mixdog 1.2.2 → 1.2.4

package/src/runtime/github/tool.mjs

@@ -1,4 +1,4 @@
-import { GITHUB_ACTIONS } from './contract.mjs';
+import { DEFAULT_GITHUB_HOSTNAME, GITHUB_ACTIONS } from './contract.mjs';
 import { executeGithubRequest } from './client.mjs';
 import { GITHUB_OUTPUT_MAX_BYTES } from '../shared/tool-output-limit.mjs';
 import { persistToolResultArtifactSync } from '../agent/orchestrator/session/tool-result-offload.mjs';
@@ -6,19 +6,19 @@ import { normalizeOutputPath } from '../agent/orchestrator/tools/builtin/path-ut
 
 // Model-facing reduction only; executeGithubRequest (also used by Desktop)
 // keeps the raw REST response, and the agent's copy is preserved as `raw`.
-const KEPT_URL_KEYS = new Set([
-  'html_url',
-  'browser_download_url',
-  'diff_url',
-  'patch_url',
-  'clone_url',
-  'ssh_url',
-  'tarball_url',
-  'zipball_url',
-  'target_url',
-  'details_url',
+// html_url is the one page link the model can hand to a user; the asset,
+// status and check links are the only other URLs not derivable from ids.
+const KEPT_URL_KEYS = new Set(['html_url', 'browser_download_url', 'target_url', 'details_url']);
+const DROPPED_KEYS = new Set([
+  'url',
+  'node_id',
+  '_links',
+  'gravatar_id',
+  'performed_via_github_app',
+  'author_association',
+  'sub_issues_summary',
+  'issue_dependencies_summary',
 ]);
-const DROPPED_KEYS = new Set(['node_id', '_links', 'gravatar_id']);
 const USER_KEYS = new Set([
   'user',
   'owner',
@@ -55,12 +55,195 @@ function reduceGithubData(value, key, parentKey) {
   if (isNestedRepository(key, parentKey) && typeof value.full_name === 'string') return value.full_name;
   const reduced = {};
   for (const [name, item] of Object.entries(value)) {
-    if (DROPPED_KEYS.has(name) || (name.endsWith('_url') && !KEPT_URL_KEYS.has(name))) continue;
+    if (DROPPED_KEYS.has(name) || name.endsWith('node_id') || (name.endsWith('_url') && !KEPT_URL_KEYS.has(name))) {
+      continue;
+    }
+    // Numbered objects (issues, PRs, milestones) are addressed by number; their id is noise.
+    if (name === 'id' && typeof value.number === 'number') continue;
+    if (name === 'reactions' && isEmptyReactions(item)) continue;
     reduced[name] = reduceGithubData(item, name, key);
   }
   return reduced;
 }
 
+function isEmptyReactions(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  return Object.values(value).every((item) => typeof item !== 'number' || item === 0);
+}
+
+const EXCERPT_MAX = 140;
+const day = (value) => (typeof value === 'string' ? value.slice(0, 10) : undefined);
+const login = (value) => userLogin(value) ?? (typeof value === 'string' ? value : undefined);
+
+function excerpt(body) {
+  if (typeof body !== 'string') return undefined;
+  const text = body.replace(/\s+/g, ' ').trim();
+  if (!text) return undefined;
+  return text.length > EXCERPT_MAX ? `${text.slice(0, EXCERPT_MAX - 1)}…` : text;
+}
+
+function labelNames(labels) {
+  const names = (Array.isArray(labels) ? labels : [])
+    .map((label) => (typeof label === 'string' ? label : label?.name))
+    .filter(Boolean);
+  return names.length ? names : undefined;
+}
+
+// Compact per-row projections for *.list actions: only what picks the next item
+// to open. Undefined fields are dropped by JSON.stringify.
+const LIST_PROJECTORS = {
+  'issue.list': (item) => ({
+    number: item.number,
+    title: item.title,
+    state: item.state,
+    author: login(item.user),
+    updated: day(item.updated_at),
+    labels: labelNames(item.labels),
+    comments: item.comments || undefined,
+    excerpt: excerpt(item.body),
+  }),
+  'pr.list': (item) => ({
+    number: item.number,
+    title: item.title,
+    state: item.merged_at ? 'merged' : item.state,
+    draft: item.draft || undefined,
+    author: login(item.user),
+    updated: day(item.updated_at),
+    head: item.head?.ref,
+    base: item.base?.ref,
+    labels: labelNames(item.labels),
+    excerpt: excerpt(item.body),
+  }),
+  'repo.list': (item) => ({
+    name: item.full_name,
+    description: excerpt(item.description),
+    visibility: item.visibility || (item.private ? 'private' : 'public'),
+    language: item.language || undefined,
+    fork: item.fork || undefined,
+    archived: item.archived || undefined,
+    updated: day(item.pushed_at || item.updated_at),
+  }),
+  'run.list': (item) => ({
+    id: item.id,
+    name: item.display_title || item.name,
+    workflow: item.name,
+    status: item.status,
+    conclusion: item.conclusion || undefined,
+    branch: item.head_branch,
+    event: item.event,
+    actor: login(item.actor),
+    updated: day(item.updated_at),
+  }),
+  'release.list': (item) => ({
+    id: item.id,
+    tag: item.tag_name,
+    name: item.name || undefined,
+    draft: item.draft || undefined,
+    prerelease: item.prerelease || undefined,
+    author: login(item.author),
+    published: day(item.published_at || item.created_at),
+  }),
+  'notification.list': (item) => ({
+    id: item.id,
+    unread: item.unread,
+    reason: item.reason,
+    type: item.subject?.type,
+    title: item.subject?.title,
+    number: Number(/\/(?:issues|pulls)\/(\d+)$/.exec(item.subject?.url || '')?.[1]) || undefined,
+    repo: typeof item.repository === 'string' ? item.repository : item.repository?.full_name,
+    updated: day(item.updated_at),
+  }),
+  'workflow.list': (item) => ({ id: item.id, name: item.name, path: item.path, state: item.state }),
+};
+
+function projectList(action, data) {
+  const project = LIST_PROJECTORS[action];
+  return project && Array.isArray(data) ? data.map(project) : undefined;
+}
+
+const BODY_MAX = 1500;
+
+function bodyText(body) {
+  if (typeof body !== 'string') return undefined;
+  const text = body.replace(/\r\n/g, '\n').trim();
+  if (!text) return undefined;
+  if (text.length <= BODY_MAX) return text;
+  const cut = /[\ud800-\udbff]/.test(text[BODY_MAX - 1]) ? BODY_MAX - 1 : BODY_MAX;
+  return `${text.slice(0, cut)}… ${text.length - cut} more chars in raw`;
+}
+
+function logins(list) {
+  const names = (Array.isArray(list) ? list : []).map(login).filter(Boolean);
+  return names.length ? names : undefined;
+}
+
+const stamp = (value) => (typeof value === 'string' ? value : undefined);
+const repoName = (repo) => (typeof repo === 'string' ? repo : repo?.full_name);
+
+// Single-item projections: the decision fields of one issue/PR. Nulls that
+// mean "not yet" (open PR closed_at) are dropped; `mergeable`/`mergeable_state`
+// stay as returned because null there means GitHub is still computing.
+const VIEW_PROJECTORS = {
+  'pr.view': (pr) => ({
+    number: pr.number,
+    title: pr.title,
+    state: pr.state,
+    draft: pr.draft,
+    merged: pr.merged,
+    mergeable: pr.mergeable,
+    mergeable_state: pr.mergeable_state,
+    user: login(pr.user),
+    labels: labelNames(pr.labels),
+    assignees: logins(pr.assignees),
+    requested_reviewers: logins(pr.requested_reviewers),
+    head: pr.head && { ref: pr.head.ref, sha: pr.head.sha, repo: repoName(pr.head.repo) },
+    base: pr.base && { ref: pr.base.ref, sha: pr.base.sha },
+    commits: pr.commits,
+    additions: pr.additions,
+    deletions: pr.deletions,
+    changed_files: pr.changed_files,
+    comments: pr.comments,
+    review_comments: pr.review_comments,
+    html_url: pr.html_url,
+    created_at: stamp(pr.created_at),
+    updated_at: stamp(pr.updated_at),
+    closed_at: stamp(pr.closed_at),
+    merged_at: stamp(pr.merged_at),
+    body: bodyText(pr.body),
+  }),
+  'issue.view': (issue) => ({
+    number: issue.number,
+    title: issue.title,
+    state: issue.state,
+    state_reason: issue.state_reason || undefined,
+    user: login(issue.user),
+    labels: labelNames(issue.labels),
+    assignees: logins(issue.assignees),
+    milestone: issue.milestone?.title,
+    comments: issue.comments,
+    html_url: issue.html_url,
+    created_at: stamp(issue.created_at),
+    updated_at: stamp(issue.updated_at),
+    closed_at: stamp(issue.closed_at),
+    body: bodyText(issue.body),
+  }),
+};
+
+function projectView(action, data) {
+  const project = VIEW_PROJECTORS[action];
+  return project && data && typeof data === 'object' && !Array.isArray(data) ? project(data) : undefined;
+}
+
+// Rows whose excerpt/description was shortened ("…") need raw for the rest.
+function rowsWereCut(rows) {
+  return rows.some(
+    (row) =>
+      row &&
+      typeof row === 'object' &&
+      Object.values(row).some((value) => typeof value === 'string' && value.endsWith('…'))
+  );
+}
+
 const fits = (text) => Buffer.byteLength(text, 'utf8') <= GITHUB_OUTPUT_MAX_BYTES;
 
 function clampStrings(value, max) {
@@ -213,7 +396,7 @@ export const GITHUB_TOOL_DEF = {
   },
   trigger: 'GitHub repos, issues, PRs, Actions, releases; not local Git history, diffs or staging (git).',
   description:
-    'GitHub repositories, issues, PRs and reviews, Actions/logs, releases, and notifications through the signed-in GitHub CLI. Local Git history/diffs/staging belong to git. One action per call; writes are serialized and never retried. Obtain user approval before writes; workflow runs and published releases may deploy. repo is owner/name; omit to resolve the current Project. Lists use page/limit. Review/merge requires the current PR head sha. Install/connect in Extensions → Plugin → Git & GitHub. Results omit API-only URLs and node ids and name users/repos by login/full_name; `raw` is a readable file with the full response, and long results state what is shown.',
+    'GitHub repositories, issues, PRs and reviews, Actions/logs, releases, and notifications through the signed-in GitHub CLI. Local Git history/diffs/staging belong to git. One action per call; writes are serialized and never retried. Obtain user approval before writes; workflow runs and published releases may deploy. repo is owner/name; omit to resolve the current Project. Lists use page/limit and return compact rows (issues/PRs: number, title, state, author, updated, labels, 140-char excerpt; other lists: ids and status fields); open a row with its *.view action for bodies and details. Review/merge requires the current PR head sha. Install/connect in Extensions → Plugin → Git & GitHub. Results omit API-only URLs and node ids and name users/repos by login/full_name; issue/PR views keep decision fields and cap the body; `raw`, present whenever rows, text or fields were cut or dropped, is a readable file with the full response, and long results state what is shown.',
   inputSchema: {
     type: 'object',
     properties: {
@@ -267,9 +450,17 @@ export const GITHUB_TOOL_DEF = {
 export async function executeGithubTool(args, cwd, options = {}) {
   try {
     const result = await executeGithubRequest(args, cwd, options);
-    const reduced = { ...result, data: reduceGithubData(result.data) };
+    const data =
+      projectList(args.action, result.data) ?? projectView(args.action, result.data) ?? reduceGithubData(result.data);
+    const reduced = { ...result, data };
+    if (reduced.hostname === DEFAULT_GITHUB_HOSTNAME) delete reduced.hostname;
     const text = JSON.stringify(reduced);
-    if (text === JSON.stringify(result) && fits(text)) return text;
+    // Lists point at raw only when a row or excerpt was cut; they are projected
+    // by design. Everything else needs raw whenever the reduction dropped data.
+    const lossy = GITHUB_ACTIONS[args.action]?.list
+      ? Array.isArray(data) && rowsWereCut(data)
+      : JSON.stringify(data) !== JSON.stringify(result.data);
+    if (!lossy && fits(text)) return text;
     const raw = persistToolResultArtifactSync({
       sessionId: options.sessionId,
       toolCallId: options.toolCallId,

package/src/runtime/media/adapters/codex-image.mjs

@@ -1,17 +1,27 @@
 /**
  * ChatGPT OAuth image adapter (`openai-oauth` lane).
  *
- * Runs the hosted `image_generation` tool on the Codex responses backend — the
- * same endpoint/headers the chat provider uses, so the subscription session is
- * the only credential involved. The final image arrives as base64 on the
- * image_generation_call item; partial frames are kept as a fallback.
+ * Primary path: the subscription's Images endpoints on the Codex backend
+ * (`images/generations`, or `images/edits` when reference images are given),
+ * a plain JSON request answered with the finished image as base64.
+ *
+ * Fallback path, used only when those endpoints are not served (404/405/501,
+ * or the edge's HTML 403 for an unknown route): the hosted `image_generation`
+ * tool on the responses backend. Its final image arrives on the
+ * image_generation_call item; a stream that only produced partial preview
+ * frames fails instead of saving a draft as the result.
+ *
+ * Both paths use the chat provider's session, so the subscription login is the
+ * only credential involved. Usage-limit failures name the reset time, looked up
+ * from the account's usage summary when the failure itself omits it.
  */
 import { randomBytes } from 'node:crypto';
 import { resolveCodexAuth } from '../auth.mjs';
 import { timeoutSignal } from '../bounded-signal.mjs';
+import { chatgptLimitResetAt } from '../chatgpt-usage.mjs';
 import { decodeBase64Media } from '../download.mjs';
 import { mediaError } from '../lanes.mjs';
-import { upstreamError } from '../upstream-error.mjs';
+import { upstreamError, usageLimitError, usageLimitFromResponse, usageLimitInfo } from '../upstream-error.mjs';
 import { responsesUsage, withReportedUsage } from '../media-usage.mjs';
 import { CODEX_OAUTH_ORIGINATOR, CODEX_RESPONSES_URL } from '../../agent/orchestrator/providers/openai-oauth.mjs';
 import {
@@ -21,6 +31,13 @@ import {
 } from '../../agent/orchestrator/providers/codex-client-meta.mjs';
 
 const REQUEST_TIMEOUT_MS = 400_000;
+const LABEL = 'ChatGPT image';
+export const CODEX_IMAGE_MODEL = 'gpt-image-2';
+export const CODEX_IMAGES_GENERATIONS_URL = new URL('images/generations', CODEX_RESPONSES_URL).href;
+export const CODEX_IMAGES_EDITS_URL = new URL('images/edits', CODEX_RESPONSES_URL).href;
+const BACKGROUNDS = new Set(['transparent', 'opaque', 'auto']);
+
+const dataUrl = (ref) => `data:${ref.mime || 'image/png'};base64,${ref.base64}`;
 
 function imageTool(options = {}) {
   const tool = { type: 'image_generation' };
@@ -28,9 +45,91 @@ function imageTool(options = {}) {
   if (size && size !== 'auto') tool.size = size;
   const quality = String(options.quality || 'auto');
   if (quality && quality !== 'auto') tool.quality = quality;
+  if (options.background && options.background !== 'auto') tool.background = options.background;
   return tool;
 }
 
+/** Images endpoint request: generation, or an edit when references are given. */
+export function codexImagesRequest({ prompt, options = {}, references = [] }) {
+  const body = { prompt, model: CODEX_IMAGE_MODEL, size: 'auto', quality: 'auto' };
+  if (options.background) body.background = options.background;
+  if (!references.length) return { url: CODEX_IMAGES_GENERATIONS_URL, body };
+  return {
+    url: CODEX_IMAGES_EDITS_URL,
+    body: { images: references.map((ref) => ({ image_url: dataUrl(ref) })), ...body },
+  };
+}
+
+export function codexImagesRequestHeaders(auth) {
+  const headers = {
+    Authorization: `Bearer ${auth.access_token}`,
+    'Content-Type': 'application/json',
+    Accept: 'application/json',
+    originator: CODEX_OAUTH_ORIGINATOR,
+    'x-client-request-id': randomBytes(16).toString('hex'),
+    version: codexVersionHeader(),
+    'User-Agent': codexUserAgent(),
+  };
+  if (auth.account_id) headers['ChatGPT-Account-ID'] = auth.account_id;
+  return headers;
+}
+
+// The endpoint is not served for this backend: a missing route or method, or
+// the edge's HTML 403 page that unknown backend routes answer with. Auth,
+// billing and limit failures come back as JSON and are reported, not retried.
+function imagesEndpointUnavailable(res) {
+  if ([404, 405, 501].includes(res.status)) return true;
+  return res.status === 403 && !/json/i.test(res.headers.get('content-type') || '');
+}
+
+function imagesUsage(usage) {
+  const tokens = responsesUsage(usage);
+  const imageTokens = Math.trunc(Number(usage?.output_tokens_details?.image_tokens) || 0);
+  return imageTokens > 0 ? { ...tokens, outputImageTokens: imageTokens } : tokens;
+}
+
+async function limitError(limit, { auth, fetchFn, lookupReset, signal }) {
+  const resetsAt = limit.resetsAt || (await lookupReset({ auth, limitId: limit.limitId, fetchFn, signal }));
+  return usageLimitError(LABEL, { limitId: limit.limitId, resetsAt });
+}
+
+async function failedResponse(res, ctx) {
+  const text = await res.text().catch(() => '');
+  const limit = usageLimitFromResponse(res.status, text, res.headers);
+  if (limit) return await limitError(limit, ctx);
+  return upstreamError(LABEL, res.status, text);
+}
+
+/** Returns the image, or null when the Images endpoint is unavailable. */
+async function generateViaImagesEndpoint({ prompt, options, references, signal }, ctx) {
+  const { url, body } = codexImagesRequest({ prompt, options, references });
+  const res = await ctx.fetchFn(url, {
+    method: 'POST',
+    headers: codexImagesRequestHeaders(ctx.auth),
+    body: JSON.stringify(body),
+    redirect: 'error',
+    signal: timeoutSignal(signal, REQUEST_TIMEOUT_MS),
+  });
+  if (imagesEndpointUnavailable(res)) {
+    await res.body?.cancel().catch(() => {});
+    return null;
+  }
+  if (!res.ok) throw await failedResponse(res, ctx);
+  const json = await res.json().catch(() => null);
+  const usage = imagesUsage(json?.usage);
+  const b64 = json?.data?.[0]?.b64_json;
+  if (typeof b64 !== 'string' || !b64) {
+    throw withReportedUsage(mediaError(`${LABEL}: returned no image data`, 'MEDIA_EMPTY_RESULT', 502), usage);
+  }
+  return {
+    bytes: decodeBase64Media(b64, LABEL),
+    mime: 'image/png',
+    revisedPrompt: null,
+    actualModel: CODEX_IMAGE_MODEL,
+    usage: usage || null,
+  };
+}
+
 function collectImage(event, state) {
   const item = event?.item;
   // Terminal Responses events carry the orchestrator's token usage. It does
@@ -55,10 +154,7 @@ export function codexImageRequestBody({ model, prompt, options = {}, references
   // Reference images ride as input_image parts on the user turn — the same
   // shape the chat path uses for pasted images.
   const content = [
-    ...references.map((ref) => ({
-      type: 'input_image',
-      image_url: `data:${ref.mime || 'image/png'};base64,${ref.base64}`,
-    })),
+    ...references.map((ref) => ({ type: 'input_image', image_url: dataUrl(ref) })),
     { type: 'input_text', text: prompt },
   ];
   return {
@@ -91,7 +187,12 @@ export function codexImageRequestHeaders(auth) {
 
 export async function generateImage(
   { model, prompt, options = {}, references = [], signal },
-  { fetchFn = fetch, resolveAuth = resolveCodexAuth, warmVersion = warmCodexClientVersion } = {}
+  {
+    fetchFn = fetch,
+    resolveAuth = resolveCodexAuth,
+    warmVersion = warmCodexClientVersion,
+    lookupReset = chatgptLimitResetAt,
+  } = {}
 ) {
   if (['size', 'quality', 'resolution', 'aspectRatio'].some((key) => options[key] && options[key] !== 'auto')) {
     throw mediaError(
@@ -99,19 +200,28 @@ export async function generateImage(
       'MEDIA_OPTION_UNSUPPORTED'
     );
   }
+  if (options.background && !BACKGROUNDS.has(options.background)) {
+    throw mediaError('background must be transparent, opaque or auto.', 'MEDIA_OPTION_UNSUPPORTED');
+  }
   const auth = await resolveAuth();
   // Discovery and generation must report the same client version; otherwise
   // a newly discovered model can still be rejected by the Codex version gate.
   await warmVersion();
+  const ctx = { auth, fetchFn, lookupReset, signal };
+  const image = await generateViaImagesEndpoint({ prompt, options, references, signal }, ctx);
+  return image || (await generateViaResponses({ model, prompt, options, references, signal }, ctx));
+}
+
+async function generateViaResponses({ model, prompt, options, references, signal }, ctx) {
   const body = codexImageRequestBody({ model, prompt, options, references });
-  const res = await fetchFn(CODEX_RESPONSES_URL, {
+  const res = await ctx.fetchFn(CODEX_RESPONSES_URL, {
     method: 'POST',
-    headers: codexImageRequestHeaders(auth),
+    headers: codexImageRequestHeaders(ctx.auth),
     body: JSON.stringify(body),
     redirect: 'error',
     signal: timeoutSignal(signal, REQUEST_TIMEOUT_MS),
   });
-  if (!res.ok || !res.body) throw upstreamError('ChatGPT image', res.status, await res.text().catch(() => ''));
+  if (!res.ok || !res.body) throw await failedResponse(res, ctx);
 
   const reader = res.body.getReader();
   const decoder = new TextDecoder();
@@ -136,7 +246,8 @@ export async function generateImage(
           continue;
         }
         if (event?.type === 'response.failed' || event?.type === 'error') {
-          failure = event?.response?.error?.message || event?.message || 'stream failed';
+          // A top-level `error` event carries code/type/resets_at on itself.
+          failure = event?.response?.error || event?.error || event;
         }
         collectImage(event, state);
       }
@@ -147,15 +258,23 @@ export async function generateImage(
     } catch {}
   }
 
-  const b64 = state.final || state.partial;
-  if (!b64) {
-    throw withReportedUsage(
-      mediaError(`ChatGPT returned no image data${failure ? `: ${failure}` : ''}`, 'MEDIA_EMPTY_RESULT', 502),
-      state.usage
-    );
+  if (!state.final) {
+    const limit = failure && usageLimitInfo(failure, res.headers);
+    if (limit) throw withReportedUsage(await limitError(limit, ctx), state.usage);
+    const reason = (typeof failure === 'string' ? failure : failure?.message) || 'stream failed';
+    // A partial frame is a low-fidelity preview of an unfinished render; it is
+    // never saved as the result.
+    const error = state.partial
+      ? mediaError(
+          `${LABEL}: generation stopped after a partial preview; no final image was produced${failure ? ` (${reason})` : ''}`,
+          'MEDIA_PARTIAL_ONLY',
+          502
+        )
+      : mediaError(`ChatGPT returned no image data${failure ? `: ${reason}` : ''}`, 'MEDIA_EMPTY_RESULT', 502);
+    throw withReportedUsage(error, state.usage);
   }
   return {
-    bytes: decodeBase64Media(b64, 'ChatGPT image'),
+    bytes: decodeBase64Media(state.final, LABEL),
     mime: 'image/png',
     revisedPrompt: state.revisedPrompt,
     actualModel: state.actualModel || null,

package/src/runtime/media/catalog.mjs

@@ -145,12 +145,12 @@ export function projectMediaModels(lane, rows) {
     result.image = orchestrator
       ? [
           {
-            id: 'chatgpt-image-auto',
-            label: 'ChatGPT Image · Auto',
+            id: 'gpt-image-2',
+            label: 'GPT Image 2',
             description:
-              'ChatGPT selects the image engine. GPT Image 2.5 selection and output size/quality are not verified on this connection.',
+              'ChatGPT image engine. Output size/quality are chosen by ChatGPT; background can be transparent.',
             requestModel: orchestrator.id,
-            controls: { maxReferences: 5 },
+            controls: { maxReferences: 5, background: ['auto', 'transparent', 'opaque'] },
           },
         ]
       : [];

package/src/runtime/media/chatgpt-usage.mjs

@@ -0,0 +1,55 @@
+/**
+ * ChatGPT subscription usage lookup.
+ *
+ * A usage-limit failure does not always say when the window reopens. The
+ * account's usage summary does: each metered limit lists its windows with
+ * `used_percent` and an epoch `reset_at`.
+ */
+import { timeoutSignal } from './bounded-signal.mjs';
+import { codexUserAgent } from '../agent/orchestrator/providers/codex-client-meta.mjs';
+
+export const CHATGPT_USAGE_URL = 'https://chatgpt.com/backend-api/wham/usage';
+const LOOKUP_TIMEOUT_MS = 10_000;
+
+function exhaustedResetAt(rateLimit) {
+  if (!rateLimit || typeof rateLimit !== 'object') return null;
+  const windows = [rateLimit.primary_window, rateLimit.secondary_window].filter((w) => Number(w?.reset_at) > 0);
+  const full = windows.filter((w) => Number(w.used_percent) >= 100);
+  const candidates = full.length ? full : rateLimit.limit_reached ? windows : [];
+  return candidates.length ? Math.max(...candidates.map((w) => Math.trunc(Number(w.reset_at)))) : null;
+}
+
+/**
+ * Reset time (epoch seconds) of the exhausted limit in a usage summary. The
+ * limit named `limitId` wins; an image limit is next; the account's main
+ * window is last.
+ */
+export function limitResetFromUsage(payload, limitId = '') {
+  const extra = Array.isArray(payload?.additional_rate_limits) ? payload.additional_rate_limits : [];
+  const id = String(limitId).toLowerCase();
+  const names = (entry) => [entry?.metered_feature, entry?.limit_name].map((name) => String(name || '').toLowerCase());
+  const named =
+    (id && extra.find((entry) => names(entry).includes(id))) ||
+    extra.find((entry) => names(entry).some((name) => name.includes('image')));
+  return exhaustedResetAt(named ? named.rate_limit : payload?.rate_limit);
+}
+
+/**
+ * Look the reset time up for the signed-in account. A failed lookup yields
+ * null: the caller still reports the limit, just without a time.
+ */
+export async function chatgptLimitResetAt({ auth, limitId = '', fetchFn = fetch, signal } = {}) {
+  try {
+    const headers = { Authorization: `Bearer ${auth.access_token}`, 'User-Agent': codexUserAgent() };
+    if (auth.account_id) headers['ChatGPT-Account-Id'] = auth.account_id;
+    const res = await fetchFn(CHATGPT_USAGE_URL, {
+      headers,
+      redirect: 'error',
+      signal: timeoutSignal(signal, LOOKUP_TIMEOUT_MS),
+    });
+    if (!res.ok) return null;
+    return limitResetFromUsage(await res.json(), limitId);
+  } catch {
+    return null;
+  }
+}

package/src/runtime/media/defaults.mjs

@@ -41,6 +41,43 @@ export function getMediaDefault(kind) {
   return lane ? { kind: key, lane, model: text(row?.model) } : null;
 }
 
+// Settings → Built-in → Media generation. Unlike the remembered selection above
+// (rewritten by every generation), a pin is only ever written by the user:
+// `{ lane, model, account }` per kind, where an empty model is the lane default
+// and an empty account follows that provider's currently selected account.
+const PINNED = 'pinned';
+
+function readPins() {
+  const pins = readAll()[PINNED];
+  return pins && typeof pins === 'object' && !Array.isArray(pins) ? pins : {};
+}
+
+/** `{ kind, lane, model, account }` for the kind, or null when it is on auto. */
+export function getMediaPin(kind) {
+  const key = text(kind);
+  if (!MEDIA_KINDS.includes(key)) return null;
+  const row = readPins()[key];
+  const lane = text(row?.lane);
+  return lane ? { kind: key, lane, model: text(row?.model), account: text(row?.account) } : null;
+}
+
+export function getMediaPins() {
+  return Object.fromEntries(MEDIA_KINDS.map((kind) => [kind, getMediaPin(kind)]));
+}
+
+/** Pin one kind to a lane/model/account; an empty `lane` returns it to auto. */
+export function setMediaPin({ kind, lane, model, account } = {}) {
+  const key = text(kind);
+  if (!MEDIA_KINDS.includes(key)) throw new TypeError(`kind must be one of ${MEDIA_KINDS.join(', ')}`);
+  const laneId = text(lane);
+  const { [key]: _previous, ...others } = readPins();
+  const pins = laneId ? { ...others, [key]: { lane: laneId, model: text(model), account: text(account) } } : others;
+  const path = defaultsPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeJsonAtomicSync(path, { ...readAll(), [PINNED]: pins });
+  return getMediaPin(key);
+}
+
 /** Remember the lane (and model) for one kind. `model` may be empty: the lane default then applies. */
 export function setMediaDefault({ kind, lane, model } = {}) {
   const key = text(kind);

package/src/runtime/media/jobs.mjs

@@ -8,7 +8,8 @@
  */
 import { randomUUID } from 'node:crypto';
 import { MAX_GENERATED_MEDIA_BYTES } from './download.mjs';
-import { mediaError, resolveMediaRequest } from './lanes.mjs';
+import { mediaError, mediaLaneAccountProvider, resolveMediaRequest } from './lanes.mjs';
+import { withProviderAccount } from '../shared/provider-auth-binding.mjs';
 import { saveMediaAsset } from './store.mjs';
 import { setMediaDefault } from './defaults.mjs';
 import { recordMediaUsage } from './media-usage.mjs';
@@ -77,8 +78,17 @@ async function runAdapter({ lane, kind, model, requestModel, prompt, options, re
 /**
  * Validate + start one generation. Returns the initial snapshot immediately;
  * the caller polls getMediaJob for progress and the finished asset id.
+ * `account` runs the whole job (catalog check, credentials, adapter) as that
+ * connected account of the lane's provider, whatever the chat is using; an
+ * account that cannot serve the call fails it, never another account.
  */
-export async function startMediaJob({
+export async function startMediaJob(input = {}) {
+  const account = String(input?.account || '').trim();
+  const provider = account ? mediaLaneAccountProvider(input.lane) : '';
+  return provider ? withProviderAccount(provider, account, () => beginMediaJob(input)) : beginMediaJob(input);
+}
+
+async function beginMediaJob({
   lane: laneId,
   kind,
   model,