fix: preserve native image references and model routing

.github/workflows/image-repair.yml

@@ -0,0 +1,63 @@
+name: Native image repair
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  image-repair:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CI: "true"
+      NEXT_TELEMETRY_DISABLED: "1"
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+      OMNIROUTE_BUILD_BACKEND_ONLY: "1"
+      OMNIROUTE_USE_TURBOPACK: "0"
+      NEXT_DIST_DIR: .build/next
+      OMNIROUTE_MAX_TEST_WORKERS: "2"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24.21.0"
+      - name: Install, check changed sources, test image seams, build once
+        run: node scripts/check/image-repair-ci.mjs
+      - name: Upload verified standalone build only
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: native-image-backend-${{ github.sha }}
+          path: .build/next/standalone/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 3
+      - name: Remove owned CI state
+        if: always()
+        run: rm -rf -- .ci-work/image-repair
+
+  windows-runtime:
+    needs: image-repair
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24.21.0"
+      - name: Build full Windows runtime and verify portable assets
+        run: node scripts/check/image-runtime-package.mjs
+      - name: Upload verified full Windows runtime
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: native-image-windows-${{ github.sha }}
+          path: .build/next/standalone/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 3

.gitignore

@@ -1,5 +1,27 @@
 # See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
 
+# Local workspace protection
+/.ai/
+/.specify/
+/specs/
+/secrets.md
+/explain-AI.md
+/reference.md
+/CLAUDE.md
+/AGENTS.md
+/.agents/
+/.claude/
+/.kiro/
+/.codex/
+/.cursor/
+/.cline/
+/graphify-out/
+/.codebase-memory/
+/plans/
+.ignoreme
+**/.ignoreme
+/.ci-work/
+
 # project-specific directories
 /output/
 .slim/deepwork/
@@ -301,3 +323,15 @@ docker-compose.yml.bak
 
 # run-translation.mjs writes the state atomically via a per-process temp file
 /.i18n-state.json.*.tmp
+
+# Hook Maker: local/private files (auto-managed)
+/.env
+/.env.*
+!/.env.example
+!/.env.sample
+!/.env.template
+!/.env.dist
+# Public templates intentionally shipped by the upstream repository
+!/.env.devin-bridge.example
+!/.env.homolog.example
+!/.env.selfhost.example

CONTEXT.md

@@ -0,0 +1,13 @@
+# Domain Glossary
+
+- **Orchestration model**: A model that chooses and calls an image-generation tool; not necessarily the engine that creates the image.
+- **Image engine**: The model responsible for generating the output pixels. A configured name does not prove which engine served a request.
+- **Reference image**: Original user-approved image bytes used to guide generation or editing.
+- **Native output**: The image returned by the provider, without client-side resizing.
+- **Requested resolution**: The pixel dimensions or resolution tier requested by the operator.
+- **Actual resolution**: Pixel dimensions verified by decoding the saved native output.
+- **Account availability**: Whether the selected account can use a model and operation at the time checked.
+- **Model alias**: An alternate label for the same canonical model, not permission to substitute another model family.
+- **Custom model entry**: A configured routing name; adding it does not create a provider model or grant a capability.
+- **Receipt artifact**: A saved copy of an operation result, distinct from the durable request record that prevents repeated paid submission.
+- **Isolated gateway**: A separate runtime with its own writable artifacts, listener and state, independent of the active gateway.

README.md

@@ -592,7 +592,7 @@ the current catalog at **[radar.omniroute.online/planos](https://radar.omniroute
 - **🧠 Memory you control** — off by default, opt-in int8 vector quantization + typed decay, per-request `x-omniroute-no-memory`. → [Memory](docs/frameworks/MEMORY.md)
 - **🛡️ Security** — prompt-injection guard on every LLM route (red-team suite), opt-in credential-masking guardrail (redacts leaked API keys/secrets in both directions), free DuckDuckGo last-resort web search, and an optional OIDC login gate for the dashboard (password login always stays available). → [Guardrails](docs/security/GUARDRAILS.md)
 - **🖼️ New endpoints** — `/v1/ocr` (Mistral OCR) and `/v1/audio/translations` (Whisper-style) round out the media surface. → [API Reference](docs/reference/API_REFERENCE.md)
-- **🎨 Image / video / audio generation** — one API for media: xAI Grok Imagine & Novita AI video, ComfyUI, Magnific, Adobe Firefly, Segmind, and speech providers such as ElevenLabs. → [API Reference](docs/reference/API_REFERENCE.md)
+- **🎨 Image / video / audio generation** — one API for media: xAI Grok Imagine & Novita AI video, ComfyUI, Magnific, Adobe Firefly, Segmind, and speech providers such as ElevenLabs. → [API Reference](docs/reference/API_REFERENCE.md). This fork's [native image repair contracts](docs/CODEX-IMAGES.md) document Codex engine routing, Antigravity references and verification limits.
 - **🌍 Deployment & ops** — reverse-proxy `basePath`, browser-language auto-detect, per-key device tracking, root-less MITM trust, zh-TW localization. → [Environment](docs/reference/ENVIRONMENT.md)
 - **🤝 More providers & agents** — cloud agents (Codex Cloud, Cursor, Devin, Jules), Grok Build (xAI) with browser + OAuth login, Ollama first-class card, Claude Opus 5 & Sonnet 5, Kimi official partnership (Code/Web/Moonshot), Zed, Requesty, SenseNova, Yuanbao, Agnes AI… and a refreshed **374-provider catalog**. → [Providers](docs/reference/PROVIDER_REFERENCE.md)
 - **📡 Routing transparency** — every response carries an `X-OmniRoute-Decision` header naming the strategy/provider/latency that served it, a new `cache-optimized` combo strategy + Auto-Combo `cacheAffinity` factor route repeat requests back to the connection holding the cached prefix, and a read-only `/v1/auto-combo/{channel}/candidates` endpoint exposes an `auto/*` channel's live candidate pool. → [Auto-Combo](docs/routing/AUTO-COMBO.md)

config/quality/eslint-suppressions.json

@@ -189,11 +189,6 @@
       "count": 1
     }
   },
-  "open-sse/handlers/imageGeneration.ts": {
-    "@typescript-eslint/no-unused-vars": {
-      "count": 4
-    }
-  },
   "open-sse/handlers/musicGeneration.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 1
@@ -3705,11 +3700,6 @@
       "count": 1
     }
   },
-  "tests/unit/image-generation-route.test.ts": {
-    "@typescript-eslint/no-unused-vars": {
-      "count": 1
-    }
-  },
   "tests/unit/injection-guard-nonchat-route-logging.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 1

config/quality/test-masking-allowlist.json

@@ -1,5 +1,6 @@
 {
   "_comment": "Anti test-masking allowlist (check-test-masking.mjs). Files here are EXEMPT ONLY from the net-assert-REDUCTION signal, when the reduction is a verified-legitimate refactor or field removal (NOT weakening to go green). New tautologies (assert.ok(true)), new .skip/.todo/.only, and test-file deletions are STILL flagged for these files. Every entry needs a reason with the PR ref. Prune an entry once the release that introduced the reduction has merged to main (the merge-base then already reflects the reduced state, so the signal no longer fires).",
+  "tests/unit/image-generation-route.test.ts": "PR #15524: responsibility-based extraction preserves all 120 original assertions: 77 remain here, 26 are in the independently discovered image-generation-proxy.test.ts, and 17 in image-generation-resilience.test.ts. The proxy suite retains bounded fetch cleanup; duplicate copies were removed from resilience, not unique coverage. No skips, tautologies or deleted test files. Prune after #15524 merges to main.",
   "tests/e2e/api-keys-flow.spec.ts": "PR #16420: the oversized 1063-line fixture is split by existing workflows. All six tests remain: create/copy/reveal/revoke and create validation here (15 assertions), rename/validation/combo deny-all in api-key-access-flow.spec.ts (22), provider wildcard/model deny-all persistence in api-key-model-scope.spec.ts (25), shared readiness/navigation in helpers/apiKeyFlow.ts (5). Total static assertions 67 -> 67; helper assertions execute at every call. Removed modal assumptions are replaced by the actual routed editor, GET/PATCH refetch, disabled invalid save and reopened deny-all checks. No test skip, deletion, gate-floor or production-policy relaxation.",
   "tests/unit/appearance-widget-settings-schema.test.ts": "v3.8.27 #4033: the `showTokenSaverOnEndpoint` schema field was removed (renamed/consolidated into the settings surface); its 2 asserts were removed accordingly — the field no longer exists in source. Verified legitimate, not masking.",
   "tests/unit/dashboard-shell-tabs.test.ts": "v3.8.27 #3973: settings UI refactored from a tabbed client component to redirect-based routing; 5 old-structure asserts (tabpanel/aria/initialTab) were replaced by 4 new-structure asserts (redirect/resolveSettingsRoute), net -1. Asserts replaced, not weakened. Verified legitimate.",