minecodex 0.1.19 → 0.2.1

package/features/images/codex-feature.json

@@ -12,6 +12,11 @@
   },
   "surfaceUrl": "http://127.0.0.1:47831/",
   "healthUrl": "http://127.0.0.1:47831/api/health",
+  "runtimePortEnvironment": "CODEX_IMAGE_HOST_PORT",
+  "pageScript": {
+    "resource": "src/chatgpt-image-source-page.mjs"
+  },
+  "hostActions": ["import-generated-image"],
   "placement": {
     "after": "sites",
     "order": 10

package/features/images/src/chatgpt-image-source-page.mjs

@@ -0,0 +1,207 @@
+const MAX_BYTES = 32 * 1024 * 1024;
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
+const MARKER_SELECTORS = [
+  "[data-image-generation-result]",
+  "[data-generated-image]",
+  '[data-testid="image-generation-result"]',
+  '[data-testid="generated-image"]',
+  '[data-testid="image-generation"]',
+];
+
+function importUrl() {
+  try {
+    const origin = new URL(config?.serviceOrigin);
+    if (
+      origin.protocol !== "http:"
+      || !LOOPBACK_HOSTS.has(origin.hostname)
+      || origin.username
+      || origin.password
+    ) return null;
+    return new URL("/api/import-generated-image", origin.origin).href;
+  } catch {
+    return null;
+  }
+}
+
+const IMPORT_URL = importUrl();
+if (!IMPORT_URL) return () => {};
+
+function sendImport(payload) {
+  if (
+    typeof config?.bindingName === "string"
+    && typeof config?.bindingToken === "string"
+    && typeof config?.featureId === "string"
+    && typeof window[config.bindingName] === "function"
+  ) {
+    window[config.bindingName](JSON.stringify({
+      token: config.bindingToken,
+      featureId: config.featureId,
+      requestId: `${payload.itemId}:${Date.now()}`,
+      action: "import-generated-image",
+      payload,
+    }));
+    return Promise.resolve();
+  }
+  return window.fetch(IMPORT_URL, {
+    method: "POST",
+    credentials: "omit",
+    referrerPolicy: "no-referrer",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload),
+    signal,
+  }).then((result) => {
+    if (!result.ok) throw new Error(`Images import returned ${result.status}`);
+  });
+}
+
+function sourceKind() {
+  const selectedConversation = document.querySelector?.('[role="button"][aria-current="page"]');
+  const selectedLabel = selectedConversation?.textContent?.trim() ?? "";
+  if (/work$/i.test(selectedLabel)) return "work";
+  if (/chat$/i.test(selectedLabel)) return "chat";
+  const active = Array.from(document.querySelectorAll('[aria-selected="true"], [data-state="active"]'))
+    .map((element) => `${element.getAttribute("aria-label") ?? ""} ${element.textContent ?? ""}`)
+    .join(" ");
+  const context = `${window.location.pathname} ${active}`.toLowerCase();
+  if (/\bwork\b/.test(context)) return "work";
+  if (/\bchat\b/.test(context)) return "chat";
+  return null;
+}
+
+function selectedConversationTitle() {
+  const label = document.querySelector?.('[role="button"][aria-current="page"]')?.textContent?.trim() ?? "";
+  return label.replace(/(?:chat|work)$/i, "").trim() || null;
+}
+
+function generatedGalleryMetadata(element) {
+  const preview = element.closest?.('[data-testid="generated-image-preview"]');
+  const gallery = preview?.closest?.('[data-testid="generated-image-gallery"]');
+  if (!gallery) return null;
+
+  const previews = Array.from(gallery.querySelectorAll?.('[data-testid="generated-image-preview"] img') ?? []);
+  const imageIndex = previews.indexOf(element);
+  if (imageIndex < 0) return null;
+
+  const fiberKey = Object.getOwnPropertyNames(gallery).find((key) => key.startsWith("__reactFiber$"));
+  let fiber = fiberKey ? gallery[fiberKey] : null;
+  for (let depth = 0; fiber && depth < 8; depth += 1, fiber = fiber.return) {
+    for (const props of [fiber.pendingProps, fiber.memoizedProps]) {
+      if (!props || !Array.isArray(props.images) || typeof props.conversationId !== "string") continue;
+      const image = props.images[imageIndex];
+      const itemId = typeof image?.id === "string" ? image.id : null;
+      if (!itemId || typeof image.src !== "string" || !image.src.startsWith("sediment://file_")) return null;
+      return {
+        itemId,
+        conversationId: props.conversationId,
+        conversationTitle: selectedConversationTitle(),
+      };
+    }
+  }
+  return null;
+}
+
+function closestValue(element, attribute) {
+  return element.closest?.(`[${attribute}]`)?.getAttribute(attribute)?.trim() || null;
+}
+
+function descriptor(element) {
+  const source = element.currentSrc || element.src || "";
+  let protocol;
+  try { protocol = new URL(source, window.location.href).protocol.slice(0, -1); } catch { protocol = null; }
+  const gallery = generatedGalleryMetadata(element);
+  if (gallery && new Set(["https", "blob", "data"]).has(protocol)) {
+    return {
+      source,
+      ...gallery,
+      sourceKind: sourceKind(),
+      prompt: null,
+      createdAt: null,
+    };
+  }
+  const marker = MARKER_SELECTORS.some((selector) => element.matches?.(selector) || element.closest?.(selector));
+  const assistant = Boolean(element.closest?.('[data-message-author-role="assistant"], [data-message-author-role="tool"]'));
+  const itemId = element.dataset.imageId
+    || element.dataset.itemId
+    || closestValue(element, "data-image-id")
+    || closestValue(element, "data-item-id")
+    || closestValue(element, "data-message-id");
+  if (!marker || !assistant || !itemId || itemId.length > 256 || /[\\/\u0000]/.test(itemId)) return null;
+  if (!new Set(["https", "blob", "data"]).has(protocol)) return null;
+  return {
+    source,
+    itemId,
+    sourceKind: sourceKind(),
+    conversationId: closestValue(element, "data-conversation-id"),
+    conversationTitle: closestValue(element, "data-conversation-title"),
+    prompt: element.getAttribute("data-image-prompt") || null,
+    createdAt: element.getAttribute("data-created-at") || null,
+  };
+}
+
+function base64(bytes) {
+  let output = "";
+  const chunkSize = 0x8000;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    output += String.fromCharCode(...bytes.subarray(offset, offset + chunkSize));
+  }
+  return window.btoa(output);
+}
+
+async function imagePayload(image, element, signal) {
+  try {
+    const response = await window.fetch(image.source, {
+      credentials: "same-origin",
+      redirect: "error",
+      referrerPolicy: "no-referrer",
+      signal,
+    });
+    if (!response.ok) throw new Error(`generated image fetch returned ${response.status}`);
+    const mimeType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() || null;
+    if (!mimeType) throw new Error("generated image response has no Content-Type");
+    const length = Number(response.headers.get("content-length") || 0);
+    if (length > MAX_BYTES) throw new Error("generated image exceeds the import limit");
+    return { mimeType, bytes: new Uint8Array(await response.arrayBuffer()) };
+  } catch (error) {
+    if (!image.source.startsWith("blob:") || !element?.complete || !element.naturalWidth) throw error;
+    const canvas = document.createElement("canvas");
+    canvas.width = element.naturalWidth;
+    canvas.height = element.naturalHeight;
+    canvas.getContext("2d").drawImage(element, 0, 0);
+    const blob = await new Promise((resolve) => canvas.toBlob(resolve, "image/png"));
+    if (!blob) throw error;
+    return { mimeType: "image/png", bytes: new Uint8Array(await blob.arrayBuffer()) };
+  }
+}
+
+async function importImage(image, element, signal) {
+  const { mimeType, bytes } = await imagePayload(image, element, signal);
+  if (!bytes.length || bytes.length > MAX_BYTES) throw new Error("generated image exceeds the import limit");
+  const payload = {
+    ...image,
+    mimeType,
+    bytesBase64: base64(bytes),
+  };
+  delete payload.source;
+  await sendImport(payload);
+}
+
+const seen = new Set();
+const inFlight = new Set();
+const scan = () => {
+  if (!sourceKind()) return;
+  for (const element of document.querySelectorAll("img")) {
+    const image = descriptor(element);
+    if (!image || !image.sourceKind || seen.has(image.itemId) || inFlight.has(image.itemId)) continue;
+    inFlight.add(image.itemId);
+    void importImage(image, element, signal)
+      .then(() => seen.add(image.itemId))
+      .catch(() => {})
+      .finally(() => inFlight.delete(image.itemId));
+  }
+};
+
+const observer = new MutationObserver(scan);
+observer.observe(document.documentElement, { childList: true, subtree: true, attributes: true, attributeFilter: ["src", "srcset", "data-image-id", "data-item-id"] });
+scan();
+signal.addEventListener("abort", () => observer.disconnect(), { once: true });
+return () => observer.disconnect();

package/features/images/src/chatgpt-image-source.mjs

@@ -0,0 +1,42 @@
+const SUPPORTED_SURFACES = new Set(["chat", "work"]);
+
+export function sourceKindForSurface({ pathname = "", activeLabel = "" } = {}) {
+  const value = `${pathname} ${activeLabel}`.toLowerCase();
+  if (/\bwork\b/.test(value)) return "work";
+  if (/\bchat\b/.test(value)) return "chat";
+  return null;
+}
+
+export function classifyGeneratedImage({
+  hasGenerationMarker = false,
+  isAssistantResult = false,
+  itemId = null,
+  sourceProtocol = null,
+} = {}) {
+  if (!hasGenerationMarker || !isAssistantResult) return { accepted: false, reason: "NOT_GENERATED_RESULT" };
+  if (!itemId || typeof itemId !== "string" || itemId.length > 256 || /[\\/\u0000]/.test(itemId)) {
+    return { accepted: false, reason: "MISSING_STABLE_ITEM_ID" };
+  }
+  if (!new Set(["https", "blob", "data"]).has(sourceProtocol)) {
+    return { accepted: false, reason: "UNSUPPORTED_SOURCE" };
+  }
+  return { accepted: true };
+}
+
+export function buildImportMetadata({
+  sourceKind,
+  itemId,
+  conversationId = null,
+  conversationTitle = null,
+  prompt = null,
+  createdAt = null,
+} = {}) {
+  return {
+    sourceKind: SUPPORTED_SURFACES.has(sourceKind) ? sourceKind : null,
+    itemId: typeof itemId === "string" ? itemId.slice(0, 256) : null,
+    conversationId: typeof conversationId === "string" ? conversationId.slice(0, 256) : null,
+    conversationTitle: typeof conversationTitle === "string" ? conversationTitle.slice(0, 512) : null,
+    prompt: typeof prompt === "string" ? prompt.slice(0, 8_192) : null,
+    createdAt: typeof createdAt === "string" ? createdAt.slice(0, 64) : null,
+  };
+}

package/features/images/src/http-server.mjs

@@ -2,6 +2,7 @@ import { createReadStream } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 import { createServer as createNodeServer } from "node:http";
 import path from "node:path";
+import { MAX_IMPORTED_IMAGE_BYTES } from "./image-library.mjs";
 import { saveImageAs } from "./save-as.mjs";
 
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
@@ -9,6 +10,7 @@ const CODEX_EMBED_ORIGIN = "app://-";
 const DEFAULT_PAGE_LIMIT = 36;
 const MAX_PAGE_LIMIT = 72;
 const MAX_PAGE_OFFSET = Number.MAX_SAFE_INTEGER;
+const MAX_IMPORT_BODY_BYTES = Math.ceil(MAX_IMPORTED_IMAGE_BYTES * 4 / 3) + 64 * 1024;
 
 const STATIC_FILES = new Map([
   ["/", ["index.html", "text/html; charset=utf-8"]],
@@ -41,7 +43,7 @@ function publicImage(image, { includePrompt = false } = {}) {
     archived: image.archived,
     fileUrl: `/api/images/${image.id}/file`,
     downloadUrl: `/api/images/${image.id}/download`,
-    sourceUrl: `codex://threads/${image.threadId}`,
+    sourceUrl: image.threadId.startsWith("chatgpt:") ? null : `codex://threads/${image.threadId}`,
   };
   if (includePrompt) result.prompt = image.prompt;
   return result;
@@ -70,6 +72,82 @@ function mutationError(message, code) {
   return Object.assign(new Error(message), { status: 403, code });
 }
 
+async function readRequestBody(request, maxBytes) {
+  const declaredLength = Number(request.headers["content-length"] ?? 0);
+  if (Number.isSafeInteger(declaredLength) && declaredLength > maxBytes) {
+    throw Object.assign(new Error("Request body exceeds the Images import limit"), {
+      status: 413,
+      code: "BODY_TOO_LARGE",
+    });
+  }
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of request) {
+    total += chunk.length;
+    if (total > maxBytes) {
+      throw Object.assign(new Error("Request body exceeds the Images import limit"), {
+        status: 413,
+        code: "BODY_TOO_LARGE",
+      });
+    }
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks, total);
+}
+
+async function readImportPayload(request) {
+  if (!String(request.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+    throw Object.assign(new Error("Images import requires application/json"), {
+      status: 415,
+      code: "UNSUPPORTED_CONTENT_TYPE",
+    });
+  }
+  let payload;
+  try {
+    payload = JSON.parse((await readRequestBody(request, MAX_IMPORT_BODY_BYTES)).toString("utf8"));
+  } catch (error) {
+    if (error.code === "BODY_TOO_LARGE") throw error;
+    throw Object.assign(new Error("Images import body must be valid JSON"), {
+      status: 400,
+      code: "INVALID_JSON",
+    });
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw Object.assign(new Error("Images import body must be an object"), {
+      status: 400,
+      code: "INVALID_BODY",
+    });
+  }
+  if (typeof payload.bytesBase64 !== "string" || payload.bytesBase64.length > MAX_IMPORT_BODY_BYTES) {
+    throw Object.assign(new Error("Images import requires bounded base64 image bytes"), {
+      status: 400,
+      code: "INVALID_IMAGE_BYTES",
+    });
+  }
+  const bytes = Buffer.from(payload.bytesBase64, "base64");
+  if (!bytes.length || bytes.toString("base64") !== payload.bytesBase64.replace(/\s/g, "")) {
+    throw Object.assign(new Error("Images import image bytes are not valid base64"), {
+      status: 400,
+      code: "INVALID_IMAGE_BYTES",
+    });
+  }
+  return { ...payload, bytes };
+}
+
+function contentTypeForPath(sourcePath) {
+  const extension = path.extname(sourcePath).toLowerCase();
+  return extension === ".jpg" || extension === ".jpeg"
+    ? "image/jpeg"
+    : extension === ".webp" ? "image/webp" : "image/png";
+}
+
+function downloadFilename(image, sourcePath) {
+  const stem = String(image.imageGenerationItemId ?? "generated-image")
+    .replace(/[^a-zA-Z0-9._-]/g, "_")
+    .slice(0, 128) || "generated-image";
+  return `${stem}${path.extname(sourcePath)}`;
+}
+
 function applyCodexEmbedCors(request, response) {
   if (request.headers.origin !== CODEX_EMBED_ORIGIN) return false;
   response.setHeader("Access-Control-Allow-Origin", CODEX_EMBED_ORIGIN);
@@ -235,6 +313,17 @@ export async function createHttpServer({
         return;
       }
 
+      if (request.method === "POST" && url.pathname === "/api/import-generated-image") {
+        const payload = await readImportPayload(request);
+        const result = await library.importExternalImage({ ...payload, bytes: payload.bytes });
+        if (!result.imported && result.reason !== "DUPLICATE") {
+          json(response, 400, { ...result, imported: false });
+          return;
+        }
+        json(response, result.reason === "DUPLICATE" ? 200 : 201, result);
+        return;
+      }
+
       const saveAsMatch = url.pathname.match(/^\/api\/images\/([a-f0-9]{24})\/save-as$/);
       if (request.method === "POST" && saveAsMatch) {
         const image = library.get(saveAsMatch[1]);
@@ -266,12 +355,12 @@ export async function createHttpServer({
         }
         const sourceStat = await stat(image.sourcePath);
         const headers = {
-          "Content-Type": "image/png",
+          "Content-Type": contentTypeForPath(image.sourcePath),
           "Content-Length": sourceStat.size,
           "Cache-Control": "public, max-age=31536000, immutable",
         };
         if (imageMatch[2] === "download") {
-          headers["Content-Disposition"] = `attachment; filename="${image.imageGenerationItemId}.png"`;
+          headers["Content-Disposition"] = `attachment; filename="${downloadFilename(image, image.sourcePath)}"`;
         }
         response.writeHead(200, headers);
         createReadStream(image.sourcePath).pipe(response);

package/features/images/src/image-library.mjs

@@ -2,10 +2,14 @@ import { watch } from "node:fs";
 import {
   mkdir,
   open,
+  readFile,
   readdir,
+  rename,
   stat,
+  unlink,
+  writeFile,
 } from "node:fs/promises";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { ThreadPromptIndex } from "./prompt-index.mjs";
@@ -13,6 +17,8 @@ import { ThreadPromptIndex } from "./prompt-index.mjs";
 const PNG_EXTENSION = ".png";
 const FALLBACK_RESCAN_INITIAL_DELAY_MS = 30_000;
 const FALLBACK_RESCAN_MAX_DELAY_MS = 5 * 60_000;
+export const MAX_IMPORTED_IMAGE_BYTES = 32 * 1024 * 1024;
+export const MAX_IMPORTED_IMAGE_DIMENSION = 16_384;
 
 function isPng(filePath) {
   return path.extname(filePath).toLowerCase() === PNG_EXTENSION;
@@ -31,8 +37,8 @@ function buildWhere({ query = "", source = "all", threadId = null } = {}) {
     parameters.push(threadId);
   }
 
-  if (source === "chat") {
-    clauses.push("thread_sources.source_kind = 'chat'");
+  if (source === "chat" || source === "work") {
+    clauses.push(`thread_sources.source_kind = '${source}'`);
   } else if (source.startsWith("project:")) {
     clauses.push("thread_sources.source_kind = 'project' AND thread_sources.project_id = ?");
     parameters.push(source.slice("project:".length));
@@ -76,6 +82,53 @@ async function readPngSize(filePath) {
   }
 }
 
+function imageSizeFromBuffer(bytes, mimeType) {
+  if (mimeType === "image/png") {
+    if (bytes.length < 24 || bytes.subarray(0, 8).toString("hex") !== "89504e470d0a1a0a") return null;
+    return { width: bytes.readUInt32BE(16), height: bytes.readUInt32BE(20) };
+  }
+  if (mimeType === "image/jpeg") {
+    if (bytes.length < 4 || bytes.readUInt16BE(0) !== 0xffd8) return null;
+    let offset = 2;
+    while (offset + 9 < bytes.length) {
+      if (bytes[offset] !== 0xff) return null;
+      const marker = bytes[offset + 1];
+      offset += 2;
+      if (marker === 0xd8 || marker === 0xd9) continue;
+      if (offset + 2 > bytes.length) return null;
+      const segmentLength = bytes.readUInt16BE(offset);
+      if (segmentLength < 2 || offset + segmentLength > bytes.length) return null;
+      if ((marker >= 0xc0 && marker <= 0xc3) || (marker >= 0xc5 && marker <= 0xc7)
+        || (marker >= 0xc9 && marker <= 0xcb) || (marker >= 0xcd && marker <= 0xcf)) {
+        if (segmentLength < 7) return null;
+        return { width: bytes.readUInt16BE(offset + 5), height: bytes.readUInt16BE(offset + 3) };
+      }
+      offset += segmentLength;
+    }
+    return null;
+  }
+  if (mimeType === "image/webp") {
+    if (bytes.length < 30 || bytes.toString("ascii", 0, 4) !== "RIFF" || bytes.toString("ascii", 8, 12) !== "WEBP") {
+      return null;
+    }
+    if (bytes.toString("ascii", 12, 16) !== "VP8X") return null;
+    return {
+      width: 1 + bytes[24] + (bytes[25] << 8) + (bytes[26] << 16),
+      height: 1 + bytes[27] + (bytes[28] << 8) + (bytes[29] << 16),
+    };
+  }
+  return null;
+}
+
+function normalizedImportMime(mimeType) {
+  const normalized = String(mimeType ?? "").split(";", 1)[0].trim().toLowerCase();
+  return new Set(["image/png", "image/jpeg", "image/webp"]).has(normalized) ? normalized : null;
+}
+
+function extensionForMime(mimeType) {
+  return mimeType === "image/jpeg" ? "jpg" : mimeType.slice("image/".length);
+}
+
 async function collectPngFiles(directory, output = []) {
   let entries;
   try {
@@ -282,6 +335,12 @@ export class ImageLibrary {
       JOIN thread_sources ON thread_sources.thread_id = images.thread_id
       WHERE thread_sources.source_kind = 'chat'
     `).get().count;
+    const works = this.database.prepare(`
+      SELECT COUNT(*) AS count
+      FROM images
+      JOIN thread_sources ON thread_sources.thread_id = images.thread_id
+      WHERE thread_sources.source_kind = 'work'
+    `).get().count;
     const projects = this.database.prepare(`
       SELECT thread_sources.project_name,
         COUNT(*) AS count, MAX(images.created_at) AS latest_created_at
@@ -296,7 +355,7 @@ export class ImageLibrary {
       count: row.count,
       latestCreatedAt: row.latest_created_at,
     }));
-    return { total: this.count(), chats, projects };
+    return { total: this.count(), chats, works, projects };
   }
 
   countGroups({ source = "all" } = {}) {
@@ -562,6 +621,114 @@ export class ImageLibrary {
     return true;
   }
 
+  async importExternalImage({
+    bytes,
+    mimeType,
+    itemId,
+    conversationId = null,
+    conversationTitle = null,
+    sourceKind,
+    prompt = null,
+    createdAt = null,
+  } = {}) {
+    if (!this.isLifecycleActive() || !Buffer.isBuffer(bytes)) return { imported: false, reason: "INVALID_BYTES" };
+    const normalizedMime = normalizedImportMime(mimeType);
+    if (!normalizedMime) return { imported: false, reason: "UNSUPPORTED_MIME" };
+    if (bytes.length === 0 || bytes.length > MAX_IMPORTED_IMAGE_BYTES) {
+      return { imported: false, reason: "IMAGE_TOO_LARGE" };
+    }
+    const size = imageSizeFromBuffer(bytes, normalizedMime);
+    if (!size || size.width < 1 || size.height < 1
+      || size.width > MAX_IMPORTED_IMAGE_DIMENSION || size.height > MAX_IMPORTED_IMAGE_DIMENSION) {
+      return { imported: false, reason: "INVALID_DIMENSIONS" };
+    }
+    if (!new Set(["chat", "work"]).has(sourceKind)) {
+      return { imported: false, reason: "INVALID_SOURCE_KIND" };
+    }
+    const safeItemId = String(itemId ?? "").trim();
+    if (!safeItemId || safeItemId.length > 256 || /[\\/\u0000]/.test(safeItemId)) {
+      return { imported: false, reason: "INVALID_ITEM_ID" };
+    }
+    const safeConversationId = conversationId == null ? null : String(conversationId).trim().slice(0, 256) || null;
+    const safeTitle = conversationTitle == null ? "" : String(conversationTitle).trim().slice(0, 512);
+    const safePrompt = prompt == null ? null : String(prompt).trim().slice(0, 8_192) || null;
+    const logicalThreadId = safeConversationId?.startsWith("chatgpt:")
+      ? safeConversationId
+      : `chatgpt:${sourceKind}:${safeConversationId ?? "unknown"}`;
+    const id = imageIdFor(`external:${sourceKind}:${safeConversationId ?? ""}:${safeItemId}`);
+    const extension = extensionForMime(normalizedMime);
+    const assetDir = path.join(this.dataDir, "external-images");
+    const sourcePath = path.join(assetDir, `${id}.${extension}`);
+    const existing = this.database.prepare("SELECT source_path, byte_length FROM images WHERE id = ?").get(id);
+    if (existing && existing.byte_length === bytes.length) {
+      try {
+        const existingBytes = await readFile(existing.source_path);
+        if (existingBytes.equals(bytes)) return { imported: false, id, reason: "DUPLICATE" };
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+    }
+    await mkdir(assetDir, { recursive: true });
+    const temporaryPath = path.join(assetDir, `.${id}.${randomUUID()}.tmp`);
+    try {
+      await writeFile(temporaryPath, bytes, { flag: "wx", mode: 0o600 });
+      await rename(temporaryPath, sourcePath);
+    } finally {
+      await unlink(temporaryPath).catch((error) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+    }
+    const importedAt = new Date().toISOString();
+    const normalizedCreatedAt = createdAt && !Number.isNaN(Date.parse(createdAt))
+      ? new Date(createdAt).toISOString()
+      : importedAt;
+    this.database
+      .prepare(`
+        INSERT INTO images (
+          id, thread_id, image_generation_item_id, source_path,
+          prompt, width, height, byte_length, source_mtime_ms,
+          created_at, imported_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET
+          source_path = excluded.source_path,
+          prompt = excluded.prompt,
+          width = excluded.width,
+          height = excluded.height,
+          byte_length = excluded.byte_length,
+          source_mtime_ms = excluded.source_mtime_ms,
+          created_at = excluded.created_at,
+          imported_at = excluded.imported_at
+      `)
+      .run(
+        id,
+        logicalThreadId,
+        safeItemId,
+        sourcePath,
+        safePrompt,
+        size.width,
+        size.height,
+        bytes.length,
+        0,
+        normalizedCreatedAt,
+        importedAt,
+      );
+    this.database
+      .prepare(`
+        INSERT INTO thread_sources (
+          thread_id, source_kind, project_id, project_name, thread_title, archived, updated_at
+        ) VALUES (?, ?, NULL, NULL, ?, 0, ?)
+        ON CONFLICT(thread_id) DO UPDATE SET
+          source_kind = excluded.source_kind,
+          thread_title = CASE
+            WHEN excluded.thread_title <> '' THEN excluded.thread_title
+            ELSE thread_sources.thread_title
+          END,
+          updated_at = excluded.updated_at
+      `)
+      .run(logicalThreadId, sourceKind, safeTitle, importedAt);
+    return { imported: true, id };
+  }
+
   close() {
     this.closed = true;
     this.lifecycleVersion += 1;