mixdog 0.9.69 → 0.9.70

package/src/runtime/media/jobs.mjs

@@ -0,0 +1,174 @@
+/**
+ * Media generation jobs.
+ *
+ * Image lanes answer in one request, video lanes submit + poll for minutes, so
+ * both run as background jobs with a polled snapshot instead of a blocking
+ * call. The desktop reads snapshots over the normal capability bridge; nothing
+ * here streams, which keeps a long video job independent of window lifetime.
+ */
+import { randomUUID } from 'crypto';
+import { mediaError, resolveMediaRequest } from './lanes.mjs';
+import { saveMediaAsset } from './store.mjs';
+
+const JOBS = new Map();
+// Finished jobs stay readable for a while so a slow poller still sees the
+// terminal state, then drop out to bound memory.
+const TERMINAL_TTL_MS = 10 * 60_000;
+const MAX_PROMPT_CHARS = 8_000;
+
+function snapshot(job) {
+  return {
+    id: job.id,
+    status: job.status,
+    kind: job.kind,
+    lane: job.lane,
+    model: job.model,
+    prompt: job.prompt,
+    options: job.options,
+    progress: job.progress,
+    assetId: job.assetId,
+    error: job.error,
+    errorCode: job.errorCode,
+    startedAt: job.startedAt,
+    endedAt: job.endedAt,
+  };
+}
+
+function sweep() {
+  const now = Date.now();
+  for (const [id, job] of JOBS) {
+    if (job.endedAt && now - job.endedAt > TERMINAL_TTL_MS) JOBS.delete(id);
+  }
+}
+
+async function runAdapter({ lane, kind, model, prompt, options, references, signal, onProgress }) {
+  if (lane.id === 'grok-oauth' || lane.id === 'xai') {
+    const adapter = await import('./adapters/xai-media.mjs');
+    return kind === 'video'
+      ? await adapter.generateVideo({ lane: lane.id, model, prompt, options, references, signal, onProgress })
+      : await adapter.generateImage({ lane: lane.id, model, prompt, options, references, signal });
+  }
+  if (lane.id === 'openai-oauth') {
+    const adapter = await import('./adapters/codex-image.mjs');
+    return await adapter.generateImage({ model, prompt, options, references, signal });
+  }
+  if (lane.id === 'gemini') {
+    if (kind === 'video') {
+      const adapter = await import('./adapters/gemini-video.mjs');
+      return await adapter.generateVideo({ model, prompt, options, references, signal, onProgress });
+    }
+    const adapter = await import('./adapters/gemini-image.mjs');
+    return await adapter.generateImage({ model, prompt, options, references, signal });
+  }
+  throw mediaError(`lane "${lane.id}" has no adapter`, 'MEDIA_LANE_UNKNOWN');
+}
+
+/**
+ * Validate + start one generation. Returns the initial snapshot immediately;
+ * the caller polls getMediaJob for progress and the finished asset id.
+ */
+export function startMediaJob({ lane: laneId, kind, model, prompt, options = {}, references = [] } = {}) {
+  const text = String(prompt || '').trim();
+  if (!text) throw mediaError('prompt is required', 'MEDIA_PROMPT_REQUIRED');
+  if (text.length > MAX_PROMPT_CHARS) throw mediaError('prompt is too long', 'MEDIA_PROMPT_TOO_LONG');
+  const resolved = resolveMediaRequest({ lane: laneId, kind, model });
+  // Reference images: the MODEL publishes its own cap (Veo takes one start
+  // frame, Grok ref2v takes seven), so the bound follows the resolved model.
+  const modelEntry = resolved.spec.models.find((entry) => entry.id === resolved.model);
+  const maxRefs = Number(
+    modelEntry?.controls?.maxReferences ?? resolved.spec.controls?.maxReferences ?? 0,
+  ) || (resolved.kind === 'video' ? 7 : 5);
+  const refs = (Array.isArray(references) ? references : [])
+    .filter((ref) => typeof ref?.base64 === 'string' && ref.base64.length > 0)
+    .slice(0, maxRefs)
+    .map((ref) => ({ base64: ref.base64, mime: String(ref.mime || 'image/png') }));
+  sweep();
+
+  const controller = new AbortController();
+  const job = {
+    id: randomUUID(),
+    status: 'running',
+    kind: resolved.kind,
+    lane: resolved.lane.id,
+    model: resolved.model,
+    prompt: text,
+    options: { ...options },
+    referenceCount: refs.length,
+    progress: 0,
+    assetId: null,
+    error: null,
+    errorCode: null,
+    startedAt: Date.now(),
+    endedAt: null,
+    controller,
+  };
+  JOBS.set(job.id, job);
+
+  (async () => {
+    try {
+      const result = await runAdapter({
+        lane: resolved.lane,
+        kind: resolved.kind,
+        model: resolved.model,
+        prompt: text,
+        options,
+        references: refs,
+        signal: controller.signal,
+        onProgress: (value) => {
+          const raw = Number(value);
+          if (!Number.isFinite(raw)) return;
+          // Lanes report either a 0-1 fraction or a percentage, and a poll can
+          // come back stale — normalize and never let the rail walk backwards.
+          const next = Math.round(Math.max(0, Math.min(100, raw > 1 ? raw : raw * 100)));
+          if (next > job.progress) job.progress = next;
+        },
+      });
+      const asset = saveMediaAsset({
+        kind: resolved.kind,
+        lane: resolved.lane.id,
+        model: resolved.model,
+        prompt: text,
+        options: job.options,
+        mime: result.mime,
+        bytes: result.bytes,
+        meta: {
+          ...(result.revisedPrompt ? { revisedPrompt: result.revisedPrompt } : {}),
+          ...(result.durationSeconds ? { durationSeconds: result.durationSeconds } : {}),
+        },
+      });
+      job.assetId = asset.id;
+      job.progress = 100;
+      job.status = 'done';
+    } catch (err) {
+      const canceled = controller.signal.aborted || err?.code === 'MEDIA_CANCELED' || err?.name === 'AbortError';
+      job.status = canceled ? 'canceled' : 'failed';
+      job.error = canceled ? 'canceled' : String(err?.message || err).slice(0, 500);
+      job.errorCode = err?.code || null;
+    } finally {
+      job.endedAt = Date.now();
+    }
+  })();
+
+  return snapshot(job);
+}
+
+export function getMediaJob(id) {
+  const job = JOBS.get(String(id || ''));
+  return job ? snapshot(job) : null;
+}
+
+export function listMediaJobs() {
+  sweep();
+  return [...JOBS.values()]
+    .sort((a, b) => b.startedAt - a.startedAt)
+    .map(snapshot);
+}
+
+export function cancelMediaJob(id) {
+  const job = JOBS.get(String(id || ''));
+  if (!job) return { id, canceled: false };
+  if (job.status === 'running') {
+    try { job.controller.abort(); } catch {}
+  }
+  return { id: job.id, canceled: job.status === 'running' };
+}

package/src/runtime/media/lanes.mjs

@@ -0,0 +1,230 @@
+/**
+ * Media generation lanes (image / video).
+ *
+ * A lane is one credential path we can actually generate with. Auth state is
+ * resolved from the SAME stores the chat providers use (OAuth token stores and
+ * the keychain-backed API keys), so the Studio only ever offers lanes the user
+ * already signed in to. No lane owns a fallback to another lane's credential —
+ * an unauthenticated lane fails closed.
+ */
+import { getAgentApiKey } from '../shared/provider-api-key.mjs';
+// Credential probes are file-level checks: the catalog must not drag the whole
+// provider graph in just to render lane availability.
+import {
+  hasGrokOAuthCredentials,
+  hasOpenAIOAuthCredentials,
+} from '../agent/orchestrator/providers/oauth-credential-probes.mjs';
+
+export const MEDIA_KINDS = Object.freeze(['image', 'video']);
+
+const GROK_IMAGE_MODELS = Object.freeze([
+  Object.freeze({ id: 'grok-imagine-image', label: 'Imagine Image' }),
+  Object.freeze({ id: 'grok-imagine-image-quality', label: 'Imagine Image Q' }),
+]);
+// Per-model control overrides: video contracts differ per model (fixed clip
+// lengths on Veo, 1080p only on Grok 1.5, no length knob on Omni), so each
+// entry carries what it actually accepts instead of one lane-wide guess.
+const GROK_VIDEO_MODELS = Object.freeze([
+  Object.freeze({
+    id: 'grok-imagine-video',
+    label: 'Imagine Video',
+    controls: Object.freeze({ resolution: Object.freeze(['480p', '720p']) }),
+  }),
+]);
+// grok-imagine-video-1.5 is intentionally absent: upstream rejects prompt-only
+// text-to-video on it ("Text-to-video is not supported for this model"), and it
+// only works through an image/reference input we do not accept yet.
+
+// Aspect/resolution vocabularies are lane-native: xAI takes aspect_ratio +
+// resolution, Gemini/Codex take pixel sizes. The UI renders whatever the lane
+// declares instead of inventing a cross-provider size model.
+const GROK_ASPECTS = Object.freeze(['auto', '1:1', '16:9', '9:16', '4:3', '3:4', '3:2', '2:3']);
+
+const LANES = Object.freeze([
+  Object.freeze({
+    id: 'grok-oauth',
+    label: 'Grok Imagine (OAuth)',
+    auth: Object.freeze({ type: 'oauth', provider: 'grok-oauth' }),
+    image: Object.freeze({
+      models: GROK_IMAGE_MODELS,
+      defaultModel: 'grok-imagine-image',
+      controls: Object.freeze({ aspectRatio: GROK_ASPECTS, resolution: Object.freeze(['1k', '2k']), maxReferences: 5 }),
+    }),
+    video: Object.freeze({
+      models: GROK_VIDEO_MODELS,
+      defaultModel: 'grok-imagine-video',
+      controls: Object.freeze({
+        aspectRatio: GROK_ASPECTS,
+        resolution: Object.freeze(['480p', '720p', '1080p']),
+        durationRange: Object.freeze([1, 15]),
+        // 1 ref = image-to-video, 2-7 = reference-to-video.
+        maxReferences: 7,
+      }),
+    }),
+  }),
+  Object.freeze({
+    id: 'xai',
+    label: 'Grok Imagine (API key)',
+    auth: Object.freeze({ type: 'api-key', provider: 'xai' }),
+    image: Object.freeze({
+      models: GROK_IMAGE_MODELS,
+      defaultModel: 'grok-imagine-image',
+      controls: Object.freeze({ aspectRatio: GROK_ASPECTS, resolution: Object.freeze(['1k', '2k']), maxReferences: 5 }),
+    }),
+    video: Object.freeze({
+      models: GROK_VIDEO_MODELS,
+      defaultModel: 'grok-imagine-video',
+      controls: Object.freeze({
+        aspectRatio: GROK_ASPECTS,
+        resolution: Object.freeze(['480p', '720p', '1080p']),
+        durationRange: Object.freeze([1, 15]),
+        maxReferences: 7,
+      }),
+    }),
+  }),
+  Object.freeze({
+    id: 'openai-oauth',
+    label: 'ChatGPT Image (OAuth)',
+    auth: Object.freeze({ type: 'oauth', provider: 'openai-oauth' }),
+    image: Object.freeze({
+      // The hosted image_generation tool runs on the Codex responses backend,
+      // so the id is a chat model driving the tool. The catalog exposes it as
+      // an IMAGE choice (quality vs fast) — listing raw chat models here read
+      // as "why is a chat model in an image picker".
+      models: Object.freeze([
+        Object.freeze({ id: 'gpt-5.6-sol', label: 'GPT Image' }),
+        Object.freeze({ id: 'gpt-5.4-mini', label: 'GPT Image Fast' }),
+      ]),
+      defaultModel: 'gpt-5.6-sol',
+      controls: Object.freeze({
+        size: Object.freeze(['auto', '1024x1024', '1536x1024', '1024x1536']),
+        quality: Object.freeze(['auto', 'low', 'medium', 'high']),
+        maxReferences: 5,
+      }),
+    }),
+  }),
+  Object.freeze({
+    id: 'gemini',
+    label: 'Gemini Image (API key)',
+    auth: Object.freeze({ type: 'api-key', provider: 'gemini' }),
+    image: Object.freeze({
+      models: Object.freeze([
+        Object.freeze({ id: 'gemini-3-pro-image', label: 'Nano Banana Pro' }),
+        Object.freeze({ id: 'gemini-3.1-flash-image', label: 'Nano Banana 2' }),
+        Object.freeze({ id: 'gemini-2.5-flash-image', label: 'Nano Banana 2.5' }),
+      ]),
+      defaultModel: 'gemini-3.1-flash-image',
+      controls: Object.freeze({
+        aspectRatio: Object.freeze(['auto', '1:1', '16:9', '9:16', '4:3', '3:4']),
+        // Reference caps the image edit path at 3 inline references.
+        maxReferences: 3,
+      }),
+    }),
+    video: Object.freeze({
+      // Omni Flash answers inline on the Interactions API; the Veo trio runs as
+      // a long-running predict. Both are paid-tier only on this key.
+      models: Object.freeze([
+        Object.freeze({
+          id: 'gemini-omni-flash-preview',
+          label: 'Omni Flash',
+          // Omni picks its own clip length; only the frame shape is ours.
+          controls: Object.freeze({
+            resolution: Object.freeze([]),
+            durations: Object.freeze([]),
+            maxReferences: 3,
+          }),
+        }),
+        Object.freeze({ id: 'veo-3.1-fast-generate-preview', label: 'Veo 3.1 Fast' }),
+        Object.freeze({ id: 'veo-3.1-generate-preview', label: 'Veo 3.1' }),
+        Object.freeze({ id: 'veo-3.1-lite-generate-preview', label: 'Veo 3.1 Lite' }),
+      ]),
+      defaultModel: 'gemini-omni-flash-preview',
+      controls: Object.freeze({
+        aspectRatio: Object.freeze(['16:9', '9:16']),
+        resolution: Object.freeze(['720p', '1080p']),
+        // Veo 3.1 accepts discrete clip lengths, not a free range.
+        durations: Object.freeze([4, 6, 8]),
+        // Veo takes a single start frame; Omni overrides this below.
+        maxReferences: 1,
+      }),
+    }),
+  }),
+]);
+
+const LANE_BY_ID = new Map(LANES.map((lane) => [lane.id, lane]));
+
+function laneAuthenticated(lane) {
+  try {
+    if (lane.auth.type === 'api-key') return Boolean(getAgentApiKey(lane.auth.provider));
+    if (lane.auth.provider === 'grok-oauth') return hasGrokOAuthCredentials();
+    if (lane.auth.provider === 'openai-oauth') return hasOpenAIOAuthCredentials();
+  } catch {
+    return false;
+  }
+  return false;
+}
+
+function laneKindView(lane, kind) {
+  const spec = lane[kind];
+  if (!spec) return null;
+  const laneControls = spec.controls || {};
+  return {
+    // Each model publishes its EFFECTIVE controls (lane defaults + its own
+    // overrides) so the UI never offers a knob the model rejects.
+    models: spec.models.map((model) => ({
+      id: model.id,
+      label: model.label,
+      controls: JSON.parse(JSON.stringify({ ...laneControls, ...(model.controls || {}) })),
+    })),
+    defaultModel: spec.defaultModel,
+    controls: JSON.parse(JSON.stringify(laneControls)),
+  };
+}
+
+/** Lane catalog with live auth state; the caller filters on `authenticated`. */
+export function listMediaLanes() {
+  return LANES.map((lane) => ({
+    id: lane.id,
+    label: lane.label,
+    authType: lane.auth.type,
+    authProvider: lane.auth.provider,
+    authenticated: laneAuthenticated(lane),
+    kinds: MEDIA_KINDS.filter((kind) => Boolean(lane[kind])),
+    image: laneKindView(lane, 'image'),
+    video: laneKindView(lane, 'video'),
+  }));
+}
+
+export function getMediaLane(laneId) {
+  return LANE_BY_ID.get(String(laneId || '').trim()) || null;
+}
+
+/**
+ * Resolve + validate a generation request against the lane contract. Throws a
+ * coded error rather than letting an unsupported model reach the network.
+ */
+export function resolveMediaRequest({ lane: laneId, kind, model } = {}) {
+  const kindName = String(kind || '').trim();
+  if (!MEDIA_KINDS.includes(kindName)) {
+    throw mediaError(`unsupported media kind "${kindName}"`, 'MEDIA_KIND_UNSUPPORTED');
+  }
+  const lane = getMediaLane(laneId);
+  if (!lane) throw mediaError(`unknown media lane "${laneId}"`, 'MEDIA_LANE_UNKNOWN');
+  const spec = lane[kindName];
+  if (!spec) throw mediaError(`${lane.id} does not support ${kindName}`, 'MEDIA_KIND_UNSUPPORTED');
+  if (!laneAuthenticated(lane)) {
+    throw mediaError(`${lane.label} is not authenticated — sign in from Settings → Providers first`, 'MEDIA_LANE_UNAUTHENTICATED');
+  }
+  const requested = String(model || '').trim() || spec.defaultModel;
+  if (!spec.models.some((entry) => entry.id === requested)) {
+    throw mediaError(`model "${requested}" is not available on ${lane.id}/${kindName}`, 'MEDIA_MODEL_UNSUPPORTED');
+  }
+  return { lane, kind: kindName, model: requested, spec };
+}
+
+export function mediaError(message, code, status = 400) {
+  const err = new Error(message);
+  err.code = code;
+  err.status = status;
+  return err;
+}

package/src/runtime/media/store.mjs

@@ -0,0 +1,164 @@
+/**
+ * On-disk store for generated media.
+ *
+ * Assets live as real files under <data>/media/assets so nothing large is kept
+ * in memory or in a session transcript; index.json holds the metadata list
+ * (newest first) and is written atomically under a file lock because the
+ * desktop and CLI can generate concurrently.
+ */
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, statSync } from 'fs';
+import { join } from 'path';
+import { randomUUID } from 'crypto';
+import { spawn } from 'child_process';
+import { resolvePluginData } from '../shared/plugin-paths.mjs';
+import { writeJsonAtomicSync, withFileLockSync } from '../shared/atomic-file.mjs';
+
+const MAX_INDEX_ENTRIES = 2_000;
+// Renderer transport is base64 over IPC: refuse to inline anything larger.
+const MAX_INLINE_BYTES = 48 * 1024 * 1024;
+
+const EXTENSIONS = {
+  'image/png': 'png',
+  'image/jpeg': 'jpg',
+  'image/webp': 'webp',
+  'video/mp4': 'mp4',
+};
+
+function mediaDir() {
+  return join(resolvePluginData(), 'media');
+}
+
+function assetsDir() {
+  return join(mediaDir(), 'assets');
+}
+
+function indexPath() {
+  return join(mediaDir(), 'index.json');
+}
+
+function indexLockPath() {
+  return `${indexPath()}.lock`;
+}
+
+function ensureDirs() {
+  mkdirSync(assetsDir(), { recursive: true });
+}
+
+function readIndex() {
+  try {
+    const raw = readFileSync(indexPath(), 'utf8');
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed?.assets) ? parsed.assets : [];
+  } catch {
+    return [];
+  }
+}
+
+function writeIndex(assets) {
+  writeJsonAtomicSync(indexPath(), { version: 1, assets });
+}
+
+function extensionFor(mime) {
+  return EXTENSIONS[String(mime || '').toLowerCase()] || 'bin';
+}
+
+/** Persist one generated artifact and return its index entry. */
+export function saveMediaAsset({ kind, lane, model, prompt, options = {}, mime, bytes, meta = {} }) {
+  ensureDirs();
+  const id = randomUUID();
+  const file = `${id}.${extensionFor(mime)}`;
+  writeFileSync(join(assetsDir(), file), bytes);
+  const entry = {
+    id,
+    file,
+    kind,
+    lane,
+    model,
+    prompt: String(prompt || '').slice(0, 4_000),
+    options,
+    mime,
+    bytes: bytes.length,
+    createdAt: Date.now(),
+    ...meta,
+  };
+  withFileLockSync(indexLockPath(), () => {
+    const assets = [entry, ...readIndex()];
+    const kept = assets.slice(0, MAX_INDEX_ENTRIES);
+    for (const dropped of assets.slice(MAX_INDEX_ENTRIES)) {
+      try { unlinkSync(join(assetsDir(), dropped.file)); } catch {}
+    }
+    writeIndex(kept);
+  });
+  return entry;
+}
+
+export function listMediaAssets({ limit = 60, offset = 0, kind = null } = {}) {
+  const all = readIndex().filter((entry) => (kind ? entry.kind === kind : true));
+  const start = Math.max(0, Math.trunc(Number(offset) || 0));
+  const count = Math.min(200, Math.max(1, Math.trunc(Number(limit) || 60)));
+  return { total: all.length, assets: all.slice(start, start + count) };
+}
+
+export function getMediaAsset(id) {
+  return readIndex().find((entry) => entry.id === id) || null;
+}
+
+/** Inline an asset for the renderer (base64 + mime). Large files are refused. */
+export function readMediaAsset(id) {
+  const entry = getMediaAsset(id);
+  if (!entry) return null;
+  const path = join(assetsDir(), entry.file);
+  if (!existsSync(path)) return null;
+  const size = statSync(path).size;
+  if (size > MAX_INLINE_BYTES) {
+    const err = new Error('media asset is too large to preview');
+    err.code = 'MEDIA_ASSET_TOO_LARGE';
+    throw err;
+  }
+  return { ...entry, path, base64: readFileSync(path).toString('base64') };
+}
+
+export function mediaAssetPath(id) {
+  const entry = getMediaAsset(id);
+  return entry ? join(assetsDir(), entry.file) : null;
+}
+
+/**
+ * Hand an asset to the OS viewer. The path is resolved from our own index, so
+ * no caller-supplied path ever reaches the shell.
+ */
+export function openMediaAsset(id) {
+  const path = mediaAssetPath(id);
+  if (!path || !existsSync(path)) return { id, opened: false };
+  return { id, opened: openWithOs(path) };
+}
+
+/** Open the assets directory itself (Studio → folder button). */
+export function openMediaFolder() {
+  ensureDirs();
+  return { path: assetsDir(), opened: openWithOs(assetsDir()) };
+}
+
+function openWithOs(path) {
+  const [command, args] = process.platform === 'win32'
+    ? ['cmd', ['/c', 'start', '', path]]
+    : process.platform === 'darwin'
+      ? ['open', [path]]
+      : ['xdg-open', [path]];
+  const child = spawn(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+  child.unref();
+  return true;
+}
+
+export function deleteMediaAsset(id) {
+  let removed = false;
+  withFileLockSync(indexLockPath(), () => {
+    const assets = readIndex();
+    const entry = assets.find((row) => row.id === id);
+    if (!entry) return;
+    try { unlinkSync(join(assetsDir(), entry.file)); } catch {}
+    writeIndex(assets.filter((row) => row.id !== id));
+    removed = true;
+  });
+  return { id, removed };
+}

package/src/runtime/media/upstream-error.mjs

@@ -0,0 +1,39 @@
+/**
+ * Upstream failure translation for media lanes.
+ *
+ * A credential can be present and still unusable (exhausted credits, billing
+ * caps, per-account gating). Those come back as raw provider JSON, so the lane
+ * maps them to one legible sentence instead of leaking a wall of upstream text
+ * into the Studio.
+ */
+import { mediaError } from './lanes.mjs';
+
+const CREDIT_HINTS = /credit|spending limit|billing|quota|insufficient|payment/i;
+
+function reason(text) {
+  try {
+    const parsed = JSON.parse(text);
+    const message = parsed?.error?.message || parsed?.error || parsed?.message;
+    return typeof message === 'string' ? message : '';
+  } catch {
+    return '';
+  }
+}
+
+/** Build the error a lane throws for a non-OK upstream response. */
+export function upstreamError(label, status, text) {
+  const detail = reason(text) || String(text || '').slice(0, 300);
+  if (status === 401 || status === 403) {
+    if (CREDIT_HINTS.test(detail)) {
+      return mediaError(`${label}: account has no usable balance — ${detail}`, 'MEDIA_BILLING_BLOCKED', status);
+    }
+    return mediaError(`${label}: authentication rejected — sign in again in Settings → Providers`, 'MEDIA_AUTH_REJECTED', status);
+  }
+  if (status === 402 || CREDIT_HINTS.test(detail)) {
+    return mediaError(`${label}: account has no usable balance — ${detail}`, 'MEDIA_BILLING_BLOCKED', status || 402);
+  }
+  if (status === 429) {
+    return mediaError(`${label}: rate limited — retry in a moment`, 'MEDIA_RATE_LIMITED', 429);
+  }
+  return mediaError(`${label} failed (${status})${detail ? `: ${detail}` : ''}`, 'MEDIA_UPSTREAM_FAILED', status);
+}

package/src/session-runtime/channel-config-api.mjs

@@ -17,13 +17,24 @@ import { runScheduleSession } from '../runtime/shared/schedule-session-run.mjs';
 // API object; the mutating admin helpers are imported directly here and the
 // runtime injects only the closure-owned callbacks (backend flush, channel
 // worker handle, soft reload).
-export function createChannelConfigApi({ flushBackendSave, channels, reloadChannelsSoon, ensureAutomationRuntime = () => {} }) {
+export function createChannelConfigApi({
+  flushBackendSave,
+  channels,
+  reloadChannelsSoon,
+  ensureAutomationRuntime = () => {},
+  awaitKeychainPrewarm = async () => {},
+}) {
   return {
     async getChannelSetup() {
       // Flush a pending debounced backend switch first so setup readers
       // (Settings → Channel Setting, remote toggles) never observe the
       // previous backend during the 150ms debounce window.
       try { await flushBackendSave(); } catch {}
+      // Bot tokens live in the OS keychain. Reading them before the batch
+      // prewarm lands costs one SYNCHRONOUS PowerShell DPAPI decrypt each
+      // (measured 971ms + 579ms on a cold desktop boot, blocking the whole
+      // event loop); waiting for the prewarm serves both from its cache.
+      try { await awaitKeychainPrewarm(); } catch {}
       return channelSetup();
     },
     getChannelWorkerStatus() {

package/src/session-runtime/media-api.mjs

@@ -0,0 +1,47 @@
+/**
+ * Media studio API (image / video generation) exposed on the session runtime.
+ *
+ * The media graph (lane catalog, adapters, asset store) is imported on first
+ * use: a session that never opens the Studio must not pay for it at boot.
+ */
+let mediaModule = null;
+
+async function media() {
+  mediaModule ??= await import('../runtime/media/index.mjs');
+  return mediaModule;
+}
+
+export function createMediaApi() {
+  return {
+    async listMediaLanes() {
+      return (await media()).listMediaLanes();
+    },
+    async startMediaJob(input) {
+      return (await media()).startMediaJob(input || {});
+    },
+    async getMediaJob(id) {
+      return (await media()).getMediaJob(id);
+    },
+    async listMediaJobs() {
+      return (await media()).listMediaJobs();
+    },
+    async cancelMediaJob(id) {
+      return (await media()).cancelMediaJob(id);
+    },
+    async listMediaAssets(options) {
+      return (await media()).listMediaAssets(options || {});
+    },
+    async readMediaAsset(id) {
+      return (await media()).readMediaAsset(id);
+    },
+    async deleteMediaAsset(id) {
+      return (await media()).deleteMediaAsset(id);
+    },
+    async openMediaAsset(id) {
+      return (await media()).openMediaAsset(id);
+    },
+    async openMediaFolder() {
+      return (await media()).openMediaFolder();
+    },
+  };
+}