feat: add image generation, session tools, and background jobs

[TheLastAirbenderAng]

Hi! First-time contributor here. I've been using agy-bridge to delegate from opencode to agy, and ended up building a few things I kept reaching for. I know this is a sizable diff for a first PR — happy to split it into smaller pieces or rework anything.

What's added

• image_gen — generate images through agy's built-in generate_image. The prompt asks agy to end its reply with an IMAGE_PATH: line so the saved file is located deterministically, with a regex fallback to an absolute image path. Optional name slug and output copy target. Returns the path plus an image content block.
• setup — reports agy install + auth status without making a model call.
• session_transfer — exposes the current agy conversation id and a agy --conversation <id> resume command.
• pre_finish_review — an advisory pre-finish review. opencode doesn't expose a blocking stop hook, so this is opt-in (the agent is nudged to call it before reporting done) rather than a hard gate.
• background jobs — detached agy runs backed by a file job store, plus job_status / job_result / job_cancel and a background flag on delegate/analyze_files/deep_search/web_lookup. Cancellation uses a cross-platform tree kill (taskkill /T on Windows, process group on POSIX) and the store is written atomically.

Notes

• agy-touching logic is unit tested with mocked subprocesses.
• The synchronous path is unchanged — background: false behaves exactly as before.
• Sanctioned subprocess pattern only; no auth changes.

The pre_finish_review and background naming/shape are open for discussion if you'd rather they go a different direction. Thanks for the project — it's been really useful.

[sshahzaiib]

Hey @TheLastAirbenderAng thanks for this, and for the thoughtful PR description. This is a genuinely well-crafted contribution. You offered to split it, and I'd like to take you up on that, because the pieces deserve different treatment. Here's where I landed on each:

• treeKill (runner.ts): please open this first, it merges fast

This is actually a bugfix: the current process.kill(-pid) throws on Windows and orphans grandchildren. Your taskkill /T /F + signal-aware POSIX path is exactly right. A focused PR with just this and its tests gets merged quickly

• setup + session_transfer: very nice tools to have

Small, read-only, low risk. One question for the PR: does session_transfer earn a permanent tool slot given follow_up exists? If you've hit cases where resuming in the terminal beats follow_up, mention them in the PR body, that's the justification I need, since every tool schema costs every client context forever.

• image_gen: a missing bit from agy-bridge, but two security issues block it as-is

1. output copy target is an arbitrary file write. args.output flows straight into copyFile(src, output) with no validation — a hallucinated or prompt-injected path can overwrite anything the user can write (~/.zshrc, ~/.ssh/config...). Either drop the param (callers can copy the returned path themselves) or resolve it and reject anything outside cwd.
2. The fallback path scraper is an arbitrary file read. Scraping any absolute image-extension path from agy's reply and returning it base64 means a prompt-injected reply can exfiltrate any file that has (or is symlinked to) an image extension. Please enforce the IMAGE_PATH: marker strictly and fail loudly when it's absent — the marker contract you designed is good; trust it.

With those two changes, this is a clean merge.

• Background jobs — let's design-discuss before code

The implementation is careful (atomic temp+rename, orphan scan, idempotent cancel), but there's a structural problem: the store serializes read-modify-writes with an in-process promise chain, while MCP stdio servers spawn one instance per client session. Two editor sessions running the bridge concurrently is the normal case, and their whole-file rewrites will silently clobber each other's jobs. That needs cross-process locking or per-process store files before it's safe.

Two more things to address in the design:

• Jobs don't survive a server restart: the detached agy child keeps running, but its output is lost and the orphan scan marks it failed. Fine for a local-dev aid, but it should be documented behavior, not a surprise.
• .tmp files leak if the bridge crashes between write and rename; a startup sweep would cover it.

Could you open this one as an issue/discussion first with your locking approach? I'm interested in the feature but want the multi-instance story solid before reviewing code. Also please let me know if I am missing something here for background jobs.

• pre_finish_review — going to pass on this one

It's solving a real opencode gap, but it's prompt engineering that belongs in the client's system prompt, it overlaps adversarial_review, and it permanently costs every client context for an advisory nudge. agy-bridge's whole pitch is staying thin — I have to be strict about tool-count here.
I would say it can be solved by adding in the AGENTS.md as an instruction.

---

Again really appreciate the quality of this, especially from a first PR. The treeKill fix and image_gen (post-fixes) are things I want in. Looking forward to the split PRs.