId) => this.getApiKey(plugin, userId),
             getPluginVariables: (plugin, userId) => this.getPluginVariables(plugin, userId),
             validateEndpointUrl: endpoint => this.validateEndpointUrl(endpoint),
+            recordUsage: usage => pluginUsageService.record(usage),
+        });
+        this.audioGenerationService = new PluginAudioGenerationService({
+            getAllPlugins: userId => this.getActivePlugins(userId),
+            getPlugin: (id, userId) => this.getPlugin(id, userId),
+            getApiKey: (plugin, userId) => this.getApiKey(plugin, userId),
+            getPluginVariables: (plugin, userId) => this.getPluginVariables(plugin, userId),
+            validateEndpointUrl: endpoint => this.validateEndpointUrl(endpoint),
+            recordUsage: usage => pluginUsageService.record(usage),
+        });
+        this.videoGenerationService = new PluginVideoGenerationService({
+            getAllPlugins: userId => this.getActivePlugins(userId),
+            getPlugin: (id, userId) => this.getPlugin(id, userId),
+            getApiKey: (plugin, userId) => this.getApiKey(plugin, userId),
+            getPluginVariables: (plugin, userId) => this.getPluginVariables(plugin, userId),
+            validateEndpointUrl: endpoint => this.validateEndpointUrl(endpoint),
+            recordUsage: usage => pluginUsageService.record(usage),
         });
         this.capabilityRegistryService = new PluginCapabilityRegistryService({
             getAllPlugins: userId => this.getActivePlugins(userId),
@@ -157,6 +186,65 @@ export class PluginService {
     discoveredModelsCacheKey(pluginId, userId) {
         return `${userId}:${pluginId}`;
     }
+    discoveredCapabilityModelsCacheKey(pluginId, capability, userId) {
+        return `${userId}:${pluginId}:${capability}`;
+    }
+    getDiscoveredCapabilityModels(pluginId, capability, userId) {
+        const effectiveUserId = userId || 'default';
+        const cacheKey = this.discoveredCapabilityModelsCacheKey(pluginId, capability, effectiveUserId);
+        if (this.discoveredCapabilityModelsCache.has(cacheKey)) {
+            return this.discoveredCapabilityModelsCache.get(cacheKey) || undefined;
+        }
+        const db = getDatabaseSafe();
+        if (!db) {
+            this.discoveredCapabilityModelsCache.set(cacheKey, null);
+            return undefined;
+        }
+        try {
+            const row = db
+                .prepare(`SELECT models_json, updated_at
+           FROM plugin_discovered_capability_models
+           WHERE user_id = ? AND plugin_id = ? AND capability = ?`)
+                .get(effectiveUserId, pluginId, capability);
+            if (!row) {
+                this.discoveredCapabilityModelsCache.set(cacheKey, null);
+                return undefined;
+            }
+            const parsed = JSON.parse(row.models_json);
+            const models = Array.isArray(parsed)
+                ? Array.from(new Set(parsed.filter((model) => typeof model === 'string' && model.length > 0)))
+                : [];
+            if (models.length === 0) {
+                this.discoveredCapabilityModelsCache.set(cacheKey, null);
+                return undefined;
+            }
+            this.discoveredCapabilityModelsCache.set(cacheKey, models);
+            this.discoveredCapabilityModelsUpdatedAt.set(cacheKey, row.updated_at);
+            return models;
+        }
+        catch (error) {
+            logger.warn('Failed to read discovered %s models for plugin %s:', capability, pluginId, error);
+            this.discoveredCapabilityModelsCache.set(cacheKey, null);
+            return undefined;
+        }
+    }
+    storeDiscoveredCapabilityModels(pluginId, capability, models, userId) {
+        const effectiveUserId = userId || 'default';
+        const uniqueModels = Array.from(new Set(models));
+        const cacheKey = this.discoveredCapabilityModelsCacheKey(pluginId, capability, effectiveUserId);
+        const discoveredAt = Date.now();
+        this.discoveredCapabilityModelsCache.set(cacheKey, uniqueModels);
+        this.discoveredCapabilityModelsUpdatedAt.set(cacheKey, discoveredAt);
+        const db = getDatabaseSafe();
+        if (!db)
+            return;
+        db.prepare(`INSERT INTO plugin_discovered_capability_models
+         (user_id, plugin_id, capability, models_json, updated_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(user_id, plugin_id, capability) DO UPDATE SET
+         models_json = excluded.models_json,
+         updated_at = excluded.updated_at`).run(effectiveUserId, pluginId, capability, JSON.stringify(uniqueModels), discoveredAt);
+    }
     getDiscoveredModels(pluginId, userId) {
         const effectiveUserId = userId || 'default';
         const cacheKey = this.discoveredModelsCacheKey(pluginId, effectiveUserId);
@@ -219,6 +307,7 @@ export class PluginService {
         }
     }
     clearDiscoveredModels(pluginId, userId) {
+        this.clearDiscoveredCapabilityModels(pluginId, userId);
         const db = getDatabaseSafe();
         if (userId) {
             const cacheKey = this.discoveredModelsCacheKey(pluginId, userId);
@@ -251,13 +340,58 @@ export class PluginService {
             logger.warn('Failed to clear discovered models for plugin %s:', pluginId, error);
         }
     }
+    clearDiscoveredCapabilityModels(pluginId, userId) {
+        const db = getDatabaseSafe();
+        if (userId) {
+            for (const capability of ['image', 'tts', 'audio', 'video']) {
+                const key = this.discoveredCapabilityModelsCacheKey(pluginId, capability, userId);
+                this.discoveredCapabilityModelsCache.delete(key);
+                this.discoveredCapabilityModelsUpdatedAt.delete(key);
+                this.capabilityDiscoveryAttemptedAt.delete(key);
+            }
+            if (db) {
+                db.prepare(`DELETE FROM plugin_discovered_capability_models
+           WHERE user_id = ? AND plugin_id = ?`).run(userId, pluginId);
+            }
+            return;
+        }
+        for (const key of this.discoveredCapabilityModelsCache.keys()) {
+            if (['image', 'tts', 'audio', 'video'].some(capability => key.endsWith(`:${pluginId}:${capability}`))) {
+                this.discoveredCapabilityModelsCache.delete(key);
+                this.discoveredCapabilityModelsUpdatedAt.delete(key);
+                this.capabilityDiscoveryAttemptedAt.delete(key);
+            }
+        }
+        if (db) {
+            db.prepare('DELETE FROM plugin_discovered_capability_models WHERE plugin_id = ?').run(pluginId);
+        }
+    }
     applyDiscoveredModels(plugin, userId) {
         if (!this.canUseStoredConnectionOverrides(userId) &&
             pluginVariablesService.hasStoredConnectionOverride(plugin.id, userId, plugin.variables, getPluginConnectionVariableNames(plugin))) {
             return plugin;
         }
         const models = this.getDiscoveredModels(plugin.id, userId);
-        return models ? { ...plugin, model_map: [...models] } : plugin;
+        const capabilities = plugin.capabilities
+            ? { ...plugin.capabilities }
+            : undefined;
+        if (capabilities) {
+            for (const capability of ['image', 'tts', 'audio', 'video']) {
+                const definition = capabilities[capability];
+                const discovered = this.getDiscoveredCapabilityModels(plugin.id, capability, userId);
+                if (definition && discovered) {
+                    capabilities[capability] = {
+                        ...definition,
+                        model_map: [...discovered],
+                    };
+                }
+            }
+        }
+        return {
+            ...plugin,
+            ...(models ? { model_map: [...models] } : {}),
+            ...(capabilities ? { capabilities } : {}),
+        };
     }
     ensurePluginsDirectory() {
         if (!fs.existsSync(this.pluginsDir)) {
@@ -420,6 +554,15 @@ export class PluginService {
      * @returns The API key or null if not found
      */
     getApiKey(plugin, userId) {
+        if (plugin.id === CODEX_OAUTH_PLUGIN_ID) {
+            // Resolved from the server's Codex CLI sign-in, never user credentials.
+            // A writable same-ID definition must never receive the server user's
+            // OAuth bearer token, even when an administrator approved that file.
+            return this.usesTrustedBundledRouting(plugin) &&
+                matchesBundledPluginTrustAnchor(plugin)
+                ? codexOAuthService.getCachedAccessToken()
+                : null;
+        }
         const hasHonoredConnectionOverride = this.canUseStoredConnectionOverrides(userId) &&
             pluginVariablesService.hasStoredConnectionOverride(plugin.id, userId, plugin.variables, getPluginConnectionVariableNames(plugin));
         const usesTrustedBundledRouting = this.usesTrustedBundledRouting(plugin);
@@ -566,6 +709,98 @@ export class PluginService {
             new Promise(resolve => setTimeout(resolve, modelDiscoveryRefreshDeadlineMs()).unref?.()),
         ]);
     }
+    async discoverCapabilityModels(pluginId, capability, userId) {
+        const cacheKey = this.discoveredCapabilityModelsCacheKey(pluginId, capability, userId || 'default');
+        const inflight = this.inflightCapabilityDiscovery.get(cacheKey);
+        if (inflight)
+            return inflight;
+        const attempt = this.runCapabilityModelDiscovery(pluginId, capability, userId).finally(() => this.inflightCapabilityDiscovery.delete(cacheKey));
+        this.inflightCapabilityDiscovery.set(cacheKey, attempt);
+        return attempt;
+    }
+    isCapabilityModelDiscoveryDue(pluginId, capability, userId) {
+        const cacheKey = this.discoveredCapabilityModelsCacheKey(pluginId, capability, userId || 'default');
+        const attemptedAt = this.capabilityDiscoveryAttemptedAt.get(cacheKey);
+        if (attemptedAt && Date.now() - attemptedAt < modelDiscoveryRetryMs()) {
+            return false;
+        }
+        const models = this.getDiscoveredCapabilityModels(pluginId, capability, userId);
+        const updatedAt = this.discoveredCapabilityModelsUpdatedAt.get(cacheKey);
+        return (!models || !updatedAt || Date.now() - updatedAt >= modelDiscoveryTtlMs());
+    }
+    async refreshStaleCapabilityModels(capability, userId) {
+        const due = this.getActivePlugins(userId).filter(plugin => {
+            const definition = plugin.capabilities?.[capability];
+            return (Boolean(definition?.models_endpoint) &&
+                this.isCapabilityModelDiscoveryDue(plugin.id, capability, userId));
+        });
+        if (due.length === 0)
+            return;
+        const refreshes = Promise.all(due.map(plugin => this.discoverCapabilityModels(plugin.id, capability, userId).catch(() => undefined)));
+        await Promise.race([
+            refreshes,
+            new Promise(resolve => setTimeout(resolve, modelDiscoveryRefreshDeadlineMs()).unref?.()),
+        ]);
+    }
+    async runCapabilityModelDiscovery(pluginId, capability, userId) {
+        const plugin = this.getPlugin(pluginId, userId);
+        const definition = plugin?.capabilities?.[capability];
+        if (!plugin || !definition) {
+            return {
+                models: [],
+                outcome: 'unavailable',
+                reason: `Plugin has no ${capability} capability`,
+            };
+        }
+        if (!definition.models_endpoint) {
+            return { models: definition.model_map, outcome: 'unchanged' };
+        }
+        const cacheKey = this.discoveredCapabilityModelsCacheKey(pluginId, capability, userId || 'default');
+        this.capabilityDiscoveryAttemptedAt.set(cacheKey, Date.now());
+        const modelsEndpoint = definition.models_endpoint;
+        assertSafePluginEndpoint(modelsEndpoint, `${capability} model discovery endpoint`);
+        const apiKey = this.getApiKey(plugin, userId);
+        if (pluginRequiresApiKey(plugin) && !apiKey) {
+            return {
+                models: definition.model_map,
+                outcome: 'missing_credentials',
+                reason: this.describeMissingCredential(plugin),
+            };
+        }
+        try {
+            const response = await axios.get(modelsEndpoint, {
+                headers: buildPluginModelDiscoveryHeaders(plugin, apiKey, modelsEndpoint),
+                timeout: MODEL_DISCOVERY_REQUEST_TIMEOUT_MS,
+                maxRedirects: 0,
+            });
+            const data = response.data?.data;
+            const models = Array.isArray(data)
+                ? Array.from(new Set(data
+                    .map((entry) => entry?.id)
+                    .filter((id) => typeof id === 'string' && id.length > 0)))
+                : [];
+            if (models.length === 0) {
+                return {
+                    models: definition.model_map,
+                    outcome: 'unavailable',
+                    reason: 'The provider returned no models',
+                };
+            }
+            const previous = definition.model_map;
+            this.storeDiscoveredCapabilityModels(pluginId, capability, models, userId);
+            return {
+                models,
+                outcome: JSON.stringify(previous) === JSON.stringify(models)
+                    ? 'unchanged'
+                    : 'updated',
+            };
+        }
+        catch (error) {
+            const reason = describeModelDiscoveryFailure(error);
+            logger.debug('[Plugin] %s model discovery unavailable for %s (%s)', capability, pluginId, reason);
+            return { models: definition.model_map, outcome: 'unavailable', reason };
+        }
+    }
     /**
      * Say why no key was usable. An environment key is deliberately ignored for a
      * provider whose definition was installed into the writable plugins directory,
@@ -602,7 +837,7 @@ export class PluginService {
                 reason: this.describeMissingCredential(plugin),
             };
         }
-        const headers = buildPluginModelDiscoveryHeaders(plugin, apiKey);
+        const headers = buildPluginModelDiscoveryHeaders(plugin, apiKey, modelsEndpoint);
         try {
             const response = await axios.get(modelsEndpoint, {
                 headers,
@@ -689,7 +924,20 @@ export class PluginService {
                 logger.error(`Failed to read plugins directory ${pluginsDir}:`, error);
             }
         }
-        return Array.from(plugins.values());
+        return Array.from(plugins.values()).filter(plugin => this.isPluginVisibleToUser(plugin, userId));
+    }
+    /**
+     * The codex-oauth plugin rides the server user's ChatGPT sign-in, so it is
+     * administrator-only and hidden entirely when no sign-in exists.
+     */
+    isPluginVisibleToUser(plugin, userId) {
+        if (plugin.id !== CODEX_OAUTH_PLUGIN_ID)
+            return true;
+        if (!codexOAuthService.isAvailable())
+            return false;
+        if (!userId)
+            return false;
+        return userModel.getUserById(userId)?.role === 'admin';
     }
     // Get a specific plugin by ID
     getPlugin(id, userId) {
@@ -707,7 +955,8 @@ export class PluginService {
             const parsedPlugin = JSON.parse(content);
             if (this.validatePlugin(parsedPlugin) &&
                 parsedPlugin.id === sanitizedId &&
-                this.isPluginDefinitionApproved(parsedPlugin, filePath)) {
+                this.isPluginDefinitionApproved(parsedPlugin, filePath) &&
+                this.isPluginVisibleToUser(parsedPlugin, userId)) {
                 const plugin = applyPluginDefinitionPolicy(parsedPlugin);
                 plugin.active = this.isPluginActive(plugin.id, userId);
                 return this.applyDiscoveredModels(plugin, userId);
@@ -723,6 +972,9 @@ export class PluginService {
         if (!this.validatePlugin(pluginData)) {
             throw new Error('Invalid plugin structure');
         }
+        if (pluginData.id === CODEX_OAUTH_PLUGIN_ID) {
+            throw new Error('The bundled Codex OAuth plugin ID is reserved');
+        }
         if (!this.canUseStoredConnectionOverrides(approvedByUserId)) {
             throw new Error('Administrator approval is required');
         }
@@ -810,7 +1062,12 @@ export class PluginService {
         }
         // Wait for discovery so the activation response and the UI's first reload
         // observe the same user-scoped model catalog.
-        await this.discoverModels(id, userId).catch(() => { });
+        await Promise.all([
+            this.discoverModels(id, userId).catch(() => []),
+            ...['image', 'tts', 'audio', 'video']
+                .filter(capability => plugin.capabilities?.[capability]?.models_endpoint)
+                .map(capability => this.discoverCapabilityModels(id, capability, userId).catch(() => undefined)),
+        ]);
         return true;
     }
     // Deactivate a specific plugin
@@ -886,6 +1143,20 @@ export class PluginService {
         if (!activePlugin.model_map.includes(model)) {
             throw new Error(`Model ${model} is not supported by plugin ${activePlugin.id}`);
         }
+        if (activePlugin.id === CODEX_OAUTH_PLUGIN_ID) {
+            await codexOAuthService.ensureFreshToken();
+            // The codex endpoint only answers as an SSE stream; aggregate it here
+            // so non-streaming callers still get a complete response.
+            let aggregated = '';
+            for await (const chunk of this.executePluginStreamRequest(model, messages, options, userId, activePlugin.id)) {
+                if (chunk.type === 'content' && chunk.content) {
+                    aggregated += chunk.content;
+                }
+            }
+            return {
+                choices: [{ message: { role: 'assistant', content: aggregated } }],
+            };
+        }
         const pluginVars = this.getPluginVariables(activePlugin, userId);
         const { apiMode, endpoint: effectiveEndpoint } = resolvePluginApiConfig(activePlugin, pluginVars);
         const processedEndpoint = applyModelEndpointTemplate(effectiveEndpoint, model);
@@ -897,18 +1168,45 @@ export class PluginService {
         const providerStateScope = apiMode === 'responses'
             ? createOpenAIResponsesStateScope(activePlugin.id, model, processedEndpoint, createPluginCredentialFingerprint(apiKey))
             : undefined;
-        const headers = buildPluginAuthHeaders(activePlugin, apiKey);
+        const headers = buildPluginAuthHeaders(activePlugin, apiKey, processedEndpoint);
         const { payload, headers: payloadHeaders } = buildPluginChatPayload(activePlugin, model, messages, options, pluginVars, false, apiMode, providerStateScope);
         Object.assign(headers, payloadHeaders);
+        const startedAt = Date.now();
         try {
             const response = await axios.post(processedEndpoint, payload, {
                 headers,
                 timeout: 60000, // 60 second timeout
                 maxRedirects: 0,
             });
-            return convertProviderResponse(activePlugin, response.data, model, apiMode, providerStateScope);
+            const normalized = convertProviderResponse(activePlugin, response.data, model, apiMode, providerStateScope);
+            pluginUsageService.record({
+                userId,
+                pluginId: activePlugin.id,
+                pluginName: activePlugin.name,
+                capability: 'chat',
+                model,
+                status: 'success',
+                durationMs: Date.now() - startedAt,
+                tokens: normalized.usage
+                    ? {
+                        promptTokens: normalized.usage.prompt_tokens,
+                        completionTokens: normalized.usage.completion_tokens,
+                        totalTokens: normalized.usage.total_tokens,
+                    }
+                    : undefined,
+            });
+            return normalized;
         }
         catch (error) {
+            pluginUsageService.record({
+                userId,
+                pluginId: activePlugin.id,
+                pluginName: activePlugin.name,
+                capability: 'chat',
+                model,
+                status: 'error',
+                durationMs: Date.now() - startedAt,
+            });
             logger.error(`Plugin request failed for ${activePlugin.id}:`, error);
             if (error && typeof error === 'object' && 'response' in error) {
                 const axiosError = error;
@@ -937,6 +1235,9 @@ export class PluginService {
         if (!activePlugin.model_map.includes(model)) {
             throw new Error(`Model ${model} is not supported by plugin ${activePlugin.id}`);
         }
+        if (activePlugin.id === CODEX_OAUTH_PLUGIN_ID) {
+            await codexOAuthService.ensureFreshToken();
+        }
         const pluginVars = this.getPluginVariables(activePlugin, userId);
         const { apiMode, endpoint: effectiveEndpoint } = resolvePluginApiConfig(activePlugin, pluginVars);
         const processedEndpoint = applyModelEndpointTemplate(effectiveEndpoint, model);
@@ -948,7 +1249,7 @@ export class PluginService {
         const providerStateScope = apiMode === 'responses'
             ? createOpenAIResponsesStateScope(activePlugin.id, model, processedEndpoint, createPluginCredentialFingerprint(apiKey))
             : undefined;
-        const headers = buildPluginAuthHeaders(activePlugin, apiKey);
+        const headers = buildPluginAuthHeaders(activePlugin, apiKey, processedEndpoint);
         let payload;
         if (activePlugin.id === 'anthropic' || apiMode === 'responses') {
             const pluginRequest = buildPluginChatPayload(activePlugin, model, messages, options, pluginVars, true, apiMode, providerStateScope);
@@ -966,77 +1267,128 @@ export class PluginService {
                 stream: true,
             };
         }
-        const response = await fetch(processedEndpoint, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify(payload),
-            redirect: 'error',
-        });
-        if (activePlugin.id === 'anthropic') {
-            yield* streamAnthropicResponse(response);
-        }
-        else if (apiMode === 'responses') {
-            const contentType = response.headers.get('content-type') || '';
-            if (!contentType.includes('text/event-stream')) {
-                if (!response.ok) {
-                    const errorText = await response.text();
-                    throw new Error(`Plugin API error: ${response.status} - ${errorText.slice(0, 200)}`);
-                }
-                const normalized = convertProviderResponse(activePlugin, (await response.json()), model, apiMode, providerStateScope);
-                const choice = normalized.choices[0];
-                const message = choice?.message;
-                if (typeof message?.content === 'string' && message.content) {
-                    yield { type: 'content', content: message.content };
-                }
-                if (typeof message?.reasoning_content === 'string' &&
-                    message.reasoning_content) {
-                    yield {
-                        type: 'reasoning',
-                        content: message.reasoning_content,
-                    };
-                }
-                for (const call of message?.tool_calls || []) {
+        const startedAt = Date.now();
+        let status = 'cancelled';
+        let tokenUsage;
+        const captureUsage = (chunk) => {
+            if (chunk.type !== 'usage' || !chunk.usage)
+                return;
+            const { promptTokens, completionTokens, totalTokens } = chunk.usage;
+            if (promptTokens === undefined &&
+                completionTokens === undefined &&
+                totalTokens === undefined) {
+                return;
+            }
+            const prompt = promptTokens ?? 0;
+            const completion = completionTokens ?? 0;
+            tokenUsage = {
+                promptTokens: prompt,
+                completionTokens: completion,
+                totalTokens: totalTokens ?? prompt + completion,
+            };
+        };
+        const forward = async function* (chunks) {
+            for await (const chunk of chunks) {
+                captureUsage(chunk);
+                yield chunk;
+            }
+        };
+        try {
+            const response = await fetch(processedEndpoint, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(payload),
+                redirect: 'error',
+            });
+            if (activePlugin.id === 'anthropic') {
+                yield* forward(streamAnthropicResponse(response));
+            }
+            else if (apiMode === 'responses') {
+                const contentType = response.headers.get('content-type') || '';
+                // The codex endpoint streams SSE without any content-type header.
+                const streamedAnyway = activePlugin.id === CODEX_OAUTH_PLUGIN_ID && response.ok;
+                if (!contentType.includes('text/event-stream') && !streamedAnyway) {
+                    if (!response.ok) {
+                        const errorText = await response.text();
+                        throw new Error(`Plugin API error: ${response.status} - ${errorText.slice(0, 200)}`);
+                    }
+                    const normalized = convertProviderResponse(activePlugin, (await response.json()), model, apiMode, providerStateScope);
+                    const choice = normalized.choices[0];
+                    const message = choice?.message;
+                    if (typeof message?.content === 'string' && message.content) {
+                        yield { type: 'content', content: message.content };
+                    }
+                    if (typeof message?.reasoning_content === 'string' &&
+                        message.reasoning_content) {
+                        yield {
+                            type: 'reasoning',
+                            content: message.reasoning_content,
+                        };
+                    }
+                    for (const call of message?.tool_calls || []) {
+                        yield {
+                            type: 'tool_call',
+                            toolCall: {
+                                id: call.id,
+                                name: call.function.name,
+                                arguments: call.function.arguments,
+                                ...(call.providerMetadata
+                                    ? { providerMetadata: call.providerMetadata }
+                                    : {}),
+                            },
+                        };
+                    }
+                    if (normalized.usage) {
+                        const usageChunk = {
+                            type: 'usage',
+                            usage: {
+                                promptTokens: normalized.usage.prompt_tokens,
+                                completionTokens: normalized.usage.completion_tokens,
+                                totalTokens: normalized.usage.total_tokens,
+                            },
+                        };
+                        captureUsage(usageChunk);
+                        yield usageChunk;
+                    }
+                    const incompleteReason = typeof normalized.providerMetadata?.[OPENAI_RESPONSES_INCOMPLETE_REASON_METADATA_KEY] === 'string'
+                        ? normalized.providerMetadata[OPENAI_RESPONSES_INCOMPLETE_REASON_METADATA_KEY]
+                        : undefined;
                     yield {
-                        type: 'tool_call',
-                        toolCall: {
-                            id: call.id,
-                            name: call.function.name,
-                            arguments: call.function.arguments,
-                            ...(call.providerMetadata
-                                ? { providerMetadata: call.providerMetadata }
-                                : {}),
-                        },
+                        type: 'done',
+                        ...(incompleteReason
+                            ? { doneReason: `incomplete:${incompleteReason}` }
+                            : {}),
+                        ...(normalized.providerMetadata
+                            ? { providerMetadata: normalized.providerMetadata }
+                            : {}),
                     };
                 }
-                if (normalized.usage) {
-                    yield {
-                        type: 'usage',
-                        usage: {
-                            promptTokens: normalized.usage.prompt_tokens,
-                            completionTokens: normalized.usage.completion_tokens,
-                            totalTokens: normalized.usage.total_tokens,
-                        },
-                    };
+                else {
+                    yield* forward(streamOpenAIResponsesResponse(response, providerStateScope, {
+                        allowEmptyTerminalOutput: activePlugin.id === CODEX_OAUTH_PLUGIN_ID,
+                    }));
                 }
-                const incompleteReason = typeof normalized.providerMetadata?.[OPENAI_RESPONSES_INCOMPLETE_REASON_METADATA_KEY] === 'string'
-                    ? normalized.providerMetadata[OPENAI_RESPONSES_INCOMPLETE_REASON_METADATA_KEY]
-                    : undefined;
-                yield {
-                    type: 'done',
-                    ...(incompleteReason
-                        ? { doneReason: `incomplete:${incompleteReason}` }
-                        : {}),
-                    ...(normalized.providerMetadata
-                        ? { providerMetadata: normalized.providerMetadata }
-                        : {}),
-                };
             }
             else {
-                yield* streamOpenAIResponsesResponse(response, providerStateScope);
+                yield* forward(streamOpenAICompatibleResponse(response));
             }
+            status = 'success';
         }
-        else {
-            yield* streamOpenAICompatibleResponse(response);
+        catch (error) {
+            status = 'error';
+            throw error;
+        }
+        finally {
+            pluginUsageService.record({
+                userId,
+                pluginId: activePlugin.id,
+                pluginName: activePlugin.name,
+                capability: 'chat',
+                model,
+                status,
+                durationMs: Date.now() - startedAt,
+                tokens: tokenUsage,
+            });
         }
     }
     // Validate plugin structure
@@ -1152,6 +1504,24 @@ export class PluginService {
     getPluginsByCapability(capabilityType, userId) {
         return this.capabilityRegistryService.getPluginsByCapability(capabilityType, userId);
     }
+    getAvailableAudioGenModels(userId) {
+        return this.audioGenerationService.getAvailableModels(userId);
+    }
+    executeAudioGenRequest(model, prompt, options) {
+        return this.audioGenerationService.generate(model, prompt, options);
+    }
+    getAvailableVideoGenModels(userId) {
+        return this.videoGenerationService.getAvailableModels(userId);
+    }
+    submitVideoGenRequest(model, prompt, options) {
+        return this.videoGenerationService.submit(model, prompt, options);
+    }
+    pollVideoGenRequest(model, providerJobId, pluginId, userId) {
+        return this.videoGenerationService.poll(model, providerJobId, pluginId, userId);
+    }
+    downloadVideoGenResult(model, providerJobId, pluginId, userId) {
+        return this.videoGenerationService.download(model, providerJobId, pluginId, userId);
+    }
 }
 export default new PluginService();
 //# sourceMappingURL=pluginService.js.map