luxin-cli 0.2.3 → 0.2.5

package/cli.md

@@ -196,8 +196,8 @@ luxin claim code --json
     "agent_id": "agt_...",
     "code": "dc_...",
     "dashboard_url": "https://luxin.sh/dashboard#code=dc_...",
-    "expires_at": "2026-07-30T18:15:00.000Z",
-    "ttl_seconds": 900,
+    "expires_at": "2026-07-30T19:00:00.000Z",
+    "ttl_seconds": 3600,
     "single_use": true,
     "human_handoff": {
       "purpose": "hand_dashboard_link_to_human",
@@ -217,7 +217,7 @@ the code is the whole credential. The code travels in the URL fragment
 logs and analytics — keep it that way by sharing the link intact rather than
 rebuilding it as a query string.
 
-The code is single-use and expires (`data.ttl_seconds`, currently 15 minutes).
+The code is single-use and expires (`data.ttl_seconds`, currently 60 minutes).
 The dashboard is read-only over your work — jobs, assets, quota, activity — plus
 the ability to open a credit checkout for you. It cannot create, edit, upload,
 or spend as you. Once your human has opened the link their session lasts days,
@@ -244,9 +244,41 @@ agent. It checks health, executable model availability, auth/quota when a token
 already exists, and payment rails, then returns one primary
 `data.next_command` plus machine-readable `data.next_command_copy_runnable`,
 `data.next_command_missing_inputs`, `data.next_command_effect`,
-`data.guide_warning`, `data.auth_ready`, `data.no_spend_evaluation`, and
-`data.guide_recovery`. Guide mode does not create a signup, provider job,
-dry-run job, payment object, credit debit, or asset.
+`data.guide_warning`, and `data.output_mode`. Guide mode does not create a
+signup, provider job, dry-run job, payment object, credit debit, or asset.
+
+The guide shapes its response on state. When the guide is blocked
+(`prompt_required`, `service_unreachable`, `no_executable_model`,
+`auth_required`, `quota_required`) it returns every field, including the
+self-fund, payment-recovery, and auth-handoff detail a blocked agent needs. When
+`data.stage` is `ready_to_create` and `data.blocker` is `null`, nothing is
+blocked on funding or auth, so the response is compact: it carries the decision
+(`data.next_command`, `data.selection`, `data.cost`), the safety verdict
+(`data.guide_warning`, `data.next_command_effect`), and the no-spend proof
+(`data.no_spend_next_command` and its effect), and omits
+`data.auth_ready`, `data.auth_handoff`, `data.escape_hatches`,
+`data.guide_recovery`, `data.no_spend_evaluation`, the `data.self_fund_*`
+fields, and the `data.recommended_no_spend_command` alias trio. The alias is a
+documented duplicate of `data.no_spend_next_command`; dropping it is why
+`data.guide_warning.recommended_command_field` names the base field in a
+compact response. Resolve the no-spend command through that pointer and the
+difference is invisible.
+
+`data.output_mode` always says which shape you got and never leaves a missing
+field ambiguous: `mode` is `ready_compact` or `full`, `omitted_fields` lists
+every omitted key by name, `compacted_fields` lists sub-objects that are present
+but emptied (`checks.quota.top_up`,
+`checks.payments.preferred_method_summary`, `checks.payments.suggested_commands`),
+and `full_output_command` is a copy-runnable rerun with `--explain` that returns
+every field in every stage. Add `--explain` to `create --guide` / `edit --guide`
+whenever you want the complete payload — debugging, harnesses, and
+recovery loops should use it. `--explain` is a guide output mode; it requires
+`--guide`.
+
+One exception keeps the funding path intact: when a pre-wall top-up is actually
+recommended (`data.self_fund_preparation.recommended` is `true`), the
+`data.self_fund_*` fields stay in the compact response and are not listed in
+`data.output_mode.omitted_fields`.
 
 ```bash
 IMAGE_SKILL_DISCOVERY_SOURCE=cli-md luxin create --guide --prompt "a compact field camera on a stainless workbench"
@@ -260,7 +292,10 @@ When `data.next_command_copy_runnable` is `false`, fill
 payment state changes. Do not run
 `doctor`, `models list`, `signup`, `whoami`, `usage quota`, `create --dry-run`,
 or payment commands as a setup checklist before the guide asks for them.
-For no-doc recovery loops, prefer `data.guide_recovery`: it names the current
+For no-doc recovery loops, prefer `data.guide_recovery`. It is returned
+whenever the guide is blocked; at an unblocked `ready_to_create` rerun the guide
+with `--explain` (or run `data.output_mode.full_output_command`) to get it. It
+names the current
 precondition (`precondition_code` / `precondition_message`), the safest
 no-spend command and field to run (`no_spend_command_field` /
 `no_spend_command`), the command to run after the precondition changes, and the
@@ -332,26 +367,34 @@ step.
   `false`, `data.guide_warning.spend_required` is `true`, and
   `data.guide_warning.recommended_command_field` is
   `recommended_no_spend_command`.
-  `data.auth_ready.ready` is `true`,
-  `data.auth_ready.next_command_requires_auth` is `true`, and
-  `data.auth_ready.next_command_auth_ready` is `true`; the returned
-  `data.next_command` can reuse the current saved config, env token, or stdin
-  token context without exposing a raw token.
-  `data.no_spend_evaluation.stop_here` is `true`,
-  `data.no_spend_evaluation.next_command_is_live_create` is `true`, and
-  `data.no_spend_evaluation.recommended_command_field` is
-  `recommended_no_spend_command`. Run `data.next_command` for the first bounded
+  This stage returns the compact payload described above:
+  `data.output_mode.mode` is `ready_compact`. Auth is already usable, so the
+  returned `data.next_command` reuses the current saved config, env token, or
+  stdin token context without exposing a raw token; `data.auth_ready` and
+  `data.auth_handoff` are omitted here and returned under `--explain`.
+  Run `data.next_command` for the first bounded
   create only when media spend is allowed. If you are in a no-spend evaluation
   or only need proof that the path is ready, stop before `data.next_command` and
-  run `data.recommended_no_spend_command` instead; it aliases
-  `data.no_spend_next_command` and is the dry-run plan command. Its
+  run the dry-run plan command instead. Always resolve it as
+  `data[data.guide_warning.recommended_command_field]` rather than hardcoding a
+  field name: in this compact response that field is `no_spend_next_command`,
+  and in blocked or `--explain` responses it is the
+  `recommended_no_spend_command` alias. Its
   `data.no_spend_next_command_effect.label` is
   `dry_run_planned_job_no_provider_call_no_credit_debit_no_media_write`, with
   `no_spend`, `hosted_create_dry_run`, `planned_job`, and `plan_receipt` true,
   `activity_event: "job.planned"`, and provider call, credit debit, and media
   write false. It may create a recoverable planned job/activity receipt, but no
-  provider execution, debit, downloadable asset, or media write. If the guide authenticated from
-  env or stdin, prefer
+  provider execution, debit, downloadable asset, or media write.
+  Under `--explain` this stage also returns
+  `data.auth_ready.ready` `true`,
+  `data.auth_ready.next_command_requires_auth` `true`,
+  `data.auth_ready.next_command_auth_ready` `true`,
+  `data.no_spend_evaluation.stop_here` `true`,
+  `data.no_spend_evaluation.next_command_is_live_create` `true`,
+  `data.no_spend_evaluation.recommended_command_field`
+  `recommended_no_spend_command`, and `data.guide_recovery`. If the guide
+  authenticated from env or stdin, prefer
   `data.auth_handoff.next_command.with_env` or
   `data.auth_handoff.next_command.with_stdin` so auth follows the create.
 
@@ -370,13 +413,23 @@ stays discoverable without dominating via
 `data.no_spend_output_mode.self_fund_discovery`: its
 `rerun_with_funding_command` re-runs the guide without `--no-spend` to surface
 the funding templates, and `inspect_methods_command` is a read-only, no-spend
-payment-method inspection (the same command as
-`data.escape_hatches.payment_methods`). `--no-spend` is a guide output mode; it
+payment-method inspection (the same command as `data.escape_hatches.payment_methods`
+when that field is present). `--no-spend` is a guide output mode; it
 requires `--guide`, and for a no-spend planned job outside the guide use
 `create --dry-run`.
 
+`--no-spend` composes with the state-dependent shaping above: at an unblocked
+`ready_to_create` the response is already compact, so
+`data.output_mode.omitted_fields` and
+`data.no_spend_output_mode.suppressed_fields` together describe what is missing.
+At `ready_to_create` the plain guide (no flags) is now the smallest response;
+reach for `--no-spend` when you want the suppression declared explicitly, and
+for `--explain` when you want everything.
+
 Manual escape hatches are not prerequisites. Use them only when
-`data.next_command` / `data.escape_hatches` asks, or when the task genuinely
+`data.next_command` / `data.escape_hatches` asks (`data.escape_hatches` is
+returned when the guide is blocked and under `--explain`), or when the task
+genuinely
 needs deeper capability, quota, payment, or planning detail:
 
 ```bash
@@ -1174,11 +1227,15 @@ luxin create --guide --prompt "A compact field camera on a stainless workbench"
 
 `create --guide` returns `schema: image-skill.create-guide.v1`,
 `stage`, `next_command`, `next_command_copy_runnable`,
-`next_command_missing_inputs`, `guide_warning`, `auth_ready`,
-`no_spend_evaluation`, `recommended_no_spend_command`,
-`self_fund_next_command`, `self_fund_handoff`, `self_fund_preparation`,
-`escape_hatches`, selected executable model and cost, auth/quota/payment
-blockers, and mutation flags. All
+`next_command_missing_inputs`, `guide_warning`, `next_command_effect`,
+`recommended_no_spend_command` (aliased by `no_spend_next_command`) and its
+effect, `output_mode`, selected executable model and cost, auth/quota/payment
+blockers, and mutation flags. When the guide is blocked, and at any stage under
+`--explain`, it also returns `auth_ready`, `auth_handoff`,
+`no_spend_evaluation`, `guide_recovery`, `escape_hatches`,
+`self_fund_next_command`, `self_fund_handoff`, and `self_fund_preparation`;
+`output_mode.omitted_fields` names whichever of those the current response left
+out, and `output_mode.full_output_command` is the rerun that returns them. All
 mutation flags must be false in guide mode: no provider call, hosted create,
 signup, payment object, credit debit, or media write.
 For next-command safety, read `next_command_copy_runnable`,
@@ -1193,12 +1250,16 @@ from several arrays. It is `browserless_agent_self_fund` when the preferred
 rail is live money, browserless, agent initiated, and agent settleable;
 `human_payment_handoff` when a human/browser completion step is required; and
 `payment_method_inspection` when the guide cannot classify a direct top-up path.
-In guide cost output, `cost.estimated_usd_per_image` is the estimated Image
-Skill debit in dollars for one output, matching
+In guide cost output, `cost.estimated_usd_per_image` is the estimated Luxin
+debit in dollars for one output, matching
 `cost.estimated_debit_usd_per_image` and
 `cost.estimated_credits * cost.credit_unit_usd` when credit pricing is known.
-`cost.estimated_provider_usd_per_image` is the upstream provider estimate for
-transparency; do not use it as the amount the agent needs to fund.
+That is the amount the agent needs to fund.
+`cost.cheaper_alternative` names one available model that costs strictly fewer
+credits than the selection and still satisfies the brief, with its
+`model_id` and `estimated_credits`; it is null when the selection is already
+the cheapest model that satisfies the brief. Pass its `model_id` to `--model`
+to take it.
 
 ```bash
 luxin create \
@@ -1209,9 +1270,15 @@ luxin create \
   --json
 ```
 
-Hosted defaults are quality-first. If an agent does not choose a model, Image
-Skill selects the strongest available create capability for the requested
-intent and budget, then records the decision in `request.selection`. Explicit
+Hosted defaults are intent-first. If an agent does not choose a model, Image
+Skill selects a create capability for the requested intent and budget, then
+records the decision in `request.selection`. `--intent draft` (or `cheap`,
+`budget`, `test`) selects the lowest-credit available model; `--intent final`
+(or `hero`, `product`, `campaign`, `deliverable`) selects the quality-first
+model; no intent, or `--intent explore`, selects a cost-efficient
+general-purpose model for iteration. A brief that states a reproducibility or
+aspect-ratio requirement still gets a model that can express it, even when a
+cheaper model cannot: capability outranks price. Explicit
 `--provider`, `--model`, namespaced model ids, and validated
 `model_parameters` always take precedence. For final/product/hero-style
 intents, Luxin may default an eligible quality-capability request to a
@@ -1384,7 +1451,28 @@ usage debits, media writes, or provider execution. In the first-run guide, this
 exact no-spend command behavior is exposed as
 `data.no_spend_next_command_effect` and
 `data.recommended_no_spend_command_effect`; the evaluator stop policy is exposed
-as `data.no_spend_evaluation`.
+as `data.no_spend_evaluation` when the guide is blocked or run with `--explain`.
+
+While the agent can still create, hosted `create` / `edit` responses no longer
+repeat the browserless top-up step tree. `data.next_actions.self_fund` keeps its
+recommendation, urgency, and command fields, but its `workflow` is replaced by
+`workflow_field: "quota.top_up.workflow"`, which points at the copy still
+carried in the same response. Once credits are exhausted and the agent is at the
+wall, `data.next_actions.self_fund.workflow` is inlined again, because that is
+the block the agent has to act on.
+
+Every hosted `create` / `edit` response carries `data.mutation`, so a no-spend
+evaluator reads the proof instead of inferring it from `dry_run` plus a
+`planned` asset. On a dry run it reports `provider_call: false`,
+`credit_debit: false`, and `media_write: false` explicitly, alongside
+`hosted_create_dry_run: true` and, for an authenticated dry run,
+`planned_job: true`, `plan_receipt: true`, and `activity_event: "job.planned"`
+for the recoverable receipt the dry run does write. An anonymous dry run stores
+nothing and reports `planned_job: false` with `activity_event: null`. Each entry
+in `data.assets` is labelled: a dry-run placeholder is
+`label: "planned_placeholder_not_media"` with `placeholder: true` and
+`downloadable: false`, and real output is `label: "durable_media"` with
+`downloadable: true`.
 
 Minimum success data:
 
@@ -1397,22 +1485,24 @@ Minimum success data:
   "assets": [
     {
       "asset_id": "image_...",
-      "path": "https://media.image-skill.com/a/image_abc123.png",
+      "path": "https://media.luxin.sh/a/image_abc123.png",
       "mime_type": "image/png",
-      "url": "https://media.image-skill.com/a/image_abc123.png",
+      "url": "https://media.luxin.sh/a/image_abc123.png",
       "content_length": 333444,
       "width": 2048,
       "height": 2048
     }
   ],
   "cost": {
-    "estimated_usd": 0.07,
+    "estimated_usd": 0.12,
     "credit_pricing": {
       "credit_unit_usd": 0.01,
       "credits_required": 12,
-      "estimated_provider_cost_usd": 0.07,
-      "estimated_revenue_usd": 0.12,
-      "pricing_confidence": "known"
+      "estimated_charge_usd": 0.12,
+      "self_fundable": true,
+      "self_fund_block_reason": null,
+      "pricing_confidence": "known",
+      "pricing_source": "model_parameters"
     }
   },
   "request": {
@@ -1420,7 +1510,7 @@ Minimum success data:
     "selection": {
       "policy": "hosted_default_create_v1",
       "reason": "hosted default selected the strongest currently available quality-first create model",
-      "intent": "explore",
+      "intent": "final",
       "capability": {
         "id": "is.image.generate.xai-grok-imagine-image-quality.v1"
       },
@@ -1508,7 +1598,9 @@ curl -sS https://api.luxin.sh/v1/create \
 
 Hosted free-preview create currently requires owned artifact storage and returns
 one `assets[]` entry per output with `assets[].url` under
-`https://media.image-skill.com/...` on success.
+`https://media.luxin.sh/...` on success. Previously issued
+`https://media.image-skill.com/...` URLs remain valid and are still accepted
+wherever an asset URL is an input.
 
 ### `luxin upload`
 
@@ -1537,7 +1629,7 @@ Minimum success data:
     "asset_id": "image_...",
     "job_id": "job_...",
     "kind": "uploaded",
-    "url": "https://media.image-skill.com/a/image_abc123.png",
+    "url": "https://media.luxin.sh/a/image_abc123.png",
     "mime_type": "image/png",
     "content_length": 12345
   },
@@ -1750,7 +1842,7 @@ Inspects an Luxin-owned asset URL or hosted asset id.
 
 ```bash
 luxin assets show \
-  https://media.image-skill.com/a/image_abc123.png \
+  https://media.luxin.sh/a/image_abc123.png \
   --json
 ```
 
@@ -1771,7 +1863,7 @@ Minimum success data:
   "asset": {
     "asset_id": "image_...",
     "job_id": "job_...",
-    "url": "https://media.image-skill.com/a/image_abc123.png",
+    "url": "https://media.luxin.sh/a/image_abc123.png",
     "mime_type": "image/png",
     "content_length": 12345,
     "width": 1024,
@@ -1799,7 +1891,7 @@ Downloads an Luxin-owned asset URL or hosted asset id to a local file.
 
 ```bash
 luxin assets get \
-  https://media.image-skill.com/a/image_abc123.png \
+  https://media.luxin.sh/a/image_abc123.png \
   --output ./result.png \
   --json
 ```
@@ -1837,16 +1929,14 @@ Minimum success data:
   "state": "completed",
   "assets": [],
   "cost": {
-    "estimated_usd": 0.05,
-    "provider_reported_usd_ticks": null
+    "estimated_usd": 0.05
   },
   "job": {
     "job_id": "job_...",
     "status": "completed",
     "assets": [],
     "cost": {
-      "estimated_usd": 0.05,
-      "provider_reported_usd_ticks": null
+      "estimated_usd": 0.05
     }
   }
 }

package/commands.json

@@ -422,6 +422,7 @@
         "optional_flags": [
           "--guide",
           "--no-spend",
+          "--explain",
           "--dry-run",
           "--model",
           "--aspect-ratio",

package/llms.txt

@@ -58,15 +58,15 @@ Claim states:
 - revoked: token or agent disabled
 
 First-run guide loop:
-1. Run luxin create --guide --prompt PROMPT. This is the canonical fresh-agent entrypoint and the only required first command. It performs read-only hosted reachability, executable model availability, auth/quota, and payment rail checks and returns data.stage, data.next_command, data.guide_warning, data.next_command_effect, data.auth_ready, data.no_spend_evaluation, data.guide_recovery, data.no_spend_next_command, data.no_spend_next_command_effect, data.self_fund_next_command, data.self_fund_handoff, data.self_fund_preparation, data.auth_handoff, data.escape_hatches, data.checks.quota.top_up, and data.mutation. Guide mode must report provider_call: false, hosted_create: false, hosted_signup: false, payment_object: false, credit_debit: false, and media_write: false.
-2. Read data.guide_warning, then follow data.next_command when its next_command_safety is safe for the current spend policy. Prefer data.guide_recovery for no-doc recovery: data.guide_recovery.no_spend_command_field and data.guide_recovery.no_spend_command name the safest no-spend command, data.guide_recovery.live_create_command_field and data.guide_recovery.live_payment_command_field name fields that would spend, and data.guide_recovery.double_spend_guard tells you when to check error.recovery, jobs, activity, or payment status before any live retry. Do not run doctor, models list, signup, whoami, quota, dry-run, or payment commands as a setup checklist before the guide asks for them.
+1. Run luxin create --guide --prompt PROMPT. This is the canonical fresh-agent entrypoint and the only required first command. It performs read-only hosted reachability, executable model availability, auth/quota, and payment rail checks and returns data.stage, data.next_command, data.guide_warning, data.next_command_effect, data.no_spend_next_command, data.no_spend_next_command_effect, data.recommended_no_spend_command, data.output_mode, and data.mutation. The guide shapes the rest on state: while it is blocked it also returns data.auth_ready, data.no_spend_evaluation, data.guide_recovery, data.self_fund_next_command, data.self_fund_handoff, data.self_fund_preparation, data.auth_handoff, data.escape_hatches, and the full data.checks.quota.top_up. At an unblocked ready_to_create those are omitted because nothing is blocked on funding or auth. data.output_mode.mode is ready_compact or full, data.output_mode.omitted_fields names every omitted key, data.output_mode.compacted_fields names present-but-emptied sub-objects, and data.output_mode.full_output_command is a copy-runnable rerun with --explain that returns every field in every stage. Add --explain whenever you need the complete payload. Guide mode must report provider_call: false, hosted_create: false, hosted_signup: false, payment_object: false, credit_debit: false, and media_write: false.
+2. Read data.guide_warning, then follow data.next_command when its next_command_safety is safe for the current spend policy. Prefer data.guide_recovery for no-doc recovery; it is returned whenever the guide is blocked, and at an unblocked ready_to_create you get it by running data.output_mode.full_output_command: data.guide_recovery.no_spend_command_field and data.guide_recovery.no_spend_command name the safest no-spend command, data.guide_recovery.live_create_command_field and data.guide_recovery.live_payment_command_field name fields that would spend, and data.guide_recovery.double_spend_guard tells you when to check error.recovery, jobs, activity, or payment status before any live retry. Do not run doctor, models list, signup, whoami, quota, dry-run, or payment commands as a setup checklist before the guide asks for them.
 3. If data.stage is prompt_required, rerun data.next_command with the real prompt.
 4. If data.stage is auth_required, data.auth_ready.ready is false and data.guide_warning.next_command_safety is hosted_signup_no_spend_setup. Run data.next_command, then rerun the guide once. Hosted signup saves the restricted token to the public CLI config by default with 0600 permissions. If the configured config path is blocked, data.next_command sets LUXIN_CONFIG_PATH="$PWD/.luxin/config.json" and still runs a saved-config signup; do not switch to raw-token handoff unless recovery explicitly requires it. If the runtime intentionally uses --no-save --show-token, store the returned token in the agent runtime secret store, then rerun with IMAGE_SKILL_TOKEN or --token-stdin; data.auth_handoff.rerun_guide.with_env and data.auth_handoff.rerun_guide.with_stdin are copy-safe templates for that mode. Signup is anonymous by default: no contact inbox is required to get a restricted token. The optional --agent-contact flag takes an email-shaped durable contact inbox for the restricted agent identity, not a requirement to find an individual human; attach one later with luxin claim request --contact INBOX --json when funding or durability makes it worth having. Hosted signup returns the raw restricted token only when --show-token is set, and only once. When providing a contact, use an agent-owned inbox when available; otherwise use an operator, team, or sponsor inbox that can receive future claim, billing, or abuse notices. Never invent an inbox or borrow an unrelated human email just to fill the flag — omit it instead. example.invalid addresses are only appropriate inside documented harness or proof runs. --human-email remains accepted as a compatibility alias, but the guide must not teach it. Anonymous signups mint a fresh agent identity on every call; reuse the saved config instead of re-running signup. --save is accepted as a compatibility no-op for the default save behavior; use --no-save only when the runtime has a separate secret store and does not want local config.
-5. At any guide stage, read data.checks.quota.top_up. When available is true, it includes recommended, recommendation_reason, preferred_payment_method, quote_command, quote_command_copy_runnable, quote_command_effect, and quote/buy/status command templates for the browserless x402 top-up path; recommended and urgency say whether to act now. On quota/payment recovery errors, read error.recovery.top_up: when delegated live-money quoting is allowed, error.recovery.suggested_command points at the direct quote to open the top-up path; use error.recovery.top_up.first_command for no-spend payment-method inspection when delegated spend authority is absent or unclear. If data.stage is quota_required, data.guide_warning.next_command_safety is live_money_payment_action and data.guide_warning.payment_top_up_path summarizes the live-money path. Run data.self_fund_next_command to start the top-up. It aliases data.next_command and is the first payment command, usually an x402 or Stripe quote. First read data.checks.payments.preferred_method_summary.top_up_path: browserless_agent_self_fund means a wallet-equipped agent can complete the preferred live-money rail without a browser; human_payment_handoff means the agent can create the payment attempt but a human/browser step must complete before credits are granted. If the guide authenticated from env or stdin, prefer data.self_fund_handoff.auth.next_command.with_env or data.self_fund_handoff.auth.next_command.with_stdin so auth follows the payment command. Then follow data.self_fund_handoff.payment_commands.buy and status, and rerun data.self_fund_handoff.after_next once credits are granted. If data.stage is ready_to_create, inspect data.self_fund_preparation before consuming the remaining free allowance; it mirrors top-up urgency, urgency_score, and urgency_reasons. When available and recommended are true, data.self_fund_preparation.quote_command is the pre-wall browserless x402 quote and, when copy-runnable, data.self_fund_next_command aliases it with a pre_wall label such as pre_wall_browserless_agent_payable_quote. The quote command creates an authenticated live-money quote/payment object, but data.self_fund_preparation.quote_command_effect must show no provider call, no hosted create, no credit debit, no media write, and no wallet settlement until a later buy/payment step. One Luxin credit is $0.01. Credit quotes grant prepaid value units; create/edit operations debit model-priced credits reported as cost.credit_pricing. Starter preview currently gives 50 lifetime credits plus a 50-job daily compatibility cap. Funded usage has no daily job cap; prepaid credits and credit reservations are its spend boundary.
+5. At any blocked guide stage, and at any stage under --explain, read data.checks.quota.top_up. When available is true, it includes recommended, recommendation_reason, preferred_payment_method, quote_command, quote_command_copy_runnable, quote_command_effect, and quote/buy/status command templates for the browserless x402 top-up path; recommended and urgency say whether to act now. On quota/payment recovery errors, read error.recovery.top_up: when delegated live-money quoting is allowed, error.recovery.suggested_command points at the direct quote to open the top-up path; use error.recovery.top_up.first_command for no-spend payment-method inspection when delegated spend authority is absent or unclear. If data.stage is quota_required, data.guide_warning.next_command_safety is live_money_payment_action and data.guide_warning.payment_top_up_path summarizes the live-money path. Run data.self_fund_next_command to start the top-up. It aliases data.next_command and is the first payment command, usually an x402 or Stripe quote. First read data.checks.payments.preferred_method_summary.top_up_path: browserless_agent_self_fund means a wallet-equipped agent can complete the preferred live-money rail without a browser; human_payment_handoff means the agent can create the payment attempt but a human/browser step must complete before credits are granted. If the guide authenticated from env or stdin, prefer data.self_fund_handoff.auth.next_command.with_env or data.self_fund_handoff.auth.next_command.with_stdin so auth follows the payment command. Then follow data.self_fund_handoff.payment_commands.buy and status, and rerun data.self_fund_handoff.after_next once credits are granted. If data.stage is ready_to_create and a pre-wall top-up is recommended, data.self_fund_preparation stays in the compact response; inspect it before consuming the remaining free allowance; it mirrors top-up urgency, urgency_score, and urgency_reasons. When available and recommended are true, data.self_fund_preparation.quote_command is the pre-wall browserless x402 quote and, when copy-runnable, data.self_fund_next_command aliases it with a pre_wall label such as pre_wall_browserless_agent_payable_quote. The quote command creates an authenticated live-money quote/payment object, but data.self_fund_preparation.quote_command_effect must show no provider call, no hosted create, no credit debit, no media write, and no wallet settlement until a later buy/payment step. One Luxin credit is $0.01. Credit quotes grant prepaid value units; create/edit operations debit model-priced credits reported as cost.credit_pricing. Starter preview currently gives 50 lifetime credits plus a 50-job daily compatibility cap. Funded usage has no daily job cap; prepaid credits and credit reservations are its spend boundary.
 5a. When data.stage is quota_required, data.self_fund_handoff mirrors top-up urgency, urgency_score, and urgency_reasons, and exposes first_safe_command plus first_safe_command_effect. Run first_safe_command, usually luxin credits methods --json, for no-spend rail inspection before quote/buy when delegated spend authority is absent or unclear.
-6. If data.stage is ready_to_create, data.next_command is the first bounded live create. data.guide_warning.next_command_safety must be live_media_create_credit_debit, data.guide_warning.no_spend_safe must be false, data.guide_warning.spend_required must be true, and data.guide_warning.recommended_command_field must be recommended_no_spend_command. data.auth_ready.ready and data.auth_ready.next_command_auth_ready must be true; data.auth_ready.next_command_requires_auth must be true, and the command can reuse saved config, IMAGE_SKILL_TOKEN, or --token-stdin context without exposing a raw token. data.next_command_effect.label must be live_media_create_credit_debit and its provider_call, hosted_create, credit_debit, and media_write flags are true. data.no_spend_evaluation.stop_here must be true, data.no_spend_evaluation.next_command_is_live_create must be true, and data.no_spend_evaluation.recommended_command_field must be recommended_no_spend_command. Run data.next_command only when media spend is allowed. In no-spend evaluations, or when you only need to prove readiness without media/provider work, stop before data.next_command and run data.recommended_no_spend_command instead. data.recommended_no_spend_command must equal data.no_spend_next_command. data.no_spend_next_command_effect.label must be dry_run_planned_job_no_provider_call_no_credit_debit_no_media_write: no_spend, hosted_create_dry_run, planned_job, and plan_receipt are true; activity_event is job.planned; provider_call, credit_debit, and media_write are false. This dry-run may create a recoverable planned job/activity receipt but no provider execution, debit, downloadable asset, or media write. If the guide authenticated from env or stdin, prefer data.auth_handoff.next_command.with_env or data.auth_handoff.next_command.with_stdin so auth follows the live create. In guide cost output, cost.estimated_usd_per_image and cost.estimated_debit_usd_per_image are the Luxin debit dollars for one output; cost.estimated_provider_usd_per_image is only the upstream provider estimate. Use the guide's returned max_estimated_usd_per_image because it is sized to the credit debit the agent funds. Add --output-count N only after models show confirms the selected create model supports more than one output; credit_pricing.credits_required is the total debit across outputs, while max_estimated_usd_per_image remains a per-image Luxin debit guard.
+6. If data.stage is ready_to_create, data.next_command is the first bounded live create. data.guide_warning.next_command_safety must be live_media_create_credit_debit, data.guide_warning.no_spend_safe must be false, data.guide_warning.spend_required must be true, and data.guide_warning.recommended_command_field names whichever no-spend field this response carries, and that field is always present: read data[data.guide_warning.recommended_command_field] instead of hardcoding a name. This stage returns the compact payload, where it is no_spend_next_command because the recommended_no_spend_command alias trio is omitted; blocked and --explain responses keep the alias and name it instead. data.output_mode.mode is ready_compact. The returned command can reuse saved config, IMAGE_SKILL_TOKEN, or --token-stdin context without exposing a raw token. data.next_command_effect.label must be live_media_create_credit_debit and its provider_call, hosted_create, credit_debit, and media_write flags are true. Rerunning with --explain also returns data.recommended_no_spend_command and its label/effect, data.auth_ready.ready true, data.auth_ready.next_command_auth_ready true, data.auth_ready.next_command_requires_auth true, data.no_spend_evaluation.stop_here true, data.no_spend_evaluation.next_command_is_live_create true, data.no_spend_evaluation.recommended_command_field recommended_no_spend_command, data.guide_recovery, data.auth_handoff, and data.escape_hatches. Run data.next_command only when media spend is allowed. In no-spend evaluations, or when you only need to prove readiness without media/provider work, stop before data.next_command and run the field data.guide_warning.recommended_command_field names instead. When the alias is present it equals data.no_spend_next_command. data.no_spend_next_command_effect.label must be dry_run_planned_job_no_provider_call_no_credit_debit_no_media_write: no_spend, hosted_create_dry_run, planned_job, and plan_receipt are true; activity_event is job.planned; provider_call, credit_debit, and media_write are false. This dry-run may create a recoverable planned job/activity receipt but no provider execution, debit, downloadable asset, or media write. If the guide authenticated from env or stdin, rerun with --explain and prefer data.auth_handoff.next_command.with_env or data.auth_handoff.next_command.with_stdin so auth follows the live create. In guide cost output, cost.estimated_usd_per_image and cost.estimated_debit_usd_per_image are the Luxin debit dollars for one output. Use the guide's returned max_estimated_usd_per_image because it is sized to the credit debit the agent funds. Add --output-count N only after models show confirms the selected create model supports more than one output; credit_pricing.credits_required is the total debit across outputs, while max_estimated_usd_per_image remains a per-image Luxin debit guard.
 7. After create, prefer data.next_actions when present: inspect_job and inspect_asset are copy-runnable no-spend recovery commands, iterate_edit is the reusable-asset edit template, and self_fund is the promoted top-up quote handoff when quota.top_up.available is true. self_fund.recommended plus urgency, urgency_score, and urgency_reasons say whether to act now, and self_fund exposes first_safe_command plus first_safe_command_effect for no-spend rail inspection before quote/buy. When self_fund.recommended is true and the quote is copy-runnable, data.self_fund_next_command aliases data.next_actions.self_fund.quote_command and data.self_fund_next_command_effect proves the quote creates no provider call, hosted create, credit debit, media write, or wallet settlement. self_fund.quote_command is copy-runnable and omits --idempotency-key so the public CLI generates and returns one for retry safety; follow the quote response into buy/status. Otherwise use luxin jobs show JOB_ID to recover status, cost, safety, timestamps, and final assets; luxin assets get ASSET_URL_OR_ID --output ./result.png to fetch the generated asset without repeating provider work; and luxin activity list --subject JOB_ID to find ledger events, trace, usage, asset links, and any data.next_actions.self_fund handoff to cite or follow. Hosted asset-id assets show/get may also return data.next_actions.self_fund after generated work, so inspect that field before ending the session.
-7a. Human handoff. When a create or edit produced a real asset, data.next_actions.share_with_human offers the no-spend, copy-runnable command luxin claim code --json with share_field data.dashboard_url. Run it and give your human the returned data.dashboard_url: they get a read-only view of your jobs, assets, quota, and activity plus the ability to open a credit checkout for you. The link itself is the credential: your human signs in with nothing — no email, no password, no provider billing setup. Hand over data.dashboard_url only — never your token, and never the raw data.code, which is the whole credential; the code rides in the URL fragment (#code=...), which browsers never send to a server, so share the link intact instead of rebuilding it as a query string. The code is single-use and expires (data.ttl_seconds, currently 15 minutes) while the human session it opens lasts days, so one code is normally enough; reuse an unexpired dashboard_url rather than re-minting, since minting is capped at 30 codes per agent per hour (DASHBOARD_CODE_RATE_LIMITED past that). Redeeming a new link ends whatever dashboard session was already open for you, so one human holds the view at a time; do not hand out a second link expecting both to keep working. luxin claim code needs the dashboard.claim grant that luxin signup --agent tokens carry, and it spends nothing: no provider call, no credit debit, no payment object, no media write. Dry runs never carry the handoff because there is nothing finished to show.
+7a. Human handoff. When a create or edit produced a real asset, data.next_actions.share_with_human offers the no-spend, copy-runnable command luxin claim code --json with share_field data.dashboard_url. Run it and give your human the returned data.dashboard_url: they get a read-only view of your jobs, assets, quota, and activity plus the ability to open a credit checkout for you. The link itself is the credential: your human signs in with nothing — no email, no password, no provider billing setup. Hand over data.dashboard_url only — never your token, and never the raw data.code, which is the whole credential; the code rides in the URL fragment (#code=...), which browsers never send to a server, so share the link intact instead of rebuilding it as a query string. The code is single-use and expires (data.ttl_seconds, currently 60 minutes) while the human session it opens lasts days, so one code is normally enough; reuse an unexpired dashboard_url rather than re-minting, since minting is capped at 30 codes per agent per hour (DASHBOARD_CODE_RATE_LIMITED past that). Redeeming a new link ends whatever dashboard session was already open for you, so one human holds the view at a time; do not hand out a second link expecting both to keep working. luxin claim code needs the dashboard.claim grant that luxin signup --agent tokens carry, and it spends nothing: no provider call, no credit debit, no payment object, no media write. Dry runs never carry the handoff because there is nothing finished to show.
 8. Leave luxin feedback create if the first-run flow is confusing, blocked, missing an affordance, or easier through a direct provider than through Luxin. Feedback auth uses saved config from default signup, IMAGE_SKILL_TOKEN, or --token-stdin; if signup or guide already saved config, run feedback create normally and do not copy a raw token. Never paste tokens into feedback title, body, evidence, issues, or logs. Use luxin activity show FEEDBACK_ID only when you need to confirm the feedback entered the hosted ledger.
 
 Manual escape hatches are not prerequisites. Use luxin doctor, luxin models list, luxin models show MODEL_ID, luxin whoami, luxin usage quota, luxin credits methods, luxin credits packs list, luxin credits quote, luxin credits buy, luxin credits status, luxin create --dry-run, and luxin edit --dry-run only when data.next_command or data.escape_hatches asks for them, or when the task genuinely needs deeper capability, quota, payment, or planning detail.
@@ -126,7 +126,7 @@ Hosted API endpoints:
 - GET https://api.luxin.sh/v1/credit-purchases/status returns durable payment state for Authorization: Bearer TOKEN. Query with exactly one of quote_id, payment_attempt_id, checkout_session_id, or receipt_id. Response includes state, quote, payment_attempt, receipt, credit_event, provider_event, limits, and next.
 - GET https://api.luxin.sh/v1/models returns the compact public model menu. Query params: available=true returns currently usable executable rows, executable=true returns runtime-wired rows regardless current availability, catalog_only=true returns source-backed catalog-only rows, operation=image.generate|image.edit narrows by operation, provider=fal|xai|openai narrows by provider, and details=true returns the full list with capability schemas. Default list output excludes catalog-only rows and omits parameter schemas so fresh agents see actionable choices first. Each compact row includes show_command; use GET https://api.luxin.sh/v1/models/MODEL_ID or luxin models show MODEL_ID --json before spending or passing model_parameters. The response summary includes total, returned, available, executable, cataloged_not_wired, provider split, execution_availability, first_actionable_model_ids, recommended filter commands, and catalog-inclusion flags. For runnable choices require both status: available and execution.model_execution_status: executable; provider-level availability alone is not enough. If a reachable provider has no runnable model for the requested operation, summary.execution_availability says so directly and includes the fastest --available --operation recovery command.
 - GET https://api.luxin.sh/v1/capabilities returns the hosted capability catalog, normalized controls, model-parameter schemas, auth requirements, and deprecation notices.
-- POST https://api.luxin.sh/v1/create creates or dry-runs bounded free-preview images when Authorization: Bearer TOKEN has quota and the relevant preview grant. Request JSON: prompt, optional model, optional intent, optional aspect_ratio, optional output_count, optional references[] for reference-capable create models, optional model_parameters, optional dry_run, optional max_estimated_usd_per_image, optional accept_unknown_cost. output_count defaults to 1 and must not exceed the selected model's max_outputs_per_request. If model is omitted, hosted defaults are quality-first and the response includes request.selection with the selected capability, defaulted provider-native controls, expected output class, and pricing. Agents should read cost.credit_pricing.credits_required instead of assuming one credit per operation; for output_count greater than 1 this is the total debit across outputs. max_estimated_usd_per_image is a per-image Luxin debit budget guard, not merely an upstream provider-cost guard. On dry_run responses, cost.credit_pricing.credits_required is the planned live execution debit, while quota.consumed_credits is the actual debit and remains 0. Authenticated hosted dry-runs also create a recoverable planned job: jobs show returns status planned with plan_receipt, and activity emits job.planned. Planned receipts do not create downloadable media assets, usage debits, or provider execution. references[] items use asset_id, role, index, optional reference_index for element_reference, and optional reference_task for reference_image; do not put URLs in references[].
+- POST https://api.luxin.sh/v1/create creates or dry-runs bounded free-preview images when Authorization: Bearer TOKEN has quota and the relevant preview grant. Request JSON: prompt, optional model, optional intent, optional aspect_ratio, optional output_count, optional references[] for reference-capable create models, optional model_parameters, optional dry_run, optional max_estimated_usd_per_image, optional accept_unknown_cost. output_count defaults to 1 and must not exceed the selected model's max_outputs_per_request. If model is omitted, hosted defaults are intent-first: intent draft/cheap/budget/test selects the lowest-credit available model, intent final/hero/product/campaign/deliverable selects the quality-first model, and no intent (or explore) selects a cost-efficient general-purpose model for iteration, except that a stated reproducibility or aspect-ratio requirement always outranks price. The response includes request.selection with the selected capability, defaulted provider-native controls, expected output class, and pricing. Agents should read cost.credit_pricing.credits_required instead of assuming one credit per operation; for output_count greater than 1 this is the total debit across outputs. max_estimated_usd_per_image is a per-image Luxin debit budget guard, not merely an upstream provider-cost guard. On dry_run responses, cost.credit_pricing.credits_required is the planned live execution debit, while quota.consumed_credits is the actual debit and remains 0. Authenticated hosted dry-runs also create a recoverable planned job: jobs show returns status planned with plan_receipt, and activity emits job.planned. Planned receipts do not create downloadable media assets, usage debits, or provider execution. references[] items use asset_id, role, index, optional reference_index for element_reference, and optional reference_task for reference_image; do not put URLs in references[].
 - POST https://api.luxin.sh/v1/upload accepts client-normalized base64 raster image bytes when Authorization: Bearer TOKEN has asset.upload. Request JSON: source_kind, filename, remote_origin, mime_type, content_length, sha256, bytes_base64. Do not send local paths, full remote URLs, prompts, tokens, or provider credentials.
 - POST https://api.luxin.sh/v1/edit edits or dry-runs an Luxin-owned input asset when Authorization: Bearer TOKEN has quota and the relevant preview grant. Request JSON: input_asset_id, prompt, optional mask_asset_id for mask-capable models, optional references[] for reference-capable models, optional model, optional intent, optional aspect_ratio, optional output constraints, optional model_parameters, optional dry_run, optional max_estimated_usd_per_image, optional max_usd, optional accept_unknown_cost. On dry_run responses, ownership, prompt policy, masks, references, model_parameters, and budget guards are validated, quota.consumed_credits remains 0, a recoverable job.planned receipt is stored, and there is no provider call, media write, or credit debit. references[] items use asset_id, role, index, optional reference_index for element_reference, and optional reference_task for reference_image; do not put URLs in references[]. Current public references[] support covers Kling Image O1, Kling Image O3 image-to-image/text-to-image, Kling Image v3 image-to-image/text-to-image, Fal DreamO create, and xAI Grok Imagine image edit/quality edit. Kling references allow max 40 entries, max 10 contiguous element indexes from 0, one frontal per referenced element, and up to 3 reference images per element. DreamO references allow up to two contiguous reference_image indexes from 0, each with optional reference_task ip, id, or style. xAI edit references allow up to two contiguous reference_image indexes from 0 and do not accept reference_task; the primary input asset is the first source image. Reference assets must be owned PNG/JPEG/WebP, 10MB max, minimum 300px width/height, and aspect ratio 0.40-2.50. The public CLI uploads local paths or external URLs first for --input, --mask, --element-frontal, --element-reference, and --reference-image; do not send source bytes, external URLs, image_url, image_urls, mask_url, raw provider elements, frontal_image_url, reference_image_urls, first_image_url, second_image_url, images, or *_reference_task to /v1/edit or /v1/create. For Kling elements, --element-frontal IMAGE[@ELEMENT_INDEX] sends role element_frontal and --element-reference IMAGE[@ELEMENT_INDEX[:REFERENCE_INDEX]] sends role element_reference under top-level references[]. For DreamO create, --reference-image IMAGE[@INDEX[:TASK]] sends role reference_image with optional reference_task. For xAI edit, --reference-image IMAGE[@INDEX] supplies the second or third ordered source image.
 - GET https://api.luxin.sh/v1/assets/ASSET_ID returns hosted asset metadata for Authorization: Bearer TOKEN when the asset belongs to the actor organization.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "luxin-cli",
-  "version": "0.2.3",
-  "description": "Zero-setup durable creative-media CLI for agents (image + video + audio + 3D): guide-first creation, model and cost inspection, owned URLs, JSON recovery, payments, reusable assets, and feedback. Luxin is a creative-media runtime, unrelated to the luxon datetime library.",
+  "version": "0.2.5",
+  "description": "Image generation, image editing, video, audio, and image-to-3D for agents, with no API key to obtain first. The agent signs itself up, starts on free preview credits, and gets hosted media URLs, recoverable jobs, and cost receipts.",
   "type": "module",
   "private": false,
   "repository": {
@@ -20,7 +20,6 @@
     "SECURITY.md",
     "CONTRIBUTING.md",
     "CODE_OF_CONDUCT.md",
-    "SKILL.md",
     "skill.md",
     "llms.txt",
     "cli.md",

package/skill.md

@@ -1,13 +1,14 @@
 ---
 name: luxin
 description: >-
-  AI image generation and editing for agents across text-to-image and
-  image-to-image workflows, video generation, audio generation, and image-to-3D
-  asset creation through one zero-setup hosted runtime. Use Luxin when an
-  agent needs durable media URLs, recoverable jobs, model/cost inspection and
-  stable JSON envelopes with capability-preserving parameters. Optional
-  agent-funded credits work without a provider API key, OAuth app, local model
-  or per-provider billing account.
+  Image generation and image editing for agents, plus video, audio, and
+  image-to-3D, through one hosted runtime with no API key to obtain first. The
+  agent signs itself up in one command, starts on free preview credits, and
+  creates on the next: no provider account to open, no billing to set up. Every
+  result returns a hosted media URL with no signature or expiry, a job id the
+  agent can re-fetch with jobs show, and a receipt for what the call cost. When
+  the preview credits run out, the agent hands its human one dashboard link to
+  fund more.
 homepage: https://luxin.sh
 docs: https://luxin.sh/llms.txt
 metadata:
@@ -39,7 +40,7 @@ JSON is the default. Do not add `--json` to examples.
 npm_config_update_notifier=false npx -y luxin-cli@latest create --guide --prompt "a compact field camera on a stainless workbench"
 ```
 
-The guide is a free, zero-spend planning call. Given current auth, quota, and payment state, it returns `data.next_command`, `data.next_command_copy_runnable`, `data.next_command_missing_inputs`, `data.stage`, `data.guide_warning`, `data.next_command_effect`, `data.auth_ready`, `data.no_spend_evaluation`, `data.guide_recovery`, `data.recommended_no_spend_command` (alias of `data.no_spend_next_command`), `data.no_spend_next_command_effect`, `data.self_fund_next_command`, `data.self_fund_handoff`, `data.self_fund_preparation`, `data.auth_handoff`, and `data.mutation`. It also preserves `data.checks.quota.top_up`, the same quota top-up recommendation returned by `usage quota`, so wallet-capable agents can see whether a browserless x402 top-up is recommended before the hard wall. Read `data.guide_warning` before running `data.next_command`: `next_command_safety` names whether the command is no-spend setup, read-only inspection, live-money payment action, or live media create. Run that next command only when `data.next_command_copy_runnable` is `true` and the warning says it is safe for your spend policy; when it is `false`, fill `data.next_command_missing_inputs` first. Prefer `data.guide_recovery` for no-doc recovery loops: it names the safest no-spend command and field, the live create or payment field that would spend, and the double-spend guard to check before any live retry. Repeat until `data.stage` is `ready_to_create`. At `ready_to_create`, `data.auth_ready.ready` and `data.auth_ready.next_command_auth_ready` are `true`: the returned create can reuse saved config, env token, or stdin token context without exposing a raw token. Read `data.self_fund_preparation` in this stage before spending the remaining free allowance: when `available` is true, it mirrors top-up `urgency`, `urgency_score`, and `urgency_reasons`; when `recommended` is true, `quote_command` creates an authenticated live-money quote/payment object but does not pay, settle a wallet transfer, debit credits, call a provider, or write media. When that quote is copy-runnable, `data.self_fund_next_command` aliases it with a `pre_wall_...` label such as `pre_wall_browserless_agent_payable_quote`, so you can open the quote path before the quota wall. Only a later buy/payment step can spend money. When `data.guide_warning.next_command_safety` is `live_media_create_credit_debit` and `data.no_spend_evaluation.stop_here` is `true`, `data.next_command` is the live create: run it only if media spend is allowed, otherwise stop before it and run `data.recommended_no_spend_command` for no-spend proof. The no-spend command is an authenticated hosted dry-run: it may create a recoverable `job.planned` receipt, but it has no provider call, credit debit, downloadable asset, or media write.
+The guide is a free, zero-spend planning call. Given current auth, quota, and payment state, it returns `data.next_command`, `data.next_command_copy_runnable`, `data.next_command_missing_inputs`, `data.stage`, `data.guide_warning`, `data.next_command_effect`, `data.no_spend_next_command` and `data.no_spend_next_command_effect`, `data.output_mode`, and `data.mutation`. The guide shapes the rest on state. While it is blocked it also returns `data.recommended_no_spend_command` (a documented alias of `data.no_spend_next_command`) and its label/effect, `data.auth_ready`, `data.no_spend_evaluation`, `data.guide_recovery`, `data.self_fund_next_command`, `data.self_fund_handoff`, `data.self_fund_preparation`, `data.auth_handoff`, `data.escape_hatches`, and the full `data.checks.quota.top_up` recommendation returned by `usage quota` — everything a blocked agent needs to unblock itself. Once `data.stage` is `ready_to_create` and `data.blocker` is `null`, nothing is blocked on funding or auth, so those fields are omitted and the response is the decision plus the no-spend proof. `data.output_mode` always tells you which shape you got: `mode` is `ready_compact` or `full`, `omitted_fields` names every omitted key, `compacted_fields` names sub-objects that are present but emptied, and `full_output_command` is a copy-runnable rerun with `--explain` that returns everything in every stage. When a pre-wall top-up is actually recommended, the `data.self_fund_*` fields stay in the compact response. Read `data.guide_warning` before running `data.next_command`: `next_command_safety` names whether the command is no-spend setup, read-only inspection, live-money payment action, or live media create. Run that next command only when `data.next_command_copy_runnable` is `true` and the warning says it is safe for your spend policy; when it is `false`, fill `data.next_command_missing_inputs` first. Prefer `data.guide_recovery` for no-doc recovery loops: it names the safest no-spend command and field, the live create or payment field that would spend, and the double-spend guard to check before any live retry. Repeat until `data.stage` is `ready_to_create`. At `ready_to_create` auth is already usable: the returned create can reuse saved config, env token, or stdin token context without exposing a raw token, and `data.auth_ready.ready` and `data.auth_ready.next_command_auth_ready` are `true` when you rerun with `--explain`. When a pre-wall top-up is recommended, read `data.self_fund_preparation` in this stage before spending the remaining free allowance: when `available` is true, it mirrors top-up `urgency`, `urgency_score`, and `urgency_reasons`; when `recommended` is true, `quote_command` creates an authenticated live-money quote/payment object but does not pay, settle a wallet transfer, debit credits, call a provider, or write media. When that quote is copy-runnable, `data.self_fund_next_command` aliases it with a `pre_wall_...` label such as `pre_wall_browserless_agent_payable_quote`, so you can open the quote path before the quota wall. Only a later buy/payment step can spend money. When `data.guide_warning.next_command_safety` is `live_media_create_credit_debit` and `data.guide_warning.no_spend_safe` is `false` (`data.no_spend_evaluation.stop_here` says the same under `--explain`), `data.next_command` is the live create: run it only if media spend is allowed, otherwise stop before it and run the field `data.guide_warning.recommended_command_field` names — resolve it as `data[data.guide_warning.recommended_command_field]` rather than hardcoding, since the compact response names `no_spend_next_command` and the fuller ones name the alias. The no-spend command is an authenticated hosted dry-run: it may create a recoverable `job.planned` receipt, but it has no provider call, credit debit, downloadable asset, or media write.
 
 When `data.stage` is `quota_required`, `data.self_fund_handoff` mirrors top-up `urgency`, `urgency_score`, and `urgency_reasons`, and exposes `first_safe_command` with a no-spend inspection effect. Run that no-spend command first when you need to inspect rails or stay below delegated spend authority before opening the live-money quote path.
 
@@ -53,7 +54,7 @@ Minimum success envelope on a create or edit:
     "assets": [
       {
         "asset_id": "image_...",
-        "url": "https://media.image-skill.com/a/image_...png",
+        "url": "https://media.luxin.sh/a/image_...png",
         "mime_type": "image/png"
       }
     ],
@@ -238,7 +239,7 @@ luxin claim code --json
 
 Give them `data.dashboard_url` and nothing else. They get a read-only view of your jobs, assets, quota, and activity, plus the ability to open a credit checkout for you. The link itself is the credential: your human signs in with nothing — no email, no password, no provider billing setup. Never share your token, and never quote the raw `data.code` in prompts, logs, issues, or feedback: the code is the whole credential. It rides in the URL fragment (`#code=...`), which browsers never send to a server, so share the link intact rather than rebuilding it as a query string.
 
-The code is single-use and expires (`data.ttl_seconds`, currently 15 minutes); the human session it opens lasts days. So one code is normally enough — reuse an unexpired `dashboard_url` instead of re-minting, and expect `DASHBOARD_CODE_RATE_LIMITED` past 30 codes per agent per hour. Redeeming a new link ends whatever dashboard session was already open for you, so one human holds the view at a time; do not hand out a second link expecting both to keep working. `claim code` needs the `dashboard.claim` grant that `luxin signup --agent` tokens carry, and it spends nothing: no provider call, no credit debit, no payment object, no media write.
+The code is single-use and expires (`data.ttl_seconds`, currently 60 minutes); the human session it opens lasts days. So one code is normally enough — reuse an unexpired `dashboard_url` instead of re-minting, and expect `DASHBOARD_CODE_RATE_LIMITED` past 30 codes per agent per hour. Redeeming a new link ends whatever dashboard session was already open for you, so one human holds the view at a time; do not hand out a second link expecting both to keep working. `claim code` needs the `dashboard.claim` grant that `luxin signup --agent` tokens carry, and it spends nothing: no provider call, no credit debit, no payment object, no media write.
 
 Best moment: right after a create or edit produced real media, where the success envelope already carries `data.next_actions.share_with_human` with this command and `share_field: "data.dashboard_url"`. A human who can see finished work is a human who will fund the next run. Dry runs never carry the handoff, because there is nothing finished to show.
 
@@ -257,6 +258,8 @@ luxin models show openai.gpt-image-2
 
 `--available` filters to runnable rows (`status:"available"` and `execution.model_execution_status:"executable"`). Do not treat provider-level `status:"available"` as runnable. `--catalog-only` exposes research rows that are not runnable yet; inspect them, do not pass them to create or edit.
 
+Aspect ratio is a normalized top-level control, not a `model_parameters` field: pass `--aspect-ratio 16:9` (API: top-level `aspect_ratio` on `/v1/create` and `/v1/edit`). Supported values are per-model — `models show MODEL_ID` lists them under `media.input.aspect_ratios.values`, and passing one a model does not expose fails before any spend. If you do not state a ratio, the model default applies, so put the ratio you need in the brief or pass the flag. `create --guide` reads an explicit ratio from your prompt, reports it as `selection.suggested_aspect_ratio`, prefers a model that can express it, and includes it in `data.next_command`.
+
 Pass model-specific controls through validated JSON, not invented top-level flags:
 
 ```bash
@@ -264,6 +267,7 @@ luxin create \
   --prompt-file ./prompt.md \
   --intent finalize \
   --model openai.gpt-image-2 \
+  --aspect-ratio 16:9 \
   --output-count 2 \
   --model-parameters-json '{"quality":"high","background":"opaque","output_format":"png"}' \
   --max-usd 0.80

package/skills/agent-image-generation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-image-generation
 description: >-
-  Agent image generation for autonomous agents: text-to-image, prompt-to-image, and durable AI image output through Luxin's zero-setup hosted runtime. Use when an agent searches ClawHub or a skill marketplace for image generation but should not bring provider API keys, OAuth, local model setup, or per-provider billing. Start with the no-spend guide, then create hosted images with recoverable jobs, cost receipts, model parameters, stable JSON, and browserless x402 when available.
+  Image generation an autonomous agent can run with no human setup step: it signs itself up in one command, starts on free preview credits, and creates without an API key, a provider account, or a billing account. The --max-estimated-usd-per-image flag rejects a call whose quote is over budget before it spends. When the credits run out the agent hands its human one dashboard link to fund more.
 homepage: https://luxin.sh
 docs: https://luxin.sh/llms.txt
 metadata:

package/skills/ai-audio-generation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ai-audio-generation
 description: >-
-  AI audio generation for agents through Luxin's zero-setup hosted creative runtime. Use when a prompt should become music, sound, or audio without provider credentials, OAuth, local runtime, or per-provider billing. Start with the no-spend guide, choose an audio model, and keep durable hosted audio URLs, recoverable jobs, cost receipts, stable JSON, payments, and feedback in one loop.
+  Generate music, sound effects, and ambience from a text prompt with no API key to obtain first. The agent signs itself up in one command and starts on free preview credits: no provider account to open, no billing to set up. Audio comes back as a wav at a hosted media URL with no signature or expiry, with a job id the agent can re-fetch and a receipt for what the call cost.
 homepage: https://luxin.sh
 docs: https://luxin.sh/llms.txt
 metadata:

package/skills/ai-image-generation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ai-image-generation
 description: >-
-  AI image generation for agents: text-to-image and prompt-to-image through Luxin's zero-setup hosted runtime. Use when an agent needs a generated image with no provider API key, OAuth, local runtime, or per-provider billing account. Start with the no-spend guide, then create durable hosted images with recoverable jobs, cost receipts, model parameters, stable JSON, and browserless x402 when available.
+  AI image generation from a text prompt, with no API key to obtain first. The agent signs itself up in one command and starts on free preview credits: no provider account to open, no billing to set up. Name a model or let the guide pick one, then get the image back as a hosted media URL with no signature or expiry, a job id the agent can re-fetch, and a receipt for what the call cost.
 homepage: https://luxin.sh
 docs: https://luxin.sh/llms.txt
 metadata:

package/skills/ai-video-generation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ai-video-generation
 description: >-
-  AI video generation for agents through Luxin's zero-setup hosted creative runtime. Use when a prompt should become a durable hosted video without provider credentials, OAuth, local runtime, or per-provider billing. Start with the no-spend guide, choose a video model, and keep model discovery, jobs, costs, URLs, JSON recovery, payments, and feedback in one loop.
+  Generate video from a text prompt with no API key to obtain first. The agent signs itself up in one command, starts on free preview credits, and gets back an mp4 at a hosted media URL with no signature or expiry: no provider account to open, no billing to set up. The create call runs the render and returns a job id the agent can re-fetch, plus a receipt for what the call cost.
 homepage: https://luxin.sh
 docs: https://luxin.sh/llms.txt
 metadata:

package/skills/creative-media/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: creative-media
 description: >-
-  Creative media for agents over one zero-setup Luxin runtime: image generation, image editing, video, audio, and image-to-3D assets with no provider API key, OAuth, local runtime, or per-provider billing account. Use when an agent needs generated media plus durable hosted URLs, recoverable jobs, cost receipts, model parameters, stable JSON, payments, and feedback through one identity and one wallet.
+  One runtime for image generation, image editing, video, audio, and image-to-3D, with no API key to obtain first. The agent signs itself up once and runs all five through two calls, create and edit, on one identity and one credit balance: no provider account to open, no billing to set up. Every result returns a hosted media URL with no signature or expiry, a job id the agent can re-fetch, and a receipt for what the call cost.
 homepage: https://luxin.sh
 docs: https://luxin.sh/llms.txt
 metadata: