pi-roundtable 0.18.0 → 0.19.1

package/CHANGELOG.md

@@ -5,6 +5,24 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.19.1] - 2026-10-18
+
+### Fixed
+
+- The core's tests no longer depend on the host's `mktemp` or on a free-port probe. The check that the agents' `bash` writes into the scratch dir ran a bare `mktemp`, which macOS's BSD `mktemp` sends to the user temp dir whatever `TMPDIR` says; it now runs `mktemp -p "$TMPDIR"`, which both implementations honour, and the bare `mktemp` is held to the scratch dir only where GNU `mktemp` is the default. The listener tests found a free port by opening one and closing it, and another process could take it before the listener bound it (`EADDRINUSE`); they now let the listener bind port 0 and ask which port it got.
+- The docs say what the scratch dir promises: the agents' shell runs with `TMPDIR` pointing to it, so tools that read `TMPDIR` and GNU `mktemp` write there, while macOS's BSD `mktemp` ignores `TMPDIR` for a bare `mktemp` and needs `mktemp -p "$TMPDIR"`. The agents' prompt is unchanged: it already sends temporary files to `$TMPDIR` and never asks for a bare `mktemp`.
+
+## [0.19.0] - 2026-10-17
+
+### Added
+
+- `drawCodexImage`, `createCodexImages`, `ImageNotGeneratedError`, `CODEX_IMAGE_MODEL`, `CODEX_IMAGES_PROVIDER`, `CodexImage`, `CodexImageRequest`, `CodexImagesOptions` and `CodexFetch` (`pi-roundtable/kit`): the Codex image client and the `codex-images` plugin built on it, so a project imports one implementation instead of copying one. `drawCodexImage({ token, prompt, references?, model?, signal?, fetch? })` draws one image through ChatGPT's Codex backend and returns `{ data, revisedPrompt? }`, `data` being PNG bytes and `revisedPrompt` the prompt Codex says it drew. It aborts with `signal`, both before the response arrives and while its stream is read, and rejects with the signal's own reason, so a turn's `signal?.throwIfAborted()` still sees its own abort; it stops after five minutes with a `TimeoutError`, refuses a stream over 32 MiB (`Codex image response too large`), and reads only the first image. A call that ran and returned no image, and a completed response with no image at all, both throw `ImageNotGeneratedError`: asking again with the same prompt fails again. `createCodexImages({ fetch?, model?, onMissingLogin? })` is the plugin `codex-images`: it fills `providers.images`, reads the `openai-codex` login through `context.apiKey` for each drawing, and passes the drawing's `options.signal` on, so the turn that asked for an image can abort it. `CODEX_IMAGES_PROVIDER` is `"openai-codex"` and `CODEX_IMAGE_MODEL` is `"gpt-6-sol"`, the model that routes the request. The backend is ChatGPT's own, signed in with the owner's ChatGPT subscription, and OpenAI does not document it for this use: it can stop working without notice, and OpenAI's terms for the subscription apply.
+- `jevJudge` and `JevJudgeOptions` (`pi-roundtable/kit`): a `Judge` over Jev's hosted service, built on pi-jev-compaction's client (no new dependency), for the `judge` provider. `jevJudge({ apiKey, model?, baseUrl?, timeoutMs?, fetch? })` sends each question as one request: a yes-or-no question as Jev's own question type, a choice answer checked against the options listed, and a score read by criterion index, every probability a number from 0 to 1. Every failure throws a `JudgeError`. A question has its own limit of `timeoutMs` (default 20,000) that also covers reading the answer. An empty or blank `apiKey` throws a `JudgeError` when the judge is made, because the client would otherwise use the key in the environment.
+
+### Changed
+
+- The `codex-images` template (`roundtable add plugin codex-images`) is now a short file that imports its client and plugin from `pi-roundtable/kit` (`createCodexImages`, built on `drawCodexImage`) and makes the `codexImages` plugin your config lists, under the same warning head and still exporting `createCodexImages`, `ImageNotGeneratedError`, `CodexFetch` and `CodexImagesOptions`. Its `images` provider now aborts with the turn that asked (it ignored the `signal` the core's `generate_image` tool hands to a drawer), and it refuses a response stream over 32 MiB; a PNG of about 12 MiB, which the completed event may repeat, can be refused. Its copied test gains one that aborts a drawing through `options.signal`. A plugin already copied is unchanged until it is copied again.
+
 ## [0.18.0] - 2026-10-17
 
 ### Added

package/docs/plugins.md

@@ -63,6 +63,12 @@ Use the kit's building blocks for a plugin that runs Pi itself, such as a coding
 - Square pictures: `squarePng(bytes, { size?, maxBytes?, maxSide? })` crops a PNG, JPEG or GIF to its centered square and scales it down to at most `size` pixels per side (default 512; a smaller picture is not enlarged), as PNG: the helper the agent avatars are made with, for a plugin that needs a profile picture or an icon.
   The header is read first, and nothing is decoded for a picture that declares a width or height over `SQUARE_PNG_MAX_SIDE` (4096), which rejects with `ImagePreparationError` (`pixel-limit`, the message naming the side limit; `maxSide` sets another limit, and the 64 MP decoded-pixel budget always applies), or for bytes of no such type, a WebP (the canvas cannot decode it) or a picture that fails to decode (`invalid-image`).
   With `maxBytes` the side steps down by a quarter at a time until the PNG is no larger; a picture that does not fit even at 16 pixels throws a `RangeError`, as does a `size` or `maxBytes` that is not a whole number in range. `SquarePngOptions` types the options.
+- Codex images: `drawCodexImage({ token, prompt, references?, model?, signal?, fetch? })` draws one image through ChatGPT's Codex backend with the owner's `openai-codex` login (`CODEX_IMAGES_PROVIDER`) and returns `{ data, revisedPrompt? }`: `data` is PNG bytes, and `revisedPrompt` is the prompt Codex says it drew, when it says. `model` defaults to `CODEX_IMAGE_MODEL` (`gpt-6-sol`), which only routes the request; the backend picks the image model. `fetch` is a `CodexFetch`, which `typeof fetch` satisfies, for tests.
+  The call aborts with `signal`, before the response arrives and while its stream is read, and rejects with the signal's own reason, so a turn's `signal?.throwIfAborted()` still sees its own abort. It stops after five minutes with a `TimeoutError`, refuses a stream over 32 MiB (`Codex image response too large`; the completed event may repeat the image, so a PNG of about 12 MiB can be refused), and reads only the first image. An HTTP error carries its status and the first 300 characters of the body, never the token.
+  A call that ran and returned no image, and a response that completed without one, both throw `ImageNotGeneratedError`, usually because Codex refused the prompt; asking again with the same prompt fails again.
+  `createCodexImages({ fetch?, model?, onMissingLogin? })` is the `codex-images` plugin built on it. It fills the `images` provider, reads the login through `context.apiKey` for each drawing (the login refreshes), and passes the drawing's `options.signal` on, so the turn that asked for an image can abort it. Without a login, setup throws a `PluginError`; `onMissingLogin: "warn"` logs once and lets the host start, and a drawing then fails with the same `PluginError`. The kit exports no ready-made plugin object, because a plugin object shared between `check()` and `run()` should come from your own module; the `codex-images` template makes one.
+  The types are `CodexFetch`, `CodexImage`, `CodexImageRequest` and `CodexImagesOptions`.
+  This uses ChatGPT's Codex backend, signed in with the owner's ChatGPT subscription. OpenAI does not document it for this use, so it can stop working without notice, and OpenAI's terms for the subscription apply.
 - Work: `promptSlot` (how a run asks the owner while it works), `workTimeout` (a time limit that does not count the time spent waiting on the owner), `runWorkerTask`, `archiveSessions`, and `approvalCard`, `approvalDetails` and `canonicalJson` for the cards of held actions.
   `InterimPoster(posts, { logger, channel, primaryChars?, editMs? })` posts a run's [interim text](#interim-text-what-a-turn-writes-before-its-final-answer) to an `InterimPosts`, such as a dispatch thread's `interim`: feed it `messageEnd(message)` and `toolStart(name)` from the session's events, bind `() => poster.flush()` as the slot's `beforeCard`, and `await poster.flush()` before the final report.
 - Diagnostics: `scrubDiagnostic(text, max = 600)` masks credentials (URL userinfo, token shapes, secret-named assignments and JSON fields, `Authorization`/`Cookie`/`x-api-key` headers, JWTs, PEM blocks), turns control characters other than tab and newline into spaces, and cuts the result at `max` characters.
@@ -80,6 +86,9 @@ Use the kit's building blocks for a plugin that runs Pi itself, such as a coding
   Two adapters log each skip as `Jev leaves the compaction to Pi's summary` with `reason`, `detail` and `tokensBefore` through the `logger` they take: `jevCompactionExtension({ logger, ...options })`, the `compaction` session tool's extension, placed as `session.compaction.wrap(jevCompactionExtension({ logger }))` under the engine `JEV_COMPACTION_ENGINE` (`pi-jev-compaction`), and `jevCompactor({ logger, ...options })`, a `JevCompactor` for pi-roundtable-sandbox's `compaction` option that returns the compaction or `undefined` and logs with the `channel`.
   A `no_key` skip is logged once per adapter, as `Jev is not configured, so compaction uses Pi's summary`, and then not again; every other skip is logged each time.
   The types are `JevCompactInput`, `JevCompactOptions`, `JevCompactOutcome`, `JevCompactor`, `JevCompactRequest`, `JevExtensionOptions` and `JevSkipReason`.
+- Jev judge: `jevJudge({ apiKey, model?, baseUrl?, timeoutMs?, fetch? })` is a `Judge` (the `judge` provider) that asks Jev, built on pi-jev-compaction's client. Each question is one request: a yes-or-no question goes out as Jev's own question type and its probability is read from Jev's answer, a choice question's answer must be one of the options you listed, and a score question's probabilities are read by criterion index, so a missing index is an error. Probabilities must be numbers from 0 to 1.
+  Every failure throws a `JudgeError`: a failed request, an answer that is missing or malformed, a choice that is not an option, and a question that outlasts `timeoutMs` (default 20,000, a limit of its own for each question that also covers reading the answer), as `Jev did not answer within <n> ms`.
+  The `apiKey` is required, and an empty or blank one throws a `JudgeError` when `jevJudge` is called, because pi-jev-compaction's client would otherwise fall back to the key in the environment. `baseUrl` and `model` default to pi-jev-compaction's; `fetch` replaces the request function, for tests. The option type is `JevJudgeOptions`.
 - Effort: `effortJudge` picks a turn's thinking level from a message with your own brief (`EffortBrief`, `JUDGE_WORK`). A host that wants other turns decided differently sets `effortPolicy` (an `EffortPolicy`) in its configuration: it gets the turn's `channel`, `kind`, `agent` and `origin` and answers `{ fixed: level }` (no judge call), `{ requiredMass: [0, medium, high, xhigh] }` (the highest level whose share of the judge's answer at or above it meets its entry; the previous level does not carry over and a failed judge gives low), or `undefined` for the default. The `kind` of an agent-server agent's turn is `"agent"`; a policy that throws, or a `requiredMass` that is not four finite numbers in [0, 1], fails the turn.
 - Presentation and small helpers: `thinkingLine`, `zonedStamp(date, timeZone)`, `channelQueue()` (a queue of your own, so work does not wait behind a running turn), `checkRepoName` and `SKILL_LIST_TOOL` with `skillListExtension` for repositories and skills, and `searchTerms` for memory search.
 
@@ -909,7 +918,7 @@ defineTool({
 
 `shellHoldRule` in `pi-roundtable/kit` judges the agents' `bash`, `write` and `edit` calls; the agent server links it, and a session without a workspace has no shell.
 Its scratch roots are the shared workspace (`HoldContext.workspace`) and the scratch dir (`HoldContext.scratchDir`).
-The scratch dir is the config's `scratchDir`, by default `<os temp dir>/<discord.rootCommand>-scratch` (such as `/tmp/roundtable-scratch`); the agent server creates it with mode 0700 at startup and refuses one that is a symlink or another user's, and the agents' `bash` runs with `TMPDIR` pointing to it, so `mktemp` and tools write there.
+The scratch dir is the config's `scratchDir`, by default `<os temp dir>/<discord.rootCommand>-scratch` (such as `/tmp/roundtable-scratch`); the agent server creates it with mode 0700 at startup and refuses one that is a symlink or another user's, and the agents' `bash` runs with `TMPDIR` pointing to it, so tools that read `TMPDIR` and GNU `mktemp` write there. macOS's BSD `mktemp` ignores `TMPDIR` for a bare `mktemp`; `mktemp -p "$TMPDIR"` works with both.
 `AgentSessions.scratchDir` carries it to a runtime, and the agents' prompt tells them to write temporary files there, and to show a file with `attach_file` or a `discord_send_message` file `path` rather than reading an image or base64-encoding it.
 
 - A `>`, `>>` or `tee` target, and a `write` or `edit` path, inside a scratch root run; anything else, the rest of `/tmp` included, is held.
@@ -1397,7 +1406,7 @@ When no `images` provider is configured, `agent_create` has no `avatar_prompt` p
 The owner's profile panel reports the missing provider and offers no redraw option.
 Each agent gets a picture generated from its display name and the assistant's icon, so you can tell agents apart.
 `bunx roundtable doctor` reports whether the slot is filled.
-The copy-in [`codex-images` provider template][codex-images-template] is a complete implementation of the `images` slot.
+The copy-in [`codex-images` provider template][codex-images-template] fills the `images` slot with `createCodexImages` from `pi-roundtable/kit`, which also exports the client it is built on, `drawCodexImage`.
 
 <!-- example: examples/providers.ts -->
 ```ts
@@ -3160,6 +3169,10 @@ Install only the packages your host uses; the core does not depend on these work
 It sends requests to ChatGPT's Codex backend using the owner's ChatGPT subscription login.
 OpenAI doesn't document the backend for this use, so it can stop working without notice; the subscription's terms apply.
 The copied file begins with this warning.
+Its client and plugin come from `pi-roundtable/kit` (`createCodexImages`, built on `drawCodexImage`): the copied `plugins/codex-images.ts` imports them and makes the plugin you list, so a fix to the protocol arrives with an upgrade of the package, not with a new copy.
+A drawing aborts with the turn that asked for it, a request stops after five minutes, and a response stream over 32 MiB is refused.
+A copy made before 0.19.0 holds the whole client and keeps working as it was, without the abort and the stream limit, until you copy the template again.
+To change the model, pass `createCodexImages({ model })`; the default is `CODEX_IMAGE_MODEL`.
 
 `release-notice` listens to two [events](#events-hear-what-the-core-does).
 When the agent server's team service reports `ready`, it reads the release file and posts if the release's `sha` differs from the one it last announced (`announced-release` in the data directory), or if the previous shutdown cut work short.
@@ -3947,12 +3960,18 @@ Import from the entries listed below; source area files are internal.
 | `AgentTurnRunner` | `pi-roundtable/kit` | type |
 | `AssistantLike` | `pi-roundtable/kit` | type |
 | `Backlog` | `pi-roundtable/kit` | type |
+| `CODEX_IMAGES_PROVIDER` | `pi-roundtable/kit` | value |
+| `CODEX_IMAGE_MODEL` | `pi-roundtable/kit` | value |
 | `CardLimits` | `pi-roundtable/kit` | type |
 | `CategoryLayout` | `pi-roundtable/kit` | type |
 | `ChannelMessage` | `pi-roundtable/kit` | type |
 | `ChannelQueue` | `pi-roundtable/kit` | type |
 | `ChoiceAnswer` | `pi-roundtable/kit` | type |
 | `ChoiceQuestion` | `pi-roundtable/kit` | type |
+| `CodexFetch` | `pi-roundtable/kit` | type |
+| `CodexImage` | `pi-roundtable/kit` | type |
+| `CodexImageRequest` | `pi-roundtable/kit` | type |
+| `CodexImagesOptions` | `pi-roundtable/kit` | type |
 | `DELEGATE_TOOL` | `pi-roundtable/kit` | value |
 | `DELEGATE_TOOL_SPEC` | `pi-roundtable/kit` | value |
 | `DashboardBoard` | `pi-roundtable/kit` | type |
@@ -3968,7 +3987,9 @@ Import from the entries listed below; source area files are internal.
 | `EffortRequest` | `pi-roundtable/kit` | type |
 | `EffortRule` | `pi-roundtable/kit` | type |
 | `GroupMessage` | `pi-roundtable/kit` | type |
+| `ImageNotGeneratedError` | `pi-roundtable/kit` | value |
 | `JUDGE_WORK` | `pi-roundtable/kit` | value |
+| `JevJudgeOptions` | `pi-roundtable/kit` | type |
 | `McpEndpoint` | `pi-roundtable/kit` | type |
 | `ModelRef` | `pi-roundtable/kit` | type |
 | `OwnerIdentity` | `pi-roundtable/kit` | type |
@@ -3980,6 +4001,9 @@ Import from the entries listed below; source area files are internal.
 | `SCHEDULE_TOOLS` | `pi-roundtable/kit` | value |
 | `SHELL_TOOLS` | `pi-roundtable/kit` | value |
 | `SKILL_LIST_TOOL` | `pi-roundtable/kit` | value |
+| `createCodexImages` | `pi-roundtable/kit` | value |
+| `drawCodexImage` | `pi-roundtable/kit` | value |
+| `jevJudge` | `pi-roundtable/kit` | value |
 | `packageDir` | `pi-roundtable/kit` | value |
 | `serveUnix` | `pi-roundtable/kit` | value |
 | `ScheduleToolContext` | `pi-roundtable/kit` | type |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.18.0",
+	"version": "0.19.1",
 	"description": "A plugin-driven Pi agent server for one owner, reached through Discord or the web",
 	"type": "module",
 	"license": "MIT",

package/src/core/http/listeners.ts

@@ -225,6 +225,7 @@ export class HttpListeners {
 	readonly #sockets: SocketSet;
 	readonly #closeTimeoutMs: number;
 	#servers: Pick<Server<unknown>, "stop">[] = [];
+	readonly #ports = new Map<string, number>();
 
 	/** Validates every route before any socket opens; `closeTimeoutMs` bounds how long a stop waits on WebSocket handlers. */
 	constructor(
@@ -271,9 +272,15 @@ export class HttpListeners {
 					);
 					chmodSync(listener.socketPath, listener.mode ?? 0o660);
 				} else {
-					this.#servers.push(
-						serveTcp(listener.port, listener.hostname, handle, websocket),
+					const server = serveTcp(
+						listener.port,
+						listener.hostname,
+						handle,
+						websocket,
 					);
+					this.#servers.push(server);
+					if (server.port !== undefined)
+						this.#ports.set(listener.id, server.port);
 				}
 			}
 		} catch (error) {
@@ -282,6 +289,11 @@ export class HttpListeners {
 		}
 	}
 
+	/** The port an open TCP listener is bound to, which differs from the configured one when that was 0. */
+	portOf(listener: string): number | undefined {
+		return this.#ports.get(listener);
+	}
+
 	/** The listener's WebSocket handler, sized for its largest route limits; none without WebSocket routes. */
 	#websocketHandler(
 		listener: string,
@@ -314,6 +326,7 @@ export class HttpListeners {
 		this.#sockets.closeAll();
 		for (const server of this.#servers) void server.stop(true);
 		this.#servers = [];
+		this.#ports.clear();
 		await this.#sockets.drain(this.#closeTimeoutMs);
 	}
 }

package/src/core/images/codex-image.ts

@@ -0,0 +1,257 @@
+// A client for ChatGPT's undocumented Codex backend, signed in with an openai-codex login, that draws one image.
+
+import type { ReferenceImage } from "../contract/providers.ts";
+
+const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
+const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const REQUEST_TIMEOUT_MS = 5 * 60_000;
+const MAX_IMAGE_BYTES = 32 * 1024 * 1024;
+const MAX_IMAGE_BASE64 = Math.ceil(MAX_IMAGE_BYTES / 3) * 4;
+
+/** The Pi provider whose login pays for the images. */
+export const CODEX_IMAGES_PROVIDER = "openai-codex";
+/** Routes the Codex request; the backend picks the image model itself. */
+export const CODEX_IMAGE_MODEL = "gpt-6-sol";
+
+/**
+ * Codex ran the image tool but returned no image, or answered without one; usually it refused
+ * the prompt. Asking again with the same prompt fails again.
+ */
+export class ImageNotGeneratedError extends Error {
+	override name = "ImageNotGeneratedError";
+}
+
+/** The part of `fetch` the client uses, so a test can stand in for the network. `typeof fetch` is assignable. */
+export type CodexFetch = (url: string, init: RequestInit) => Promise<Response>;
+
+export interface CodexImageRequest {
+	/** The openai-codex login's access token; read it again for each drawing, because the login refreshes. */
+	token: string;
+	prompt: string;
+	references?: readonly ReferenceImage[];
+	/** The model that routes the request; default `CODEX_IMAGE_MODEL`. */
+	model?: string;
+	/** Aborts the request and the read of its stream; the five-minute limit applies as well. */
+	signal?: AbortSignal;
+	/** The request function; default the global `fetch`. */
+	fetch?: CodexFetch;
+}
+
+export interface CodexImage {
+	/** PNG bytes. */
+	data: Uint8Array;
+	/** The prompt Codex says it drew, when it tells. */
+	revisedPrompt?: string;
+}
+
+/** What bounds one drawing; the core's tests lower these, the public client always uses the defaults. */
+export interface CodexImageLimits {
+	timeoutMs: number;
+	maxStreamBytes: number;
+}
+
+export const CODEX_IMAGE_LIMITS: CodexImageLimits = {
+	timeoutMs: REQUEST_TIMEOUT_MS,
+	maxStreamBytes: MAX_IMAGE_BYTES,
+};
+
+/** The ChatGPT account the login token belongs to, from the token's claims. */
+function chatGptAccountId(token: string): string {
+	const [, payload] = token.split(".");
+	if (!payload) throw new Error("the Codex token is not a JWT");
+	let claims: Record<string, unknown>;
+	try {
+		claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+	} catch {
+		throw new Error("the Codex token's claims are not JSON");
+	}
+	const auth = claims[JWT_CLAIM_PATH] as
+		| { chatgpt_account_id?: unknown }
+		| undefined;
+	const id = auth?.chatgpt_account_id;
+	if (typeof id !== "string" || !id)
+		throw new Error("the Codex token has no ChatGPT account");
+	return id;
+}
+
+function object(value: unknown): Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value)
+		? (value as Record<string, unknown>)
+		: {};
+}
+
+/** The one image an `image_generation_call` item carries; anything else is not an image. */
+function imageOf(value: unknown): CodexImage | undefined {
+	const item = object(value);
+	if (item.type !== "image_generation_call") return undefined;
+	if (
+		item.status !== "completed" ||
+		typeof item.result !== "string" ||
+		!item.result
+	) {
+		const { result: _result, ...detail } = item;
+		throw new ImageNotGeneratedError(
+			`Codex image generation did not complete (status ${String(item.status)}): ${JSON.stringify(detail).slice(0, 300)}`,
+		);
+	}
+	if (item.result.length > MAX_IMAGE_BASE64)
+		throw new Error("the image exceeds 32 MiB");
+	const data = new Uint8Array(Buffer.from(item.result, "base64"));
+	return typeof item.revised_prompt === "string" && item.revised_prompt
+		? { data, revisedPrompt: item.revised_prompt }
+		: { data };
+}
+
+/** The frames of a server-sent event stream: the text between blank lines. */
+async function* frames(
+	body: ReadableStream<Uint8Array>,
+	signal: AbortSignal,
+	maxBytes: number,
+): AsyncGenerator<string> {
+	const decoder = new TextDecoder();
+	let buffer = "";
+	let read = 0;
+	for await (const chunk of body) {
+		signal.throwIfAborted();
+		read += chunk.byteLength;
+		if (read > maxBytes) throw new Error("Codex image response too large");
+		buffer += decoder.decode(chunk, { stream: true });
+		let match = /\r?\n\r?\n/.exec(buffer);
+		while (match) {
+			yield buffer.slice(0, match.index);
+			buffer = buffer.slice(match.index + match[0].length);
+			match = /\r?\n\r?\n/.exec(buffer);
+		}
+	}
+	if (buffer.trim()) yield buffer;
+}
+
+/** The event a frame carries, or undefined for a frame without data. */
+function eventOf(frame: string): Record<string, unknown> | undefined {
+	const data = frame
+		.split(/\r?\n/)
+		.flatMap((line) => (line.startsWith("data:") ? [line.slice(5).trim()] : []))
+		.join("\n");
+	if (!data || data === "[DONE]") return undefined;
+	try {
+		return object(JSON.parse(data));
+	} catch {
+		throw new Error(`Codex sent a malformed event: ${data.slice(0, 200)}`);
+	}
+}
+
+/** Reads the events until the response completes, and returns its first image. */
+async function parseImageStream(
+	response: Response,
+	signal: AbortSignal,
+	maxBytes: number,
+): Promise<CodexImage> {
+	if (!response.body) throw new Error("Codex returned no body");
+	let image: CodexImage | undefined;
+	for await (const frame of frames(response.body, signal, maxBytes)) {
+		const event = eventOf(frame);
+		switch (event?.type) {
+			case "error":
+			case "response.failed": {
+				const error = object(object(event.response).error ?? event.error);
+				throw new Error(
+					`Codex failed: ${String(error.message ?? error.code ?? "unknown error")}`,
+				);
+			}
+			case "response.incomplete":
+				throw new Error("the Codex response was incomplete");
+			case "response.output_item.done":
+				image ??= imageOf(event.item);
+				break;
+			case "response.completed": {
+				const output = object(event.response).output;
+				if (Array.isArray(output))
+					for (const item of output) image ??= imageOf(item);
+				if (!image)
+					throw new ImageNotGeneratedError("Codex answered without an image");
+				return image;
+			}
+			default:
+				break;
+		}
+	}
+	throw new Error("the Codex stream ended before completion");
+}
+
+async function send(
+	request: CodexImageRequest,
+	signal: AbortSignal,
+	maxBytes: number,
+): Promise<CodexImage> {
+	const fetchImpl = request.fetch ?? fetch;
+	const response = await fetchImpl(CODEX_RESPONSES_URL, {
+		method: "POST",
+		redirect: "error",
+		signal,
+		headers: {
+			authorization: `Bearer ${request.token}`,
+			"chatgpt-account-id": chatGptAccountId(request.token),
+			originator: "pi",
+			"openai-beta": "responses=experimental",
+			accept: "text/event-stream",
+			"content-type": "application/json",
+		},
+		body: JSON.stringify({
+			model: request.model ?? CODEX_IMAGE_MODEL,
+			store: false,
+			stream: true,
+			instructions:
+				"You are generating bitmap image assets. For this request, call the image_generation tool exactly once. Do not answer with only text unless image generation is unavailable.",
+			input: [
+				{
+					role: "user",
+					content: [
+						{ type: "input_text", text: request.prompt },
+						...(request.references ?? []).map((image) => ({
+							type: "input_image",
+							image_url: `data:${image.mimeType};base64,${image.data}`,
+						})),
+					],
+				},
+			],
+			tools: [{ type: "image_generation", output_format: "png" }],
+			tool_choice: "auto",
+			parallel_tool_calls: false,
+			text: { verbosity: "low" },
+		}),
+	});
+	if (!response.ok) {
+		const detail = (await response.text()).slice(0, 300);
+		throw new Error(`Codex answered ${response.status}: ${detail}`);
+	}
+	return parseImageStream(response, signal, maxBytes);
+}
+
+/** `drawCodexImage` with its limits given, for the core's tests. */
+export async function requestCodexImage(
+	request: CodexImageRequest,
+	limits: CodexImageLimits,
+): Promise<CodexImage> {
+	const timeout = AbortSignal.timeout(limits.timeoutMs);
+	const signal = request.signal
+		? AbortSignal.any([request.signal, timeout])
+		: timeout;
+	signal.throwIfAborted();
+	try {
+		return await send(request, signal, limits.maxStreamBytes);
+	} catch (error) {
+		// The abort reaches the caller as its own reason, not as whatever the stream wrapped it in.
+		if (signal.aborted) throw signal.reason;
+		throw error;
+	}
+}
+
+/**
+ * Draws one image through the Codex backend. It aborts with `request.signal`, before the response
+ * and while its stream is read, stops after five minutes, and refuses a stream over 32 MiB.
+ */
+export function drawCodexImage(
+	request: CodexImageRequest,
+): Promise<CodexImage> {
+	return requestCodexImage(request, CODEX_IMAGE_LIMITS);
+}

package/src/core/images/codex-images-plugin.ts

@@ -0,0 +1,76 @@
+// The codex-images plugin: fills the images slot with drawCodexImage.
+
+import { definePlugin } from "../define.ts";
+import { PluginError } from "../errors.ts";
+import type { RoundtablePlugin } from "../plugin.ts";
+import {
+	CODEX_IMAGE_MODEL,
+	CODEX_IMAGES_PROVIDER,
+	type CodexFetch,
+	drawCodexImage,
+} from "./codex-image.ts";
+
+export interface CodexImagesOptions {
+	/** The request function; default the global `fetch`. */
+	fetch?: CodexFetch;
+	/** The model that routes the request; default `CODEX_IMAGE_MODEL`. */
+	model?: string;
+	/**
+	 * What setup does when the openai-codex login is missing or unusable: "throw" (the default)
+	 * stops the host; "warn" logs a warning, and a drawing then fails with the same PluginError.
+	 */
+	onMissingLogin?: "throw" | "warn";
+}
+
+const NO_LOGIN = `the host has no login for ${CODEX_IMAGES_PROVIDER}, the provider that pays for the images. Log in to the ${CODEX_IMAGES_PROVIDER} provider with Pi so the agent directory's auth.json holds it, or remove this plugin.`;
+
+/**
+ * The `codex-images` plugin. It fills `providers.images`, reads the login's token for each drawing
+ * through `context.apiKey`, and aborts a drawing with the turn that asked for it.
+ */
+export function createCodexImages(
+	options: CodexImagesOptions = {},
+): RoundtablePlugin {
+	const {
+		fetch: fetchImpl,
+		model = CODEX_IMAGE_MODEL,
+		onMissingLogin = "throw",
+	} = options;
+	let apiKey: ((provider: string) => Promise<string | undefined>) | undefined;
+	// The login refreshes its token, so each image reads it again instead of keeping the first.
+	const token = async (): Promise<string> => {
+		const value = await apiKey?.(CODEX_IMAGES_PROVIDER);
+		if (!value) throw new PluginError(`plugin codex-images: ${NO_LOGIN}`);
+		return value;
+	};
+	return definePlugin({
+		name: "codex-images",
+		providers: {
+			// The images slot draws an agent's avatar from a prompt and reference pictures.
+			images: async (prompt, references, drawing) =>
+				(
+					await drawCodexImage({
+						token: await token(),
+						prompt,
+						references,
+						model,
+						signal: drawing?.signal,
+						fetch: fetchImpl,
+					})
+				).data,
+		},
+		async setup(context) {
+			apiKey = context.apiKey;
+			try {
+				await token();
+			} catch (error) {
+				if (onMissingLogin !== "warn" || !(error instanceof PluginError))
+					throw error;
+				context.logger.warn(
+					`${NO_LOGIN} Drawing images fails until the login exists.`,
+				);
+			}
+			return {};
+		},
+	});
+}

package/src/core/runtime/session-factory.ts

@@ -472,7 +472,7 @@ export function imageTools(
 	return images ? { generateImage: generateImageExtension(images, roots) } : {};
 }
 
-/** Pi's bash tool with TMPDIR set to `scratchDir`, so `mktemp` and tools write there. */
+/** Pi's bash tool with TMPDIR set to `scratchDir`, so tools that read TMPDIR and GNU `mktemp` write there (BSD `mktemp` needs `-p "$TMPDIR"`). */
 export function scratchBash(cwd: string, scratchDir: string): ToolDefinition {
 	// SAFETY: Pi's bash definition is a ToolDefinition typed by its own parameter schema, which the session takes as any custom tool.
 	return createBashToolDefinition(cwd, {

package/src/kit/images.ts

@@ -0,0 +1,15 @@
+// Plugin helpers, versioned like the main entry; see the plugin guide.
+
+export type {
+	CodexFetch,
+	CodexImage,
+	CodexImageRequest,
+} from "../core/images/codex-image.ts";
+export {
+	CODEX_IMAGE_MODEL,
+	CODEX_IMAGES_PROVIDER,
+	drawCodexImage,
+	ImageNotGeneratedError,
+} from "../core/images/codex-image.ts";
+export type { CodexImagesOptions } from "../core/images/codex-images-plugin.ts";
+export { createCodexImages } from "../core/images/codex-images-plugin.ts";

package/src/kit/index.ts

@@ -56,6 +56,19 @@ export {
 	thinkingLabel,
 } from "./domain.ts";
 export { HOLD_DESCRIBE_TIMEOUT_MS, holdChain } from "./holds.ts";
+export type {
+	CodexFetch,
+	CodexImage,
+	CodexImageRequest,
+	CodexImagesOptions,
+} from "./images.ts";
+export {
+	CODEX_IMAGE_MODEL,
+	CODEX_IMAGES_PROVIDER,
+	createCodexImages,
+	drawCodexImage,
+	ImageNotGeneratedError,
+} from "./images.ts";
 export type {
 	JevCompactInput,
 	JevCompactOptions,
@@ -74,6 +87,8 @@ export {
 	jevCompactionExtension,
 	jevCompactor,
 } from "./jev.ts";
+export type { JevJudgeOptions } from "./jev-judge.ts";
+export { jevJudge } from "./jev-judge.ts";
 export type {
 	EffortBrief,
 	EffortJudgeOptions,

package/src/kit/jev-judge.ts

@@ -0,0 +1,153 @@
+// A Judge over Jev's hosted service, built on pi-jev-compaction's client.
+
+import { JevClient, type JevQuestions } from "pi-jev-compaction";
+import type {
+	ChoiceAnswer,
+	ChoiceQuestion,
+	Judge,
+	ScoreQuestion,
+	YesNoQuestion,
+} from "../core/contract/providers.ts";
+import { JudgeError } from "../core/errors.ts";
+
+/** The service's name for the yes-or-no question and for its answer's probability. */
+const WIRE_YES_NO = "noul";
+type JevQuestion = JevQuestions[string];
+const DEFAULT_TIMEOUT_MS = 20_000;
+
+export interface JevJudgeOptions {
+	/** The service's API key. It is required: an empty one is refused, not looked up in the environment. */
+	apiKey: string;
+	/** The service's model; default pi-jev-compaction's. */
+	model?: string;
+	/** The service's endpoint; default pi-jev-compaction's. */
+	baseUrl?: string;
+	/** How long one question may take, the read of the answer included; default 20,000. */
+	timeoutMs?: number;
+	/** The request function; default the global `fetch`. */
+	fetch?: typeof fetch;
+}
+
+// pi-lens-ignore: no-unknown-parameters — a type guard over parsed JSON
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+	typeof value === "object" && value !== null && !Array.isArray(value);
+
+// pi-lens-ignore: no-unknown-parameters — a type guard over parsed JSON
+const isProbability = (value: unknown): value is number =>
+	typeof value === "number" && value >= 0 && value <= 1;
+
+/**
+ * A `Judge` that asks Jev. Each question is one request with its own time limit of `timeoutMs`,
+ * which also covers reading the answer. Every failure throws a `JudgeError`: a missing answer,
+ * a probability outside 0 to 1, a choice that is not one of the listed options, a failed request,
+ * and a limit that ran out. An empty `apiKey` is refused when the judge is made.
+ */
+export function jevJudge(options: JevJudgeOptions): Judge {
+	const apiKey = options.apiKey.trim();
+	if (!apiKey)
+		throw new JudgeError(
+			"jevJudge needs an apiKey; an empty one would fall back to the environment's key",
+		);
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+
+	async function ask(
+		state: Record<string, unknown>,
+		questions: JevQuestions,
+	): Promise<Record<string, unknown>> {
+		const signal = AbortSignal.timeout(timeoutMs);
+		const client = new JevClient({
+			apiKey,
+			model: options.model,
+			baseUrl: options.baseUrl,
+			fetch: options.fetch,
+			signal,
+		});
+		try {
+			return (await client.ask(state, questions)).answers;
+		} catch (error) {
+			if (error instanceof JudgeError) throw error;
+			if (signal.aborted)
+				throw new JudgeError(`Jev did not answer within ${timeoutMs} ms`, {
+					cause: error,
+				});
+			const message = error instanceof Error ? error.message : String(error);
+			throw new JudgeError(
+				/^Jev/.test(message) ? message : `Jev request failed: ${message}`,
+				{ cause: error },
+			);
+		}
+	}
+
+	const malformed = (name: string, detail = "") =>
+		new JudgeError(`Jev's answer for ${name} is malformed${detail}`);
+
+	return {
+		async askYesNo(
+			state: Record<string, unknown>,
+			questions: Record<string, YesNoQuestion>,
+		): Promise<Record<string, number>> {
+			const names = Object.keys(questions);
+			if (names.length === 0) return {};
+			const answers = await ask(
+				state,
+				Object.fromEntries(
+					names.map((name) => {
+						const { type: _type, ...question } = questions[
+							name
+						] as YesNoQuestion;
+						return [name, { ...question, type: WIRE_YES_NO } as JevQuestion];
+					}),
+				),
+			);
+			// pi-lens-ignore: no-known-value-widening — filled per question name below
+			const result: Record<string, number> = {};
+			for (const name of names) {
+				const answer = answers[name];
+				const probability = isRecord(answer) ? answer[WIRE_YES_NO] : undefined;
+				if (!isProbability(probability)) throw malformed(name);
+				result[name] = probability;
+			}
+			return result;
+		},
+
+		async askChoice(
+			state: Record<string, unknown>,
+			name: string,
+			question: ChoiceQuestion,
+		): Promise<ChoiceAnswer> {
+			const answer = (await ask(state, { [name]: question }))[name];
+			if (
+				!isRecord(answer) ||
+				typeof answer.choice !== "string" ||
+				!isProbability(answer.confidence)
+			)
+				throw malformed(name);
+			if (!Object.hasOwn(question.criteria, answer.choice))
+				throw new JudgeError(
+					`Jev chose ${answer.choice}, which is not an option of ${name}`,
+				);
+			return { choice: answer.choice, confidence: answer.confidence };
+		},
+
+		async askScore(
+			state: Record<string, unknown>,
+			name: string,
+			question: ScoreQuestion,
+		): Promise<number[]> {
+			if (question.criteria.length === 0) return [];
+			const answer = (
+				await ask(state, {
+					[name]: { ...question, criteria: [...question.criteria] },
+				})
+			)[name];
+			const probabilities = isRecord(answer) ? answer.probabilities : undefined;
+			if (!isRecord(probabilities)) throw malformed(name);
+			return question.criteria.map((_, index) => {
+				const value = probabilities[String(index)];
+				if (!isProbability(value))
+					throw malformed(name, `: no probability for criterion ${index}`);
+				return value;
+			});
+		},
+	};
+}

package/templates/official/codex-images/plugin.test.ts.tmpl

@@ -107,6 +107,37 @@ test("codex-images reports an HTTP error with its status, and never the token",
 	await harness.stop();
 });
 
+test("codex-images aborts a drawing with the turn that asked for it", async () => {
+	const signals: AbortSignal[] = [];
+	const plugin = createCodexImages({
+		fetch: (_url, init) => {
+			const signal = init.signal as AbortSignal;
+			signals.push(signal);
+			return new Promise((_resolve, reject) => {
+				signal.addEventListener("abort", () => reject(signal.reason));
+			});
+		},
+	});
+	const harness = await testPlugin(plugin, {
+		apiKeys: { "openai-codex": token("acct-1") },
+	});
+	const turn = new AbortController();
+	const reason = new Error("the turn ended");
+	const drawing = plugin.providers?.images?.("a fox", [], {
+		signal: turn.signal,
+	});
+	const outcome = drawing?.then(
+		() => undefined,
+		(error: unknown) => error,
+	);
+	await new Promise((done) => setTimeout(done, 20));
+	expect(signals[0]?.aborted).toBe(false);
+	turn.abort(reason);
+	expect(await outcome).toBe(reason);
+	expect(signals[0]?.aborted).toBe(true);
+	await harness.stop();
+});
+
 test("codex-images refuses to start without an openai-codex login", async () => {
 	const failure = await testPlugin(codexImages).then(
 		() => undefined,

package/templates/official/codex-images/plugin.ts

@@ -3,238 +3,14 @@
 // as an API, so it can stop working without notice, and OpenAI's terms for the subscription
 // apply to it. Use it only where you accept that risk.
 
-import { definePlugin, PluginError, type ReferenceImage } from "pi-roundtable";
+import { createCodexImages } from "pi-roundtable/kit";
 
-const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
-/** The Pi provider whose login pays for the images. */
-const CODEX_PROVIDER = "openai-codex";
-/** Routes the Codex request; the backend picks the image model itself. */
-const CODEX_MODEL = "gpt-6-sol";
-const JWT_CLAIM_PATH = "https://api.openai.com/auth";
-const REQUEST_TIMEOUT_MS = 5 * 60_000;
-const MAX_IMAGE_BYTES = 32 * 1024 * 1024;
-const MAX_IMAGE_BASE64 = Math.ceil(MAX_IMAGE_BYTES / 3) * 4;
-
-/**
- * Codex ran the image tool but returned no image, usually because it refused the prompt.
- * Asking again with the same prompt fails again.
- */
-export class ImageNotGeneratedError extends Error {
-	override name = "ImageNotGeneratedError";
-}
-
-/** The part of `fetch` the plugin uses, so a test can stand in for the network. */
-export type CodexFetch = (url: string, init: RequestInit) => Promise<Response>;
-
-export interface CodexImagesOptions {
-	/** The request function; default the global `fetch`. */
-	fetch?: CodexFetch;
-	/** The model that routes the request; default `gpt-6-sol`. */
-	model?: string;
-	/**
-	 * What setup does when the openai-codex login is missing or unusable: "throw" (the default)
-	 * stops the host; "warn" logs a warning, and a drawing then fails with the same PluginError.
-	 */
-	onMissingLogin?: "throw" | "warn";
-}
-
-/** The ChatGPT account the login token belongs to, from the token's claims. */
-function chatGptAccountId(token: string): string {
-	const [, payload] = token.split(".");
-	if (!payload) throw new Error("the Codex token is not a JWT");
-	let claims: Record<string, unknown>;
-	try {
-		claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-	} catch {
-		throw new Error("the Codex token's claims are not JSON");
-	}
-	const auth = claims[JWT_CLAIM_PATH] as
-		| { chatgpt_account_id?: unknown }
-		| undefined;
-	const id = auth?.chatgpt_account_id;
-	if (typeof id !== "string" || !id)
-		throw new Error("the Codex token has no ChatGPT account");
-	return id;
-}
-
-function object(value: unknown): Record<string, unknown> {
-	return value !== null && typeof value === "object" && !Array.isArray(value)
-		? (value as Record<string, unknown>)
-		: {};
-}
-
-/** The one image an `image_generation_call` item carries; anything else is not an image. */
-function imageOf(value: unknown): Uint8Array | undefined {
-	const item = object(value);
-	if (item.type !== "image_generation_call") return undefined;
-	if (
-		item.status !== "completed" ||
-		typeof item.result !== "string" ||
-		!item.result
-	) {
-		const { result: _result, ...detail } = item;
-		throw new ImageNotGeneratedError(
-			`Codex image generation did not complete (status ${String(item.status)}): ${JSON.stringify(detail).slice(0, 300)}`,
-		);
-	}
-	if (item.result.length > MAX_IMAGE_BASE64)
-		throw new Error("the image exceeds 32 MiB");
-	return new Uint8Array(Buffer.from(item.result, "base64"));
-}
-
-/** The frames of a server-sent event stream: the text between blank lines. */
-async function* frames(
-	body: ReadableStream<Uint8Array>,
-): AsyncGenerator<string> {
-	const decoder = new TextDecoder();
-	let buffer = "";
-	for await (const chunk of body) {
-		buffer += decoder.decode(chunk, { stream: true });
-		let match = /\r?\n\r?\n/.exec(buffer);
-		while (match) {
-			yield buffer.slice(0, match.index);
-			buffer = buffer.slice(match.index + match[0].length);
-			match = /\r?\n\r?\n/.exec(buffer);
-		}
-	}
-	if (buffer.trim()) yield buffer;
-}
-
-/** The event a frame carries, or undefined for a frame without data. */
-function eventOf(frame: string): Record<string, unknown> | undefined {
-	const data = frame
-		.split(/\r?\n/)
-		.flatMap((line) => (line.startsWith("data:") ? [line.slice(5).trim()] : []))
-		.join("\n");
-	if (!data || data === "[DONE]") return undefined;
-	try {
-		return object(JSON.parse(data));
-	} catch {
-		throw new Error(`Codex sent a malformed event: ${data.slice(0, 200)}`);
-	}
-}
-
-/** Reads the events until the response completes, and returns its one image. */
-async function parseImageStream(response: Response): Promise<Uint8Array> {
-	if (!response.body) throw new Error("Codex returned no body");
-	let image: Uint8Array | undefined;
-	for await (const frame of frames(response.body)) {
-		const event = eventOf(frame);
-		switch (event?.type) {
-			case "error":
-			case "response.failed": {
-				const error = object(object(event.response).error ?? event.error);
-				throw new Error(
-					`Codex failed: ${String(error.message ?? error.code ?? "unknown error")}`,
-				);
-			}
-			case "response.incomplete":
-				throw new Error("the Codex response was incomplete");
-			case "response.output_item.done":
-				image ??= imageOf(event.item);
-				break;
-			case "response.completed": {
-				const output = object(event.response).output;
-				if (Array.isArray(output))
-					for (const item of output) image ??= imageOf(item);
-				if (!image)
-					throw new ImageNotGeneratedError("Codex answered without an image");
-				return image;
-			}
-			default:
-				break;
-		}
-	}
-	throw new Error("the Codex stream ended before completion");
-}
-
-async function generateImage(
-	prompt: string,
-	references: readonly ReferenceImage[],
-	token: string,
-	model: string,
-	fetchImpl: CodexFetch,
-): Promise<Uint8Array> {
-	const response = await fetchImpl(CODEX_RESPONSES_URL, {
-		method: "POST",
-		redirect: "error",
-		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-		headers: {
-			authorization: `Bearer ${token}`,
-			"chatgpt-account-id": chatGptAccountId(token),
-			originator: "pi",
-			"openai-beta": "responses=experimental",
-			accept: "text/event-stream",
-			"content-type": "application/json",
-		},
-		body: JSON.stringify({
-			model,
-			store: false,
-			stream: true,
-			instructions:
-				"You are generating bitmap image assets. For this request, call the image_generation tool exactly once. Do not answer with only text unless image generation is unavailable.",
-			input: [
-				{
-					role: "user",
-					content: [
-						{ type: "input_text", text: prompt },
-						...references.map((image) => ({
-							type: "input_image",
-							image_url: `data:${image.mimeType};base64,${image.data}`,
-						})),
-					],
-				},
-			],
-			tools: [{ type: "image_generation", output_format: "png" }],
-			tool_choice: "auto",
-			parallel_tool_calls: false,
-			text: { verbosity: "low" },
-		}),
-	});
-	if (!response.ok) {
-		const detail = (await response.text()).slice(0, 300);
-		throw new Error(`Codex answered ${response.status}: ${detail}`);
-	}
-	return parseImageStream(response);
-}
-
-const NO_LOGIN = `the host has no login for ${CODEX_PROVIDER}, the provider that pays for the images. Log in to the ${CODEX_PROVIDER} provider with Pi so the agent directory's auth.json holds it, or remove this plugin.`;
-
-/** The plugin, with its request function and model replaceable for a test. */
-export function createCodexImages(options: CodexImagesOptions = {}) {
-	const {
-		fetch: fetchImpl = fetch,
-		model = CODEX_MODEL,
-		onMissingLogin = "throw",
-	} = options;
-	let apiKey: ((provider: string) => Promise<string | undefined>) | undefined;
-	// The login refreshes its token, so each image reads it again instead of keeping the first.
-	const token = async (): Promise<string> => {
-		const value = await apiKey?.(CODEX_PROVIDER);
-		if (!value) throw new PluginError(`plugin codex-images: ${NO_LOGIN}`);
-		return value;
-	};
-	return definePlugin({
-		name: "codex-images",
-		providers: {
-			// The images slot draws an agent's avatar from a prompt and reference pictures.
-			images: async (prompt, references) =>
-				generateImage(prompt, references, await token(), model, fetchImpl),
-		},
-		async setup(context) {
-			apiKey = context.apiKey;
-			try {
-				await token();
-			} catch (error) {
-				if (onMissingLogin !== "warn" || !(error instanceof PluginError))
-					throw error;
-				context.logger.warn(
-					`${NO_LOGIN} Drawing images fails until the login exists.`,
-				);
-			}
-			return {};
-		},
-	});
-}
+export {
+	type CodexFetch,
+	type CodexImagesOptions,
+	createCodexImages,
+	ImageNotGeneratedError,
+} from "pi-roundtable/kit";
 
+/** The plugin the project lists. The client and the plugin are the kit's; this file is yours to change. */
 export const codexImages = createCodexImages();